Home | Databases | WorldLII | Search | Feedback Privacy Law Resources

Greenleaf, Graham --- "Submission on the Privacy Amendment (Private Sector) Bill 2000" [2000] PrivLRes 3; [2000] CyberLRes 5 (14 May 2000)

	[Home] [Databases] [Search] [Feedback] [Help]
	Privacy Law Resources

Submission on the Privacy Amendment (Private Sector) Bill 2000 ([2000] CyberLRes 5) - [2000] PrivLRes 3

Greenleaf (2000)

Contents of submission

• 1. Introduction
• 1.1. Structure of submission
• 1.2. Overall assessment of the Bill
• 1.3. Biased purposes (cl 3)
• 2. Deficiencies in the enforcement procedures
• 2.1. The lack of an appeals structure is biased towardbusinesses
• 2.2. Judicial review will not deliver justice, nordevelop consistent privacy law
• 2.3. Lack of powers to investigate
• 2.4. The need for consistent and accessible privacylaw
• 3. Publication of Code decisions - avoiding secretjustice
• 3.1. Formal determinations
• Recommendations
• 3.2. Informal mediation
• Recommendations
• 4. Unjustified exemptions
• 4.1. Flaws in the 'small' business exemption
• How big businesses can rort the 'small' business exemption
• How to increase the sale value of a small businessby privacy-invasion
• The 'small' business exemption will hurt small businessesand industry associations
• Appropriate measures to safeguard small business interests
• Recommendation
• 4.2. A better political parties 'exemption'
• Recommendation
• 4.3. The employment exemption
• 5. Will the Privacy Act be 'adequate' for EU purposes?
• 5.1. Uncertainty about the meaning of 'adequacy'
• 5.2. Problems with the Bill's 'adequacy'
• 6. Other recommendations
• 6.1. Related corporations
• Recommendation
• 6.2. Inadequate definition of 'personal information'for cyberspace
• Recommendation
• 6.3 Transborder data flows (NPP 9)
• Recommendation

1. Introduction

1.1. Structure of submission

References to sections ('s5B') are to sections of the PrivacyAct 1988, as proposed to be amended by this Bill. References to clauses('cl 3') are to clauses of the Bill

I have attached brief biographical details indicating my qualificationsand experience in relation to privacy matters.

1.2. Overall assessment of the Bill

At the most general level, the formal structure of the Bill is supportable,including its co-regulatory structure. The principal deficiencies of theBill are its numerous exception and exclusions, and the omission of a numberof basic protective mechanisms that prevent effective enforcement of suchconsumer rights as do exist. As noted by the Charter Council, the Billalso contains many well-drafted provisions.

Before this Bill deserves any support from a consumer perspective,it requires many major improvements. With such major improvements, thestructure of the Bill is capable of providing a useful (though still inadequate)form of privacy protection. Well-controlled and enforceable co-regulatoryschemes can provide a useful advance in the world-wide development of privacylaws - but this Bill lacks both the necessary public interest controlsand fair enforcement mechanisms.

As the Bill stands, I do not support its enactment. Due to its numerousweaknesses, it will legitimate previously questionable privacy-invasivebusiness practices more than it will protect privacy. Large areas of privacy-invasivebusiness (and political) practices will be completely exempt from the Bill.Protection to individual privacy will be piecemeal, and will leave consumersunprotected against many of the worst privacy invasions (which will nowhave an aura of legitimacy of 'complying with the Privacy Act'). Such rightsas the Bill provides will be inadequately enforced and enforced in a waywhich is biased toward business.

This Bill is capable of amendment so it could at least bring Australiaup to the standards of privacy protection now commonplace in Europe, NewZealand, Hong Kong and elsewhere. Such legislation will not be sufficientto provide sufficient privacy protection in the 21st century, but wouldat least bring Australia up to last century's standards.

In this submission I have detailed some major deficiencies ofthe Bill, and suggest how some of them can by remedied by simple amendments.Many other deficiencies, and suggestions for improvement, are covered insubmissions by the Privacy Charter Council. These constructive suggestionsfor improvement of the Bill should not be misinterpreted as support fora Bill which is fundamentally anti-consumer. It will take major surgeryfor this Bill to be of substantial value to consumers.

1.3. Biased purposes (cl 3)

Recommendation: Two changes would make the objects more evenlybalanced, without bias toward either business or consumers:

(i) a change to 'individuals rights in protecting their privacy';and

(ii) a change to 'the right of business to achieve its legitimate objectivesefficiently'.

2. Deficiencies in the enforcement procedures

• The procedures are not biased against either businesses or consumers.
• The Code authorities have sufficient powers to properly investigate complaints.
• There is a process by which the potential differences in interpretationof the Act by different Code authorities can be overcome, with uniformand legally correct interpretations of the Act resulting and applied byall Code authorities and the Commissioner.

2.1. The lack of an appeals structure is biasedtoward businesses

As is currently the case under s55 of the Privacy Act, under thenew ss55 and 55A, a determination of a complaint by a Code authority orby the Commissioner can only be enforced by proceedings in the FederalCourt (or the new or Federal Magistrates Court), and the Court has to dealwith the matter by way of a hearing de novo (anew) as to whetherthere has been conduct constituting an interference with privacy (s55A(5)).

As a result, all that a business has to do if it is aggrieved by theway in which a Code Complaints Body or the Privacy Commissioner has dealtwith their complaint, is sit on its hands and not pay the compensationor take the other steps it has been ordered to take. The complainant mustthen take the matter to the Federal Court, and the business can have thematter heard in full again. In effect, it obtains a right of appeal toa Court.

The problem is that an unsuccessful complainant, whether the complaintis heard by a Code Complaints Body or by the Privacy Commissioner, hasno such right of appeal - no right to have the matter heard de novoby any higher authority. They have no redress against a wrong interpretationof an Industry Code or the National Privacy Principles (or of other provisionsof a Code or the Act), or of the wrong application of the law to the factsof the complainant's case. This is unfair and biases the whole enforcementstructure of the Act against consumers.

A determination will now be prima facie evidence of the factsupon which the determination is based (s55A(6)). It will be possible, however,for those facts to be challenged. This does not address the fundamentalproblem of unsuccessful complainants having no right of appeal, but isan improvement since the successful complainant is at least not put toproof or those facts all over again.

2.2. Judicial review will not deliver justice, nordevelop consistent privacy law

As a result of these continuing deficiencies of the proposals,there will be little likelihood of the development of a significant orconsistent body of law concerning the meaning and application of the Principles.The Privacy Commissioner will not oversee the interpretation of codes byindustry bodies in individual cases, being limited to some vague obligationto report on their general operation in his or her annual report. The Courtswill only do so rarely, and only in cases where the code has been interpretedin favour of complaints and is therefore under attack by businesses.

2.3. Lack of powers to investigate

It is intended that privacy codes should require participantsto co-operate with and provide requested information to code complaintbodies. However, this will not fully substitute for the Privacy Commissioner'sstatutory powers, particularly in relation to obtaining information fromthird parties.

This deficiency in investigative powers exacerbates greatly the complainant'slack of right of appeal. If investigations are frustrated, a complainant'scase will remain unproven. Where an industry complaint body's investigationis frustrated by its lack of investigative powers (particularly where athird party not a party to the industry scheme has failed to cooperate),it is unlikely that it could be criticised in a process of judicial review,and the fact that it can make no enforceable determination denies the complainantthe avenue of taking the matter to a tribunal where legal powers of compulsionare available (the Federal Court). In contrast, in the rare event thata business could not provide evidence of its defence because some thirdparty refused to provide evidence, the business can use the avenues ofFederal Court process to obtain the evidence, once the complainant startsan enforcement action.

The ability of a Code authority to refer complaints to the Commissioner(s40(1B)) is useful, but is out of the control of the complainant and atthe discretion of the Code authority, and is no substitute for a rightof appeal against bad decisions based on inadequate investigations.

All of these remedial processes are biased against complaintsin favour of businesses, and should not be. These weaknesses bring thebona fides of the proposed legislation as genuine co-regulationinto question.

2.4. The need for consistent and accessible privacylaw

However, the Privacy Act needs the benefit of occasional interpretationby the Courts on serious issues, and the Privacy Commissioner's decisionsshould also be subject to appeal where the issue is important enough. Aright of appeal is unlikely to lead to a flood of cases.

3. Publication of Code decisions - avoiding secretjustice

3.1. Formal determinations

It is of vital importance that the way in which Code authoritieshandle complaints, and particularly how they decide the most importantcomplaints - those that go to a full formal determination. This informationneeds to be available to potential complainants, to their advisers, andto those generally interested in the way in which the law is being interpretedby Code bodies.

If there is not full access to determinations, then there is notransparency of the Code process and no guarantee of its integrity.

Recommendations

(ii) s18BB should require determinations by Code authorities tobe provided to the Privacy Commissioner when made, and for the Commissionerto publish them. Complainants should be anonymised where necessary.

3.2. Informal mediation

Recommendations

(ii) The Code authority should provide a copy of these summariesto the Commissioner at least annually, for publication by the Commissioner.Publication via Internet, and a copy available on request from the Commissioner'soffice, will be sufficient.

4. Unjustified exemptions

4.1. Flaws in the 'small' business exemption

I will concentrate on how the exemption will be abused to provideexemptions to big businesses, and how it will also operate unfairly toprejudice the interests of small businesses that wish to protect privacy,and will put at risk the privacy-protective efforts of industry associations.

How big businesses can rort the 'small' businessexemption

This potential for the rorting of the Act takes several stepsto explain:

• A 'small business operator' (not a 'small business') is the entity exemptedfrom the operation of the Act, because 'organisation' does not includea 'small business operator' (s6C). Since only 'organisations' (in the privatesector) are obliged to comply with the Act, small business operators ('SBOs')are therefore exempt from complying with the Act.
• The definition of a 'small business operator' says a SBO 'carries on oneor more small businesses' (s6D(3)(a)). A SBO could therefore carry on anumber of businesses, let's call them 'YourInfo (Marketing)', 'YourInfo(Sales)' and 'YourInfo (Collections)'.
• The exemption as a 'small business operator' is lost if any of the businessesof a SBO 'discloses personal information ... to anyone else for a benefit,service or advantage' (s6D(4)(c)). The loophole is that disclosure of personalinformation between any of the businesses run by the SBO is not disclosure'to anyone else', it is just disclosure to the same SBO (the fact it isbetween different businesses is irrelevant). Similarly, the collectionof information from the other business does not cause the exemption tobe lost because it is not collection 'from anyone else' (s6D(4)(d)).
• The different businesses run by the SBO can use the personal informationreceived from the other businesses for any purpose they like, because onlydisclosure, not use, can cause loss of the exemption.
• This is so even if the use is completely unrelated to the purpose of collection,and if the information used is inaccurate, irrelevant, incomplete etc.The individuals concerned have no rights of access or correction.

How to increase the sale value of a small businessby privacy-invasion

This argument also takes a couple of steps:

• Many small businesses will hold personal information (often about theircustomers) which could be misused for purposes for which it was not providedby combining it with other personal information held by other businesses.However, the small business cannot do this, because it would involve disclosureof the information to someone else, which would cause loss of SBO statusfor both the disclosing business (s6D(4)(c)) and the collecting business(s6D(4)(d)).
• At face value, the value of the small business will therefore not includeany component based on the commercially valuable disclosure and use ofthis personal information, because such disclosure is illegal.
• However, any SBO who buys the small business in question that has the valuablepersonal information (as opposed to buying the information) can immediatelyshare all of this personal information with its other small businesses.The combining of the information held by all the businesses is now withinthe privacy-free zone.
• Because of the so-called small business exemption, the sale value of abusiness that holds personal information can therefore be higher than itsvalue as a stand-alone business, because what would be an illegal invasionof privacy by a stand-alone business (even a small business), becomes perfectlylegal when one 'small' business buys another.

The 'small' business exemption will hurt smallbusinesses and industry associations

A business that wishes to protect privacy therefore cannot even saythat it complies with the Privacy Act without being in danger of falseand misleading conduct through implying it is bound by the Act.

Many businesses with a turnover of less than $3M are involvedin international e-commerce via the Internet. Successful Internet businessesare not necessarily big businesses. They may make extensive use of personalinformation, particularly concerning their customers, without buying orselling personal information. It is likely that Australian 'small' businesseswill be excluded from any finding of 'adequacy' by the European Union,and will therefore be excluded from receiving any personal informationfrom EU countries. Similar exclusions are likely under laws of regionaljurisdictions which have data export prohibitions, such as Hong Kong. Moredetails are provided below.

Where a business is in an industry which has a Code under theAct, it cannot even participate fully in the industry Code, because anycomplaints against it will not be able to be dealt with by use of proceduresunder the Act (including enforcement of determinations, referrals to theCommissioner, administrative review etc).

Similarly, any industry associations which have as members any businesseswithin the definition of 'small business operator' and have an industryCodes will be at risk of false and misleading conduct unless all informationand publicity about the Code stresses that the legally significant aspectsof the Code only apply to those of their members with turnover of lessthan $3M (and how will the public know who they are?).

This exemption therefore harms those small-ish businesses, andindustry associations, that wish to protect privacy by refusing them thereputational and trade benefits that compliance with the Act provides.

Appropriate measures to safeguard small businessinterests

Recommendation

The Privacy Commissioner should be required, before the Bill comesinto force, to make a Public Interest Determination concerning small businesses,for the purpose of modifying the NPPs to the extent necessary to ensurethat a simplified and less onerous set of privacy obligations applies tothose small businesses where lesser obligations are proportionate and appropriateto the lesser risk to privacy of their business operations. Such a Determinationshould be reviewed periodically by the Commissioner as the need arises.

The Commissioner should be required to take the modificationsto the NPPs into account in the development of all industry Codes, to ensurethat such Codes have appropriate provisions for small businesses.

Such a requirement on the Commissioner would ensure that appropriateallowance is made for small businesses, based on the Commissioner's expertisein the NPPs and how they will be administered, while at the same time preservingthe benefits of privacy protection both for businesses and consumers.

4.2. A better political parties 'exemption'

The blanket exemption in the Bill is completely unnecessary toaddress that problem. All that is needed is to remove the Privacy Commissioner,and the Act, from the heat of the electoral process.

Recommendation

Where a complaint under the Act is made against a political party (oran associated body), the following procedure should apply:

• Once writs have been issued for any election in which that political partyhas candidates, the Privacy Commissioner shall immediately cease to investigateany such complaint.
• Once the poll is declared for all seats in which the political party hascandidates, the Privacy Commissioner will resume investigation of any suchcomplaint.

4.3. The employment exemption

• Public sector employment information are already covered by the PrivacyAct (and this has not caused problems), so the exemption of private sectoremployees is discriminatory.
• The workplace relations legislation does not cover many of the privacyprotections provided by the NPPs.
• If such an exemption is included, it is unlikely that Australian employerswill be able to obtain employment information from European employers.

5. Will the Privacy Act be 'adequate' for EU purposes?

5.1. Uncertainty about the meaning of 'adequacy'

A realistic assessment of the likely 'adequacy' of the AustralianBill must therefore await the outcome of the A31 Committee's deliberationson the Safe Harbor proposal, and this is unlikely to be possible duringthe Parliamentary passage of this Bill. The safest course, given the importanceof satisfaction of the EU standard, is to address deficiencies in the Billwhich are likely to cause problems with an EU finding of 'adequacy'.

5.2. Problems with the Bill's 'adequacy'

• Lack of extra-territorial protection for EU citizens - Section 5Bonly extends the protection of the Act concerning extra-territorial practicesof Australian businesses to benefit Australians, and therefore cannot beused to protect citizens of EU countries. NPP 9 dealing with transborderdata flows does not operate to prevent the transfer of the informationby an Australian business to its own branch operating overseas, becausethis is only a transfer to itself (and s5B would normally apply to extendthe protection of the Australian Act). There is therefore a loophole inthe Bill whereby an Australian company could import personal informationon EU citizens, but could then export it outside Australia to a countrywith no privacy law but without the Australian Act applying.
• Lack of correction rights for EU citizens - The existing approachin s41(4) which prevents anyone other than Australian citizens and permanentresidents from exercising correction rights (IPP 7) is extended to theprivate sector (NPP 6 and equivalent provisions in Codes). As with theprevious example, this provision prevents against EU citizens obtainingthe same benefits as Australians from our privacy law, and is contraryto the EU objective in the notion of 'adequacy' that their citizens shouldbe protected by (adequate) local laws wherever their information is used,in the same way that the privacy of local citizens is protected.


New Zealand's Privacy Commissioner recently proposed that the NZPrivacy Act 1993 be amended to ensure that non-citizens have all rightsunder the Act, in order to ensure adequacy under EU law and that of otherjurisdictions such as Hong Kong. The Australian Bill is failing to do this.

• Generally available publications - The broad exemption in the Actfor information in a "generally available publication"[1],irrespective of whether the information came to be included in the publicationin breach of the Act, may cause problems, as the A29 Committee noted asimilar deficiency in the Safe Harbor principles.
• 'Small' businesses - There is no equivalent in the EU Directivefor an exemption for 'small' businesses (or in the Safe Harbor proposals).At best, this is likely to result in an A31 Declaration that expresslyexcludes exempt Australian 'small' businesses from its coverage. However,the resulting difficulties involved in an EU business knowing whether anyAustralian business was covered by the Act could lead to the type of proceduralcomplexities that legislation was supposed to avoid. There is no provisionfor 'small' businesses that wish to be bound by privacy law so as to beable to import personal information from Europe to opt in to being coveredby the Act. They would have to resort to some artificial device such asbuying or selling personal information so as to lose their exempt statusunder the Act. But how would the EU exporter be satisfied of this?
• Employment information - There is no equivalent general exemptionin the EU Directive, and this is likely to lead to any A31 Declarationexcluding any transfer of employment-related information. The A29 Committeewanted such an exclusion of employment information made explicit in theSafe Harbor proposal because the US Commerce Department did not have jurisdictionover such information. If there is such an exclusion, a European companywould not be able to export employee data to a branch of its own companyin Australia because the Australian company cannot 'opt in' to be coveredby the Act in relation to its employment information.
• Weak control over onward transfers - As discussed later, two ofthe conditions under which personal information can be exported from Australiaunder NPP 9 are much weaker than anything found in the Directive. The A29Committee has consistently identified controls over onward transfers asone of the key elements of 'adequacy', so this may also cause difficulties.

6. Other recommendations

6.1. Related corporations

Normally this exchange of information between related corporationswill not matter so much, because the recipient corporation will still haveto satisfy one of the conditions of NPP 2 before it can use theinformation (see NPP 2.3 which clarifies this). The use would have to bewith the consent of the individual, or as authorised by law, or with similarlyserious justification.

However, there is two exceptions to this:

• NPP 2.1(c) allows the information to be used for direct marketing purposesby the related corporation even though such use is contrary to the individual'sreasonable expectations at the time of collection of the information, providedthe individual is given the opportunity to opt out.
• Where information is used in a non-identified form, NPP2 may be irrelevant.The extent to which the related corporation may be able to use a de-identifiedform of the information, merged with other information it holds, to createprofiles of Internet usage and to customise user interactions in a waythat falls outside the Act's definition of 'personal information' is uncertain.

Recommendation

Alternatively, s13B should state that it has no application toNPP 2.1(c) (direct marketing contrary to the individual's reasonable expectationsat the time of collection).

6.2. Inadequate definition of 'personal information'for cyberspace

In the article I concluded:

The approach of this definition misses the point to some extent.Information about, say, the interests, understanding or consumption habitsof a particular person can be aggregated by an internet service provider(or providers), by use of e-mail or machine addresses, for purposes suchas e-mailing customised direct marketing materials to that address, orto customise the appearance of a web page so as to appeal most to requestswhich come from a particular machine address. It makes no difference whetherthe ISP can 'reasonably ascertain' the identity of the person who is associatedwith either the e-mail address or the http request, because the informationabout their consumption habits has been aggregated and used to market backto them, without them necessarily being aware of this or having consentedto it. More serious consequences may also follow from such aggregation,such as decisions to limit access, or to deny some goods or services. Ifthe definition of 'personal information' excludes such activity, IPPs willbe very weak in cyberspace.

Recommendation

6.3 Transborder data flows (NPP 9)

If one of the conditions is satisfied, then the Australian organisationwhich transferred the data does not have any liability under the Act forany privacy breaches which may occur subsequently. It is therefore important,from the individual's point of view, to ensure that the conditions do notallow transfers which create unjustified privacy risks.

All of the publications by the A29 Committee of the EU have interpretedthe 'adequacy' requirement of the Directive as requiring some such 'onwardtransfer' restriction, so this will be an aspect of the Bill that the EUlooks at carefully.

Condition (a) plays the role of A25 of the Directive (which allowstransfers to foreign countries with 'adequate' laws), but is weaker.

(a) the organisation reasonably believes that the recipientof the information is subject to a law, binding scheme or contract whicheffectively upholds principles for fair handling of the information thatare substantially similar to the National Privacy Principles.

Conditions (b) - (e) are similar to those in A26(1) of the Directiveand largely uncontentious.

Condition (f), however, is much weaker than anything found inthe Directive:

(f) the organisation has taken reasonable steps to ensure thatthe information which it has transferred will not be held, used or disclosedby the recipient of the information inconsistently with the National PrivacyPrinciples.

The subjective and imprecise nature of condition (a), and theweak and imprecise nature of exception (f), means that there is real dangerthat personal information will be exported from Australia under conditionswhich give little protection to privacy.

The EU may well regard these two aspects of NPP 9 as inadequateprotection for EU citizens.

Recommendation

WorldLII: Copyright Policy | Disclaimers | Privacy Policy | Feedback
URL: http://www.worldlii.org/int/other/PrivLRes/2000/3.html