Privacy and the Courts
Emeritus Professor John Burrows
Commissioner
Law Commission
Address to the Privacy Forum
Hotel Intercontinental, Wellington
27 August 2008
Privacy and the Courts
1 The part of the privacy project with which I am particularly concerned is stage 3. Its terms of reference are:
a) the adequacy of New Zealand’s civil law remedies to deal with invasions of privacy and b) the adequacy of New
Zealand’s criminal law to deal with invasions of privacy. In short, this stage of the project is about the enforcement
of privacy rights in the courts.
However we have found we cannot look at this in a vacuum. We need to assess the role of the courts against the
background of the remedies available outside the court system. In summary this is how the overall picture looks.
The regulatory framework
2 For want of a better name I shall call the enforcement measures which lie outside the courtroom the regulatory
framework.
3 First the Broadcasting Standards Authority set up under the Broadcasting Act 1989 hears complaints about breach
of privacy by broadcasters. It can award damages of up to $5,000, and impose a range of penalties such as suspending
advertising on the station or channel in question. The BSA has formulated a set of privacy principles and has created a
substantial jurisprudence around them over a period of 18 years or so.
4 Secondly the Press Council hears complaints, including complaints about breach of privacy, against the print
media. The Council is a voluntary body with no statutory basis and it cannot impose any sanctions. However, media
organisations are expected to publish any decisions which go against them.
5 Thirdly, the Privacy Commissioner hears complaints about breaches of the information privacy principles in the
Privacy Act 1993. The Commissioner attempts to reach a resolution between the parties, but if this cannot be achieved
the matter can be progressed to the Human Rights Review Tribunal which can make a decision against an infringer and
award damages of up to $200,000. In fact the highest the tribunal has gone in a privacy case is $40,000.
6 There are gaps in the coverage of these bodies. With a very limited exception the news media in their news
activities are not bound by the principles in the Privacy Act. The BSA can deal only with broadcasters, the Press
Council only with the print media. Neither have jurisdiction over a large amount of publication on the internet.
7 The remedies and penalties available in the courts (the heavy machinery we might call it) overlay these lower
level methods of enforcement.
Criminal law
8 There is a miscellaneous array of statutory provisions in New Zealand which impose penalties for various sorts
of conduct which we might categorise as invasions of privacy. Some of them protect what we call “local privacy” and
penalise conduct which intrudes on a person’s seclusion. Among them are provisions prohibiting intimate covert filming,
and provisions prohibiting the use of listening devices to intercept private conversations. Others protect what we have
labelled informational privacy, and render it an offence to publish certain sorts of information about people: various
sorts of health information, the contents of someone’s mail, and information about a person’s past criminal record for
example. There is a degree of overlap between these two categories: thus it is an offence to publish intimate pictures
as well as to film them.
9 These criminal offences have grown up willy nilly and form a patchwork with not much rationale about it. There
are anomalies. Private investigators are not allowed to take photographs of anyone, a prohibition which applies to no
other category of person. It is an offence to use a listening device to intercept a private conversation, but no offence
at all to secretly film someone (unless the film is of an intimate nature). It is an offence to peep through a dwelling
house window at night, but not during the day time. The penalties lack consistency too. Why should a peeping tom be
liable only to a fine of $500, but a person who tape records someone’s conversation to two years imprisonment? There are
serious questions, to which I shall return later, of the rationale for making some kinds of conduct criminal but some
not. There are some deep and difficult questions about what the role of the criminal law is, or should be.
Civil law
10 For a long time people have been able to sue in the courts to get remedies for certain types of conduct which
affect privacy to a greater or lesser degree. Sometimes a defamation action may be available, sometimes breach of
copyright (for example to stop the publication of embarrassing photographs), and sometimes trespass (for example to
exact a remedy from a person who has come on land without permission to take pictures).
11 A breach of confidence action has long been available too. This usually requires that information has been
entrusted from one person to another on the understanding that it will go no further. Breach of confidence has a wide
reach: it can extend to such things as commercial secrets, but it can also protect confidences between friends and
spouses, at which point we are getting into privacy territory.
12 In the United Kingdom they have applied breach of confidence liberally to give remedies for breach of privacy.
They have extended its traditional scope. They have been nudged in that direction by the European Convention on Human
Rights which contains strong privacy rights.
13 In New Zealand our courts have been rather more bold. For something over twenty years High Court judges in this
country have been saying it is arguable that invasion of privacy by publishing private facts about someone should be
actionable as a tort. Our Court of Appeal in 2004 decided in Hosking v Runting that indeed that is the case. It has laid
down a rule that a person may sue if i) there are facts in respect of which there is a reasonable expectation of privacy
and ii) publicity given to those facts is highly offensive to an objective reasonable person. There is a defence if it
can be shown that the information published is of public concern. A successful plaintiff may recover damages (the sky is
the limit), or an injunction to stop publication.
14 This tort has come into existence by the skin of its teeth. In the Court of Appeal the majority in favour was
three judges to two, with two judges dissenting very strongly. The Supreme Court could yet overrule it. In a recent case
one judge has indicated he believes it should do so, and another (the Chief Justice) while apparently generally in
support of the tort, has indicated that some of its criteria might merit re-examination. In particular, the Chief
Justice wonders whether the “highly” offensive test is right, and whether it may not be enough simply to say that there
must be facts in respect of which there is a reasonable expectation of privacy.
15 The new tort obviously requires a court to make some fairly subjective judgements. People might easily disagree
on whether in a particular case the facts were such as might reasonably be expected to be kept private; or whether it
was highly offensive to publish them; or whether public concern overrides the privacy interest. There will be cases
where it will be quite hard to predict which way a court will go, and where it will therefore be difficult for lawyers
to advise their clients. Such uncertainty can act as a restraint on freedom of expression. Moreover there are many gaps
in the tort which remain to be resolved. Does it apply to corporations as well as individual human beings? Can a
deceased person’s family sue for breach of the deceased’s privacy? If some of the statements made are untrue can you
bring a privacy action in respect of those? Furthermore, currently the tort is only about the publication of
information: it protects informational privacy. We do not know whether the tort will be extended to protect local
privacy – in other words whether it will extend to intrusion into seclusion and solitude. In other words there is a lot
that as yet we do not know about it. This is often the case with law that has been made by the courts rather than by
Parliament.
Some difficulties
16 So that is how the terrain lies at the moment. We have been asked to fix it. Here are some of the difficulties
and problems we face.
17 First the very subject matter of the enquiry is not clear. What is privacy? How does it differ from other
concepts like confidentiality or secrecy? It is surprising how often one finds oneself reflecting and asking whether a
problem that one is considering is a privacy issue at all or whether it is really something else. It was Lord Woolf who
said that privacy is even worse than an elephant, because while it is difficult to define an elephant you at least know
one when you see it. That is not always the case with privacy. You can see what I mean by looking at the range of
criminal offences which I mentioned before. Some of them were passed into law before privacy was fully recognised as a
legal value. (In fact it was not until around the 1970’s that the word “privacy” cropped up in our law much at all.) A
number of the criminal offences to which I alluded were probably prompted by considerations only remotely connected to
privacy. Thus the prohibition on opening and disclosing the contents of someone else’s mail was probably more due to a
policy of stopping theft and sabotage than it was to protect the privacy of the owner of the correspondence. The rule
that election officers must not disclose how any person voted at an election is more about protecting the integrity of
the electoral system than it is about protecting people’s privacy.
18 We can see the same potential for confusion in the new tort. It is not just about intimately private facts such
as health, domestic relations, sexual activity and so on. It is about any fact in respect of which there is a reasonable
expectation of privacy. In this context “privacy” undergoes a subtle shift in meaning. The tort protects any facts which
I can reasonably expect not to be published. So the very concept of privacy is protean. It shifts before one’s very
eyes. The hope that some of us had that the longer we studied the subject the clearer it would become, has diminished as
time has gone by.
19 This difficulty is one we are unlikely to be able to fix. However we try to define privacy we shall be unable to
pin it down securely. There are as many definitions as there are theorists who have written about it.
20 The second difficulty is that the field, as we have seen, is currently very untidy. A regulatory system with
gaps in it is overlaid by a common law system with gaps in it, and also by a tort with gaps in it. Sometimes a person
may have alternative avenues of redress: a complaint to the Privacy Commissioner or a tort action (if for example the
police publish private information); a complaint to the Broadcasting Standards Authority or a criminal law prosecution
(if for example a broadcasting journalist tapes a private conversation); a tort action or a criminal prosecution
(publication of intimate pictures for example). This possibility of overlap is not itself a ground for reform. Our legal
system is full of alternative causes of action. Nor is untidiness of itself a reason for reform. Much of our law is
untidy. But, hopefully, as the Commission goes about its business it may be able to bring a little more order to the
subject.
21 The third difficulty is more serious. There are some gaps in our privacy law: areas where protection may be
needed, but does not exist in proper measure. Surveillance is one such area. A major concern that many people have about
their privacy centres around the increasing number of ways in which their activities can be observed and recorded.
Surveillance devices are becoming more common and more sophisticated: closed circuit television, webcams, radio
frequency identification, GPS systems, biometric technologies and many others. Some uses of surveillance are readily
justifiable: detection of offenders, traffic regulation, security and market research. But some uses are much less
justifiable, and even the legitimate uses, unless carefully controlled, can create real danger of the misuse of
information. Currently nothing in our legal system covers surveillance very well. The Broadcasting Standards Authority
recognises intrusion into solitude and seclusion as one of breaches of privacy over which it exercises jurisdiction.
They use it to control the use of hidden cameras. But this covers only broadcasters. The Privacy Act does not provide
clear and unequivocal coverage. Principle 3 applies only where an agency collects personal information directly from an
individual, a description which is inappropriate to cover surveillance. While principle 4 (the collection of personal
information by unfair or intrusive means) is more appropriate to cover surveillance, its exact scope is the subject of
debate. And of course the Privacy Act’s principles do not (for good reason) apply to the media in their news coverage.
The Hosking tort does not extend to surveillance (yet). The criminal law covers a very small part of the ground.
22 Overseas law reform agencies have done much work on surveillance, and so must we. It is not an easy subject.
There are differences between overt and covert surveillance; there are differences between surveillance in a public
place and surveillance in private premises. Law enforcement agencies are strictly controlled in how they can monitor
people’s activities, and it may be thought anomalous that there is much less control over the activities of private
persons. How much surveillance activity should be regarded as criminal? How much can be satisfactorily dealt with by
extensions to the Privacy Act? What role should tort play? We have begun to grapple with this complex problem.
23 The fourth difficulty is also serious. It is uncertainty. Uncertainty in law is seldom a good thing. It means
that people do not know precisely what their rights are. In privacy law it is particularly problematic, because it can
lead people to constrain their freedom of speech and freedom of action more than they need to, just to be on the safe
side. I personally believe that some elements of the Privacy Act are open to this criticism. But the new tort is
particularly uncertain, as I have indicated. The criteria it lays down are matters of impression; it has a lot of gaps
in it that will only be filled by case law, and that will take a long time to happen. There is a danger that when
pressed into action it may do more, or less, than is desirable.
24 Some say we do not need a tort at all. Indeed in some ways it is an odd tort. It addresses intangible damage:
humiliation, distress, embarrassment and hurt to dignity. Generally speaking our law has shied away from providing
remedies for that sort of damage, because it is hard to prove and quantify. Nor will the tort be much used. It is
limited in scope. As currently understood it cannot do much to prevent gross misuse of health information, credit
information and the like, unless that misuse is connected with publicity. Moreover court actions cost a lot of money and
most ordinary citizens cannot afford to bring them. There is even something of a paradox in expecting a person to go to
a court, one of the most public bodies in the land, to protect his or her privacy. In the United Kingdom where the tort
has got a firmer foothold than it has here, most of the plaintiffs to date have been the rich and famous: film stars,
entertainers, authors, models and prominent business people. (One must not, however, make too much of this. In New
Zealand since 1985 some fifteen people have brought cases wholly or partly based on privacy, and many of them have been
neither rich nor famous.)
25 The tort has the potential to affect freedom of speech. We need to ask whether we have a problem in our society
which merits such heavy machinery. The dissenters in Hosking certainly thought not. Our media are not, to date anyway,
serious infringers in the way that the English tabloids are. There is much more serious infringement by way of the
internet, but most of the perpetrators through that avenue are not worth powder and shot.
26 However to get rid of such a law, especially a judicially created one, would require very good reason, and the
arguments are certainly not all one way. A tort action can achieve something that nothing else can, at least currently:
it can enable the grant of an injunction to stop an offensive publication happening in the first place. The other
existing forms of redress all operate after the event. The courts are always reluctant to use injunctions to inhibit
publication (they are a kind of censorship), but sometimes in privacy cases they can be the most effective remedy if the
plaintiff can get in in time. The majority of claims in the court both in New Zealand and in the United Kingdom have
been for injunctions before the event rather than for damages afterwards. Injunctions aside, sometimes very serious or
persistent infringements may merit strong remedial action in the form of heavy damages. Sometimes the mere availability
of the heavy machinery of the court can create a climate of restraint which ensures that serious breaches do not happen
in the first place.
27 However given the vigorous opposition of the two dissenting judges in the Court of Appeal is it certainly worth
asking whether we should have the tort at all.
28 If it were decided that the tort should not remain, how would this be done? It is not unknown for common law
torts to be abolished by legislation. One of the shortest sentences in any statute in the world appears in a UK statute
which gets rid of the tort of detinue. The section simply reads “Detinue is abolished”. But if one did this in respect
of the privacy tort, where would that leave us? All you would have left is the current incomplete set of criminal
provisions, the incomplete regulatory controls, plus the ability of other parts of the common law to expand into the
gap. Perhaps there are two things one might do. First, one might enhance some of the current regulatory controls and
fill the gaps in them to give those agencies wider powers. Could there be attraction in having a specialist tribunal to
grant remedies for all sorts of breach of privacy? Another possibility is to get rid of the common law tort, but replace
it by a more carefully defined statutory tort. That would mean there still was a tort, but it would be possible to
define its criteria more closely (although never precisely) and fill the gaps which currently beset the common law. It
could for example be definitively stated whether corporations have any right to sue, whether claims can be brought by
the families of deceased persons, and so on. Statute always has the ability to map a field more fully and more
immediately than the common law, which sometimes has to wait for ages for the appropriate cases to arise. A statutory
tort could also, if it was thought desirable, extend to surveillance and intrusion as well as publication.
29 It must be said that attempts overseas to introduce a statutory tort have not been very successful. A few of the
Canadian provinces have done it, but not with much effect. Very few people have used them. Proposals in the United
Kingdom have come to nothing. The Australian Law Reform Commission in its recent Privacy Report does propose a statutory
cause of action. The proposal has already run into opposition. “This must rank as one of the most hairbrained ideas to
emerge from a proud institution”, said The Australian. “The only winners would be judges who would have a new weapon to
use against the media, and lawyers who would have a new stream of work to make up for what they lost in the defamation
reforms”. The Government has taken notice and the Special Minister of State recently said “Let me say clearly that I am
not progressing that recommendation at this stage”. It is different in New Zealand, of course, in that we already have a
tort, and any proposal to codify it could be argued to be an improvement.
30 In the end, might it be better just to leave the common law as it currently is and hope that it sorts itself out
over time?
31 The fifth difficulty is anomaly. When the law is inconsistent, and treats people differently when they are in
similar situations, there is lowered respect for it. Our criminal statutes provide an example.
32 As we saw they are a strange lot indeed. Some were passed before privacy was much thought of as a legal value.
Quite a lot were passed before any of the modern regulatory controls. In the old days life was simpler: if the
government wanted to stop people doing something they made it a criminal offence. These days there are other expedients
which need to be considered.
33 It is time to ask exactly when it is appropriate for the criminal law to intervene in privacy matters. This
raises important questions about the role of the criminal law. When the Law Commission recommended that intimate covert
filming be made a criminal offence, it took a range of considerations into account: the seriousness of the invasion of
the individual’s privacy; the wider implications for society; the ability of the police to stop the conduct immediately
by making an arrest; the availability of the full panoply of police investigation powers; the range of penalties and
rehabilitative options which are available to a sentencing court; and the fact that a criminal prosecution does not cost
the complainant anything whereas launching a civil action does.
34 The present range of criminal offences contain such anomalies that it needs a long hard look. Some of the
offences involve kinds of surveillance, and will be considered in the study of that subject. Others relate to other
kinds of invasion of privacy. We need to ask whether things which are currently criminalised should be, and whether
things which are not should be.
35 In our issues paper to be published in a few months time we shall be asking for feedback on questions such as
these. We very much look forward to that feedback. We need as much as we can get.
ends