Greenleaf, Graham --- "High Court Confirms Privacy Right Against Governments" [1994] PrivLawPRpr 1; (1994) 1(1) Privacy Law & Policy Reporter 1
High Court Confirms Privacy Right Against Governments
Graham Greenleaf discusses the implications of Johns v ASC.
The High Court of Australia has held that any information collected under statutory powers is held as confidential information and may only be used or disclosed in accordance with express or implied statutory authority, affirming recent UK case law. The decision in Johns v Australian Security Commission (noted in full, in Cases & Complaints) has important implications for any government agencies which collect personal information, and for the interpretation of the Privacy Act 1988 (Cth). The case turned on whether the Australian Securities Commission (ASC) had breached an obligation of confidence when it disclosed to a Victorian Royal Commission transcripts of ASC compulsory examinations of Ian Malcolm Johns, former Tricontinental group director, under conditions which allowed general publication by the Royal Commission, and resulted in the transcripts coming into the hands of media representatives.
A statutory right to confidentiality
A majority of the High Court (Brennan, Dawson, Gaudron and McHugh JJ; Toohey J dissenting) decided that a statute which confers a power to obtain information by compulsion limits, expressly or impliedly, the purposes for which the information obtained can be used or disclosed. It can then be used, as Brennan J said, ''for no other purpose'. Information obtained in the exercise of such a statutory power must therefore be treated as subject to a statutory duty of confidentiality, except to the extent that the statute otherwise allows. A similar approach has been taken in the recent UK cases, Marcel v Commissioner of Police [1992] Ch 225 and Morris v Director of the Serious Fraud Office [1993] 3 WLR 1. Brennan J said that the duty is ''closely analogous' to the equitable duty of confidence, and can be protected by injunction.
The court's approach to compulsorily obtained information was indicated by the following passage from the decision by Sir Donald Nicholls V-C in Morris v Director of the Serious Fraud Office:
'Compulsory powers are not to be regarded as encroaching more upon the rights of individuals than is fairly and reasonably necessary to achieve the purpose for which the powers were created'.
This decision may have profound implications for the protection of privacy, as it recognises as a general principle of law (at least in regard to information collected compulsorily by governments) the key privacy principle that personal information which is collected for one purpose should not normally be used or disclosed for any other purpose, except with consent, statutory authority, or other limited exceptional circumstances.
A tougher standard than the information privacy principles
Australia's Privacy Act 1988 (Cth), by Information Privacy Principles (IPPs) 10 and 11 (s14), imposes the only general limits on the use and disclosure of personal information by Commonwealth agencies to the purposes for which it was collected. However, each IPP is subject to five exceptions, some of which are regarded as weakening the IPPs considerably, depending on their interpretation (for example, disclosures ''reasonably necessary' for law enforcement or protection of the public revenue). The significance of Johns v ASC is that there is no reason to assume that the statutory obligation of confidentiality in relation to compulsorily acquired information is subject to exceptions the same as, or as broad as, are found in the IPPs. The IPPs also apply to information which is collected not through any powers of compulsion, and which it is therefore reasonable to assume might obtain lesser protection than compulsorily acquired information. It is important to appreciate that IPPs 10 and 11 do not create any statutory right of disclosure where one of the five exceptions is applicable; the exceptions merely provide defences to what would otherwise be a breach of the Privacy Act. Therefore, the Johns v ASC obligation of confidence may make some of these purported exceptions inapplicable (in effect) to compulsorily acquired personal information, because disclosure of the information may still be a breach of a Johns v ASC statutory obligation of confidence.
Implications for government information sharing
In light of Johns v ASC, there may be instances of government sharing of personal information which are no longer tenable. Whereas previous debates on these matters were sometimes framed in terms of whether or not any exceptions to IPP 11 did not prohibit the disclosure, the proper question where any compulsorily acquired information is concerned will only be whether or not there is express or implied positive statutory authority for such disclosure.
Natural justice may require a hearing before disclosure
In Johns's case, there was statutory authority for the type of disclosure made to the Royal Commission, under s127(4)(b) of the Australian Securities Commission Act. Nevertheless, the same majority of the court found that the rules of natural justice required that the disclosure should only have been made after Johns was given a formal opportunity to object to it. Brennan, Dawson, and Gaudron JJ all based this requirement on Johns's prima facie right to insist upon the maintenance of confidentiality of the transcripts, whereas McHugh J was inclined to base it on his interest in his reputation. Consequently, Johns was entitled to a declaration that the decision to disclose was invalidly taken for failure to accord him such a hearing so that he could attempt to persuade the ASC not to disclose the information, or only to disclose it on conditions preventing public dissemination (following Ainsworth v Criminal Justice Commission [1992] HCA 10; (1992) 175 CLR 564).
The court noted that natural justice would not always require a hearing in such situations. Brennan J gave the example of where an investigation by a State law enforcement agency might be frustrated by informing the examinee of the ASC's intention to make certain information available to the agency. However, there were no such exceptional circumstances here.
Such an obligation to provide an opportunity to object to disclosure, even when there is a clear statutory basis for disclosure, has obvious implications for any government agencies that disclose personal details to other agencies or organisations, either on a ''one-off' basis for investigations, or as mass data-matching exercises. Statutory powers to make such disclosures may still be exercised invalidly if no opportunity to object to disclosure is offered. The circumstances of disclosure would need to contain exceptional circumstances which negated a hearing requirement as part of natural justice, or the statutory authority would need to clearly negate the requirement to observe natural justice. Where mass data-matching has an express statutory foundation (for example, the Data-matching Program (Assistance and Tax) Act 1990 (Cth)), it is unlikely that natural justice would provide a right of hearing additional to any provided by the statute, but there are many data-matching programs carried out by Australian governments which do not have such a clear statutory basis.
A privacy right against State governments
There is nothing in Johns v ASC which limits its applicability to Commonwealth government agencies. At least in regard to compulsorily acquired information, it can now be asserted that there is a general law right which may be stronger than that contained in IPPs 10 and 11. The obligation to provide natural justice in relation to disclosures is equally applicable to State agencies. This may have important implications for some State data-sharing schemes, such as in relation to land information, or criminal record checking which does not have any statutory basis.
When is information in the public domain?
Despite his success on the natural justice point, Johns was ultimately unsuccessful in restraining further disclosures because a majority of the court (Brennan, Dawson, and Toohey JJ; Gaudron and McHugh JJ dissenting) decided that no obligation of confidence was imposed on the media respondents because when the transcripts were tendered in public proceedings of the Royal Commission they therefore became part of the public domain.
Some uncertainties
Not surprisingly, Johns v ASC leaves many questions unanswered. In many cases it will not be as clear-cut that information has been obtained under a ''power to obtain information' as is the case in an ASC examination, and so the case will provide little guidance on that point. The circumstances which might provide public policy exceptions to the enforcement of an obligation of confidence and which might negate a hearing requirement as part of natural justice are also uncertain. Nevertheless, Johns v ASC marks an important step in the development of privacy protection under the general law in Australia.
Graham Greenleaf