Greenleaf, Graham --- "Austen v Civil Aviation Authority" [1994] PrivLawPRpr 114; (1994) 1(8) Privacy Law & Policy Reporter 150

---

Austen v Civil Aviation Authority

Federal Court of Australia, Wilcox, Foster and Carr JJ, 20 May 1994

Privacy Act 1988 (Cth) - IPP 4, IPP7, IPP 8, IPP 9, IPP 11 - meaning of ''use' - Pt VIII obligations of confidence - right of action in tort for breach of Privacy Principles

This appeal against a decision of (1994) Burchett J (see 1 PLPR 32, where the facts are set out) concerned the disclosure of a medical history file kept by the respondents concerning the appellant, Austen. Austen claimed that the disclosures gave rise to three causes of action:

(a) breach of obligations of confidence arising from the Privacy Act and in equity;

(b) the rule in Beaudesert Shire Council v Smith; and

(c) misfeasance in public office. Austen had consented to the release of the information concerned by signing a Medical Information Authority.

In relation to the Privacy Act claims, the court held that there was no breach of IPP 4 (security obligations) because the access to and use of the personal information contained in the medical history file was authorised by Austen. There was no breach of IPP 8 or IPP 9 (concerning ''use' of personal information) because the respondent, by its employed doctor, did no more thandisclose the information, and the s4 definition of ''use' states that ''use does not include mere disclosure'. IPP 7 does not impose any obligations of confidence (or other restrictions on disclosure). There was no breach of IPP 11 because it expressly permits disclosure where ''the individual concerned has consented to the disclosure', and also because IPP 11 does not apply to information collected before the commencement of the Act. There were therefore no breaches of the Privacy Act by the respondents.

The claim in equity for breach of confidence was dismissed because of Austen'sconsent. No claim for damages for breach of confidence under s93 of the Privacy Act could therefore succeed, because ''s 90 limits the operation of Part VIII (in which s93 appears) to obligations of confidence in respect of a breach of which relief may be obtained in legal proceedings'.

In obiter dicta the court said:

It would appear that a deliberate decision was made by Parliament not to give a right of action in tort for breach of a privacy principle; see the Law ReformCommission Report No 22, vol 2 para 1085 and s105-110 in the draft Bill forming Appendix A to that volume which, so far as it is relevant, is insubstantially identical terms to s89-94 of the Privacy Act as enacted; also the Explanatory Memorandum for the Privacy Bill paras 201, 203 and 205. Instead the provisions of Pt VIII of the Privacy Act can be seen as extending the remedies available in equity for breach of an obligation of confidence.

The Beaudesert claim was dismissed because there was no breach of statutory duty shown (the requirement of a positive act forbidden by law) and also because the damage to Austen was not the inevitable consequence of any such disclosure in breach of duty (if there had been a breach) but rather from Austen's resignation on other grounds. The claim of misfeasance in public office was dismissed because neither the respondents or its doctor ''acted maliciously or with knowledge that what he did was an abuse of his office'.

Comment

Although the case is one of the few to mention the Privacy Act at all, the court does not decide anything unexpected about the interpretation of the IPPs or of Pt VIII. However, its obiter remarks about a breach of the IPPs not giving rise to a right of action in tort (presumably for breach of statutory duty) are significant but (with respect) unconvincing. Without attempting to canvass the issue in detail here, it is noteworthy that the Law Reform Commission's draft Privacy Bill did not provide any remedies for breaches of the IPPs, whereas the Privacy Act that emerged from the political process provides for the Privacy Commissioner to award compensatory damages (and provide other remedies) forbreaches of the IPPs, and also allows injunctions to be obtained under s98 to prevent beaches of the IPPs. Parliament therefore chose to reject the ALRC's views on remedies for breaches of the IPPs. Clauses 201-205 of the Explanatory Memorandum only deal with Pt VIII obligations of confidence, and say nothing about the availability of tort remedies for breaches of the IPPs. Other relevant parts of the Explanatory Memorandum (for example, cl 52 dealing with the Commissioner's power to award damages, and cl 16 dealing with agencies' obligations to comply with the IPPs), are also silent on the question. The fact that Pt VIII of the Act is identical with provisions in the ALRC's Bill would therefore seem to be only one relevant consideration, and probably not the most important one.

The Full Court did not comment on Burchett J's obiter remark that the Federal Court (as distinct from the ACT Supreme Court) had no jurisdiction to award damages under Pt VIII (see (1994) 1 PLPR 33 for criticisms)

Graham Greenleaf