Privacy in the digital age

Privacy 14
17 December 2014 | By Richard Leder (Partner)

Important proposals by the ALRC to strengthen Australia’s privacy laws are unlikely to be implemented, at least by the current government.

Individuals could one day have a right to sue over serious invasions of privacy if the federal government adopts the proposals in the Australian Law Reform Commission’s (ALRC) final report, “Serious Invasions of Privacy in the Digital Era”, which was tabled in Parliament in September 2014. 

Principal among the ALRC’s recommendations is a statutory cause of action for serious invasions of privacy that seeks to strike a balance between the right to privacy on the one hand and the right to freedom of expression and other fundamental public interests on the other. 

It is easy to forget that society often benefits from invasions of privacy. On a global scale, WikiLeaks has exposed, among other things, the harsh and often unknown realities of war including torture and large-scale civilian deaths. Closer to home, we have seen invasions of privacy leading to the capture and prosecution of criminals.

Who can forget the tragic CCTV footage that helped lead to Jill Meagher’s killer being charged and found guilty of her senseless murder? However, rapidly evolving technology, the dominance of social media and unscrupulous behaviour by the tabloid media in Britain culminating in the News of the World phone hacking scandal, have affected society’s attitude towards privacy and resulted in renewed discussion in Australia about whether privacy laws should be tightened. 

The ALRC has again entered the debate, making recommendations in its final report that are designed to fill existing gaps in Australia’s privacy law framework and ensure that the law is well placed to adapt to technological advancements in the digital era.

Principal among the recommendations is a statutory cause of action in tort for serious invasions of privacy which the ALRC proposes be set out in a new stand-alone Commonwealth Act. Whether Australia should implement a statutory cause of action for privacy invasions, and the form it should take, has been long debated as a consequence of the development of privacy law overseas and uncertain developments in our common law, and has been the subject of previous reports by the ALRC, the Victorian Law Reform Commission, the NSW Law Reform Commission and the Department of the Prime Minister and Cabinet.

The proposed tort has attracted criticism from media organisations on the basis that its introduction, in the absence of a constitutional or statutory right of freedom of expression, would likely restrict legitimate investigative journalism and undermine the media’s ability to report on matters in the public interest “to the detriment of the Australian public and Australia’s democracy”.

Concern has been expressed that such a cause of action will be relied on by public figures, sports stars and celebrities to restrain people from going to the media and prevent the publication of stories in the public interest. However, ALRC Inquiry Commissioner Professor Barbara McDonald, while acknowledging that a new privacy law is a concern for the media, says that it is “not necessarily served well by uncertainty and inconsistency in the existing law”.

The current framework

Australia has a range of laws designed to protect privacy. The Privacy Act (Cth) 1988, and its state and territory counterparts, govern the handling of personal and sensitive information. Common law torts such as trespass, nuisance and defamation protect individuals against physical invasions of privacy. An equitable action for breach of confidence may be commenced where private information has been disclosed provided that information may be regarded as confidential. 

However, there are gaps in the legal framework. The Privacy Act protects personal information (and not intrusions into personal privacy) and generally excludes from its operation individuals, small businesses and media organisations, while the common law torts protecting against physical invasions of privacy are limited as they exclude the recovery of damages for emotional distress. 

The common law has been reluctant to step in and fill these gaps, despite the High Court in Lenah Game Meats clearing the path for an invasion of privacy tort to develop. While Australian cases have since expressed recognition of a common law right of action for breach of privacy, there have equally been cases with judicial commentary to the effect that our common law does not recognise such a right.

Invasions of privacy overseas

Australia trails behind other jurisdictions. A statutory cause of action for invasions of privacy exists in some provinces of Canada and states of the US, while a common law cause of action exists in New Zealand and Britain. Actions brought in these jurisdictions highlight the potential ambit of the proposed tort. 

Ned RocknRoll, the curiously named husband of actress Kate Winslet, sought an injunction to prevent the publication of semi-naked photographs of himself because he had a reasonable expectation of privacy, publication would not contribute to the public interest and it would cause distress to him and his family. The UK High Court, in balancing the right to privacy against freedom of expression, found that there was no legitimate public interest in publishing the photographs given Mr RocknRoll was not a person of public interest of whom a higher standard of conduct could be expected and publication would likely cause harm and distress to the couple’s children. In California, the Supreme Court found television producers guilty of invading a plaintiff’s privacy in circumstances where they had equipped a rescue nurse with a microphone and recorded communications between the plaintiff and her rescuers. The Court found that the conversations were private and therefore the recordings amounted to an invasion of privacy. In Ontario, the Court of Appeal found that a defendant had invaded a plaintiff’s privacy by repeatedly accessing her bank records, despite the fact that no information was published, distributed or recorded. In awarding the plaintiff damages of $10,000, the Court found that the intrusion was intentional and would be highly offensive to the reasonable person. In New Zealand, the Court of Appeal considered whether publication of photograph of the children of a television personality out shopping constituted an invasion of privacy. 

The Court of Appeal, while recognising a tort of privacy exists in circumstances where there is a reasonable expectation of privacy and where publication of private facts would be highly offensive to a reasonable person, held that there had been no invasion of privacy as the photographs were taken while the family were in public and they were not offensive.

“A new tort in a new Commonwealth Act”  

There are five elements to the proposed tort, all of which must be satisfied:

  • there must be an intrusion into the plaintiff’s seclusion or private affairs (including by unlawful surveillance) or a misuse or disclosure of private information about the plaintiff (whether true or not);
  • the invasion of privacy must be intentional or reckless (the fault element);
  • a person in the position of the plaintiff would have had a reasonable expectation of privacy in all the circumstances;
  • the court must consider that the invasion of privacy is serious having regard to, among other things, the degree of offence, distress or harm to dignity that the invasion to privacy was likely to cause a person of ordinary sensibilities in the position of the plaintiff and whether the defendant was motivated by malice or knew the invasion was likely to offend, distress or harm the dignity of the plaintiff; and
  • the court must be satisfied that the public interest in privacy outweighs any countervailing public interests. 

Two types of invasion: As the first element makes clear, the ALRC proposes that the cause of action protect against two types of invasion of privacy: intrusion upon seclusion or private affairs and misuse or disclosure of private information. These two types of privacy invasion are commonly considered fundamental to a right to privacy and, as noted in Lenah Game Meats, come perhaps the closest to mirroring a concern for privacy “as a legal principle drawn from the fundamental value of personal autonomy”.

The fault element: The ALRC proposes that the cause of action be restricted to intentional or reckless invasions of privacy and therefore excludes negligent invasions from its reach. This is an important limitation given the cause of action will be actionable without a requirement of actual damage and will give rise to an entitlement to damages for mere distress. 

Reasonable expectation of privacy: The ALRC proposes a list of non-exhaustive factors to assist the court in determining whether a reasonable expectation of privacy exists including, among other things, the way in which private information was obtained, the nature of the information disclosed, whether the information was already in the public domain and the conduct of the plaintiff (including whether they invited publicity or exhibited a desire for privacy). 

Seriousness: The ALRC recommends that the new act contain a threshold test of seriousness to ensure that trivial and other non-serious breaches of privacy are not actionable. The test proposed is an objective one concerned with whether the court views an invasion of privacy as serious. The reasonable expectation of privacy and seriousness tests largely mirror the tests applied in overseas jurisdictions including New Zealand, where the common law recognises a tort of invasion of privacy in circumstances where there is a reasonable expectation of privacy and where publication would be highly offensive. 

Balancing privacy against the public interest: In its March 2014 discussion paper, the ALRC proposed that the balancing act requires the court to weigh the plaintiff’s interest in privacy against the defendant’s interest in freedom of expression and any broader public interest. However, in its final report the ALRC recommends that the court considers the public interest in privacy against any countervailing public interests. This change, which reflects the ALRC’s view that privacy is of itself a public interest, is designed to ensure that the focus of the balancing act is on the public interest in whether a particular type of invasion of privacy can be justified on public interest grounds. To assist the court in determining whether an interest in privacy outweighs any countervailing public interest, the ALRC proposes a non-exhaustive list of public interests to be considered including, among other things:

  • freedom of expression (including political communication and artistic expression);
  • freedom of the media;
  • the proper administration of government; and
  • the promotion of open justice.

Such a list is welcome as it gives a level of certainty to the proposed tort and imposes a positive obligation on the court to consider these issues.

Understandably, it is this element of the cause of action that has generated the most controversy and is of particular concern to the media, having been criticised as putting the cart before the horse. However, any criticism ought be tempered with an understanding that making the balancing act an element of the cause of action may, if properly executed, provide greater protection to freedom of expression than would occur if the public interest was considered only as a defence. This is because a plaintiff would be required to prove that the public interest in privacy outweighs any countervailing public interests. If it is found at any early stage that the public interest outweighs a right to privacy, then a cause of action simply cannot be established. Conversely, leaving the public interest to be considered as a defence would potentially prolong unmeritorious claims and allow a plaintiff to delay or prevent legitimate reporting of matters of public interest.

Unlike most liberal democracies (including the US, the UK and the European Union), while there exists an implied freedom of political communication, there exists no express constitutional protection for free speech or a Commonwealth bill of rights to protect important public interests in Australia. Accordingly, to provide adequate protection for fundamental public interest rights, two things are critical:

  • the balancing act must have a proper focus on a broad and flexible concept of public interest; and
  • it must be clear that matters that are truly in the public interest can override what would otherwise be considered a private matter.

Any new legislation must make clear that privacy is not an absolute right and cannot automatically take precedence over matters in the public interest.

It is essential that the balancing act never be performed, even on a preliminary basis, based only on a plaintiff’s complaint of a privacy infringement. That would put the cart before the horse. A proper balancing act can only be performed where an alleged privacy infringement and any countervailing public interest matters are put on the table at the same time and examined together.


The ALRC has proposed defences including, among other things:

  • a defence of lawful authority;
  • a defence for conduct amounting to self defence or defence of property;
  • defences of necessity and consent; and 
  • defences based on defamation such as a defence of absolute privilege, a defence of publication of public documents and a defence of fair reporting of public proceedings.

In its discussion paper, the ALRC proposed the introduction of a safe harbour scheme to protect internet intermediaries (such as internet service providers, search engines and content hosts) from liability for the actions of third party service users in circumstances where they innocently disseminate material that seriously invades an individual’s privacy. This proposal has been abandoned by the ALRC in its final report. The ALRC believes that a safe harbour scheme is unnecessary as the proposed tort targets only positive conduct (not omissions) and is confined to intentional or reckless invasions of privacy. The ALRC considers that internet intermediaries would often be unaware that their service has been used to invade an individual’s privacy and therefore a failure to act would not constitute an invasion of privacy as it would not be intentional or reckless (unless of course the intermediary knew of the invasion and could reasonably have stopped it but elected not to).


The ALRC has proposed a wide range of remedies including compensatory damages (including for emotional distress), account of profits, injunctions, declarations, correction orders, apology orders and declarations to destroy or deliver up material.  The proposed allowance for the recovery of emotional distress damages, in the absence of physical or psychiatric injury, reflects the ALRC’s belief that embarrassment and humiliation can cause significant harm despite the harm not being physical or financial.

The ALRC recommends that exemplary damages (but not aggravated damages) be available in exceptional circumstances where other remedies would not provide an effective deterrent. It is proposed that damages available for exemplary damages and non-economic loss be capped at the same level as damages for non-economic loss in defamation to prevent plaintiffs from cherry-picking between those actions.

Other Important Reforms

If the government elects not to enact the proposed tort, the ALRC recommends that legislation be amended to allow for the recovery of damages for emotional distress in actions for breach of confidence arising from serious invasions of privacy. The ALRC also recommends that state and territory legislation be enacted for a statutory tort of harassment which would provide protection and redress for individuals who suffer some of the most serious invasions of privacy and make existing criminal offences for harassment uniform throughout Australia.

Uniform surveillance laws: The ALRC recommends that the federal government enact surveillance legislation to replace existing state and territory surveillance laws and make uniform the types of devices regulated, when those devices may be used, and the offences, defences and exceptions available.

It is illegal in New South Wales to record a conversation that you participate in without the consent of all participants, while the same conduct is perfectly legal in Victoria. As a consequence, a journalist who records a conversation that they participate in, without the consent of the other participants, has broken the law in New South Wales but not in Victoria.

In its final report, the ALRC recommends:

  • a technology neutral definition of “surveillance device” (to ensure that a wide range of devices, including those yet to emerge, are covered);
  • a uniform offence for the use of surveillance devices to monitor or record private conversations or activities without the consent of the participants (whether or not the person conducting the surveillance is a participant in the conversation or activity and regardless of whether the monitoring or recording occurs on private property); and
  • a provision that the court may make orders to compensate, or otherwise provide remedial relief to, victims of unlawful surveillance.

The ALRC’s compromise to the strengthening of existing surveillance device laws is a new uniform defence of responsible journalism that is designed to protect freedom of speech and is intended to allow journalists and media organisations to investigate important matters of public concern without breaking the law every time they record a private conversation.


The proposals outlined in the ALRC’s final report are designed to strengthen Australia’s privacy laws in light of the rapidly evolving digital age in which we live. And rightly so. It is important that the law provides certain and consistent outcomes while maintaining the ability to adapt to an ever-changing technological environment. However, any increased protection of personal privacy must be balanced against protections for public interest such as freedom of expression and the right of the media to obtain and publicise information that is in the public interest. These are fundamental public interests that are critical to the operation of a successful democratic society.

The final report, which was commissioned by the Gillard government, has been presented to Attorney-General George Brandis for his consideration. Given the Attorney- General (a member of the Abbott government) is on the record as stating that he does not support the introduction of a statutory tort for serious invasions of privacy, it would seem unlikely that the ALRC’s recommendations will be implemented, at least by the current government.

This article first appeared in the December edition of the Law Institute Journal.

The content of this publication is for reference purposes only. It is current at the date of publication. This content does not constitute legal advice and should not be relied upon as such. Legal advice about your specific circumstances should always be obtained before taking any action based on this publication.

Related Content


Richard Leder

Partner. Melbourne
+61 3 9672 3489