6. Options for reform

Updates and background for this project (Digest)

• Possible statutory models
• Identifying privacy interests
• Proposal 1

POSSIBLE STATUTORY MODELS

6.2 The Commission has identified four broad models that could form the basis for a statutory cause of action for invasion of privacy. The legal systems from which these models are drawn differ, markedly in some respects, from our own. Therefore, while it is helpful to examine how other jurisdictions have approached the issue of a privacy cause of action, it is not suggested that any particular model should be slavishly copied in New South Wales.

6.3 The four models are:

1. One general, non-specific right to seek redress for invasion of personal privacy.

2. A general cause of action for invasion of privacy, supplemented by a non-exhaustive list of the circumstances that could give rise to the cause of action.

3. A general cause of action for invasion of privacy, together with other specific statutory causes of action, for example, in respect of unauthorised surveillance activity.

4. Several narrower and separate causes of action based on various distinct heads of privacy.

6.4 Several European countries have very broad, open-ended provisions establishing a right to privacy with remedies available for breach of that right. For example, the French Civil Code states that “everyone has the right to respect for his private life”. The courts are empowered to order compensation for injury suffered, and may prescribe “any measures, such as sequestration, seizure and others, appropriate to prevent or put an end to an invasion of personal privacy; in case of emergency those measures may be provided for by interim order”.¹ This provision draws on Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms (“ECHR”),² and is balanced by the right of freedom of expression contained in Article 10 of the ECHR, and Article 11 of the Declaration of Human Rights 1789, as quoted in the preamble to the French Constitution of 1958.³

6.5 In Germany, the Constitution places a duty on State authorities to have respect for and protect human dignity, as well as recognising the right to “the free development of … personality insofar as it does not infringe the rights of others or offend against the constitutional order or the moral code”.⁴ German courts have held that this personality right is actionable under the general delictual provision in the German Civil Code.⁵ The Constitution balances the personality right with that of freedom of expression.⁶

6.6 While the terms “private life” and “personality” are not defined, European courts have said that they refer to the plaintiff’s right to solitude and “autonomous space” for private acts and decisions.⁷ The terms have also been held to include references to the plaintiff’s identity, love life, health, religion, sexuality, family relationships and business and financial details, as well as photographs depicting people in the course of their ordinary activities (for example, shopping), or for commercial gain without their consent.⁸ Whether or not a remedy of damages or an injunction applies will depend on the circumstances of each case.

Advantages

6.7 The major advantage of such a general cause of action is its inclusiveness. As such, there is no danger of genuine and clear invasions of privacy lacking a basis to bring an action. Being reliant on context rather than legislative proscription keeps the cause of action fluid and relevant, and more readily able to adapt to changes in jurisprudential thinking and advances in technologies. It also avoids the difficult task of determining in legislation exactly what constitutes an invasion of privacy, since this can be assessed on a case by case basis.

Disadvantages

6.8 If a broad statutory cause of action along the lines of European models were to be introduced in New South Wales, the primary obstacle would be the lack of certainty that it would generate. Legislation providing only for a bald statement of the ability to bring an action for invasion of privacy or private life would make it extremely difficult to know when, and how, conduct would give rise to liability. The difficulty would be pronounced particularly if, as is likely,⁹ no satisfactory definition of privacy could be found for inclusion in the legislation. Although legislation may create broad statutory obligations, whose scope is determined by subsequent case law, the context of the legislation usually assists in that determination. The mere legislative statement of a broad principle of privacy would lack that context.¹⁰

6.9 Reflecting a different relationship between case law and legislation, the lack of legislative precision is neither problematic nor unusual in the civil law systems of Europe. It is common in those systems of law for broad principles of law to be set out in legislation, particularly in codes, whose exact meaning and import are worked out subsequently. Thus, the general principle of French law that “everyone has the right to respect for his private life” does not mean that every conceivable breach of privacy contravenes this provision. The provision supplies merely a guiding principle whose meaning is only understood in the light of more general legal principles and of “common sense notions about what civil liability is about” – an inquiry informed by the jurisprudence (“case law”) and “doctrine” (commentary) that surrounds it.¹¹

6.10 Moreover, a substantial body of privacy-specific case law has developed in most European countries and in the European Court of Human Rights that now enables the contours of privacy to be drawn in those countries with some specificity.¹²

General action with examples of privacy violation

6.11 Existing laws in the Canadian provinces of Manitoba, Saskatchewan, Newfoundland and Labrador, and British Columbia,¹³ and proposed legislation in Ireland, provide for a general statutory tort actionable when a person wilfully, and without claim of right or lawful authority, violates the privacy of another.¹⁴ While none of these statutes define privacy, they all contain a non-exhaustive list of examples of the type of conduct that may constitute a breach of privacy. For example, it would be a prima facie violation of personal privacy under those laws to:

• subject someone to aural or visual surveillance,¹⁵ whether or not accompanied by trespass;¹⁶
• disclose information or material obtained as a result of surveillance, even if the person disclosing the information did not conduct the surveillance;¹⁷
• use, with the intention to exploit, the name, likeness or voice of an identifiable individual for profit or gain without that person’s consent;¹⁸ or
• use a person’s letters, diaries or other personal documents without consent.¹⁹

Advantages

6.13 This approach has similar advantages to the first model, in that it is open-ended and inclusive, thereby allowing the courts, rather than the legislature, to determine the circumstances in which alleged invasions of privacy should succeed. However, it has the additional benefit of giving context to the cause of action, and hence guidance as to when it might arise. This would allow the law to develop fluidly, as social and technological changes alter views on privacy and the means of its violation, within the structure provided by the legislation. This also helps to overcome the problems associated with developing a workable definition of privacy.²¹

Disadvantages

6.14 Although more structured than the first model, there is still an element of uncertainty, especially since none of the above examples contain a definition of privacy.

General action plus other specific causes of action

6.15 The third model for a statutory cause of action is the one adopted in the Canadian province of British Columbia. In addition to the general cause of action discussed above, the British Columbian Privacy Act also has a further cause of action for the unauthorised use of the name or portrait of another. Specifically, it is a tort, actionable without proof of damage, for a person to “use the name or portrait²² of another for the purpose of advertising or promoting the sale of, or other trading in, property or services, unless that other, or a person entitled to consent on his or her behalf, consents to the use for that purpose”.²³

Advantages

6.16 Once again, this model has the same advantage of inclusiveness as the previous two, with the additional certainty of providing for specific areas that may have presented themselves as privacy concerns. In this way, Parliament could legislate to include specific causes of action for invasion of privacy to reflect developments in the courts, but also have the general catch-all provision for cases that fall outside the scope of those specific causes of action, ensuring that genuine violations of any aspect of privacy would be actionable. This would offer a degree of clarity in terms of the particular causes of action that had been identified, while incorporating the flexibility to cover unforeseen developments that may threaten privacy.

Disadvantages

6.17 Although this model offers a more solid and definite framework by providing for one or more specific causes of action, the element of uncertainty remains regarding the general, catch-all provision. In fact, this uncertainty becomes more apparent when compared with the proscription of the specific cause of action. There is also the problem of identifying one or more specific causes of action. While this would be less of a problem if it occurred naturally as a common law development, it may seem somewhat arbitrary if specific causes of action were statutorily created without any empirical evidence of the privacy concerns that warrant protection.

Several distinct causes of action

6.18 As noted in Chapter 4, the United States’ Restatement (Second) of Torts sets out distinct categories of privacy tort, based on the classifications developed by William Prosser in 1960.²⁴ Prosser believed that an action for invasion of privacy was contextual, and represented not one, but a number of distinct actions. To recap, he identified the following four causes of action for breach of privacy following an analysis of existing case law:²⁵

1. Public disclosure of embarrassing private facts about the plaintiff.

2. Intrusion upon the plaintiff’s seclusion or solitude, or into the plaintiff’s private affairs.

3. Appropriation for the defendant’s advantage of the plaintiff’s name or likeness.

4. Publicity that places the plaintiff in a false light in the public eye.

6.20 The Law Reform Commission of Hong Kong recommended the legislative enactment of the first and second torts.²⁷ However, the Commission decided against recommending that the remaining torts of appropriating someone’s name or likeness, and portraying an individual in a false light, be incorporated into Hong Kong law. The Commission was of the view that such torts involve marginal privacy issues at best, may represent undue restriction on freedom of speech, and that existing actions such as defamation, breach of copyright and malicious falsehood provided adequate remedies.²⁸

Advantages

6.21 The key advantage of this approach is that it can be truly contextual: each cause of action can be tailored to a specific privacy right and its violation. This tailoring provides for more certainty in scope and operation. Since this provides for a series of specific causes of action rather than one general over-arching one, there is no real need to grapple with a comprehensive definition of privacy. Distinctions can also be made between personal and information privacy, providing more focus and clarity, and different elements can apply to each cause of action. It was these advantages, together with the difficulties associated with definition and enforcement, that led the Law Reform Commission of Hong Kong to decide against a general tort of privacy invasion.²⁹ That Commission’s preferred approach was to “isolate and specify the privacy concerns in which there is an undoubted claim for protection by the civil law”.³⁰

Disadvantages

6.22 While there is not the problem of having to define privacy as such, this model requires the identification and isolation of the privacy right or rights that are significant enough to warrant a specific cause of action. In the United States, Prosser categorised the four torts based on an extensive body of existing causes of action. They were not imposed arbitrarily. Since there is no recognised legal right or distinct common law cause of action for privacy in New South Wales, such a body of jurisprudence does not exist. This would make the task of classifying and identifying the causes of action more difficult in New South Wales. While the United States classifications may serve as a model, the substantial differences between American and Australian jurisprudence make it undesirable to import all aspects of their law protecting privacy.

6.23 It is also possible, depending on the type of causes of action chosen and how they were framed, that conduct warranting redress could fall between the gaps.

The Commission’s preferred approach

6.24 If a cause of action for invasion of privacy is considered desirable in New South Wales, the Commission’s preliminary view is to prefer the second option: that of a general statutory cause of action supported by a non-exhaustive list of examples of invasion. We hold this tentative view as we believe that option to be the most suitable of the four, considering the legal landscape in NSW. The absence of a human rights context and an established body of privacy jurisprudence would make the application and operation of the first model far too vague and uncertain. Similarly, the lack of privacy case law makes it difficult to decide on specific causes of action that characterise models three and four. While these could be determined by statute, this runs the risk of being an arbitrary exercise. We consider the preferable path to be the enactment of a general but structured cause of action that could guide the future development of the law.

6.25 Of course, the success of this legislative model would depend on how it is framed. The type of examples of privacy violation that may be included is an issue related to definition, and is discussed in the paragraphs that follow. The elements, balancing considerations and defences would also need to be carefully stated, and are examined in Chapter 7.

6.26 We emphasise that this preferred view is tentative only. It is based on our research and analysis to date. We consider consultation on this issue to be of the utmost importance in exploring alternative approaches or options.

IDENTIFYING PRIVACY INTERESTS

Possible approach

6.27 The formulation of a comprehensive and meaningful definition of privacy has eluded legislatures and commentators for centuries.³¹ Statutory attempts at definition tend to be either self-referential (using the term privacy to define the concept), so vague as to be meaningless, or circumscribed to be more relevant, which can render them arbitrary. This may not be so problematic in jurisdictions with a significant body of privacy jurisprudence in which to house a statutory cause of action for invasion of privacy, but may present difficulties for NSW.

6.28 The Commission acknowledges the difficulties inherent in the task of defining privacy. While the formulation of the ultimate definition for such a nebulous and over-arching concept would be satisfying, it may be of questionable value in setting the scope for a statutory cause of action.³² However, we believe that, if there is to be a cause of action for invasion of privacy, this must be accompanied by a statement of some kind that clearly articulates the rights and interests that such an action aims to protect, the values that support and propel the action, and the dangers it seeks to avoid. This could, perhaps, be best achieved through a two-pronged approach, namely:

1. an objects clause providing a general statement of legislative intent, and the values inherent in the concept of privacy; and

2. a more pragmatic, non-exhaustive list of examples of invasions of privacy.

An objects clause

6.30 While a broad, general statement concerning privacy would not be an adequate definition on its own, the Commission holds the provisional view that such a statement could form part of an objects clause. This could help clarify the purpose of the cause of action, and specify the underlying values. As we have already indicated,³³ the traditional values underlying privacy will almost certainly require elaboration or need to be stated in some alternative way. Subject to this reservation, the following is an example of how the legislation establishing the cause of action might encapsulate its purposes:

This Act enables an individual to bring an action before the courts seeking redress of an invasion of his or her privacy. Privacy is recognised as an important human right and social value, interpreted most succinctly as the “right to be let alone”.

Privacy is a broad concept based on individual autonomy, dignity, liberty, and the freedom to make choices that affect one’s personal life. Privacy also has an important social dimension, since a society is characterised by the rights and freedoms enjoyed by its citizens.

However, like all rights and freedoms, privacy is not absolute, but must be balanced against other interests, values and human rights in the context of the merits of each case.

6.31 While such broad and general statements may be suitable for an objects clause, a more solid foundation is needed for an actionable right of action for invasion of privacy backed up by remedies to support it. To achieve this, the Commission is of the provisional view that a non-exhaustive list should be developed of the privacy invasions that the statutory cause of action seeks to remedy. This approach accords with that taken in Ireland and the Canadian provinces, as outlined in paragraph 6.11 above.

6.32 An example may be as follows:

A person would be liable under this Act for invading the privacy of another, if he or she:

(a) interferes with that person’s home or family life;

(b) subjects that person to unauthorised surveillance;³⁴

(c) interferes with, misuses or discloses that person’s correspondence or private written, oral or electronic communications;

(d) unlawfully attacks that person’s honour and reputation;

(e) places that individual in a false light;

(f) discloses irrelevant embarrassing facts relating to that person’s private life;

(g) uses that person’s name, identity, likeness or voice without authority or consent.


This list should be interpreted as illustrative and not exhaustive.

PROPOSAL 1

If a cause of action for invasion of privacy is enacted in New South Wales, the statute should identify its objects and purposes and contain a non-exhaustive list of the types of invasion that fall within it.

1. Article 9, inserted by law No 70-643 of July 17, 1970, discussed at para 5.8, 5.11-5.13.

2. European Convention for the Protection of Human Rights and Fundamental Freedoms, opened for signature 4 November 1950, <www.echr.coe.int> at 10 January 2007, (entered into force on 3 September 1953) (“ECHR”).

3. See <www.assemblee-nationale.fr/english/8ab.asp#PREAMBLE> at 10 January 2007. See further para 5.10-5.26.

4. Grundgesetz (1949) Articles 1 and 2.

5. Bürgerliches Gesetzbuch, Article 823(1) provides that “a person who wilfully or negligently injures the life, body, health, freedom, property or other right of another contrary to law is bound to compensate him for any property arising therefrom”.

6. See Grundgesetz (1949) Article 5. See also N Nolte and JDR Craig, “Privacy and Free Speech in Germany and Canada: Lessons for an English Privacy Tort” (1998) 2 European Human Rights Law Review 162, 162.

7. Lebach case, 35 BVerfGE 202, 5 June 1973.

8. See, eg, Von Hannover v Germany (2005) 40 EHHR 1; Herrenreiter case, 26 Zivilsachen 349, 14 February 1958. See also Taylor Wessing, Defamation and Privacy Law and Procedure in England, Germany and France, 2006 (accessed at <www.taylorwessing.com>). See further para 5.37 – 5.64.

9. See para 1.12-1.18.

10. See para 1.43.

11. See G Wagner, “Comparative Tort Law” in M Reimann and R Zimmermann, The Oxford Handbook of Comparative Law (Oxford UP, 2006) 1003, 1006-1007.

12. See para 5.37-5.64.

13. A Privacy Bill has also been proposed in the Canadian province of New Brunswick. The Bill, similar to the legislation in the other provinces, has been under consideration by the Law Amendments Committee since 2000: see New Brunswick, Department of Justice, A Commentary on the Privacy Act (December 2000) and «www.inter.gov.nb.ca/legis/index-e.htm». Note that the Uniform Law Conference of Canada has also developed a Uniform Privacy Act based on the provincial legislation: see «www.ulcc.ca.en.us».

14. See Privacy Act, RSNL 1990, c P-22 (Newfoundland and Labrador) s 3(1); Privacy Act, RSS 1978, c P-24 (Saskatchewan) s 2; Privacy Act, CCSM c P125 (Manitoba) s 2(2); Privacy Act, RSBC 1996, c 373 (British Columbia) s 1(1); and Privacy Bill 2006 (Ireland) cl 2(2). Note that the Manitoba statute requires that the conduct be substantial and unreasonable, but does not specify wilful conduct. For further discussion, see para 3.42-3.58.

15. Surveillance is variously defined as eavesdropping or spying on, watching, besetting or following an individual, and listening to, intercepting or recording a communication, whether by electronic means or not: see Privacy Act, RSS 1978, c P-24 (Saskatchewan) s 3(a)-(b); Privacy Act, RSNL 1990, c P-22 (Newfoundland and Labrador) s 4(a)-(b); Privacy Act, CCSM, c P125 (Manitoba) s 3(a)-(b); and Privacy Bill 2006 (Ireland) cl 1. Note that the Manitoba, Saskatchewan and Newfoundland and Labrador laws permit recording of a conversation or message by a party to a conversation, whereas the Irish Bill does not.

16. Privacy Act, CCSM c P125 (Manitoba) s 3(a)-(b); Privacy Act, RSNL 1990, c P-22 (Newfoundland and Labrador) s 4(a)-(b); Privacy Act, RSS 1978, c P-24 (Saskatchewan) s 3(a)-(b); Privacy Act, RSBC 1996, c 373 (British Columbia) s 1(4); and Privacy Bill 2006 (Ireland) cl 3(2)(a).

17. Privacy Bill 2006 (Ireland) cl 3(2)(b). Note that this would cover the facts in Lenah Game Meats, where the ABC broadcast the surveillance footage, but did not film it.

18. Privacy Act, CCSM c P125 (Manitoba) s 3(c); Privacy Act, RSS 1978 c P-24 (Saskatchewan) s 3(c); Privacy Act, RSNL 1990 c P-22 (Newfoundland and Labrador) s 4(c); and Privacy Bill 2006 (Ireland) cl 3(2)(c).

19. Privacy Act, CCSM c P125 (Manitoba) s 3(d); Privacy Act, RSS 1978 c P-24 (Saskatchewan) s 3(c); Privacy Act, RSNL 1990 c P-22 (Newfoundland and Labrador) s 4(c); and Privacy Bill 2006 (Ireland) cl 3(2)(d). Note that the Irish Bill also refers to medical records.

20. See Privacy Act, RSS 1978 c P-24 (Saskatchewan) s 6(2); Privacy Act, RSBC 1996 c 373 (British Columbia) s 1(3); and Privacy Bill 2006 (Ireland) cl 4, for a complete list of the factors that courts must take into account.

21. This was the rationale adopted by the Irish Working Group: see B Murray, L O’Daly, B MacNamara and C O’Hobain, Report of Working Group on Privacy (2006), <http://www.justice.ie/80256E010039C5AF/vWeb/flJUSQ6REJMU-en/$File/WkgGrpPrivacy.pdf> at 22 March 2007 (“Working Group Report”) at [7.12].

22. “Portrait” means a likeness, still or moving, and includes a likeness of another deliberately disguised to resemble the plaintiff, and a caricature: see Privacy Act, RSBC 1996 c 373 (British Columbia) s 3(1).

23. Privacy Act, RSBC 1996 c 373 (British Columbia) s 3(2).

24. W Prosser, “Privacy” (1960) 48 California Law Review 383.

25. See Restatement (Second) of Torts § 652B-652E. The law is analysed fully in ch 4.

26. Discussed at para 6.15 above.

27. See Law Reform Commission of Hong Kong, Sub-Committee on Privacy, Consultation Paper on Civil Liability for Invasion of Privacy, August 1999 (hereafter referred to as “Hong Kong LRC Consultation Paper”), [7.48] (Recommendation 1), [8.38]-[8.39] (Recommendation 3).

28. Hong Kong LRC Consultation Paper, [9.29] (Recommendation 7), [10.16] (Recommendation 8); Hong Kong Law Reform Commission, Civil Liability for Invasion of Privacy (Report, 2004) [10.38], [11.57].

29. Hong Kong LRC Consultation Paper, [6.19].

30. Hong Kong LRC Consultation Paper, [6.19].

31. See para 1.13.

32. In this respect, we agree with the comments of the Australian Law Reform Commission, Review of Privacy, Issues Paper No 31 (2006), [1.115].

33. See para 1.43.

34. The Commission proposes that the definition of surveillance would be the same as that recommended by us in NSW Law Reform Commission, Surveillance: An Interim Report Report 98 (2001), [2.36], [2.39] (Recommendations 1, 2 and 3).