Why creative professionals must carefully navigate new privacy tort

Roxanne Lorenz, Principal Solicitor at the Arts Law Centre of Australia, says, “Whereas artists may have had more room to justify their choices and expressions to reduce liability before, the new tort for serious invasion of privacy creates new burdens of proof and heightened risks when making artistic choices.”

Reforms to the Act are designed to strengthen individual privacy rights and to provide greater powers to the Office of the Australian Information Commissioner (OAIC). Alongside a statutory tort for serious invasions of privacy, further reforms include new criminal offenses for doxxing, and increased penalties for privacy breaches, the introduction of a Children’s Online Privacy Code and stricter overseas disclosure requirements. Each of these reforms were based upon proposals of a review of the Privacy Act completed in 2022. The Attorney General released the Privacy Act review report  on 16 February 2023, informed by recommendations made in the Digital platforms inquiry – final report published by the Australian Competition and Consumer Commission (ACCC) in 2019. At that time, the ACCC argued various international jurisdictions, including the EU, were reforming their privacy laws in light of technological advancements.

Digital expansion demands enhanced privacy protections

The reforms under the Privacy and Other Legislation Amendment Bill 2024 were introduced to Parliament in September last year, amendments agreed and passed in the Senate in November. Per the Bill, a key reason for the reforms is the “rapidly evolving digital landscape presents opportunities for innovation, advances in productivity and efficiency, and a range of other benefits for all Australians. However, the Privacy Act has not kept pace with Australians’ widespread adoption and reliance on digital technologies, which increases the risks that personal data will be subject to misuse or mishandling, including through data breaches, fraud and identity theft, unauthorised surveillance and other significant online harms.”

In providing a statutory cause of action for serious invasions of privacy, the Bill justified enhanced cause of action in tort to recommendations made in both the Australian Law Reform Commission’s (ALRC’s) 2008 report For Your Information: Australian Privacy Law and Practice (ALRC Report 108), and the ALRC’s 2014 report Serious Invasions of Privacy in the Digital Era (ALRC Report 123).

There was previously a patchwork of common law, criminal law, and privacy legislation addressing breaches of privacy at Commonwealth, state and territory levels but variations between jurisdictions resulted in uneven legislative tools to address privacy breaches of varying levels of seriousness.

Plaintiff must prove their privacy has been invaded

The reforms mean individuals would have a cause of action, according to the Bill, “if they suffer an invasion of their privacy, either by an intrusion into their seclusion or by misuse of information, when: a person in their position would have had a reasonable expectation of privacy in all the circumstances; the invasion of privacy was intentional or reckless; and the invasion of privacy was serious. Where one or more competing public interests are identified by a defendant (for example, the public interest in freedom of expression), the plaintiff must also satisfy the court that the public interest in protecting their privacy outweighs those competing public interests.”

However, artists who are packing up their photography equipment shouldn’t be too hasty. There are protections for creative professionals and journalists. Defences ensure the upholding of “the vital public interest in press freedom, including the role of journalists in fostering informed public debate, to promote accountability and transparency, and serve as a platform for diverse opinions and voices.”

Under the new tort, courts may award damages for ‘emotional distress’ with a maximum cap for damages for non-economic loss and exemplary or punitive damages of $478,550 or the maximum amount of damages for non-economic loss under defamation law. Courts will also have a toolkit of remedies beyond, or in addition to, damages ‘as the court thinks appropriate in the circumstances’.

A plaintiff will have a cause of action in tort against a defendant where:

• the defendant invaded the plaintiff’s privacy by doing one or both of the following:
  • intruding upon the plaintiff’s seclusion
  • misusing information that relates to the plaintiff and
• a person in the position of the plaintiff would have had ‘a reasonable expectation of privacy in all of the circumstances’
• the invasion of privacy was intentional or reckless and
• the invasion of privacy was serious.

“Intruding upon the seclusion” of an individual is defined as ‘physically intruding into the person’s private space’ and ‘watching, listening to or recording the person’s private activities or private affairs’. Should the plaintiff believe their private affairs have been observed and recorded, then potentially shared against their will or in a way that causes distress, they do not need to prove damage. The new tort is ‘actionable without proof of damage’. According to the Bill, “a range of factors are listed which a court may consider in determining whether ‘a person in the position of the plaintiff would have had a reasonable expectation of privacy in all of the circumstances’ and whether the invasion of privacy was serious.”

There is a timeframe for actions, meaning that a documentary film, street scene photograph, or biographical written work cannot be the cause of an action decades after it is made public. Plaintiffs must commence an action, according to the Bill, “before the earlier of ‘1 year after the day on which the plaintiff became aware of the invasion of privacy’ and ‘the day that is 3 years after the invasion of privacy occurred’. If the plaintiff was under 18 at the time when the invasion of privacy occurred, they must commence an action before their 21st birthday.”

Defences of the creative professional

The Bill clarifies that ‘artistic expression’ is a form of freedom of expression worthy of being a ‘countervailing public interest’, and journalists have a specific defence applicable to their industry.

Where the defendant believes they have acted in the public interest, the onus is on the plaintiff to satisfy the court that protecting the plaintiff’s privacy outweighs the public interest inherent in the alleged breach of privacy. The invasion of privacy must also have been reckless or intentional, rather than negligent.

Further defences include, according to the Bill:

• where the plaintiff, or another authorised person, expressly or impliedly consented
• where the defendant reasonably believed it was necessary ‘to prevent or lessen a serious threat to the life, health or safety of a person’
• where it was both incidental to the exercise of a lawful right of defence of persons or property and ‘proportionate, necessary and reasonable’.

Sydney photographers weigh in

Sydney-based architectural photographer Chris Cook says he wasn’t aware the laws had changed.

He tells LSJ Online, “To be honest, it’s probably a good thing.”

He explains, “I do some urban landscape photography in my spare time, and people form a part of that. On most occasions, people are captured from behind or they are blurred to a point of being unrecognisable.

“My main work is architecture photography, and clients generally want people in the scene to have motion blur or be removed entirely. Occasionally someone will ask what I’m photographing, and I tell them and explain that I can delete the images and retake the scene.”

Fellow photographer Sam Ferris says, “[Reforms to] the Privacy Act actually came up recently in a street photography group chat I’m part of. It immediately brought to mind the landmark U.S. case where Philip-Lorca diCorcia was sued by one of his subjects. He ultimately won, and I’d like to think that if a similar case ever arose in Australia, common sense would prevail here too.”

He adds, “Over the 15 years or so I’ve done it, I can count the number of negative encounters I’ve had on one hand. Most people who approach me to ask what I’m doing are curious rather than confrontational, and once I explain my process and show them my work, the conversation usually turns into one of mutual respect and interest. These new laws won’t change how I operate because my practice has never caused harm.”

Both Ferris and Cook compare the privacy risks of their work with the near-constant surveillance in public.

Ferris says, “If we’re talking about genuine privacy threats, I think it’s important to remember that we live in a world saturated with CCTV cameras and a growing array of technologies tracking our movements and harvesting our personal data in ways that are far more invasive than a photograph taken on a city street. If someone is truly concerned about the erosion of privacy, my photographs are the least of their worries.”