Common Questions

Contributed by Dr Bruce Baer Arnold, University of Canberra and current to February 2022.

At a glance

This part of the chapter provides a brief introduction to a range of common questions about privacy and issues that readers may encounter in their daily lives. It covers Territory and Commonwealth law.

Media

Australian law gives considerable latitude to reporting in print, electronic and other forms regarding the public and private activity of people within the Australian Capital Territory. It does not permit journalists to invade private spaces.

Readers should however note that in the absence of a court order it is lawful for media organisations to disseminate images of people who have been convicted of offences, have been charged with crimes, are bystanders or participants at public events, are ‘missing persons’ or are being sought by law enforcement agencies.

It is similarly lawful for the media and other entities, such as scholars, to report judicial proceedings in an open court. Note that such reporting must not breach court orders (for example unilaterally disclose the identity of a victim of sexual assault) and not disclose the identity of personnel of some national security agencies or undercover police officers.

Adjudication by the Australian Press Council and by ACMA, the national broadcast regulator, has indicated that the media has scope for reporting on matters and in ways that some people may consider to be disrespectful of privacy or deeply offensive, including reporting on suicide, fraud, business collapses and the private lives of celebrities.

Drones

The Civil Aviation Regulations (Commonwealth law) provide a framework for the regulation of unmanned aerial vehicles (UAVs), aka drones, on a commercial or recreational basis.

Drones with an imaging capability are perceived by many people as inherently privacy-invasive. From the perspective of Australian law the reality is more subtle. Neither Territory nor Commonwealth law prohibit (in particular criminalise) the making of every image of a farm, factory, home, backyard or individual, unsurprising in a world where many people live/work in multi-storey buildings or otherwise oversight what their neighbours and passers-by are doing.

Readers have no exclusive rights regarding the sky overhead. They may however be able to restrict disregard of their privacy through the tort of nuisance and criminal law regarding stalking or even offensive behaviour in use of a network, where for example someone deliberately harasses an individual through persistent unjustified observation using a drone in close proximity to the person who is being surveilled.

Unhappiness with corporate use of drones to deliver coffee or alcohol in northern Canberra has attracted media attention (and reports of residents cheering ravens that attack Wings’ drones) but has not been reflected in litigation and it is likely that retailers such as Coles and Woolworths will trial drone-based delivery in coming years.

Imaging (‘Street photos’)

It remains axiomatic in Australian law that (subject to restrictions regarding such matters as non-obstruction of law enforcement personnel in the course of their duty, disrespect of an exclusion zone around a reproductive health facility, stalking or ‘passing off’) it is not an offence to make an image – a painting, sketch, still photograph or video – of someone in a public place or of what can be seen from a public place.

That means a range of businesses are free to create and publish images of what can be seen in a residential street and tourists or others are free to take snapshots of people in ACT streets and parks. It is not an offence to make images of someone else’s clothed children in a public place; further guidance is given below.

Biometrics

Public and private sector entities in Australia and overseas are rapidly establishing increasingly comprehensive biometric schemes for identifying individuals. Those schemes include retina, face, palm and finger print registration as the basis of authentication of identity claims (for example passports, driver licence ID cards and access to specific building or networks). Governments are increasingly sharing biometric data that was acquired on a mandatory basis, for example provided by an individual in the course of gaining a passport or a driver licence or gun licence or an Aviation Security Identification Card.

The technology is increasingly enabling integration of that data on a one-off or general basis with data collected through closed-circuit cameras in public spaces (eg transport nodes in Canberra and elsewhere) and private facilities, alongside tools such as networked ‘speed cameras’ or devices used to detect whether a driver is holding a mobile phone.

Some individuals have objected to corporate use of biometric tools in the workplace, whether from anxieties that data capture might be physically harmful or more persuasively that the tools collide with perceived privacy rights. As of February 2022, Australian courts and the Fair Work Commission have found that biometric schemes in the workplace are permissible if the employer has taken reasonable steps in introducing the technology and if reasonable care is taken regarding data handling. A salient but sometimes misunderstood point of reference is the 2019 case of case of Lee v Superior Wood Pty Ltd [2019] FWCFB 2946

Tracking

The preceding part of this chapter noted scope for spatial tracking by employers of employees or agents through for example devices that allow real-time or retrospective mapping of a vehicle’s movement across the Territory or – in exceptional circumstances – the use of such technology without disclosure to the employee.

Reductions in cost and increases in the robustness/useability of other tracking technologies are reflected in growing disagreements about parents covertly tagging children or teens, adults tagging partners (through for example software surreptitiously loaded onto a mobile phone or laptop) and aged care facility operators placing ‘electronic bracelets’ on seniors who are perceived as likely to wander into harm away from a care precinct.

Disregard of privacy through tracking that takes place without a person’s knowledge and thus consent may be addressed in terms of ACT criminal law. Note that ACT government use of automated numberplate recognition (ANPR) is authorised by law, deemed to identify the vehicle (not identical with the driver) and will be increasingly used, potentially in conjunction with the biometric facial recognition discussed above.

Questions about special privacy as part of public health responses to COVID are discussed below.

Upskirting and Sexting

Offensive practice such as up-skirting and down-blousing (ie unauthorised photography of a woman’s clothed private parts) is an offence under the Crimes Act 1900 (ACT), with several convictions each year over the past decade.

Note that using a telephoto lens or mobile to make images of a person’s clothed body that is visible from the street is repugnant but, as stated by the ACT Supreme Court’s 2017 judgment in Stroop v Harris [2017] ACTSC 294, such ‘creepshots’ are not an enforceable invasion of privacy.

There is now substantial case law across Australia regarding sexting, ie the dissemination or threatened dissemination of still/moving images made by adults or minors in a situation of intimacy. Law in the ACT is likely to follow that in other jurisdictions where offenders have faced criminal sanctions and tort action.

Employment

As highlighted in the preceding part of this chapter, a number of enactments coexist with employment awards and employment contracts to strengthen or weaken information privacy and other privacy protections. It is axiomatic for example that employees can lawfully, subject to preliminary disclosure, monitor employee/agent use of corporate networks (including private ‘chat’ and email undertaken via those networks). They both can and typically do require employees to disclose personal information such as residential addresses and contact details for next-of-kin.

Depending on contracts and awards they may require employees to undergo targeted or random substance/health checks, with people in particular industries such as mining or transport for example being required under statute to undergo breath/saliva tests for the detection of alcohol or other substances independent of whether there has been an incident. Many employers, often with endorsement by unions, require people to undergo health checks – including invasive tests such as provision of blood samples – prior to and in the course of employment.

People in particular occupations, such as anti-corruption officials and politicians, may be required to disclose both personal relationships and financial interests. People more broadly may be asked to disclose criminal records (a mandatory requirement for work with young and other vulnerable people), bankruptcy or – a catch-all used in vetting – ‘anything we need to know’.

Readers should note that although potential employers may lawfully seek personal information the misuse of that information in decision-making is likely to raise questions about discrimination. A requirement to disclose marital status, ethnicity or sexual affinity is for example problematical. Provision to another entity such as a marketer of candidate/employee information without knowledge and thus authorisation by a candidate will typically breach the 1988 national Privacy Act. Employers and recruitment services should heed the axiom that just because you can do something does not mean that you should or must.

Finance

Other chapters of this Handbook have noted disagreements about consumer credit (in particular credit referencing) and finance for small business. Overall, it is commonplace that people seeking to borrow money or gain insurance must disclose accurate personal information about aspects of their lives, primarily their financial history, assets and other matters that enable the lender/insurer to assess risk. The Privacy Act 1988 (Cth) authorises a national Privacy (Credit Reporting) Code 2014 – amended in 2018 – that binds credit reporting bodies (rating services), credit providers (eg banks), mortgage insurers and trade insurers. It sits alongside the contentious Consumer Data Right, administered by the OAIC and the ACCC.

The Act covers the types of credit information that may be disclosed to rating services, the circumstances in which that information may be disclosed by those services to credit providers and other recipients and the handling of that disclosed information. Businesses collecting and dealing in credit-related personal information are required to disclose their information management practices through a policy that must be freely available.

Readers should note that the Code was developed by industry and has been criticised by consumer advocates over several years, alongside criticism of practice in the 2018 finance sector Royal Commission. A substantial number of complaints to the Office of the Australian Information Commissioner, the Finance sector ombudsman and other bodies on an ongoing basis indicates that use/misuse of credit referencing data remains a privacy ‘hot spot’.

Protests

Australian law over the past century has sought to balance rights of political communication, association and participation with concerns regarding public safety and disruption of traffic or other matters. The High Court has thus found that it is permissible for state/territory governments to develop and implement law that require permits for protest marches or prohibits preaching and other activities in particular locations.

In the ACT health legislation authorises establishment of an exclusion zone around reproductive health centres, encompassing a ban on recording and publication of images of clients/staff of such centres. One effect is to protect the privacy of those people who would otherwise encounter protests such as prayer vigils. The High Court in judgments such as Kathleen Clubb v Alyce Edwards and Anor; John Graham Preston v Elizabeth Avery and Anor [2019] HCA 11 has recognised that protection as lawful and proportionate rather than contrary to Australia’s implied freedom of political communication. That freedom is significant more restricted than what people often perceive as a comprehensive right of free speech in the United States.

Note that it is an offence to impede members of the Australian Federal Police in the course of their duties, for example ‘getting in the way’ in reporting on a protest. There are restrictions on recording (eg still photography) in some Commonwealth precincts, particularly defence facilities.

The ACT Supreme Court is likely to look to jurisprudence interstate such as Windridge Farm v Grassi [2011] NSWSC 196 in considering claims that animal rights or other activists have breached the privacy of employees in agricultural or research facilities through unauthorised entry to and recording at those facilities, reflected in a request that recordings be destroyed or handed over to the facility operator.

Real estate

Consistent with the comments above regarding ‘streetview’ photography Australian real estate agents, landlords and the mass media commonly disseminate images of the exterior of real estate that is for sale or lease. There is disagreement about the publication of images of the interior of leased residential property, ie video or photographs that feature the possessions of people who are renting the property and who might be identified on that basis (for example by an estranged and violent partner or stalker).

Readers should note that under the Residential Tenancies Act 1997 (ACT) tenancy agreements permit inspections by landlords or their agents and encompass ‘display’ of the property to a future buyer/lessee but such entry into a domestic space in which people have a reasonable expectation of privacy, otherwise expressed as ‘quiet enjoyment’ of the property.

Children

It is common to encounter claims in blogs, online discussion groups and tabloid media that it is a criminal offence under national/state law to make a still or moving image of young people or that taking such photos/videos is a breach of ‘the Privacy Act’. Reality is more complicated.

As indicated earlier in this chapter, it is not an offence under national or ACT law to make an image of someone in a public place. That imaging is not prohibited under privacy law. Outside privacy law restrictions on the use of the image may be available under for example ‘passing off’ law, ie where someone sighting the image in an advertisement, on packing or another commercial format reasonably believes the subject of the image has endorsed that product, service or use.

As discussed elsewhere in this Handbook there are strong restrictions on making images of minors for sexual gratification, for example criminalisation of making, disseminating and acquiring (through purchase or sharing) images of young people that emphasise their private parts.

Parents, guardians and friends are more broadly advised to be cautious about sharing images of offspring and other young relatives using social media such as Facebook.

Identity Documents and Public Registers

It is a given that individuals are required to provide personal information (including names, birth dates, addresses and other contact details, and facial or other biometric images) to government agencies as a condition of entitlement to exercise particular rights. Two examples are provision for the salient proof of identity documents used by many adult Australians: the driver licence and the passport.

That information is held in official registers (typically an electronic database) and may be shared across different governments under for example the Commonwealth’s national identity hub. Those registers are typically not searchable online by ordinary members of the public and there may be specific enactments restricting sharing, for example official data matching using the ubiquitous national tax file number. Note that identity documents tied to particular registers may be sighted by both public and private sector entities, for example driver licences being scrutinised as a condition of entry to entertainment venues.

The ACT government is likely to emulate the move by NSW to introduce a digital driver licence and proof-of-age scheme in which the equivalent of the licence card is displayed on the licence holder’s mobile phone.

Some enactments require people to disclose personal information that is searchable online by ordinary members of the public. Such disclosure is likely to increase, given the Commonwealth’s enthusiasm for ‘open government’. Examples of what may be required include residential details of directors of not-for-profit organisations in the ACT that hold a liquor licence; those details may be findable in a PDF or other format by an experienced or diligent searcher.

Electronic or manual searching may reveal address, ownership and other details on a free or commercial basis. Examples include the electoral roll and land titles registers.

Census

The Australian Bureau of Statistics (ABS) conducts a broad range of surveys that include the periodic population & housing census. Those surveys have a mandatory basis: participation is required but privacy concerns are offset by ABS practice – criticised after the 2017 ‘censusfail’ controversy – and statutory restrictions on the sharing of personal information that has not been de-identified. Individuals and organisations cannot opt-out of particular surveys; readers should note that the ABS has indicated its preparedness to litigate against people who refuse to participate and has drawn attention to social goods resulting from the collection of demographic and other data as the basis of planning and policymaking.

Convictions and embarrassments

A value in Australian law is that justice is not only done but is seen to be done. Accordingly, there are few restrictions on contemporaneous reporting of civil and criminal judgments, for example identifying that an individual was sentenced to time in a correctional institution after being found guilty of breaching the law. One consequence is that a diligent searcher of online sources – including free legal databases such as AustLII – or of print/microfilm copies of newspapers in the National Library can often determine that someone was convicted, was fined or served time.

The Commonwealth and ACT spent convictions regimes formally limit the use that can be made of such personal information, consistent with recognition that there is an individual and social good in providing people with an incentive to reform after past misbehaviour. Note that not all convictions are ‘spent’ after the passage of several years under for example the Spent Convictions Act 2000 (ACT) and that exceptionally some historic convictions – notably relating to consensual same-sex activity – can be expunged.

Many journalists and readers appear to misunderstand the so-called Right To Be Forgotten that is an aspect of the GDPR mentioned earlier in this chapter. In essence, European law now provides a limited right to obscurity relating to display by search engines of personal information about youthful misdemeanours or other embarrassments. Implementation of that right involves requests by the individual to the relevant search engine. It does not involve the purging of print archives (ie newspapers and books in public/private libraries and archives) or official/academic legal databases. Importantly, it does not cover Australia and there is little likelihood that the national government will introduce such a scheme.

One implication is that people in the ACT who have experienced a business failure, relationship difficulties or otherwise featured in embarrassing news do not have an automatic enforceable right under Territory/Commonwealth law to ‘clean up’ the internet or a library to prevent people sighting that news in future. Readers contemplating management of their public profile might note the so-called Streisand Effect: there are instances where seeking to suppress what is in the public domain results in its wide dissemination.

Epidemics

This chapter began by emphasising that privacy is not an absolute and that people often have widely different views regarding rights and responsibilities.

Authority regarding public health is shared by the Commonwealth and state/territory governments, something that is often misunderstood by people who assume that the national; government has all the power over everything that is significant. One consequence is that the Territory government has the authority, just like the states, to make law about restrictions that minimise epidemics such as COVID and that involve systematic data collection that potentially includes identification of who was present at a specific location and by extension where that person (and others at the location) visited afterwards.

Neither the High Court nor the various Supreme Courts have overturned such law, in other words found that data collection and/or data handling was unlawful because for example contrary to the national Constitution or unnecessary and disproportionate. Some privacy advocates have accepted the lawfulness but cogently condemned inadequate design of the Commonwealth’s COVID App as presenting significant dangers regarding security and the data breaches noted above.