10 Nov 2011
Gone fishin': The Privacy Act as another means of attack
by John Carroll, Steven Klimt
The Privacy Act can be used as a fishing expedition for potential plaintiffs.
More and more, we're seeing the access provisions in the Privacy Act 1988 (Cth) used as an another means of attack, rather than as an end in themselves – for example, disappointed job applicants might want to see why they were unsuccessful, and then use that information for litigation. A recent high-profile case, Smallbone v New South Wales Bar Association  FCA 1145, is a clear example of this growing tend.
It also gives some useful guidance on when access can be limited because it would have an unreasonable impact upon others' privacy.
The application for Senior Counsel and the Privacy Act
Mr Smallbone applied to the NSW Bar Association to become a Senior Counsel. The Bar Association has a Consultation Group and the Judicial Consultation Group which give their feedback on each applicant.
Concerned by the process, Mr Smallbone sought access under section 98 of the Privacy Act to the information collected on him as part of the Bar Association's consultation process, which includes forms filled in by individuals assessing his readiness for silk, and statistical analyses of these answers.
Mr Smallbone said that he might want to exercise the right to:
request that corrections be made to information the Bar Association holds that was collected in considering his application for appointment as Senior Counsel in 2011; or
require that a statement be associated with that information where he did not agree that the information is accurate, complete or up-to-date.
He also asked for an injunction to stop the Bar Association from processing his application until he had reviewed the information. Unless this was done, he said, his rights under the Act would be rendered nugatory.
The Bar Association declined to give him access on the basis that to do so would have an unreasonable impact on others' privacy, as set out in National Privacy Principle 6(1)(c).
How was the information collected?
This information was collected from members of the Consultation Group and the Judicial Consultation Group under a Protocol which stated, among other things, that it "will not be used or disclosed for a purpose other than the selection of Senior Counsel and the giving of counselling by the President to unsuccessful applicants."
What's an unreasonable impact upon the privacy of others?
There is no dispute that the information or Bar Association are covered by NPP 6. As Justice Yates said, the only real issue is the extent to which NPP 6.1(c) applies to limit Mr Smallbone's right of access to that information. Under NPP 6.1(c), access to the information must be provided except to the extent that it would have an unreasonable impact on the privacy of others.
Neither NPP 6.1(c) nor the Act defines privacy. Justice Yates said it "would comprehend and include an individual’s expression of opinion that was proffered so as to be confined to or intended only for the person or persons to whom the opinion was expressed".
Whether providing access to the information would have that unreasonable impact is essentially a matter of practical judgment having regard to all the circumstances of the case. Some helpful considerations were set put in C v Insurance Company  PrivCmrA 3, but they're not the only ones:
- Whether the individual would expect that his or her information would be disclosed to a third party, including whether an assurance of confidentiality was provided.
- The extent of the impact on the individual’s privacy.
- Whether any public interest reasons for providing access to the information outweigh any expectation of confidentiality.
- Whether masking the identifying details of the third parties would sufficiently protect the privacy of these individuals.
- Another relevant consideration is the nature of the information that is held by the organisation and the form in which that information is held.
Why did the Court give him limited access?
Here, the information was provided on the basis it would remain confidential, and members of the Consultation Group and the Judicial Consultation Group did not proceed on the basis that any information that they provided as individuals would be provided to any applicant for appointment, whether as part of a counselling session or in an endeavour to fill a gap in the Selection Committee’s knowledge or to help resolve an issue about an applicant.
Disclosing their identities (or certain identifying facts) would have an unreasonable impact upon their privacy. But that wasn't the end of the matter. That information could be redacted, while allowing Mr Smallbone to see the other information provided. Access in that form was ordered, and the Bar Association was also ordered not to proceed with his application until after he has been granted appropriate access to the information.
What should businesses do?
This trend of using the Privacy Act in this way will only grow as more plaintiffs and potential plaintiffs become aware of it. Businesses need to take two lessons away from this:
- first, the Privacy Act can be used as a fishing expedition for potential plaintiffs. While this means they do not have to use discovery processes, which have their own limitations, the Privacy Act route does limit them to information about themselves. There is a specific exemption under NPP 6 relating to discovery (NPP 6.1(e)) which precludes production of information that would not be accessible by the process of discovery, although it is questionable what exactly falls within this exemption;
- secondly, there are exceptions to the rule of general access, and courts will (as in this case) attempt to craft an access regime taking these into account, and not simply refuse any access.
You might also be interested in ...