From Revenge Porn to Big Data Breaches: NSW Opposition Introduces Bill to Redress "Serious Invasions of Privacy"

There is a common misconception that Australian residents enjoy a general "right to privacy." Many people understandably believe that if they are, for example, eating lunch at a restaurant minding their own business, it would be "unlawful" for someone to take photos of them without their consent, and then publish those photos on the internet.

In fact, despite a range of privacy related legislation, there is no clearly recognised cause of action in Australia for "invasion of privacy."¹ Instead, other causes of action such as defamation, trespass and breach of confidence must be considered. 

This can be contrasted with the position in Canada, New Zealand and much of Europe, where a stand-alone cause of action for invasion of privacy is available. 

For decades, various Australian Federal and State law reform commissions have considered, and in some cases recommended, introducing a statutory cause of action for invasion of privacy.² Most recently, the Australian Competition and Consumer Commission's Digital Platforms Inquiry: Final Report of June 2019 (Inquiry) made a number of recommendations relating to privacy laws which included the introduction of such a statutory cause of action. The Inquiry noted that this cause of action should require privacy to be balanced against other public interests, such as freedom of expression. In response to this recommendation, the Federal Government has committed to a review of the Federal Privacy Act 1988 (Cth) before a formal view on this recommendation is adopted.³

Issues such as revenge porn, unwanted drone surveillance, rapid technological advancements in private data harvesting (such as the huge photo-scraping activity undertaken by Clearview AI), and the rise of now-ubiquitous social media platforms has provided added impetus to the need for law reform. 

New South Wales (NSW) might be the first Australian jurisdiction to introduce such a law - its Parliament is presently considering the Civil Remedies for Serious Invasions of Privacy Bill 2020 (Bill), introduced by that State's opposition party and having been read for a second time last month. The Bill adopts the recommendations made by the NSW Standing Committee on Law and Justice's Remedies for Serious Invasions of Privacy in New South Wales 2016 report,⁴ which opined that privacy legislation and general law causes of action for invasion of privacy in Australia were limited in providing adequate remedies to individuals who suffer serious invasions of privacy due to conduct ranging from revenge porn to "big data" breaches. 

If enacted, the Bill would provide individuals in NSW with a statutory cause of action in circumstances where their privacy was invaded by the:

• intrusion upon seclusion (for example, by physically intruding into the plaintiff's private space or by watching, listening to or recording the plaintiff's private activities or private affairs)
  or
• misuse of private information (for example, by collecting or disclosing private information about a plaintiff).

The main features of the Bill include the following:

• the statutory cause of action would be actionable only if a person in the position of the plaintiff would have had a "reasonable expectation of privacy" (in that regard, the court would consider issues such as the means used to obtain the information, the place where the intrusion occurred, and whether the plaintiff invited publicity)
• the plaintiff must prove that the defendant acted intentionally or recklessly (or in the case of a body corporate or a government entity, negligently, intentionally or recklessly) to succeed
• a cause of action would only be available where the invasion of privacy is "serious", having regard to factors such as whether the defendant was motivated by malice or knew that the invasion was likely to harm the dignity of the plaintiff
• a cause of action would not be available where any countervailing public interest outweighs the public interest in privacy (in that regard freedom of the media and freedom of the expression will be given particular consideration, among other factors)
• there would be various defences available including lawful conduct (where the defendant proves that their conduct was required or authorised by or under NSW law or Commonwealth law, or by an Australian court or tribunal), protection of person or property, absolute privilege (as that defence is understood in defamation law), necessity and consent (which can be express or implied)
• a variety of civil remedies would be available depending on the plaintiff's choice of jurisdiction,⁵ including general damages, damages for emotional distress and exemplary damages (damages for non-economic losses are capped at the same amount as is available in an action for defamation, currently AUD$407,500), an account of profits, injunctions, declarations, destruction of material, corrections and apologies. 

The Bill also contemplates that as an alternative to litigation, complainants may refer an alleged serious invasion of privacy to the NSW Privacy Commissioner for investigation, and that the Commissioner can commence proceedings to enforce his or her determination.

In his Second Reading Speech, Mr Lynch MP referred to the, "public concern … about unauthorised sharing of intimate images. While that is criminalised now, take-down orders only follow a criminal conviction. That has a number of disadvantages, including the time lag that will be involved. Other legal avenues are complex and unclear. It may well be that the common law will in time develop remedies in tort and damages and there has been the hint of that in some judgements. Some observers think that that development is inevitable. A much better course, in my view, is to provide a statutory basis for this. It is better for the Parliament rather than courts to make law."

It remains to be seen whether the Bill receives the support of the NSW Parliament and becomes law. If it does not, the courts will be left to reluctantly continue to fashion civil remedies for serious invasions of privacy.