Kirby, Michael --- "Privacy Today: Something Old, Something New, Something Borrowed, Something Blue" [2017] JlLawInfoSci 1; (2017) 25(1) Journal of Law, Information and Science 1

Privacy Today: Something Old, Something New, Something Borrowed, Something Blue^[*]

THE HON. MICHAEL KIRBY AC CMG ^[*]

Abstract

The author was the Chair of the OECD Expert Group (1978-80) that drafted the OECD Guidelines on Privacy. He describes developments in privacy law and protection over the past 40 years by reference to the marriage tradition ‘Something old, something new, something borrowed, something blue’. The ‘Old’ is the foundation for privacy protection in international human rights law beginning in the Charter of the United Nations in 1945 and Universal Declaration of Human Rights 1948. The ‘Borrowed’ is the source materials for the OECD initiative derived from early laws in Nordic and other European countries. The ‘New’ is the Guidelines themselves. Here the author describes many of the key personalities and controversies that played a part in the development of the Guidelines. The ‘Blue’ includes the disappointments and failed attempts to update the Guidelines since 1980. The article concludes with the establishment of the new Special Rapporteur on the right to privacy of the UN Human Rights Council (2015) and the challenges and fresh opportunities which this new global mandate offers.

1 Privacy Protection: Making Progress

Privacy is a universal value. It arises from essential attributes of our human nature. It is included in the Universal Declaration of Human Rights (‘UDHR’).^[1] It is also provided for in the international treaty law that soon followed.^[2] As a small boy, attending kindergarten in Sydney, Australia, I was lined up to watch Eleanor Roosevelt drive past my school. She was on her way to open a veterans’ hospital in Concord, a suburb of Sydney. Later she was to chair the committee that produced the UDHR. Later still, in the 1980s, I served in the International Commission of Jurists with Professor John Humphrey of Canada. He had been the head of the UDHR Secretariat. It was he who first wrote the splendid opening words of the UDHR: ‘All human beings are born free and equal in dignity and rights. They are endowed with reason and conscience and should act towards one another in a spirit of brotherhood.’^[3]

And of article 12: ‘No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks on his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks.’

As a schoolchild I was taught how the UDHR had emerged after the ‘great and terrible war’, then recently concluded. I was instructed in its language and in an understanding that, for the avoidance of the repetition of wars, it was necessary to build the foundations of peace in mutual respect for universal human rights. My life has often involved me in the pursuit of these interactive goals.

Although the new information technology that has arisen since those days has provided many challenges for the protection of individual privacy, scholars, officials and citizens have continued to demand effective protection for the privacy of individuals. This has been especially so in Western Europe, where memories persisted of the use that could be made of personal information, often literally a matter of life or death, that had supported tyrants and oppressors. In the United States of America, the culture of individual rights and liberty encouraged the development of an implied constitutional right to privacy.^[4] In Europe, privacy protection commissioners, information commissioners and other guardians were appointed to update the law. They regularly met to exchange information and ideas.

Even in the region most important to Australasia (Asia, the Pacific and Oceania), laws were developed for the protection of data privacy, a fact explained in his magisterial study by Professor Graham Greenleaf, Asian Data Privacy Laws.^[5] Stimulated by trade law and data exchange requirements, even that region witnessed a remarkable proliferation of privacy and data protection laws emerging from lawmakers in Hong Kong in the east to India and Pakistan in the west.^[6] Although sometimes giving the impression of merely ‘paddling’ in the one spot,^[7] the Asia Pacific region has not stood still. Part of the reason for this has been the borrowing of protective principles and mechanisms from other parts of the world, which had adopted legal protections earlier.

I am not now directly involved in the controversies of privacy protection. I watch them from afar. For this review, borrowing the idea from a wedding tradition, I will offer ‘something old, something new, something borrowed and something blue’, although not necessarily in that order.

In a sense, I was present at the creation, or at least soon after the creation, when effective privacy protection principles and laws came first to be developed. I may not be able to offer significant insights into all the ongoing controversies of privacy protection today. However, by looking back to the origins, to the events that stimulated the need for privacy protection laws, I may be able to provide a reminder of the central concepts. Many of them still remain true. If we keep the main concepts clearly in mind, the machinery for their protection may be easier to fashion and develop as changing needs oblige.

I congratulate the Asian Privacy Scholars’ Network (‘APSN’). Its existence continues and enlarges the remarkable efforts in data privacy protection described by Professor Greenleaf. APSN’s work is an antidote to the UDHR-defying assertions of some local autocrats and sceptics who argue that privacy (like women’s rights, children’s rights, LGBTI and other rights) are notions of western states and Caucasian peoples only, not likely to take root in the more communitarian soil of Asia and the islands, great and small, of the Pacific and Oceania. This Network and its detailed scholarship demonstrate that these assertions are not true. Moreover, they are dangerous.

2 Something Borrowed: Nordic & European Initiatives

In the design of information privacy laws, Australia, New Zealand and other countries borrowed the basic principles to govern their national privacy regulations from the Organisation for Economic Co-operation and Development Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (‘OECD Guidelines’).^[8] These, in turn, had been borrowed from the report on privacy of the Australian Law Reform Commission (‘ALRC’), of which I was then chairman.^[9] Indeed, as Greenleaf’s compendium shows, those Guidelines have been utilised throughout Asia and in the majority of jurisdictions that have enacted data privacy laws.^[10] Nor did the borrowing begin or end in that source. To explain how it happened, it is necessary to go back to the formation of the Expert Group on Transborder Data Flows and the Protection of Privacy established by the Organisation for Economic Co-operation and Development (OECD) in 1978. How did I, a comparatively newly appointed Australian judge, become the chair of this important body? What was the background of expertise and knowledge that I brought to that task? Does its work have any lessons for us today?

Privacy was, it is true, a social value that I cherished back in the 1970s. Just before that decade opened, approaching the grand age of 30, I had ventured into a personal relationship first with a Spaniard (Demofilo Solera) and then, when Demo unkindly abandoned me, with a partner from the Netherlands (Johan van Vloten). In those days the criminal law in many countries, including in Australasia, exposed gay men to criminal prosecution. Accordingly, such relationships had to be kept very private. Ironically, it was the very notion of a right to privacy that was later to be invoked by courts^[11] and United Nations committees to invalidate such criminal laws.^[12] However, as the 1970s opened, such changes lay in the future. By one of the strange ironies of life, the venue at which the APSN conference was hosted in Auckland, was the same hotel, then named the Hyatt Hotel, where my Spanish partner and I stayed exactly 48 years ago, in December 1968.

It was my partner Johan, whom I met in February 1969, who lived with me protected by notions of privacy when I was appointed in January 1975 as inaugural chairman of the ALRC. However, the dismissal of the Whitlam Government by the Governor-General of Australia in November 1975 opened the possibility that the ALRC would be wound up.

In the Australian federal election campaign of December 1975, the caretaker Prime Minister (Mr Malcolm Fraser) included in his party’s policy speech a promise that, if returned to government, the ALRC would receive a reference from the Attorney-General (later Mr Robert Ellicott QC) to develop new laws for the protection of privacy in Australia. This was a far-sighted proposal. It tapped the concerns of many Australians about the erosion of privacy as a consequence of new information technology. The commitment indicated that the future of the ALRC was secure. Issues concerning privacy had lately been raised by a distinguished academic lawyer, Sir Zelman Cowen, in his Boyer Lectures on the subject.^[13] Cowen was later to be appointed a part-time commissioner of the ALRC. His subsequent elevation to Governor-General brought the Commission into the very heartland of Australian institutional respectability. The Commission embarked on its enquiry into privacy protection in Australia. That enquiry coincided with developments that were occurring in many jurisdictions overseas.

The Australian enquiry on privacy could not be divorced from those global developments. The first national laws on data protection had been enacted in Scandinavia.^[14] They followed conceptual work that had been undertaken earlier in the Nordic Council of the Scandinavian states. This, in turn, stimulated activities in the Council of Europe which later led to binding Conventions, adopted by that body, expressing rules to govern automated and non-automated data systems.^[15] The European Economic Community also began to concern itself with these issues, partly out of an anxiety that disparate approaches to privacy protection might be enacted that would reduce market efficiencies and result in unnecessary costs.^[16]

At the time the ALRC began its investigation into privacy protection in Australia, a lot was therefore happening, especially in Europe. Considering the commonalities of the new information technology, it was decided to send the Secretary of the ALRC, George Brouwer, to attend a conference on the legal issues of privacy protection held in Vienna in 1977. He returned to the Commission with the strong opinion that Australia should develop its law with an atypical attention to these international developments. This was not an unusual perspective for him. He was a rare antipodean public official who had graduated from the École Nationale d’Administration (‘ENA’) in France. It was the training ground for the leading officials of France and of Europe. It encouraged a conceptual and multinational approach to new legal and administrative challenges.

In part in consequence of George Brouwer’s advice, when it was announced that the OECD intended to commence its own investigation into privacy issues, the suggestion was made through the Federal Attorney-General’s department to the Treasury that I should be nominated to participate in the OECD’s work on behalf of Australia. This was agreed. That work was planned to commence at the OECD headquarters in Paris in 1978. The expert group thereafter ordinarily met in Paris in underground, windowless meeting rooms in the modern post-War building that housed the OECD secretariat. This was where the international meetings occurred that hammered out important OEDC policy documents. Most such reports related to economic issues for which, inferentially, a dungeon meeting room was deemed adequate, if not appropriate. Occasionally, when a grand meeting was called, the expert group would be summoned to one of the beautiful salons of the adjoining Château de la Muette, with its chandeliers and mirrored walls.

3 Something New: OECD Guidelines On Privacy

The OECD in 1978 was essentially the global association of established western democracies. At that time, it was smaller than it is now. It comprised 24 member states: Western Europe, the United States of America and Canada, Japan, Australia and New Zealand. These were the nations that shared democratic parliamentary traditions; the rule of law; and independent judiciaries. They also upheld market economies. They shared a great deal of economic and social data of use to politicians, governments and bureaucrats in the member countries.

Being smaller in size, with fewer members and more commonalities, there was a marked contrast between the OECD meetings in Paris that I attended in the 1970s and those of United Nations agencies (including UNESCO in the same city) with far greater diversity of membership, politics, economic organisation and values. In a United Nations agency it would have been likely that the election of the chairman of an expert group would have been decided well in advance of the first meeting. However, in the OECD, spontaneous democracy and efficiency were the way things were done. When the expert group convened in Paris for the first time, nominations were called for. I suspect that I was favoured, in part, because of my judicial status and, in part, because I constituted something of a compromise between the suspected viewpoints of the major political combatants. These were France, which favoured the strong data protection model that had been copied from the Nordics and embraced by the Council of Europe (based in Strasbourg and in some ways reflective of French values). And the values of the United States of America (with its constitutional and political commitments to free flows of information and with its economic attachment to avoiding restrictions on the already burgeoning US informatics industry arising in Silicon Valley in California). The Americans did not want a European chair. The Europeans did not want a North American. I was elected.

My years in student activities at university, chairing meetings, often with heated and passionate agreement and disagreement, stood me in good stead in chairing the OECD expert group. It comprised a remarkable collection of experts, many with more than a decade of experience in aspects of what most of them already described as ‘data protection’. The secretariat of the expert group was headed by a long time officer of the OECD, Hans-Peter Gassmann. He was a highly talented German national who had already lived in France for more than a decade. He had raised his family there. His first language was German; but he also spoke perfect French and English, and switched effortlessly between them, as did most other European members of the group. He was fully conversant with the technology of informatics; aware of the economic implications of computers for the OECD countries under contemporaneous discussion elsewhere in the Organisation; and determined to chalk up a consensus document that would be more influential than the European Conventions because it extended beyond Europe to the non-European Anglophone countries and Japan. He was as efficient as he was ambitious.

Dr Gassmann surrounded himself with a small, talented group of advisors for this project. They included Professor Peter Seipel. He was a young Swedish professor of law specialising in the implications of automated information systems for the law. He was fully conversant with more than a decade of legal and technological developments on this subject in Scandinavia and Europe. In 1977 he had written an important textbook, translated into English: Computing Law: A New Legal Discipline (LiberFörlag, 1977). This had caught Gassmann’s attention and it resulted in his recruitment to our secretariat. Whereas Gassmann could be excitable and occasionally quite emotional, Seipel was calm, reserved and even dour, in the Scandinavian manner. Gassmann came up with an array of suggested solutions to every problem. Seipel would take time to embrace some and to bury others.

They were supported by Miss Alice Frank. She was a United Kingdom national but seemingly earlier a refugee from the Nazi emergence in Europe. She was short, courteous and ever deferential to my judicial status, in the English manner. She spoke English with perfect vowels and was a brilliant drafter. When none of the rest of us in the secretariat could come up with a drafting solution, Alice Frank could be relied on to do so. In recent years, I discovered her living in the South of England, now in her 90s. Telephone conversations with her reminded me of her precision and perfect diction. I have no doubt that she could still find the perfect English word for a troublesome idea. It was an impressive team, well integrated and boasting different capacities.

These were days before the advent of the laptop, not to say the mobile device. Dr An Wang’s astonishing word processor had just come on the market. Gassmann and Seipel took advantage of this early technology. However, in my own case, it was necessary to work without benefit of a computer. Throughout the process, as chair of the expert group, I kept detailed notes of all debates and suggestions of the expert group. Each night I would repair to my hotel, often the Paris Hilton near the Australian Mission. I would summarise points of agreement and disagreement; prepare drafts; and provide them for photocopying and distribution the next day.

Whereas UNESCO meetings in Paris, to my knowledge, always began at least half an hour after the appointed time, the OECD was generally punctual. Its Secretary-General at the time was Emiel van Lennep, a Netherlands diplomat and politician. Anglo-American-Netherlands efficiency dominated its bureaucratic culture. To this, in the expert group, was added the Australian judicial tradition of commencing work exactly at the appointed hour. Almost as a matter of cultural protest, the French delegation to the expert group were invariably slightly late for meetings. They protested at the necessity of having to work on drafts photocopied from the chair’s neatly written English language suggestions from the previous day. In this objection they had a point under the OECD rules. However, the objection was gently noted and the meetings proceeded. Most of the experts spoke English fluently and by preference. Only the French, Belgian, Luxembourg and occasionally the Swiss and Spanish experts made their interventions in French.

Over the life of the expert group 1978−79, on one point of procedure the French delegates prevailed. From the chair, I urged that the meeting should continue beyond 6pm when interpreters conventionally ceased duty. This was tolerated at first for a short time. However, eventually the French delegates objected and, ultimately, walked out. These were days when high sensitivity over the use of the English language in international meetings, including the OECD, was more vociferous than it would later become. At some stage, President Giscard d’Estaing issued an edict to uphold the dignity of la langue Française, effectively prohibiting French officials from continuing if deprived of translation. In the end, I could not overcome this presidential edict.

Nevertheless, despite significant differences between its members, the photocopied notes in clear, printed, cursive writing were, I believe, an important ingredient to the forward movement of the expert group. Many of the participants in the OECD group were graduates from the earlier meetings of the Council of Europe. They had never seen anything like the speedy presentation of minutes of the meetings on the day following each meeting. These summaries added a momentum to the deliberations. They helped to avoid the repetition of arguments that had effectively already been settled. They isolated the important emerging points of difference where compromises were necessary, if the project was to succeed.

One of the most charming of the participants in the work of the OECD expert group was Dr Frits Hondius. He was a national of the Netherlands who, by 1978, was a senior official in the secretariat of the Council of Europe (‘CE’) based in Strasbourg. He had piloted the two new CE Conventions through to adoption. Whilst he was keen to spread their influence through intercontinental operation beyond the borders of Europe, it soon became plain that this would be unacceptable to the United States experts. They saw regulations specifically targeted at automated data as a sword pointed at the United States itself, and its fast growing computing industry. They insisted on an approach in the OECD that was not mechanistically specific as to the medium to be adopted.

In that sense, and somewhat ironically, it was the United States delegation that was demanding a conceptual approach which rose above the technology of the information systems in which personal data was by then increasingly appearing. Generally speaking, French (and continental) lawyers pride themselves on their conceptual thinking. They tend to reject the common law methodology for solving differences as apt for immediate problem solving but lacking a conceptual foundation. It was partly amusing to see members of the OECD group coming at this problem from directions opposite to their normal cultural traditions and habitual positions.

The OECD group was additionally privileged in having outstanding advocates for the competing points of view, on this and all subjects. The leader of the United States delegation was Mr William Fishman. He was a lawyer based in Washington, D.C. His background had been in the complex field of United States telecommunications regulation. He was supported by Ms Lucy Hummer. She was an officer of the State Department, also from Washington. Whereas Fishman brought to his thinking a deep knowledge of the technology we were dealing with, Hummer never strayed far from the script written by the State Department. Unsurprisingly, this was designed to prevent the imposition on the United States or its allies of what was seen as a heavy handed European-style bureaucratic supervision of the informatics industry. Fishman was humorous, malleable in inessential matters, articulate and keen to make progress. Lucy Hummer, I suspect, won her undoubted advocacy skills from basic lessons she had learnt in stone-walling strategies learnt at Cold War meetings convened by the State Department in those years.

The leading antagonists for this formidable United States team were equally brilliant officials of the French Republic. Dominant amongst these was Mr Louis Joinet. He was a magistrate with an original background in the professional judiciary of France. However, he was serving at the time on the development of the French laws for the protection of privacy: La vie privé. He was later to serve in the Elysée Palace after 1981, during the presidency of François Mitterrand. But at this stage he had not risen so high. The president in 1978−80 was Valéry Giscard d’Estaing. Joinet was an officer in the French administration.

Joinet once explained to me the traditional role of his substantive office, which was that of holding and protecting the Seals of the French Republic (Sceaux). His office was in a beautiful building in the Place Vendôme in Paris to which he invited me. I imagined that his was a function as ancient (but not quite as high) as the Master of the Rolls in England — one of that country’s highest judges. Joinet was later to be the holder of several mandates of the United Nations Commission [later Council] on Human Rights. Decades later, in connection with one such mandate, he visited Australia to investigate the conditions of Australian detention facilities for refugees. Then, as in the times we had worked together in the OECD, he was sharp, brilliant, eloquent and insistent. In the face of United States resistance to his logic in the expert group, he would persist with a mischievous smile and adhere steadfastly to the stated French position. It would only be modified (never surrendered) at the last minute, and then with a dismissive laugh as if the difference in issue had always been a mere trifle.

Joinet was supported in the expert group by a colleague, Philippe Lemoine. My recollection was that he was an officer of the French Diplomatic Service at the Quai d’Orsay. He was a foil to Joinet’s brilliance. Each of them could speak long and passionately in defence in what was usually a pan-European posture, concerning the common cause of the emerging CE Convention and OECD Guidelines. Put shortly, Joinet and Lemoine insisted that the experience of Europe should be respected. For Europeans, at a time when the memories of alien occupation, misuse of power and contempt for individual privacy were still fresh in memory, the issues before the expert group were not theoretical. They were real, recent and deadly serious. They were made the more serious by the capacity of the new information technology to collect, retain and analyse huge amounts of data and to provide speedy access to personal information which formerly would have been harmless, gathering dust in unremembered official paper folders.

Somewhere between the positions adopted by the French and American delegations were wise voices from Scandinavia. These included those of Mr Jan Frese, the highly experienced Privacy (Data inspektionen) Commissioner of Sweden. He was a close friend of Seipel. The voices also included that of Professor Jon Bing of the University of Oslo in Norway.^[17] He was not only deeply involved in the Norwegian administrative system of privacy protection. He was a major publisher in the area and skilful in conveying his knowledge and viewpoints in English to Anglophone audiences. The smoothest representative from Scandinavia was probably the Swedish judge and diplomat, Hans Corell. He had a way of insisting on issues of principle whilst offering deft, immediate solutions to the warring factions. This skill was later to serve him in good stead as chief legal counsel to the Secretary-General of the United Nations, Kofi Annan. Corell was handsome, eloquent, and a diplomat to his white tie. However, he also boasted an eccentric affection for the poetry of Robbie Burns and to Scottish bagpipes, which he played in the privacy of his own home to the astonishment of any who were privileged to be invited there as his guests.

The Scandinavian influence did not stop at the Nordics. The Canadian Privacy [later Information] Commissioner was Inger Hansen. She bridged European and North American viewpoints. From time to time, Canada would also arrange for federal judges to serve as part of their delegation. They included Justice Gérard La Forest (who subsequently became a Justice of the Supreme Court of Canada) and Alice Desjardins (of the Quebec Court of Appeal). Not to be outdone, Bill Fishman brought along to one meeting of the group Judge David Bazelon. Originally nominated to the judiciary by President Truman, Bazelon had risen to be Chief Judge of the US Court of Appeals for the D.C. Circuit. His judicial influence in the United States was well known to me. He was alert and knowledgeable on new social issues, including discrimination and mental illness. He retired from the bench in 1979, in the midst of the work of the expert group. Perhaps his participation in our work in Paris was a well-earned opportunity to witness Bill Fishman working with a young Australian judge who shared many values with Bazelon.

Other experts who stood out amongst the impressive participants in the OECD Group were Professor Stefano Rodotà (Italy), Professor Masao Horibe (Japan) and Professor Spiros Simitis, early Data Protection Commissioner of one of the German Länder and occasional representative of Germany (FGR) on the OECD expert group. Each of them was to play an important role in their country’s developing privacy/data protection laws and, in Rodotà’s case, in political and parliamentary office.

My 40^th birthday fell in March 1979, half-way through our project. The expert group took themselves and their chairman to dinner. I still possess a photographic book of Paris signed on the cover pages by each member. The participants came to enjoy the disciplined regime that I imposed upon them. Other offices I had held in Australia and elsewhere had taught me that such an approach will work if participants can see that the taskmaster is contributing substantially to the project and if the project appears to be making progress.

The United States’ insistence on its approach paid off in several respects. The OECD Guidelines, as finalised, fell short of a binding treaty that would have potentially presented problems to the First Amendment of the U.S. Constitution and which would have required Senate confirmation for American ratification. The Guidelines did not involve legal rules that would be binding on OECD member states. As published, the Guidelines endorsed in 1980 by the OECD Council’s recommendation, obliged member states to develop domestic laws taking the OECD Guidelines ‘into account’. But the recommendation that member countries should ‘endeavour to remove or avoid creating, in the name of privacy protection, unjustified obstacles to transborder flows of personal data’ instituted what substantially became an intercontinental governmental attitude and approach.^[18]

Similarly, the ‘economically beneficial flow of data across national boundaries [was not to be] impeded unnecessarily and regulated inefficiently, producing a cacophony of laws which did little to advance human rights but much to interfere with the free flow of information and ideas’.^[19] This is what the United States gained. It was what it had been primarily seeking.

The Europeans, led by France, gained an American endorsement of the then gold standard of the European principles, around which would soon be clustered national laws for the protection of information privacy in most OECD countries. Thus, the basic rules for the flow of data through collection, use, access and storage came to influence the patterns of law-and-policy-making in OECD countries. The OECD Guidelines were not binding. But there was no point in reinventing the wheel. The interface of computers with each other, instantaneously and across linguistic, economic, national and even intercontinental borders would have a recognised advantage. It might not remove entirely and automatically the way different legal systems addressed the protection of data privacy, according to their own values. But it would at least help to reduce, and sometimes avoid, clashes that were unnecessary. It would discourage potential economic obstacles that could be avoided. These principles developed through deliberation and incorporation into the legal regimes of Sweden, then the Nordics, the Council of Europe, and thereafter to the European Economic Community and European Union. Europe member countries of the OECD gained much from this multinational exercise.

The lesson of international negotiation on privacy protection or anything else is that nothing generally happens unless there is something in it for all of the major participants. This was the case with the OECD Guidelines of 1980. It was why those guidelines were approved by the OECD expert group. It was why we were finally rewarded with a cocktail event under the chandeliers of La Muette. Our images glittered in the mirrors of the Chateau as we raised our glasses of champagne. It was why the Council of the OECD addressed its recommendation to endorsing the Guidelines and commending them to OECD member states.

One does not normally think of the OECD as a human rights protective international agency. Yet the Guidelines of 1980 were to become one of the most influential statements, elaborating the universal value of ‘privacy’ for an increasing circle of countries. They were bound together by economic advantage. However, they showed the way by which they could adopt a common approach which would sometimes produce beneficial outcomes from the human rights point of view. Central to that possibility was the key role expressed in the 1980 Guidelines, of the Individual Participation Principle. This was expressed in the language of a human rights safeguard if ever I saw one:

Individual Participation Principle

An individual should have the right:

(a) To obtain from a data controller, or otherwise, confirmation of whether or not the data controller has data relating to him;

(b) To have communicated to him, data relating to him

i. Within a reasonable time;

ii. At a charge, if any, that is not excessive;

iii. In a reasonable manner; and

iv. In a form that is readily intelligible to him;

(c) To be given reasons if a request under sub-paragraphs (a) and (b) is denied, and to be able to challenge such denial; and

(d) To challenge data relating to him and, if the challenge is successful to have the data erased, rectified, completed or amended.^[20]

4 Something Blue — The New Becomes Something Old

It was inevitable that technology would develop in directions that could not be fully foreseen in 1980, would in later years, require reconsideration of the OECD Guidelines. Between 2011 and 2013, the OECD itself undertook a revision and issued a new version of the Guidelines in September 2013. These revisions fulfilled the OECD’s indication, at a meeting in Seoul, Republic of Korea, in 2008, that it would carry out a reassessment of the OECD’s instruments ‘addressing consumer protection and empowerment, privacy and security in light of changing technologies, markets and user behaviour and the growing importance of digital identities’.^[21]

As a result of the foregoing revision, the contents of the Guidelines remained unchanged, as did the eight core principles and their given justifications.^[22] The reason for this was not a belief that there was no need to change. Far from it. It was an inability to agree on what any such changes should entail. The expert group that approached the holy grail of the 1980 Guidelines expressed the opinion that ‘the balance reflected in the eight basic principles of Part Two of the 1980 Guidelines remains generally sound and should be maintained’.^[23]

It is possible that, as in contemporary re-examination of the language of the Refugees Convention and Protocol,^[24] those who appreciate the imperfections and defects of the old language nevertheless resist redrafting because they know the obstacles that stand in the way of achieving change. They also fear that any change that might be produced might afford diminished protections, compared with those offered under the existing principles.

One principle of the 1980 Guidelines certainly presents a serious challenge to the technology that has been developed since it was written. I refer to search engines and the capacity for completely new and unexpected data analysis. I refer specifically to the Use Limitation Principle. By this it is declared:

Personal data should not be disclosed, made available or otherwise used for purposes other than those specified in accordance with paragraph 9 except:

(a) With the consent of the data subject; or

(b) By the authority of law.^[25]

In the technology that existed in 1980, this was probably a sensible human rights and privacy-protective principle. However, given the greatly enhanced capacity of search engines by 2001−13, to discover, present and disclose information of a personal kind, collected and stored for quite different purposes and otherwise than by consent or legal authority, the prospect of forbidding such useful technology was unimaginable.

Expressing this thought in the economic language that the OECD would understand, the marginal utility of search engines outweighed the real, but occasional marginal costs of affording access to personal data without the specific protections envisaged in 1980. Unless some form of blanket authorisation were to be provided (which would offend the particularity of the 1980 Guidelines) search engines will trump the Use Limitation Principle almost every time, simply because of their enormous practical value outweighing the risks. The central ideal stated in the Use Limitation Principle remains true, especially in the context of a system of law that adheres to the Individual Participation Principle. However, this was a good illustration of the way in which technology can overtake earlier rulemaking to suggest the need to rethink the rules. Or to turn a blind eye towards some of them when strict compliance would be intolerably costly. Thus, when something new becomes blue because of the inability to keep the law up to date, it is depressing for those who cherish privacy values. To adapt a phrase, it makes those who accept this realism thoroughly blue.

5 Something Very Old: Australia’s Privacy Laws

I now turn to something old. It was curious that a people who were so insistent on privacy in their ordinary lives, the British, should have been so neglectful in developing effective judicial and other legal rules for its protection. Nowhere was this irony more noticeable than in the Australasian outposts of the British Empire.

Eighty years ago, the High Court of Australia, in Victoria Park Racing & Recreation Grounds Co Ltd v Taylor (‘Taylor’s case’),^[26] concluded that the common law in Australia did not provide specific legal protections for individual privacy, although it was decided that perhaps it should. One Justice of the Court (Justice H V Evatt) dissented from this view. In the peculiar factual circumstances of the case, it was an opinion that was properly capable of being limited to the particular forms of special intrusion in issue. For example, it did not expressly address the problems of data privacy. Despite the peculiarity of the case (which involved a radio broadcaster describing a horse race on private property by viewing the horses over the perimeter fence of the race track) the general principle of law expressed in Taylor’s case has survived to this day. It is a sombre commentary on the creative impetus of the common law in Australia, on the judges and on legal inertia that this basic impediment survives into the current age.

During my service on the High Court of Australia, in Lenah Game Meats Pty Ltd v Australian Broadcasting Corporation (‘Lenah’),^[27] an attempt was made to overcome, or to have overruled or re-examined the principle in Taylor’s case. I would have been most ready to agree to doing so. However, the case in question arose in a potential claim for privacy by a corporation. Long before, in undertaking its investigation of privacy, the ALRC had pointed out that claims to ‘privacy’ by legal persons (corporations) raised issues that were distinct and separate from the human rights issues normally addressed in relation to individual claims to privacy:

The approach taken by the Commission has been to exclude legal persons and to apply the privacy regime for the benefit of natural persons only. This is the correct approach when privacy is seen in the context of human rights. The extent to which it is apt to extend human rights, or civil or political rights, of individuals to statutory creations, such as corporations or to associations, clubs, partnerships and small businesses, is a controversial question. On the other hand, so far as information privacy is concerned, the experience of a number of countries indicates that it is difficult to define clearly the dividing line between personal and non-personal information or between the individual entitled to protection and the small business or group claiming protection.

As the OECD experts pointed out, information relating to a small company may also concern its owner or owners. This aspect is taken into account in the commission’s recommendations. The possibility of extending privacy protections to legal persons was provided for in the OECD Guidelines. The issue has political and economic implications. Fears have been expressed, if a corporation had to disclose identifiable information about legal persons, it might be forced into disclosure of its research on a rival or competing corporation, association, firm or small business. Nonetheless, the privacy protection laws of a number of European countries extend to confer rights on the legal persons, including to permit such legal persons to inspect identifiable information about them.^[28]

The claim to privacy in Lenah was one by a corporate abattoir seeking to prevent the broadcast of a film, covertly recorded, picturing its operations. The conceptualisation of the issue as one of ‘privacy’ (as distinct from, say, unjust invasion, deception, deliberate economic harm or some other wrong) made the case one unsuitable for exploring the ambit of privacy as a general wrong. This is why Lenah did not open the gate to judicial reform on privacy protection under Australian law. I concurred in that conclusion.

Notwithstanding this, many efforts have been made in Australia in recent years to propose the adoption of a general remedy (sometimes called a statutory tort) for defined instances of privacy invasion. The ALRC made such a proposal in its 1979 report Unfair Publication.^[29] Proposals were repeated in later ALRC reports and in State law reform reports (in New South Wales in 2009; in Victoria in 2010; in a federal privacy tort discussion paper in 2011; and in a further ALRC report in 2014).^[30]

The New South Wales Law Reform Commission (‘NSWLRC’) recommended in that State a statutory remedy along the lines of the ALRC report of 2014. This was followed by a most thorough investigation by a New South Wales parliamentary committee in 2016. That committee also recommended the adoption in New South Wales of such a remedy,^[31] even if the Federal Parliament held back and it was not enacted elsewhere in Australia. Attention was directed to the supposed advantage of a federal system of government: permitting law reform experimentation to start in one subnational jurisdiction and to spread elsewhere, if seen to be worthwhile.

In mid-2016 the New South Wales Government rejected this argument. It agreed that a special protection against unwanted publication of sexually explicit material should be enacted. This had been one particular illustration used by the ALRC, the NSWLRC and the parliamentary committee to illustrate the need for law reform. Otherwise, the government revealed the usual timidity about enacting a law providing a remedy for privacy protection. The 2016 response, and many before, show the power of media interests in Australia to fight off law reform in the area of privacy protection. Major media outlets in Australia are controlled by relatively few interests. They generally prefer to be left alone to act as investigator, prosecutor, jury and sentencing judge, with no right of reply or appeal. Unfortunately, the political branches of government back away from a fight with the media. The abuses of privacy, including information privacy, in Australia are many. Nevertheless, the prospects of effective statutory remedies in the foreseeable future appear to be small.

This conclusion should be remembered the next time politicians deny the necessity of any form of charter or statute of rights in Australia as inessential in a jurisdiction where parliament ‘will always respond’ to specific needs. The near total failure of (all) the Australian Parliaments to respond to the demonstrated need for the protection of privacy, through appropriate and adapted legislation, is a disappointing story. It tells of the failure of law reform, the timidity of legislators, the formalism of courts and the failure of the law reform process. Something old continues to be something current in Australia. The law has failed to develop a general and enforceable civil wrong for serious and unjustifiable invasions of privacy. It has left individuals unprotected by enforceable law. To be blunt, the law reform process has repeatedly failed.

6 Something Really New: UN Human Rights Initiatives

One feature of the law that has changed in the 40 years since the OECD first initiated its investigation of privacy protection and the ALRC embarked upon its work on privacy protection in Australia is the growing number of subject matters of human rights that have come under specific international attention. Occasionally these projects invoke international legal norms.

I illustrate this proposition by reference to the areas in which I have myself been engaged during the past 12 months. These demonstrate the fact that an increasing number of subjects today arise for consideration at an international level, with a view to the effective enforcement of universal human rights. Time and the major focus of this article permit no more than a passing reference to the applicable issues. However, these will be sufficient to illustrate the growing internationalisation of matters of concern for human rights, including in the area of privacy protection:

• In 2014, I chaired a Commission of Inquiry (‘COI’) for the UN Human Rights Council. It concerned human rights violations in the Democratic People’s Republic of Korea (North Korea). The report found many grave crimes proved against the human rights of the people of North Korea.^[32] It also found reasonable cause for accepting a conclusion that serious ‘crimes against humanity’ had been committed by officials in that country. The COI recommended referral of the case of North Korea to a prosecutor of the International Criminal Court (‘ICC’). Under the Rome Statute, establishing that Court,^[33] even countries that are not State parties to the Court’s jurisdiction can be referred to the ICC by an affirmative vote of the Security Council. The report of the COI was strongly endorsed by the Human Rights Council. It was referred to the General Assembly of the United Nations, with a recommendation that it should, in turn, bring the findings to the notice of the Security Council. This has been done. In an unusual move, the Security Council voted to place the issues of North Korea on its agenda. Resolutions have more recently been adopted strengthening United Nations sanctions against North Korea. Whilst no vote has yet been taken on a proposal to refer the case to the ICC, the international community has generally responded on North Korea in a strong, principled and tough minded way. This response is continuing. It involves international treaty law, including the operation of the Charter of the United Nations itself. Law is an important component in this development of human rights.

• In 2015−16, I served on the High Level Panel of the Secretary-General of the United Nations on access to essential medicines. Amongst other topics, the report of that Panel, delivered to Secretary-General Ban Ki-moon in September 2016, addressed the ways in which the Sustainable Development Goals (‘SDGs’) of the United Nations might be given effect so that, specifically, by 2030, people everywhere will have access to essential medicines.^[34] This presents a potential conflict of legal norms between the universal right to essential health care and the international legal principles governing intellectual property protection.^[35] It would have been easy in 2015 for the outgoing Secretary-General of the United Nations to have left this issue to be handled by his successor. Instead, he grasped the nettle. He required a report to come forward showing ways of ensuring that ‘no one is left behind’ in attaining the SDGs. Slowly, imperfectly, inadequately but inexorably, international law is building the responses that are needed to turn the brave words of the UDHR and of the SDGs into practical effect. The world is not there yet. But, as with the OECD Guidelines, we can see the outline of the future. We know what needs to be done and the cooperation that will secure progress.

• Also in 2016, I was involved in a number of initiatives of the United Nations Development Programme (‘UNDP’), then headed by that fine international official, Administrator of UNDP and former Prime Minister of New Zealand, Helen Clark. These initiatives have addressed the rights of the lesbian, gay, bisexual, transgender, intersex and queer minority (‘LGBTIQ’) who are still the subject of violence and discrimination in many countries. Their oppression is similar to what I experienced at the beginning of my own journey. During 2016, the Human Rights Council (‘HRC’) established a new human rights mandate in respect of LGBTIQ people. The mandate is that of the Independent Expert on Sexual Orientation and Gender Identity (‘SOGI’) issues. Establishing that mandate was another achievement of Ban Ki-moon. He always insisted that the words ‘all human beings’ in the first line of article 1 of the UDHR refer to everyone, including minorities, and including minorities defined by the grounds of their sexuality. Again, this issue might have been left to the future. But the mandate was created. The first officeholder (Professor Vitit Muntarbhorn of Thailand) was appointed. Attempts were promptly made by a number of countries to stop progress in its tracks. A group in the General Assembly of the United Nations, led by a number of African countries and numbers of the International Organisation of Islamic States moved to delete references to the new SOGI mandate from the report of the HRC when that report was presented to the General Assembly for confirmation. This was tried in the Political (Third) Committee of the General Assembly and narrowly defeated. It was then pursued in the plenary of the General Assembly and defeated. It was then pursued in the Budget (Fifth) Committee of the General Assembly. Once again it was rejected. The last throw of the dice was attempted in the plenary session of the General Assembly when the report of the Fifth Committee was presented for ratification. The challenge was rejected, with 77 countries voting to delete the new mandate; 84 to maintain it and 16 abstaining. The United Nations stayed the course.^[36] The General Assembly upheld and defended the mandate of the HRC. It rejected the notion that LGBTIQ people were outside a human rights mandate addressed to violence and discrimination. It looked to the future. It insisted on the universality of human rights. Once again the right thing was done. The opponents were defeated.

7 Something Super New – Special Rapporteur On Privacy

In the field of privacy the current international regime has been far less forthcoming. Of course, the UDHR and the ICCPR are United Nations instruments. The inclusion within them of references to ‘privacy’ rights ensures that the concept has an ongoing significance for the entire UN system.

In 1968, the General Assembly invited the UN Secretary-General to examine and report on the specific concept of privacy.^[37] A UN report in 1976 recommended the adoption of data privacy legislation, listing proposed minimum standards.^[38] In 1990, the General Assembly adopted guidelines on data privacy, based primarily on human rights concerns. A substantive innovation was the encouragement addressed to international organisations (governmental and non-governmental), urging them to process personal data in ‘a responsible, fair and privacy respecting manner’. This went beyond the OECD Guidelines and the European Union Data Protection directive, in force by that time.^[39] There were various other innovations. However, no moves were suggested towards a binding UN treaty or like measure. The criticism of the UN initiatives on privacy to date regularly refers to the vagueness, and undefined character of the key expressions, including ‘personal data’ and ‘personal data file’. Perhaps in consequence, the UN guidelines adopted to date have had less practical impact internationally than those of the OECD.^[40]

What was also surprising was the initial failure of the Human Rights Commission, and then the HRC, to interest itself in the broad issues of privacy as a human right. This was curious given the engagement with so many other, even related, issues under international human rights law (including LGBTIQ rights) and the willingness of the HRC to push the boundaries and develop binding norms on human rights, as broadly defined.

In 2015, this initial reticence appeared at last to be overcome. In the run up to moves by the HRC, media articles contrasted the disclosures of mass surveillance of individuals by governmental authorities, particularly by governmental authorities of the United States of America and the failure of the UN to protect and promote privacy rights despite the human rights treaty provisions that support doing so.^[41] This was the context in which the mandate of a new thematic Special Rapporteur was created by the HRC in 2016 for the protection of the fundamental right to privacy and for strengthening the UN’s engagement with the protection and promotion of privacy rights generally.

The establishment of a new Special Rapporteur on the right to privacy was one of a number of new thematic ‘special procedures’.^[42] When the mandate was created by the HRC, the post was advertised and applications were invited from interested persons. An appointments committee of the HRC was established. Ultimately, Mr Joseph Cannataci, an academic from Malta with experience in privacy, was selected. He was appointed in July 2015.^[43] It is useful to set out the main provisions of the mandate of the UN Special Rapporteur on the right to privacy:

a) To gather relevant information, including on international and national frameworks, national practices and experience, to study trends, developments and challenges in relation to the right to privacy and to make recommendations to ensure its promotion and protection, including in connection with the challenges arising in new technologies;

b) To seek, receive and respond to information ... from States, the United Nations and its agencies ... regional human rights mechanisms, national human rights institutions, civil society organisations, the private sector, including business enterprises and any other relevant stakeholders or parties;

c) To identify possible obstacles to the promotion and protection of the right to privacy ...;

d) To participate in, and contribute to, relevant international conferences and events with the aim of promoting a systematic and coherent approach ...;

e) To raise awareness concerning the importance of promoting and protecting the right to privacy ...;

f) To integrate a gender perspective throughout the work of the mandate;

g) To report on alleged violations [of UDHR art 12 and ICCPR art 17] ... and to draw the attention of the Council and the United Nations High Commissioner for Human Rights to situations of particularly serious concern;

h) To submit an annual report to the Human Rights Council and to the General Assembly.^[44]

So far, the Special Rapporteur has produced one substantive report for the Council. It outlines his activities in 2016 and explains his proposed activities in 2017.^[45] Both in the version of the report addressed to the HRC and that addressed to the Third Committee of the General Assembly, the Special Rapporteur complained about the lack of staff and other resources for the discharge of his extremely wide mandate. After describing the work undertaken in the first year, the report lists a ‘ten point action plan’.^[46] High on this list is development of a ‘more detailed and more universal understanding’ of the right to privacy and promotion of energy and influence in civil society and further elaboration in international law.^[47]

Special rapporteurs of the United Nations’ HRC perform their duties in an honorary capacity. They receive travel allowances; but no remuneration. The resources made available to assist them are tiny, often limited to one or two professional officers on the staff on the High Commissioner for Human Rights. The nation states, by their resolutions, impose mandates of great detail, variety, complexity and size. Country visits consume time otherwise available for the discharge of the mandate. Linguistic limitations often restrict the practical ambit of consultations and their responsiveness. The use of websites is admirable, as is engagement with human rights organisations in civil society having the resources to enlarge the contacts. However, much of the initiatives of the special rapporteurs depend on the imagination, flair and energy of the individual mandate holders.

There are many projects that warrant the attention of the Special Rapporteur on the right to privacy. These certainly include the challenge of mass surveillance by governments that was the original trigger for the establishment of the mandate. Given the implications of doing so for the support available to the many other thematic special rapporteurs, it is probably unlikely that the resources of the Special Rapporteur on the right to privacy will be significantly enhanced in the immediate future. Strategic decisions therefore need to be made concerning particular tasks within the current mandate that would most effectively fulfil the obligation to protect and promote privacy rights, according to priorities that are explained and justified.

Given the suggested deficiencies of the OECD Guidelines, following the changes in technology since those guidelines were first adopted, one very important task that might be initiated by the Special Rapporteur on the right to privacy could be a revision of the international privacy rules, as the core principles of information privacy, to reassess those rules and to ensure that they are grounded in UN human rights law. Although this would be a major enterprise and (as the OECD itself has found) full of controversy, it is certainly a fundamental task. In a real sense, it presents itself at the threshold of the mandate. It would be worthy of the new United Nations mandate-holder.

Such a task could not be accomplished by the Special Rapporteur on the right to privacy alone. It would need engagement with a team of experts and consultative procedures assembled with university or other institutional support. The mandate is now established. In my view, the mandate-holder should be defining activities that assert, and justify, his intellectual and international pre-eminence in the field. Ironically, what he lacks in resources from the Office of the High Commissioner for Human Rights, he may be able to overcome by a deft use of the very digital technology that is sometimes viewed as the chief source of privacy’s largest challenges today. The Special Rapporteur’s special mandate is something new. Of this mandate, inevitably, there are great expectations.

Conclusions: A New Beginning?

In the field of digital privacy, the OECD Guidelines are now ‘something old’. Indeed, already at the time of their drafting, they represented ‘something borrowed’. They utilised and built upon initiatives earlier taken in Scandinavia, by the Nordic Council, then followed up by the Council of Europe and, later still, the European Economic Community and later European Union Directives.

The disappointing responses (judicial and legislative) in the Australian and other legal systems in response to the conceptual challenges to privacy protection are also ‘something old’. Inaction and passivity by the courts have been with us in Australia since Taylor’s case in 1936. Attempts to secure changes in the courts and in legislatures have repeatedly failed. Successive law reform reports have been rejected. Even the bipartisan parliamentary report in New South Wales has got nowhere. The arrival at something really new appears to be as far off as ever.

Whilst the influence of the OECD Guidelines, in Australia, New Zealand and elsewhere, has been substantial and enduring, something new is now clearly required. This is so because of the huge potential of information technology today to gather, compile, store and distribute personal information in metadata on just about everybody. The United Nations human rights machinery represents a new and legitimate venue, long neglected, to ‘develop something truly new’.

The appointment of the Special Rapporteur on the right to privacy, with his dauntingly overbroad mandate, is at least a new opportunity. Information privacy is not a concern only of the developed countries of the OECD. Privacy is a universal value but with manifestations that can vary from one jurisdiction to another. That is why the greatest attention should now be focused on the HRC’s new mandate. Privacy scholars and institutions should be exploring how they can help and support the Special Rapporteur. And how can they enhance through him, the ability of the HCR and of the UNGA to respond to the rapidly increasing challenges to data privacy in the contemporary world? It is almost too late to hope for something effective to protect privacy — a value most precious in the catalogue of valuable human rights. It is stated in clear language in Eleanor Roosevelt’s UDHR at the beginning of the global journey to enhance the protection of the precious characteristics of human rights in a time of rapid technological and societal change.

^[*] Text of an address to the Fifth Asian Privacy Scholars Network (ASPN) Conference, Auckland, New Zealand, 14 December 2016.

^[*] Chairman of the Australian Law Reform Commission (1975−84); Chairman OECD Expert Group on Transborder Data Barriers and the Protection of Privacy (1978−80); Justice of the High Court of Australia (1996−2009); EPIC, International Privacy Champion Award (2010); Australian Privacy Medal (2011).

^[1] GA Res 217A (III), UN GAOR 3^rd sess, 183^rd plen mtg, UN Doc A/810 (10 December 1948). See UDHR, UN Doc A/810, art 12.

^[2] International Covenant on Civil and Political Rights, opened for signature 16 December 1966, 999 UNTS 171 (entered into force 23 March 1976) art 17.1, 17.2.

^[3] The original version was expressed in language then common, ‘all men’; subsequently modified and generalised.

^[4] See, eg, Griswold v Connecticut [1965] USSC 128; 381 US 479, 509 (1965). See also Bowers v Hardwick [1986] USSC 194; 478 US 186 (1986) and Lawrence v Texas [2003] USSC 4776; 539 US 558 (2003).

^[5] Graham Greenleaf, Asian Data Privacy Laws (Oxford University Press, 2014) 24−9.

^[6] Ibid 79. See also ibid 406, 461.

^[7] G Gunasekara, ‘Paddling in unison or just paddling? International trends in reforming information privacy law’ (2014) 22(2) International Journal of Law and Information Technology 141.

^[8] Organisation for Economic Co-operation and Development, OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (23 September 1980) <http://www.oecd.org/sti/ieconomy/oecdguidelinesontheprotectionofprivacyandtransborderflowsofpersonaldata.htm> See, eg, Privacy Act 1988 (Cth); Privacy Commissioner Act 1991 (NZ), replaced by Privacy Act 1993 (NZ). The first New Zealand Privacy Commissioner was [Sir] Bruce Slane who was appointed in 1993 and held office until 2003. He died in Auckland shortly after the APSN Conference concluded.

^[9] Australian Law Reform Commission, Privacy, Report No 22 (1983) vol 1, 269 [602].

^[10] Greenleaf, above n 5, 10, 29−30.

^[11] Dudgeon v United Kingdom (1981) 45 Eur Court HR (ser A); Modinos v Cyprus (1993) 259 Eur Court HR (ser A); Lawrence v Texas [2003] USSC 4776; 539 US 558 (2003); McCosker v State [2005] FJHC 500.

^[12] Human Rights Committee, Views: Communication No 488/1992, 50^th sess, UN Doc CCPR/C/50/D/488/1992 (31 March 1994) [3] (‘Toonen v Australia’).

^[13] Zelman Cowen, The Private Man (Australian Broadcasting Commission, 1969).

^[14] See, eg, Data Act 1973 (Sweden) was the first national law. Private Registers Act 1978 (Denmark) s 3(3) and Public Authorities Act 1978 (Denmark) quickly followed.

^[15] Frits W Hondius, Emerging Data Protection in Europe (North-Holland, 1975).

^[16] Lee A Bygrave, Data Privacy Law (Oxford University Press, 2014), 53. See also 44.

^[17] See, eg, J Bing, ‘Information and Law’ [1982] Mediation Law and Practice 219.

^[18] Organisation for Economic Co-operation and Development, OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (23 September 1980) <http://www.oecd.org/sti/ieconomy/oecdguidelinesontheprotectionofprivacyandtransborderflowsofpersonaldata.htm> .

^[19] M D Kirby, ‘Legal Aspects of Transborder Data Flows’ (1991) 5(5) International Computer Law Adviser, 5−6.

^[20] Organisation for Economic Co-operation and Development, OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (23 September 1980) <http://www.oecd.org/sti/ieconomy/oecdguidelinesontheprotectionofprivacyandtransborderflowsofpersonaldata.htm> .

^[21] OECD Ministerial Session, Seoul Declaration for the Future of the Internet Economy (2008) 99 (18 June 2008) 10.

^[22] Supplementary Explanatory Memorandum to the recorded decision of the OECD Council quoted in Bygrave, above n 16, 44.

^[23] Ibid.

^[24] Convention Relating to the Status of Refugees, opened for signature 28 July 1951, 189 UNTS 137 (entered into force 22 April 1954); Protocol Relating to the Status of Refugees, opened for signature 31 January 1967, 606 UNTS 267 (entered into force 4 October 1967).

^[25] Organisation for Economic Co-operation and Development, OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (23 September 1980) <http://www.oecd.org/sti/ieconomy/oecdguidelinesontheprotectionofprivacyandtransborderflowsofpersonaldata.htm> .

^[26] [1937] HCA 45; (1937) 58 CLR 479.

^[27] (1999) 208 CLR 199.

^[28] ALRC, Privacy, Report No 22 (1983) Pt I [27]−[29], [1404].

^[29] ALRC, Unfair Publication: Defamation and Privacy, Report No 11 (1979).

^[30] Described in Australian Law Reform Commission, Serious Invasions of Privacy in the Digital Era, Report 123 (2014), rec 4−1.

^[31] Standing Committee on Law and Justice, Parliament of New South Wales, Remedies for the Serious Invasion of privacy in New South Wales (2016) 10.

^[32] Commission of Inquiry on Human Rights in the Democratic People’s Republic of Korea, Report to Human Rights Council, UN Doc A/hrc/25/CRP.1 (7 February 2014).

^[33] Ibid 370 [1225(a)]. See Rome Statute of the International Criminal Court, opened for signature 17 July 1998, 2187 UNTS 90 (entered into force 1 July 2002). Cf A Cassese and P Gaeta, Cassese’s International Criminal Law (Oxford University Press, 3^rd ed, 2013) 105.

^[34] Transforming our World: the 2030 Agenda for Sustainable Development, GA Res 70/1, UN GAOR, 70^th sess, Agenda Items 15 and 116, UN Doc A/RES/70/1 (21 October 2015).

^[35] Secretary-General’s High Level Panel on Access to Medicines, Report: Promoting Innovation and Access to Health Technologies (UNDP, New York, 2016).

^[36] Amendment to the draft resolution recommended by the Third Committee (A/71/479, para 17) UN GAOR, 71^st sess, Agenda Item 63, UN Doc A/RES/71/L.45 (15 December 2016). Votes in favour of the deletion amendment: 77; votes against: 84; abstain: 16; The HRC resolution establishing the mandate of the Independent Expert on SOGI is found at: Human Rights Council, Protection against violence and discrimination based on sexual orientation and gender identity, 32^nd sess, Agenda Item 3, A/HRC/RES/32/2 (15 July 2016); Cf M D Kirby ‘A Close and Curious Vote Upholds the New UN Mandate on Sexual Orientation and Gender Identity’ [2017] (1) European Human Rights Law Review 37.

^[37] Human rights and scientific and technological developments, GA Res 2450, UN GAOR, 23^rd sess, 1784^th plen mtg UN Doc E/CN.4/1025 (19 December 1968); See Bygrave, above n 16, 51.

^[38] See Bygrave, above n 16, 51 nn 83.

^[39] Ibid 52.

^[40] Ibid 53. See also Greenleaf, above n 5, 54−55.

^[41] The Guardian newspaper reported on 5 June 2013 on the disclosures of widespread mass surveillance by US agencies revealed by Edward Snowden: Glenn Greenwald, ‘NSA collecting phone records of millions of Verizon customers daily’, The Guardian (online), 6 June 2013 <https://www.theguardian.com/world/2013/jun/06/nsa-phone-records-verizon-court-order>. This led to calls for solutions affording protections. See Marc Rotenberg, Julia Horwitz and Jeramie Scott (eds), Privacy in the Modern Age: The Search for Solutions (The New Press, 2015). For the UN General Assembly resolution on the Snowden revelations see: The right to privacy in the digital age, GA Res 68/167, UN GAOR, 68^th sess, 70^th plen mtg, Agenda Item 69, UN Doc A/RES/68/167 (21 January 2014).

^[42] Office of the High Commissioner for Human Rights, Special Rapporteur on the right to privacy <http://www.ohchr.org/EN/Issues/Privacy/SR/Pages/SRPrivacyIndex.aspx> .

^[43] Human Rights Council, The Right to Privacy in the Digital Age, HRC Res 28/16, 28^th sess, Agenda Item 3, UN Doc A/HRC/28/L.27 (24 March 2015).

^[44] Office of the High Commissioner for Human Rights, Special Rapporteur on the right to privacy <http://www.ohchr.org/EN/Issues/Privacy/SR/Pages/SRPrivacyIndex.aspx> . See Joseph A Cannataci, Report of the Special Rapporteur on the right to privacy, 31^st sess, Agenda Item 3, UN Doc A/HRC/31/64 (March 8, 2016). See also Joseph A Cannataci, Report of the Special Rapporteur on the right to privacy, UN GAOR, 71^st sess, Agenda Item 69, UN Doc A/71/368 (30 August 2016).

^[45] Joseph A Cannataci, Report of the Special Rapporteur on the right to privacy, 31^st sess, Agenda Item 3, UN Doc A/HRC/31/64 (March 8, 2016) [46].

^[46] Ibid.

^[47] Ibid.