Tucked away at the end of the Harmful Digital Communications (HDC) Bill is an amendment to the Privacy Act to stop unreasonable or unfair propagation of personal information already publicly available.
“I just re-tweeted it” or “Everyone already knows” will generally no longer be available as a defence for breaching a person’s privacy, online or otherwise.
For example, you could get into trouble for embedding or sharing a link to a video that inappropriately discloses personal information. Using personal information from a publication already publicly available, say a blog post, will be as bad as the original breach.
(This is the fourth post looking at the HDC Bill from various angles. The first one was about safe harbours.)
Why the change?
Currently both principles 10 and 11 have an exception that overrides the limitations on the use and disclosure of personal information if “the source of the information is a publicly available publication”.
In its final Stage 4 report reviewing the Privacy Act the Law Commission noted:
“We think the scope of the “publicly available publication” exception to the use and disclosure principles (principles 10 and 11) should be narrowed. Reuse or disclosure that is inconsistent with the purpose for which the information was published, or that involves the use or disclosure of sensitive information that has been made publicly available without the authorisation of the individual concerned, can be harmful to individual privacy…. Most privacy statutes in comparable jurisdictions overseas limit the scope of the exception in some way.”
This proposed change to the Privacy Act is almost entirely due to the efforts of one person- University of Otago’s Professor Paul Roth. He published a paper in 2010 called Data Protection Meets Web 2.0: Two Ships Passing in the Night (costs A$ 25) that lays out the need for the law change.
Unwilling to spend $28 to read the paper, I understand it looks at the ‘publicly available publication’ exception in detail. This includes the impact of the Web as well as comparing New Zealand to other jurisdictions.
The Law Commission recommended amendments to principles 10 and 11 “to provide that the exceptions cannot be relied on if, in the circumstances of the case, it would be unfair or unreasonable to use or disclose personal information obtained from a publicly available publication.” (emphasis added)
Clause 34 of the HDC Bill seeks to amend the Privacy Act accordingly.
Quite deliberately, the threshold of “unfair or unreasonable” is substantially and significantly different from that of “harm” (serious emotional distress) in the HDC Bill generally. For example, it would prevent “unfair or unreasonable” use or re-use of a published photograph of a person which doesn’t cause “harm” to that person as such.
I support this change to minimise the loss of privacy in some circumstances and the re-victimisation or further victimisation that could occur from someone publicly publishing a person’s personal information wrongly. However, this comes with three caveats:
1. Once something is publicly available on the Web, much of the damage has already been done. It’s relatively easy to refer to the source information in such a way that it is a Google search away. All of this without breaking the law. In some cases, the law change could even have a negative impact, thanks to the Streisand effect.
2. Thinking about the recent Roast Busters case, if this law change was in force, would there have been an ability for people to look at and consider the source video? It seems that knowing about and looking at the video was a necessary ingredient to ignite widespread concern and discussion. Will our ability to discuss and call for societal change be constrained by an inability to view or spread offending material that is already public? How much legal advice is going to be required to figure out what is or isn’t allowable under the rather ambiguous term “unfair or unreasonable”?
3. There are so many people, including me, that just assume that information already public is, er, public. We re-tweet, blog, share, and re-use publicly published information without much thought. Some government agency will need to effectively inform people about the change. Otherwise, many people are going to be caught out.
[Subsequent posts on the HDC Bill]