Online Privacy Bill and Privacy Act Discussion Paper: Increased Enforcement Risk and Regulatory Change

Query

“Query” icon is for items previously considered in the ACCC’s Digital Platforms Inquiry (DPI Report) or Australian Law Reform Commission Report 123 released in June 2014, Serious Invasions of Privacy in the Digital Era (ALRC Report).

Alert

“Alert” icon is for items not subject to previous discussion

1. Issue infringement notices or seek criminal penalties

New powers to issue infringement notices or seek criminal penalties in the event of repeated non-compliance with notices to produce information and contained in the Exposure Draft.

2. Undertake public inquiries

The Discussion Paper suggests new powers to undertake public inquiries as directed or subject to Ministerial approval (akin to the ACCC’s powers).

3. Introduce a new funding model 

a new funding model, including the imposition of levies on entities which operate in a high privacy risk environment.

4. Discuss alternative regulatory models.

alternative regulatory models, including the separation of complaints handling from enforcement.

5. Review or remediation

New powers to issue infringement notices or seek criminal penalties in the event of repeated non-compliance with notices to produce information and contained in the Exposure Draft.

6. Increased civil penalties for serious and repeated interferences with privacy

This would increase to $10m, three times the value of the benefit obtained or 10% of domestic annual turnover, bringing the regime in line with existing civil penalty regimes, such as under the Australian Consumer Law.

7. Proposed introduction of a civil penalty and infringement notice regime

The proposed introduction of a civil penalty and infringement notice regime for lower level interferences with privacy. 

This suggests a desire to pursue less serious breaches as part of driving overall compliance.

8. Potential direct right of action

Introduction of a direct right of action. 

A direct right of action would allow individuals to bring claims against APP entities for breaches of the Act.

The introduction of this right would represent a step change in exposure for organisations and privacy class action risk, which has emerged in a significant way in other jurisdictions. Given privacy incidents often affect a very large number of individuals, even if there is only non-financial loss or nominal damage, the overall quantum may be significant.

Allied to that would be greater judicial consideration and clarification of privacy legislation.

The Discussion Paper notes the potential for an overwhelming number of claims if a direct right of action were to be implemented, and so proposes requirements for the complainant to make a complaint to the OAIC and attempt conciliation, before being able to seek leave from the Federal Court to commence proceedings.

At this stage, no threshold of seriousness is proposed before direct right of action claims could be brought. The Discussion Paper notes that further issues regarding the use of class actions will be addressed in the separate and ongoing consideration of the class action regime by the Parliamentary Joint Committee on Corporations and Financial Services.

As the Discussion Paper does not provide a definitive recommendation on the form the statutory tort may take, the consequences of such a model is unclear.

9. Potential statutory tort of privacy

Introduction of a statutory tort for serious interference with privacy

Similarly, the introduction of a statutory tort has the potential to change exposure for organisations. Multiple models of statutory tort are raised for consideration – as the form of the tort informs the extent of the exposure, the response to the suggested options will be a key area to watch. Unlike the direct right of action, a statutory tort may allow individuals to bring claims for breaches of privacy falling outside of the provisions of the Act.

The Discussion Paper noted the model of statutory tort recommended in the ALRC Report, which limits the circumstances where claims may be brought, contains a seriousness threshold and allows for damages for non-financial loss such as emotional distress, as well as damages for financial loss or other remedies.

In noting criticisms of the ALRC Report, the Discussion Paper ventilates alternate models employed by other jurisdictions. This includes a minimalist statutory tort, allowing the common law to develop as required and actions in equitable breach of confidence.

10. Extending the scope of orders made by the Federal Court

Enabling the Federal Court to make any orders it sees fit following a serious or repeated interference with privacy.

This may include ordering companies to take steps to ensure such conduct is not repeated or continued, take action to redress the complainant’s loss or damage or pay compensation.

This proposal intends to prevent the OAIC from having to make a separate application after the conclusion of the civil penalty proceeding.  

Our more detailed outline of the reforms is provided below.