Submission to the Australian Law Reform Commission's
Review of Privacy - Issues Paper 31

February 2007

EXECUTIVE SUMMARY

Office of the Privacy Commissioner

1. The Office of the Privacy Commissioner (the Office) is an independent statutory body whose purpose is to promote and protect privacy in Australia. The Office, established under the Privacy Act 1988 (Cth) ('the Privacy Act'), has responsibilities for the protection of individuals' personal information that is handled by Australian and ACT government agencies, and personal information held by all large private sector organisations, health service providers and some small businesses. The Office also has responsibilities under the Privacy Act in relation to credit worthiness information held by credit reporting agencies and credit providers, and personal tax file numbers used by individuals and organisations.

Background

2. The Office welcomes this review of privacy by the Australian Law Reform Commission (ALRC). The Office believes that a holistic review of privacy regulation in Australia presents a unique opportunity to enhance the consistency of privacy regulation, and assess the effectiveness of privacy laws in light of evolving circumstances, such as technological development and community expectations.

3. The ALRC's review of privacy was commissioned following recommendations made in the Office's Private Sector Review and the Senate Legal and Constitutional References Committee Review that a wider review of privacy be undertaken.1 The Office welcomes the Government's commitment to inquire into the adequacy of privacy regulation to ensure that it best serves the needs of Australia in the future.

4. This is an important period of review for privacy regulation. The Office notes that the ALRC's review is being undertaken concurrently with similar reviews in other jurisdictions. The NSW Law Reform Commission is undertaking a review of privacy which will consider issues such as the desirability of uniform privacy protection principles across Australia, and the desirability of introducing a tort of privacy in NSW.2 The Victorian Law Reform Commission is also undertaking an inquiry into surveillance in public places.3 The Office believes that it will be useful to engage with these and other jurisdictions, to encourage a coordinated response to improving privacy regulation in Australia.

5. In addition, the New Zealand Law Commission is currently undertaking a review of privacy laws.4 The Office believes that this may provide a timely opportunity for greater harmonisation of trans-Tasman privacy regulations.

6. In what the Privacy Commissioner has described as a 'once in a generation opportunity', the Office looks forward to further opportunities to contribute to the ALRC's review of privacy.

General comments

7. A great deal has changed since the Privacy Act was enacted in 1988.

8. There have been changes to the way Australians think about privacy, changes to the manner and speed in which personal information is handled, particularly as a result of technological developments, and there has also been the arrival of the internet as a mainstream source of public information and interaction.

9. In the Office's experience, one thing that hasn't changed is that Australians still deeply value their privacy as a necessary condition for living an independent, fulfilling and dignified life.

10. The current principles under the Privacy Act are based on the OECD data protection guidelines that were developed almost 30 years ago.5 At that time:

• personal computers were scarce, and the internet did not exist
• there was little of biometric technology beyond ink fingerprints
• international counter-terrorism initiatives were not the focus they are today
• surveillance systems like closed circuit television and global positioning systems were not as widespread and
• mobile phones and camera phones were a distant prospect

11. These modern-day phenomena have changed the circumstances surrounding data protection. Nevertheless, the Office believes that the Privacy Act has served the community well since its enactment in 1988. The challenge now is to ensure that the legislation operates effectively for at least a similar period again, and continues to best serve the diverse needs of the Australian community.

12. This submission responds to the questions raised in IP31. In providing these responses, the Office has attempted to share nearly 20 years of experience in applying the Privacy Act, as well as its strong belief in the importance of privacy in a healthy, democratic society.

13. Privacy is important to our way of life, but what does it mean exactly? It has been said that for most of us, privacy is something we think about only when it is lacking.6 The difficulty of defining this term is well-documented in IP31 which explores the range of meanings commonly associated with the term. This submission, like the ALRC inquiry, is concerned primarily with information privacy (see IP31 paragraph 1.89). However, the Office observes that information privacy can intersect with other categories of privacy. For example, location detection technologies, which collect information about an individual's whereabouts, might be considered to cut across both information and physical privacy. While information privacy forms the focus of this inquiry, the Office submits that it will be important for the ALRC to consider cross-over between information privacy and other forms of privacy to ensure that the Privacy Act meets community expectations and continues to be relevant and provide adequate protection in the future.

14. Privacy is important but of course, complete anonymity or isolation from the rest of society is neither possible nor desirable. There will always be interactions that require individuals to be 'knowable' to another person or organisation, just as individuals will often want to share their personal information with particular people and organisations. Privacy laws are not designed to obstruct those interactions. Rather, privacy laws are about making sure that individuals have control, to the extent possible, over when their personal information will be collected by others, and how their personal information is subsequently used.

15. In light of these considerations, this submission is concerned first and foremost with ensuring that the privacy of individuals is valued, protected and respected in Australian society, now and into the future.

16. The Office also recognises that privacy must be protected alongside other societal interests such as free speech, security and commercial efficiency. Indeed, the Office notes that when the private sector provisions were introduced into the Privacy Act, they were intended to be responsive to both business and consumer needs.7

17. It is important that the costs of complying with privacy regulations are proportionate to the social benefits they provide. In the Office's view, regulatory inconsistency can have a negative impact on businesses' ability to comply with such regulations, creating undue complexity and confusion as to which law to apply.

18. The continued existence of inconsistency in Australia's privacy framework is borne out by the findings of the Office's Private Sector Review. That Review concluded that the Privacy Act had not achieved its object of establishing a single comprehensive national scheme for the protection of personal information.8 The Office believes that increased regulatory consistency is crucial if agency and organisational compliance costs are to be minimised, and if individuals are to be empowered to exercise their privacy rights without confusion or difficulty.

19. Accordingly, a central theme of this submission is identifying ways that regulatory consistency can be enhanced, for the benefit of consumers, businesses and the provision of government services. In particular, the Office believes that regulatory complexity will be reduced by the introduction of a single set of principles to the Privacy Act. This single set of principles would ideally replace the two separate sets of provisions that currently regulate the the Commonwealth public sector (the Information Privacy Principles, or IPPs) and the Australian private sector (the National Privacy Principles, or NPPs). These principles could also serve as a model for uniform privacy legislation, which could be implemented across Commonwealth, state and territory jurisdictions.

Structure of this submission

20. This submission follows the structure of IP31. As with IP31, there are 13 chapters which are outlined below. In those chapters, the Office responds to the questions raised by the ALRC in IP31.

Submission summary

Chapter 1: Introduction to the Inquiry

21. Chapter 1 places Australia's privacy regulatory regime in an international context and draws out the central ideas that inform Australia's regulatory approach.

22. This chapter also addresses two specific questions. The first relates to the suggestion that the Privacy Act be extended to cover certain groups such as indigenous or ethnic groups or commercial entities. In its response to this question, the Office submits that the Privacy Act should continue to apply specifically to individuals, which has been the international approach to regulating privacy.

23. The second question in this chapter examines the case for a tort of privacy. In general, the Office believes there are several positive arguments for the development of a tort of privacy, and would therefore encourage further examination of the issue by the ALRC.

Chapter 2: Overview of Privacy Regulation in Australia

24. Chapter 2 introduces the Office's views on the importance of national consistency of privacy regulation. The Office believes that regulatory consistency will benefit both businesses and individuals by reducing compliance difficulties for organisations, and empowering individuals to understand and exercise their privacy rights without confusion as to their legal entitlements.

25. This chapter takes national regulatory consistency to be a key goal of privacy reform where there is no compelling need for differentiation. As such, the key message contained in Chapter 2 underpins many of the Office's responses to chapters that follow.

Chapter 3: The Privacy Act 1988 (Cth)

26. Chapter 3 suggests possible amendments to definitions in the Privacy Act. These suggestions align with the Office's belief that terms should be defined in a way that balances flexibility with regulatory stability. Approached in this way, the Office submits that definitions in the Privacy Act will reflect the intentions behind principle-based law.

27. As noted in IP31, much of the complexity within the Privacy Act stems from its development and amendment over several years. As such, many of the recommendations made in Chapter 3 are aimed at updating or clarifying relevant definitions, and better articulating the objects and scope of the Act.

28. In particular, Chapter 3 makes suggestions in relation to the definitions of personal information, sensitive information, financial information, record, identifier, collector, small business, generally available publication, agency, State or Territory authority and related bodies corporate. This chapter also suggests that certain privacy principles be extended to the personal information of deceased persons.

Chapter 4: Examination of the Privacy Principles

29. Chapter 4 builds on the idea that principle-based law remains the best way to regulate information handling.

30. This chapter explores the IPPs and NPPs in detail, and makes suggestions for their improvement based on the Office's experience in applying the Privacy Act.

31. While the Office believes that the existing principles under the Privacy Act are operating well, the Office believes there would be benefit in introducing to the Privacy Act a single set of principles to replace the IPPs and NPPs. In the Office's view, a single set of privacy principles would encourage greater regulatory consistency and simplicity, while maintaining or improving existing protections. Chapter 4 suggests that a single set of principles could include provisions relating to: anonymity, notice and openness, collection, collection of sensitive information, use and disclosure, information quality, information security, access and correction, transborder data flows and identifiers.

Chapter 5: Exemptions from the Privacy Act 1988 (Cth)

32. In Chapter 5 the Office expresses its view that to achieve uniformity and consistent application of privacy legislation, exemptions under the Privacy Act should be minimised. Where exemptions do exist, a clear public interest should also exist to support their continuation.

33. In the interests of enabling greater community understanding of the Privacy Act, the Office would support the adoption of consistent criteria to determine which entities are exempt from the application of the Act.

34. In particular the Office suggests that:

• small business telecommunications service providers should be brought under the jurisdiction of the Privacy Act
• gaps in coverage of residential tenancy database operators by privacy regulation should be addressed
• consideration be given removing the employee records exemption in the interests of national consistency
• the Privacy Act should apply to state and territory statutory corporations, except where equivalent privacy legislation has been enacted in the relevant jurisdiction
• the small business 'opt-in' provision be made available to any organisations which are exempt from the operation of the Privacy Act9 (for example, to give political parties and other entities the opportunity to voluntarily opt-in to coverage by the Privacy Act).

Chapter 6: Powers of the Office of the Privacy Commissioner

35. Chapter 6 examines the powers of the Privacy Commissioner, and makes recommendations based on the Office's experience in monitoring and enforcing compliance with the Privacy Act.

36. In general, the Office finds that the Privacy Act contains appropriate provisions to support the Office of the Privacy Commissioner's role as an effective complaint-handling body. However, the Office submits that the strong focus in the Privacy Act on resolving individual complaints should be balanced with improved provisions for dealing with systemic privacy issues. To this end, many of the suggestions made in this chapter relate to strengthening the Office's capacity to respond effectively to issues which may have broader impacts on privacy. This would better equip the Office to address the causes of interferences with privacy, not only the effects.

37. Particular suggestions in Chapter 6 include:

• that the relationship between the Office and other dispute resolution bodies be clarified
• that the Privacy Commissioner be given more ways of dealing with systemic issues, such as enforceable remedies following an own motion investigation, and a targeted private sector audit power
• that the Privacy Commissioner be empowered to make binding codes
• that public sector agencies be required to undertake Privacy Impact Assessments for new projects or legislation that significantly impact on the collection or handling of personal information.

Chapter 7: Interaction, Fragmentation and Inconsistency in Privacy Regulation

38. Chapter 7 expands on some of the issues raised in Chapter 2, particularly regarding the interaction and inconsistency between the Privacy Act and other privacy-related regulations.

39. The Office notes in this chapter the importance of ensuring that privacy regulations are interoperable, consistent and comprehensive, with national consistency as the ultimate goal of such an interoperable privacy scheme.

40. Consistency does not mean the elimination of multi-layered regulation. In many cases, additional protections that regulate particular sectors, or protect certain information, can enhance privacy (such as privacy codes and secrecy provisions). However, in the interests of all parties, it is critical to ensure these layers are not unnecessary, inconsistent, or poorly interactive.

41. In the Office's view, there are a number of ways that current privacy regulations can be harmonised across various sectors and jurisdictions. These solutions include:

• providing greater guidance on the operation of existing laws, and how they relate to other regulations
• clarifying the jurisdiction of the Privacy Act (for example, in relation to coverage of the private sector)
• ensuring that privacy protections in state and territory jurisdictions are consistent with and equivalent to the Privacy Act
• making clearer reference in legislation which intends to rely on NPP and IPP exceptions to authorise particular information-handling practices (such as a use or disclosure)
• improving the consistency of provisions under federal legislation that relate to personal information-handling, such as the Privacy Act, the Freedom of Information Act 1982 and the National Archives Act 1983
• enhancing administrative functions or powers to enable regulators, including the Office, to cooperate more effectively, and
• adopting a single set of privacy principles to replace the IPPs and NPPs, which could also be uniformly adopted across federal, state and territory jurisdictions.

Chapter 8: Health Services and Research

42. In Chapter 8 the Office puts forward the view that Privacy Act's existing provisions have generally met individuals' expectations regarding the handling of their health information, and afforded appropriate regard to the needs of health service delivery and medical research.

43. However, the Office notes in this chapter that there is a strong need to clarify the application of the Privacy Act regarding private sector health service providers. Section 3 of the Privacy Act should be amended to make clear that the National Privacy Principles 'cover the field' for the regulation of private sector health service providers. This would address a key source of uncertainty and potential fragmentation in health privacy regulation in Australia.

44. The Office also notes that the proposed National Health Privacy Code (NHPC) has not been adopted by the relevant jurisdictions since the Office's Private Sector Review was released. In light of changed circumstances, the Office considers that the objectives of national consistency and higher privacy protection for health information can be best achieved through certain amendments to the NPPs, or the adoption of a single set of principles as discussed in Chapter 4.

45. While comfortable that the existing principles work well, the Office makes a number of recommendations in Chapter 8 regarding areas of health privacy regulation where the law could be enhanced. These include in regard to access, including the role of intermediaries, as well as information handling obligations where a health service closes, or where an individual wishes their records to be transferred. The Office has also suggested that, among other things, the principle regulating the collection of health information without consent and where 'necessary to provide a health service' could be usefully amended.

46. In regard to health and medical research, the Office submits that the existing regulatory framework affords individuals with an appropriate degree of assurance that their personal health information will not be misused, particularly where it is handled without their consent. The Office draws attention to provisions where regulatory complexity could be reduced, particularly by harmonising the enabling provisions for the section 95 and 95A mechanisms.

Chapter 9: Children, Young People and Adults with a Decision Making Disability

47. The privacy of vulnerable members of the community is of considerable interest and concern to the Office and the Australian public. Chapter 9 addresses the privacy of children and individuals with a decision-making disability. Each presents comparable but different challenges for privacy regulation, which must balance community, representative and individual expectations across a range of circumstances.

48. The Privacy Act is based around providing rights to individuals and does not distinguish individuals by age. Children are therefore provided with equal rights to adults, with the flexibility to determine, on a case by case basis, who should be responsible for exercising those rights. Other mechanisms supplement the Privacy Act's protections, such as legislation specific to child protection, and particular sectoral procedures. The Office believes the Privacy Act is generally functioning effectively in relation to children and young people, although in some areas, protections may be improved by amendments to the small business exemption. The Office welcomes consideration of further mechanisms beyond the Privacy Act which may be necessary to safeguard child privacy, for example, in the areas of online protections and photographs.

49. In relation to individuals with a decision-making disability, the Office believes that certain problems can be addressed without legislative amendment. This includes providing additional guidance on when personal information can currently be disclosed to representatives under the Privacy Act. The Office also believes consideration could be given to whether the disclosure of non-health information should be permitted under NPP 2.4. Other areas for consideration include the ability of representatives to seek access on an individual's behalf, how best to protect individuals' privacy from their own representatives, and whether the Privacy Act operates effectively in cases of sudden or unexpected incapacity.

Chapter 10: Telecommunications Privacy

50. Personal information handled in the telecommunications sector is regulated by a number of legislative instruments and regulatory bodies. These interrelationships need not be problematic in themselves, and indeed, they can enhance privacy protections in the sector where they operate consistently. Nevertheless, there are aspects of privacy regulation in the telecommunications sector which can benefit from review and improvement. The Office's response to Chapter 10 draws particular attention to the following issues:

• the number and extent of exceptions under Part 13 of the Telecommunications Act, which allow disclosure of personal information in various circumstances, and in some cases may provide a lower level of protections than the Privacy Act
• the lack of consistent coverage of small business operators in the sector, that may not be bound by the Privacy Act or equivalent protections
• the lack of clarity and consistency between disclosures authorised under the Privacy Act and the Telecommunications Act
• the limits on the Privacy Commissioner's involvement with the approval of telecommunications industry codes
• various issues with a range of legislation, some only recently enacted, which governs the telecommunications sector (including in relation to telecommunications interception)
• ways to streamline the regulatory interaction between the Office and the Telecommunications Industry Ombudsman.

Chapter 11: Developing Technology

51. In Chapter 11, the Office expresses its view that the most effective strategy for the protection of privacy in the context of continuously developing technologies will be multi-faceted involving:

• principle-based legislation coupled with binding codes
• end-user empowerment through education
• technology solutions
• international agreements between jurisdictions.

52. The Office believes that a technologically-neutral principles-based approach, along with provision for the Privacy Commissioner to make specific binding codes where a clearly defined privacy risk emerges, is the best way to deal with the impact of rapidly developing technology on information handling.

53. Some of the suggestions made by the Office in Chapter 11 include that:

• biometric information be classed as sensitive information under the Privacy Act and small businesses that handle biometric information be brought under the jurisdiction of the Privacy Act
• the public sector data matching guidelines be made binding and consideration be given to introducing data-matching regulation to the private sector
• consideration be given to introducing a requirement to the Privacy Act which mandates in certain circumstances the reporting by organisations of security breaches to personal information
• the Privacy Act continue to be technologically neutral with provision for the Privacy Commissioner to make binding codes where a specific privacy issue arises

Chapter 12: Unique Multi-Purpose Identifiers

54. Chapter 12 explores the regulatory regime surrounding the use of unique multi-purpose identifiers. The Office accepts that sometimes the use of unique identifiers is essential; for example, in order to correctly identify individuals for the purposes of providing health care. However, the Office notes that, when unique identifiers are used for multiple purposes and across different agencies and organisations, risk of privacy invasion is increased. This is because, if used in the wrong way, unique multi-purpose identifiers can enable greater data-matching, sharing and linking and create conditions conducive to function creep.

55. The Office believes that the Privacy Act should continue to play an important role in ensuring that unique multi-purpose identifiers are handled in ways that do not unreasonably intrude on the privacy of individuals. Subject to a few suggested amendments the Office believes that provisions in the Privacy Act dealing with unique multi-purpose identifiers remain appropriate.

Chapter 13: Transborder Data Protection

56. Advances in information technology have allowed information to be sent across the world with speed and efficiency. With the advent of inexpensive high-speed internet connections and the growth of the global economy, Australian agencies and organisations are increasingly operating across national borders.

57. The Privacy Act regulates the transfer of personal information outside Australia via NPP 9. NPP 9 provides important protections to individuals