Recent cases: Is there fragmentation of Australia's public sector privacy laws? Professor Graham Greenleaf UNSW Faculty of Law - 22 May 2003 NSW Freedom of Information and Privacy Practitioners Network

Public sector privacy laws Variations so far Commonwealth / ACT - IPPs NSW - NSW IPPs Vic & NT (and private sector) - NPPs Superficial similarities in aims All based on life-cycle of information Significant differences in details Little case law except new NSW cases - major differences already emerging

Examples and recent cases Collection from the data subject DO v University of New South Wales [2002] NSWADT 211; [2003] NSW ADTAP 9 Consent exception- express or implied FM v Macquarie University [2003] NSWADT 78 FM v Macquarie University Minimal collection - anonymity Wykanak v Dept Local Govt [2002] NSWADT 208 Wykanak v Dept Local Gov FH v NSW Dept Corrective Services [2003] NSWADT 72 FH v NSW Dept Corrective Services Are records required before Acts apply? FM v Macquarie University [2003] NSWADT 78 FM v Macquarie University

Collection from the data subject Some laws require collection from the data subject, but they differ considerably Cth IPPs impose no obligation to do collect from the individual, no consent needed to collect from 3rd Ps NPP 1.4 requires collection only from individual ‘if it is reasonable and practicable to do so’ NSW s9 requires collection directly from individual unless NSW s9 3rd P collection is authorised by the individual; or Provided by parent/guardian if under 16 DO v University of New South Wales [2002] NSWADT 211 UNSW did have authorisation to collect from 3rd Ps Iillustrates risks under NSW Act It is OK to ‘double check’ with a 3rd P - collection from both

Consent exception Cth IPPs and NPPs - implied consent ‘express consent or implied consent’ (Cth PA s6, also Vic) Consent must also be informed ( meaning of ‘consent’) Can consent be implied from failure to opt out? NSW s26(2) requires express consent Failure to opt out could never be good enough FM v Macquarie University [2003] NSWADT 78 FM v Macquarie University Consent to UNSW to collect transcript from UNSW was implied consent to Macquarie to disclose it, but that is not express consent Cf NZ requires ‘authorization’ NZ Courts (L v J, L v L) have held this includes implied authorizations (see Roth article)

Minimal collection - anonymity NPP 8 - ‘Wherever lawful and practicable, individuals must have the option of not identifying themselves when entering transactions with an organisation’ - no direct NSW equiv. Is it a breach to build systems which make anonymity impracticable? Does NPP8 require anonymity to be ‘designed in’? FH v NSW Dept Corrective Services [2003] NSWADT 72 - FH v NSW Dept Corrective Services Equivocal on whether breach of security principle where it would cost millions for Dept to change system to log accesses Wykanak v Dept Local Govt [2002] NSWADT 208 (summary) Wykanak v Dept Local Govsummary ADT could not review a complaint of an anticipated breach of a NSW IPP Compare Cth IPPs or NPPs - s98 Injunctions available where ‘a person … is proposing to engage in any conduct that … would constitute a contravention of this Act’Cth IPPs or NPPs - s98 Injunctions

'Records' / 'documents’ Significance in Commonwealth Privacy Act Cth IPPs all require information in ‘records’ or a ‘generally available publication’IPPsrecords NPPs don’t, but s16B has same effects16B One of the dividing lines between information privacy and surveillance laws Problems - compare Cth and NSW results Interview with no notes taken CCTV with no film Listening device with no recording

'Records' / 'documents’ (2) Other jurisdictions requiring records / documents Victoria S3 definition ‘personal information’ - ‘means information … that is recorded in any form …’ Northern Territory S4 definition ‘personal information’ means ‘government information from which …’ S4 definition ‘government information’ means ‘a record held …’ Hong Kong s2 definition 'data' is only 'any representation of information, in any document'. 'document' includes disks, film etc from which visual images or other data are 'capable...of being reproduced’

'Records' / 'documents’ (3) New South Wales - the odd one out S4 defn ‘personal information’ means ‘information or an opinion (….whether or not recorded in a material form) …’ - cannot imply a record from the definition NSW IPPs all refer to ‘personal information’ (contrast Cth IPPs require ‘in a record’) No equivalent to Cth s16B re NPPs All NSW IPPs therefore apply to all personal information whether or not it is ever recorded IPPs only require that agency must ‘collect’ or ‘hold’ personal information

'Records' / 'documents’ (4) FM v Macquarie University [2003] NSWADT 78 FM v Macquarie University Hennessy Dep P (on appeal) S18 breach by Macq’s disclosure to UNSW of information in 2 telephone conversations Information was observations of FM and opinions about him The information was never recorded by Macq Held - Was ‘personal information’ even though FM’s behaviour was observed by others Held - Info was ‘held’ in the mind of Macq staff s4(4) defines ‘held’ as ‘possession or control’ ‘Possess’ must include ‘in the mind’ for non-material information Order - Macq staff must not disclose any information in their minds about students, unless s18 exemption applies