AustLII Home | Databases | WorldLII | Search | Feedback

University of New South Wales Law Journal Student Series

You are here:  AustLII >> Databases >> University of New South Wales Law Journal Student Series >> 2023 >> [2023] UNSWLawJlStuS 12

Database Search | Name Search | Recent Articles | Noteup | LawCite | Author Info | Download | Help

Dolan, Rory --- "Guarding the Guardians: How Should the Privacy Act 1988 (Cth) Protect Journalistic Output?" [2023] UNSWLawJlStuS 12; (2023) UNSWLJ Student Series No 23-12


GUARDING THE GUARDIANS: HOW SHOULD THE PRIVACY ACT 1988 (CTH) PROTECT JOURNALISTIC OUTPUT?

RORY DOLAN

I INTRODUCTION

Freedom of the press guarantees that citizens have access to an uncensored ‘flow of information about matters of public interest’.[1] The autonomy enhancing effects of this access are widely accepted as a tenet of democracy.[2] However, journalistic output frequently encroaches on individuals’ privacy – another bastion of democratic participation.[3] Regulators must strike a fine balance in protecting both freedom of the press and individuals' privacy to maximise the democratic utility of each construct.[4]

Section 7B(4) of the Privacy Act 1988 (Cth) (the ‘Act’) attempts to execute this balance by exempting journalistic activities of a media organisation from compliance with the Australian Privacy Principles (the ‘APPs’).[5] Yet, the Act unduly favours journalistic output by failing to limit the availability or scope of the exemption to only those activities necessary for, and APPs which impede, public interest journalism. In light of these deficiencies, this article examines how other jurisdictions have protected journalistic activities from privacy regulation. Drawing on novel criteria from the United Kingdom and Canada, this article proposes that section 7B(4) should be amended by: incorporating a public interest test; restricting the breadth of exempt APPs; and establishing an avenue to appeal the outcome of a media organisation’s complaint process.

II THE DEMOCRATIC RATIONALE FOR A JOURNALISM EXEMPTION

A Two Ingredients for Democratic Participation

The ability to restrict access to the self allows individuals to build relationships,[6] ‘form independent moral and political judgments’ and express these judgments without the influence of others.[7] The protection of individuals’ privacy is therefore a prerequisite for generating meaningful involvement in democratic society.[8]

Journalism is also an important avenue for ensuring that citizens can freely communicate and obtain information.[9] The media is often romanticised as the “fourth estate” of a parliamentary democracy – a watchdog of government process for the people.[10] Journalistic output is said to alert citizens to matters of public interest which they would otherwise lack the means to effectively monitor first hand.[11] This discourse helps ensure that government actors are held accountable for their actions (or lack thereof) and arms citizens with the information required to properly exercise their democratic rights ‘to vote, express their opinions [and] make representations to authorities’.[12] Media investigations into “pork barrelling”,[13] juvenile detention,[14] unlawful debt recovery,[15] greyhound racing,[16] and misconduct in public office,[17] each demonstrate instances where the Australian press has assumed the role of the fourth estate and galvanised political action. Thus, journalistic output and the protection of individuals’ privacy each serve as valuable mechanisms for maximising democratic participation.[18]

B The Inconsistency

However, these mechanisms conflict in operation. The media’s capacity to fearlessly criticise government actors and thereby ‘[construct] ... an open terrain of accountability’ in the public interest depends on freedom of the press.[19] The protection of individuals’ privacy, and the enforcement of laws which secure that protection, will often be inconsistent with this freedom.[20] For example, journalists may be prevented from disseminating information on matters of public interest on grounds that individuals who are the subject of that information withhold consent.[21] At least in these circumstances, there is a clear democratic rationale in ensuring individuals cannot use privacy regulation to ‘shield themselves and their activities from legitimate scrutiny’ by the press.[22]

C Subdividing the Fourth Estate: The Good and the Ugly

Yet, news media frequently distorts the public sphere and invades individuals’ privacy without a countervailing public interest justification.[23] As such, freedom of the press is an “instrumental good” – its value, in democratic terms, is contingent on the extent to which journalistic output enhances the system of representative government.[24]

1 Commoditising Privacy in Algorithmic Curation

Media organisations make editorial decisions based ‘on the economic and political structure and context of [their] institutions’ rather than a public interest vacuum.[25] This ecosystem has radically evolved following the advent of Google, Facebook, Instagram, and Twitter as dominant intermediaries through which individuals access news.[26] These platforms rely on sophisticated algorithms to sort, select, extract and order the news content which appears in users’ search results and social media feeds.[27] While the semantic rules that purportedly govern these algorithms differ between intermediaries,[28] they are each fundamentally driven by metrics of engagement such as, for example, the probability a user will click, like, comment or share a linked news article.[29]

To successfully compete for user engagement in this competitive algorithmic-curation market, media organisations are incentivised to produce and structure content in ways which capture users’ attention and generate traffic to the linked article.[30] Unfortunately, the ‘“naming and shaming” of easily denigrated members of disadvantaged or unpopular groups in society’ has proven to be a robust engagement generating input for infotainment and clickbait content.[31] Although the public may be curious about (and even desire) the publication of dating app subscriptions of unfaithful partners,[32] mental health conditions of celebrities,[33] or the identity of individuals that breach COVID restrictions,[34] there is no significant public interest justifying these types of invasions on individuals’ privacy.[35]

2 Partisanship in Australian News Media

Most Australian news brands are strongly associated with a partisan leaning which, for the most part, tracks the political orientation of that brand’s audience.[36] In Australian Broadcasting Corp v Lenah Game Meats Pty Ltd, Justice Callinan characterised the relationship between Australian journalists and politicians as a “symbiosis” in which ‘each seeks to use the other for its own purposes’.[37] This symbiosis manifests in whether, and to what extent, contentious political issues like immigration or climate change are reported and, more bluntly, how political parties are depicted.[38] For example, an analysis of the front page of major Australian newspapers in the leadup to the 2019 Australian federal election found ‘a heavy anti-Labor bias’ amongst papers owned by News Corporation and ‘a roughly equivalent – but less strident – pro-Labor bias by the old Fairfax (now Nine) newspapers’.[39]

The recent resurgence of “fake news” has only bolstered the existing apparatus media organisations wield to manipulate constituents.[40] Individuals are now increasingly willing to discredit real news in favour of ‘information that reinforces their views, no matter how distorted or inaccurate’.[41] The dissemination of disinformation to successfully: mobilise a racialised fear campaign regarding immigration before the 2016 Referendum on the United Kingdom’s Membership of the European Union (the ‘Brexit vote’); and construct a false narrative that the 2020 United States presidential election was invalidated by voter fraud, highlight the capacity for media organisations to abuse this post-truth vulnerability.[42] Clearly, journalism which misleads and deceives citizens to advance partisan interests is likely to hamper rather than enhance democratic participation.

In opposition, libertarians might contend that the deceptive output of a given source will allow for the ‘livelier impression of truth’ after being confronted and corrected by censure.[43] However, the veracity of this conflict-based model is doubtful in the Australian media landscape where the already scarce ‘mass media space-time’[44] is dominated by a handful of firms which control the vast majority of commercial news publications and broadcasters.[45] The “echo chambers” and “filter bubbles” generated by intermediary platforms only further reduce the probability that users will observe content that conflicts with views they previously exhibited a preference for.[46] Even if the truth of an issue is eventually revealed, the initial acceptance of false information can be harmful as defamation law and the prohibition on misleading or deceptive conduct in consumer protection law recognise.[47]

3 Drawing the Line

Whilst the media’s role as a public interest watchdog demands that journalism be exempted from privacy regulation, this exemption must be ‘contingent on the degree to which [journalistic output] promotes’[48] the public interest given the capacity for media to exploit the exemption for commercial and partisan gain, and the democratic value of privacy itself.

III THE AUSTRALIAN DEBATE ON THE JOURNALISM EXEMPTION

The Act protects the privacy of individuals by requiring that certain entities comply with the APPs which regulate personal information.[49] Section 7B(4) exempts ‘an act done, or practice engaged in, by a media organisation ... in the course of journalism’ from the operation of the Act, and consequently the APPs, where ‘the media organisation is publicly committed to observe’ privacy standards.[50] Activities which benefit from the exemption may nevertheless be the subject of another cause of action in, for example, defamation or equity for breach of confidence (and potentially a statutory tort for serious invasions of privacy).[51] The Act will continue to apply to non-journalistic activities of a media organisation like advertising or market research.[52]

Following a number of recommendations to improve Australian privacy regulation by the Australian Competition and Consumer Commission in its 2019 Digital Platforms Inquiry Final Report,[53] the Act was subject to significant consultation and review by the Attorney-General’s Department. This section will examine the journalism exemption in light of the submissions and proposals for reform canvassed in the consequent Privacy Act Review Report (the ‘PAR Report’).[54]

A Availability of the Exemption

1 “Media Organisation”

A “media organisation” encompasses any individual or association (excluding a small business, political party or State and Commonwealth authority) [55] that engages in

the collection, preparation, preparation for dissemination or dissemination of the following material for the purpose of making it available to the public:

(a) material having the character of news, current affairs, information or a documentary;

(b) material consisting of a commentary or opinion on, or analysis of, news, current affairs, information or a documentary.[56]

The definition was drafted broadly to enable publishers from ‘diverse and antagonistic sources’ to benefit from the exemption.[57] Since the democratic benefits of a free press require ‘freedom for all and not some’, the cohort of publishers which constitute a “media organisation” should not be restricted unnecessarily.[58] The evolution of independent content creators on streaming platforms and social media networks as popular avenues for consuming news media underscore the importance of an inclusive definition.[59]

Notwithstanding, the ‘inclusion of “information” separately from news, current affairs and documentaries’ in the definition has been criticised as overbroad.[60] It seemingly protects any entity that publishes personal information irrespective of whether the publication of that information possesses public interest value.[61] For example, lobbyists may exploit personal information of vocal opponents for political gain, or tabloids may profit from the publication of intimate photographs of celebrities on grounds they were ‘making information available to the public’.[62] To strengthen the link to public interest journalism, stakeholders have proposed that existing references to the word “information” be deleted and an additional limb be inserted ‘for information where there is a recognisable public interest in disclosure’.[63] This new limb recognises that material which is not strictly “news” oriented may possess public interest value but, given the breadth of the term “information”, a public interest test would be required to prevent misuse of the exemption.[64] However, the proposal would require that often artificial distinctions be made ‘between material of the character of news (which therefore benefits from the exemption) and material of the character of information’ which must satisfy an additional public interest test when the characterisation of material as “news” does not necessarily guarantee its public interest value.[65]

Another common proposal was to insert the word “principal” before “activities”.[66] This addition is undesirable because the dominant activities of an entity are an arbitrary proxy for determining whether any publication that entity produces is deserving of exemption from privacy regulation.[67]

2 “Journalism”

The Act does not define “journalism” and Australian courts are yet to consider how the term will limit the journalism exemption.[68] Privacy advocates have proposed that a definition be inserted which limits ‘the exemption to acts and practices that are associated with a clear public interest’.[69] An overarching public interest test would concentrate the exemption on the underlying fourth estate rationale and help prevent misuse of the exemption.[70]

However, media organisations have raised several issues with a blanket public interest test. Firstly, the test would deter valuable journalistic output by making it uncertain whether a publication constitutes “journalism” and thus benefits from the exemption.[71] Secondly, requiring media organisations to assess whether a story is in the public interest would inevitably ‘delay ... the timely publication of newsworthy material’.[72] Thirdly, it would be inappropriate for the Commissioner to adjudicate privacy complaints in respect of a public interest test under the existing framework[73] because they lack the ‘expertise or familiarity with media-specific considerations’ to determine what is public interest journalism.[74] While different versions of a public interest test were raised in the Privacy Act Review Discussion Paper, they each failed to adequately ameliorate these concerns in the view of the Attorney-General’s Department.[75]

B Scope of the Exemption

Media organisations must publicly commit to standards which ‘deal with privacy in the context of [their] activities’ before they can rely on the journalism exemption.[76] These standards may be published ‘by the organisation or a person or body representing a class of media organisations’.[77] The exemption uses a self-regulation model in which media organisations and/or bodies determine how they will ‘appropriately balance the freedom of the media to report on matters of public interest with individuals’ interest in protecting their privacy’.[78] A self-regulatory model is said to ensure that media organisations are accountable to privacy standards which are tailored to the specific broadcast, print, online or hybrid medium they operate.[79] It also conserves resources of the Office of the Australian Information Commissioner (the ‘OAIC’) as media organisations and regulators are tasked with drafting, monitoring and enforcing privacy standards.[80]

1 “Strengthening” Self-Regulation

Whilst some degree of flexibility is desirable, the Act fails to set ‘minimum standards or accountability’ for the privacy standards that a media organisation adopts.[81] Publishers are entitled to commit to privacy standards which lack clarity, unreasonably depart from the APPs and, unless a media organisation operates a “broadcasting service” and is therefore subject to regulation by the Australian Communications and Media Authority (the ‘ACMA’),[82] omit a complaints process.[83] It is particularly concerning that individuals’ opportunity to seek redress following an intrusion of privacy thus relies on such publishers ‘having voluntarily subjected [themselves] to a complaints process’.[84] In response to these issues, the PAR Report proposed to “strengthen” the existing self-regulatory regime by requiring that privacy standards be: (i) supervised by the ACMA, the Australian Press Council (the ‘APC’) or the Independent Media Council (the ‘IMC’) (each a ‘recognised oversight body’); or (ii) ‘standards that adequately deal with privacy’.[85] Yet, even where a media organisation publicly commits to privacy standards which are “adequate”, the utility of such standards in protecting individuals’ privacy is doubtful when there remains no mandated procedure for enforcement.[86]

This concern is hardly ameliorated by the input of the APC and IMC – two of the three recognised oversight bodies listed in the PAR Report.[87] While the ACMA can sanction repeated non-compliance with privacy standards using civil penalties, licence conditions or licence cancellation,[88] the APC and IMC lack authority to penalise or injunct media organisations. The APC can issue a censure or call for remedial action following an adjudication,[89] and the IMC can merely recommend the withdrawal of an online publication or the provision of an apology.[90] The lack of serious consequences for breaching the APC’s privacy standards (adopted by all but one of Australia’s largest print media organisations)[91] has led to ‘[t]he prevailing media view ... that ... any amount of low level collateral damage is an acceptable price to pay for occasional hits on major targets’.[92] The reliance of the APC and the IMC on industry funding[93] alongside poor rates of complainant success in decisions by the recognised oversight bodies only reinforce this culture of disrespect for compliance with privacy standards.[94] It casts doubt on the claim by media organisations that the low incidence of privacy complaints reflects the success of the co-regulatory model in preventing intrusions on privacy rather than, for example, a learned helplessness among victims of privacy breaches.[95] Thus, the value of any minimum standards set by a recognised oversight body (excluding the ACMA) or adequacy requirement appear moot without complementary changes to the existing enforcement framework.

2 Partial Exclusion of Self-Regulation

Privacy advocates have proposed that the journalism exemption be restricted to only those APPs which impede public interest journalism.[96] There is significant consensus among stakeholders that the fourth estate rationale justifies some form of exemption from the collection, use, disclosure and access principles (APPs 2, 3, 4, 5, 6 and 12).[97] For example, journalists could not hold politicians accountable if: consent was required prior to collecting ‘information concerning their political views’ (APP 3.3); or they could elect to have their personal information anonymised or pseudonymised (APP 2.1).[98] Further, it would be absurd to require that broadcasters justify the impracticability of notification under APP 5 each time an individual’s personal information is depicted in the broadcast of an unpredictable or crowded event like a vigil, protest or natural disaster. However, there are few circumstances in which non-compliance with principles relating to the transparent management of personal information (APP 1), direct marketing (APP 7), cross-border disclosure (APP 8), government related identifiers (APP 9) or the accuracy (APP 13), quality (APP 10) and security of personal information (APP 11), are required to facilitate public interest journalism.[99] Further, the principles based character of these APPs provide media organisations with significant leeway to mitigate any tension that may arise between compliance and public interest journalism.[100]

Notwithstanding, the PAR Report was only receptive to the argument that APP 11 and the Notifiable Data Breaches scheme be excluded from the scope of the journalism exemption.[101]

C Outstanding Issues

The discourse generated by the PAR Report on the journalism exemption has not resolved concerns that the existing self-regulation model fails to satisfactorily limit the availability of the exemption to public interest journalism, lacks sufficient accountability mechanisms to protect individuals’ privacy, and exempts media organisations from certain APPs without a commensurate public interest justification.

IV INTERNATIONAL APPROACHES TO THE PRIVACY-MEDIA DILEMMA

Several other jurisdictions have attempted to balance the protection of individuals’ privacy and public interest journalism.[102] The United Kingdom and Canada were selected for analysis in this article on the basis that these jurisdictions each have: (i) some legal recognition of the freedom of expression;[103] (ii) a system of parliamentary democracy; and (iii) a journalism exemption in their privacy regulation framework defined by reference to criteria that is novel to the Australian jurisprudence. This section will examine the desirability and feasibility of incorporating such criteria into the Act.

Both jurisdictions also exempt artistic and literary activities from privacy regulation.[104] These provisions raise interesting questions regarding the democratic value Australia ascribes to creative and academic expression.[105] However, since analogous exemptions are not contemplated by the Act, they are beyond the scope of this article.

A The United Kingdom

The Data Protection Act 2018 (UK) (the ‘DPA’) exempts the processing of personal data for journalistic purposes from select provisions of the UK General Data Protection Regulation (the ‘UKGDPR’)[106] where the controller holds a reasonable belief that: (i) ‘publication of the material would be in the public interest’;[107] and (ii) the application of those select provisions are incompatible with the purposes of journalism.[108] Unlike the Act, the DPA does not attempt to define what organisations should benefit from the exemption. Instead, any “controller” – the entity who ‘determines the purposes and means of the processing of personal data’ – may seek to rely on the exemption.[109]

1 Public Interest

The Information Commissioner’s Office (the ‘ICO’) has recently submitted a draft Data Protection and Journalism Code of Practice (the ‘Draft Code’) to the Secretary of State for parliamentary approval.[110] Under the Draft Code, controllers must be capable of demonstrating that their “reasonable belief” in both limbs was objectively reasonable at the time of publication.[111] Proof should generally take the form of a clear policy identifying how decisions will be made and evidence of compliance with that policy.[112] This framework addresses concerns expressed in the PAR Report regarding privacy regulators being the arbiter of what publications constitute public interest journalism because the ICO is merely assessing the reasonableness of a controller’s belief ‘on an objective basis’ rather than ‘[substituting] their own belief in place of [the controller]’.[113] To ensure time sensitive output is not delayed, controllers may produce reasons for their decision following publication where appropriate.[114] Controllers must consider three industry guidelines – the BBC Editorial Guidelines, Ofcom Broadcasting Code and Editors’ Code of Practice – ‘[i]n determining whether it is reasonable to believe that publication would be in the public interest’.[115] These guidelines help alleviate concerns that a public interest test would create intolerable uncertainty[116] by providing a clear non-exhaustive list of matters which are in the public interest.[117]

2 Incompatibility

Controllers will only be exempt from listed articles of the UKGDPR relating to the collection and processing of personal data which the controller reasonably believes are incompatible with their journalistic activities.[118] This requires media organisations to ‘give specific consideration to the factual position in each case’ such that they only encroach individuals’ privacy to the extent necessary for a particular publication.[119] However, an evaluation of incompatibility generally reflects the calculus used to justify ‘lawful interference with a fundamental right’.[120]

The United Kingdom’s privacy framework, as a post-Brexit derivative of the European Union approach, is underpinned by the recognition of data protection as a ‘fundamental right anchored in interests of dignity, personality and self-determination’.[121] Chapter 3 of the UKGDPR confirms this sentiment by granting data subjects: the right to access information detailing how and where their personal data is processed (Article 15); the right to have ‘inaccurate personal data concerning him or her’ rectified (Article 16); the right to demand the erasure of their personal data (Article 17); the right to restrict a controller from processing their personal data (Article 18); and the right to receive their personal data in a portable format and transfer that data to other controllers (Article 20).

The APPs mirror the substance of Articles 15 and 16 in requiring that an APP entity ‘take reasonable steps to correct personal information’ (APP 13.2) and provide access to personal information (APP 12.1), where the subject of that personal information so requests.[122] However, unlike their UKGDPR counterparts, they are expressed as obligations on an APP entity as opposed to rights that are possessed and enforceable by the data subject.[123] This distinction reflects the top down regulatory approach adopted by the Act in which the protection of individuals’ privacy is a question of compliance, and the vindication of privacy breaches depend on enforcement by the OAIC. Thus, the rights-based approach to privacy regulation in the United Kingdom is disparate in philosophy and operation to the current Australian privacy framework. Accordingly, the transposability of an incompatibility test which weighs data privacy rights against the public interest value of journalistic output is doubtful.

3 Enforcement

The ICO has a range of administrative remedies at its disposal (including administrative fines and criminal prosecutions) which it can use to sanction non-compliance with the journalism exemption.[124] Complainants may also enforce their rights under the DPA in court.[125] There is no record of any enforcement action being taken against a purported use of the journalism exemption since the ICO began publishing regulatory investigations in 2021.[126]

B Canada

Organisations are exempt from compliance with rules that ‘govern the collection, use and disclosure of personal information’ under section 4(2)(c) of the Personal Information Protection and Electronic Documents Act (the ‘PIPEDA’) ‘in respect of personal information that the organization collects, uses or discloses for journalistic ... purposes and does not collect, use or disclose for any other purpose’.[127] As such, the provision operates as a blanket exemption to privacy regulation like section 7B(4) of the Act.

The Federal Court of Canada has, in two recent cases, qualified the broad exemption in PIPEDA by confirming that an activity:

should qualify as journalism only where its purpose is to (1) inform the community on issues the community values, (2) it involves an element of original production, and (3) it involves a self-conscious discipline calculated to provide an accurate and fair description of facts, opinion and debate at play within a situation.[128]

Without any regulatory guidance or detailed judicial analysis of the new test, it remains unclear how ambiguous terms like “self-conscious discipline”, or “element of original production”, will be defined. While the first limb reads like an expansive interpretation of a public interest test, the latter originality and accuracy limbs are novel in the context of the Australian and United Kingdom exemptions.

1 Originality

An originality requirement is apt to incentivise media organisations to generate new content by excluding the publication of recycled material from the journalism exemption such that it must comply with Part 1 of PIPEDA.[129] In theory, this incentive should increase the volume of unique journalistic output by coercing media organisations to complete their own research and analysis.[130] Yet, originality is a nebulous concept in journalism as ‘stories can develop and evolve, and may include a mix of original and attributed content and original analysis’.[131] Accordingly, there is a real risk that uncertainty regarding what is “original content” (and therefore benefits from the journalism exemption) could have a chilling effect on public interest journalism. Further, it is debatable whether preventing the publication of recycled material would meaningfully reduce the harm individuals suffer when publications encroach on their privacy given the pervasive modes most news media organisations use to disseminate content. Without further modelling confirming the value of an originality requirement in enhancing public interest journalism, there is little privacy or freedom of expression justification for incorporating one into the Act.

2 Fairness and Accuracy

An accuracy requirement should exclude publications which contain disinformation as this journalistic output is, by definition, calculated to be inaccurate. It recognises that a journalism exemption should depend on the intended reliability of journalistic output because information which misrepresents issues of public interest can manipulate democratic participation.[132] Therefore, there are strong grounds for importing an accuracy requirement into section 7B(4) because the exploitation of journalistic output for ‘ulterior motivations and partisan self-interest’ are not deserving of special protection under the journalism exemption.[133]

V CONCLUSION

Freedom of the press and privacy are each indispensable yet contradictory elements of a functioning democracy.[134] To maximise the democratic utility of both elements, journalistic activities should be exempt from privacy regulation to the extent necessary to facilitate public interest journalism.[135] Section 7B(4) of the Act fails to execute this balance as it does not limit the availability or scope of the journalism exemption to only those activities and APPs which impede public interest journalism. In light of these deficiencies, this article examined how other jurisdictions exempt journalistic activities from privacy regulation. This article proposes that Parliament draw on desirable criteria from the United Kingdom and Canada and amend the journalism exemption in the following respects:

(1) Media organisations must ‘reasonably believe that the publication of the material’ which is the subject of the exemption serves the public interest.[136] Following consultation with industry, the OAIC should publish guidelines on what criteria will be used to assess the reasonableness of an organisations belief, including whether the material is accurate and enhances understanding of issues the public ‘might be legitimately interested in’.[137]

(2) Activities that satisfy the exemption criteria should only be exempt from the collection, use, disclosure and access principles (APPs 2, 3, 4, 5, 6 and 12).[138]

(3) Under section 7B(4)(b), media organisations must be ‘publicly committed to observing fair and reasonable standards' before benefiting from the journalism exemption. These standards must contain a mechanism for reviewing complaints and a right to appeal any outcome of this complaints process to the OAIC.[139]

Proposals 1 and 2 seek to prevent misuse of the journalism exemption by limiting the availability of the exemption to public interest journalism and the scope of the exemption to those APPs which have been identified as necessary to facilitate public interest journalism. Importantly, the former proposal preserves the spirit of self-regulation by deferring to the judgment of media organisations in what journalistic output is in the public interest, unless their belief is not objectively reasonable. Furthermore, media organisations can still tailor the regulation of exempt activities to their journalistic output so long as it aligns with community expectations of what is “fair and reasonable” under Proposal 3.[140] Finally, the mandatory appeal mechanism will ensure ‘that complainants can seek enforceable remedies’ where they are dissatisfied with the outcome of the complaint process set by media organisations.[141]

The federal government is yet to respond to the PAR Report with a draft amendment bill detailing which (if any) of its five proposals to amend the journalism exemption they will seek to enact. However, the decades of inaction which have followed similar proposals by the Australian Law Reform Commission engender scepticism that such a bill will deliver sufficient reform to effectively balance individuals’ privacy and public interest journalism.[142]


[1] Jack R Herman, ‘Freedom of the Press: Under Threat?’ [2005] UNSWLawJl 57; (2005) 28(3) UNSW Law Journal 909, 909.

[2] Judith Lichtenberg, ‘Foundations and Limits of Freedom of the Press’ (1987) 16(4) Philosophy & Public Affairs 329, 329.

[3] Bilyana Petkova, ‘Privacy as Europe’s First Amendment’ (2018) 25(2) European Law Journal 140, 152.

[4] Attorney-General’s Department, Privacy Act Review Report (Report, 16 February 2023) 84 (‘PAR Report’).

[5] Provided certain conditions are met: Privacy Act 1988 (Cth) ss 7(1)(ee), 7B(4) (‘Privacy Act’). See Pt III below.

[6] Daniel J Solove, Understanding Privacy (Harvard University Press, 2008) 35.

[7] Helen Nissenbaum, Privacy in Context: Technology, Policy and the Integrity of Social Life (Stanford University Press, 2010) 74–5.

[8] Petkova (n 3) 152.

[9] Daniel Joyce, ‘Privacy in the Digital Era: Human Rights Online?’ [2015] MelbJlIntLaw 9; (2015) 16(1) Melbourne Journal of International Law 270, 273.

[10] Madeleine Wall, ‘Data Retention and its Implications for Journalists and their Sources: A Way Forward’ (2018) 22 Media & Arts Law Review 315, 317–8. But see Jenifer Whitten-Woodring and Patrick James, ‘Fourth Estate or Mouthpiece? A Form Model of Media, Protest, and Government Repression’ (2012) 29(2) Political Communication 113.

[11] Anthony Gray, ‘The Punishment of Journalists for Contempt for Refusing to Reveal Their Sources in Court’ (2019) 29(2) Journal of Judicial Administration 60, 66 quoting Cox Broadcasting Corporation v Cohn, [1975] USSC 44; 420 US 469, 491–2 (White J).

[12] Moira Paterson, ‘Surveillance in Public Places and the Role of the Media: Achieving an Optimal Balance’ (2009) 14 Media & Arts Law Review 241, 251 quoting McCartan Turkington Breen v Times Newspapers Ltd (Northern Ireland) [2000] UKHL 57; [2001] 2 AC 277, 290 (Lord Bingham).

[13] Independent Commission Against Corruption (NSW), Investigation into Pork Barrelling in NSW (Report, August 2022) 13.

[14] Kate Fitz-Gibbon and Faith Gordon, ‘One Year on from Royal Commission Findings on Northern Territory Child Detention: What has Changed?’, The Conversation (online, 19 November 2018) <https://theconversation.com/one-year-on-from-royal-commission-findings-on-northern-territory-child-detention-what-has-changed-106993>.

[15] Luke Henriques-Gomes, ‘Robodebt Scandal: Leak Reveals Unlawful Debts Predate 2015 but Government Has No Plans to Pay Back Money’, The Guardian (online, 31 May 2020) <https://www.theguardian.com/australia-news/2020/may/31/robodebt-scandal-leak-reveals-unlawful-debts-predate-2015-but-government-has-no-plans-to-pay-back-money>.

[16] Michael McHugh, Special Commission of Inquiry into the Greyhound Racing Industry in New South Wales (Report, 16 June 2016) 7.

[17] Anne Davies, ‘For Years Eddie Obeid Fended Off All Allegations. Now the Truth Can’t be Denied’, The Guardian (online, 20 July 2021) <https://www.theguardian.com/world/2021/jul/20/for-years-eddie-obeid-fended-off-all-allegations-now-the-truth-cant-be-denied>.

[18] Joyce (n 9) 273; Petkova (n 3) 152.

[19] Paterson (n 12) 251; David Rolph, Matt Vitins, Judith Bannister, Daniel Joyce, Jason Bosland, Michael Douglas and Jonathan Gill, Media Law: Cases, Materials and Commentary (Oxford University Press, 3rd ed, 2022) 24 (‘Media Law’).

[20] Ibid.

[21] Australian Broadcasting Corporation, Submission No 622399074 to Attorney General’s Department, Privacy Act Review: Discussion Paper (7 February 2022) 4 (‘ABC Submission’).

[22] Special Broadcasting Service, Submission No 1045800035 to Attorney General’s Department, Privacy Act Review: Discussion Paper (January 2022) 11 (‘SBS Submission’).

[23] Salinger Privacy, Submission No 536332874 to Attorney General’s Department, Privacy Act Review: Discussion Paper (3 January 2022) 20 (‘Salinger Submission’); Johan Lidberg, ‘The Distortion of the Australian Public Sphere: Media Ownership Concentration in Australia’ (2019) 90(1) Australian Quarterly 12.

[24] Media Law (n 19) 44.

[25] Lichtenberg (n 2) 330.

[26] See eg Australian Competition and Consumer Commission, Digital Platforms Inquiry (Final Report, June 2019) 170 (‘DPI Final Report’).

[27] Ibid.

[28] See Google, ‘How Results are Automatically Generated’, Google Search (Web Page) <https://www.google.com/search/howsearchworks/how-search-works/ranking-results/#context>; Meta, ‘How Facebook Distributes Content’, Meta Business Help Centre (Web Page) <https://en-gb.facebook.com/business/help/718033381901819?id=208060977200861>; Meta, ‘Shedding More Light on How Instagram Works’, About Instagram (Web Page, 8 June 2021) <https://about.instagram.com/blog/announcements/shedding-more-light-on-how-instagram-works>; Twitter, ‘Twitter's Recommendation Algorithm’, Twitter Engineering (Web Page, 31 March 2023) <https://blog.twitter.com/engineering/en_us/topics/open-source/2023/twitter-recommendation-algorithm>.

[29] Juliane A Lischka and Marcel Garz, ‘Clickbait News and Algorithmic Curation: A. Game Theory Framework of the Relation Between Journalism, Users and Platforms’ (2021) 22 News Media & Society 1, 2.

[30] Ibid; Robyn Caplan and Danah Boyd, ‘Isomorphism through Algorithms: Institutional Dependencies in the Case of Facebook’ (2018) 12 Big Data & Society 1, 5.

[31] Australian Privacy Foundation, Submission No 911440810 to Attorney General’s Department, Privacy Act Review: Discussion Paper (24 January 2022) 8.

[32] Australian Associated Press, ‘Radio Hosts Tell Woman Live on Air Her Husband had Ashley Madison Account’, The Guardian (online, 20 August 2015) <https://www.theguardian.com/technology/2015/aug/20/radio-hosts-tell-woman-live-on-air-her-husband-had-ashley-madison-account> discussed in Salinger Submission (n 23) 20.

[33] Lexie Cartwright, ‘Kate Ritchie Blasts Daily Mail for “Shocking Invasion of My Privacy” Over Clinic Photos’, News.com.au (online, 8 December 2022) <https://www.news.com.au/entertainment/celebrity-life/kate-ritchie-blasts-daily-mail-for-shocking-invasion-of-my-privacy-over-clinic-photos/news-story/0e04c54a486f699cf69a43fe365e187c>.

[34] Jessica Marszalek, ‘Enemies of the State: Outrage as Deceptive Teens Cause COVID Chaos’, The Courier Mail (Brisbane, 30 July 2020) discussed in Salinger Submission (n 23) 20.

[35] Stephen Whittle and Glenda Cooper, Privacy, Probity and Public Interest (Oxford University Press, 2009) 57.

[36] Sora Park, Caroline Fisher, Glen Fuller and Jee Young Lee, Digital News Report: Australia 2018 (Report, June 2018) 90–9 (‘Digital News Report’).

[37] (2001) 208 CLR 199, [254] (Callinan J) (‘Lenah Game Meats’).

[38] See eg Johan Lidberg, ‘Australian Media Coverage of Two Pivotal Climate Change Summits: A Comparative Study Between COP15 and COP21’ (2018) 24(1) Pacific Journalism Review 70; The Centre for Media Transition, University of Technology Sydney, News in Australia: Impartiality and Commercial Influence (Report, January 2020) 62–3.

[39] Denis Muller, ‘Outrage, Polls and Bias: 2019 Federal Election Showed Australian Media Need Better Regulation’, The Conversation (online, 22 May 2019) <https://theconversation.com/outrage-polls-and-bias-2019-federal-election-showed-australian-media-need-better-regulation-117401>.

[40] On the distinction between ‘fake news’ and ‘disinformation’, see House of Commons, Digital, Culture, Media and Sport Committee, Disinformation and “Fake News”: Final Report (Report No 8, 14 February 2019) 7. Note that the draft Communications Legislation Amendment (Combatting Misinformation and Disinformation) Bill 2023 (Cth) (the ‘Bill’) was released on 24 June 2023. Subject to further consultation, the Bill proposes to grant the Australian Communications and Media Authority additional powers to sanction the dissemination of misinformation and disinformation by digital platforms.

[41] Ibid 5.

[42] Simon Faulkner, Hannah Guy and Farida Vis, ‘Right-Wing Populism, Visual Disinformation and Brexit’ in Howard Tumber and Silvio Waisbord (ed), The Routledge Companion to Media Disinformation and Populism (Routledge, 1st ed, 2021) 199-200; Amy Mitchell, J, Baxter Oliphant, Hannah Klein and Andrew Grant, How Americans Navigated the News in 2020: A Tumultuous Year in Review (Report, 22 February 2021) 33; DPI Final Report (n 26) 352.

[43] John Stuart Mill, On Liberty and Other Essays, ed John Gray (Oxford University Press, 1991) 57.

[44] There is a limited volume of news, commentary, and opinion that can be aired across the ‘major channels of mass communication’. Accordingly, publishers must be selective with the content and views they disseminate: Lichtenberg (n 2) 330.

[45] As of 2021, News Corporation (59%) and Nine (23%) reportedly owned 86% of the metropolitan and national print media markets by readership, and Nine and Seven Media Holdings reportedly shared, on average, 75% of the national commercial television market by viewership: Benedetta Brevini and Michael Ward, Who Controls Our Media? Exposing the Impact of Media Concentration on Our Democracy (Report, 12 April 2021) 55, 64.

[46] DPI Final Report (n 26) 346–9.

[47] Media Law (n 19) 23. See Competition and Consumer Act 2010 (Cth) sch 2 s 18.

[48] Lichtenberg (n 2) 332.

[49] Privacy Act (n 5) s 15.

[50] Ibid ss 7(1)(ee), 7B(4).

[51] Over twenty years after Lenah Game Meats (n 37) first considered the potential for a tort of privacy, the Attorney-General’s Department recommended that a statutory tort for serious invasions of privacy be introduced in the PAR Report (n 4): at 280–7.

[52] Thomson Reuters, Media and Internet Law and Practice (at 30 January 2021) Privacy, Surveillance and Confidentiality, ‘Media Exemption’ [12.20].

[53] DPI Final Report (n 26) 23–5.

[54] PAR Report (n 4) 90–8.

[55] Privacy Act (n 5) s 6C(1).

[56] Ibid s 6(1) (definition of ‘media organisation’).

[57] Associated Press v US [1945] USSC 133; (1945) 326 U.S. 1, [20] quoted in Australian Law Reform Commission, For Your Information: Australian Privacy Law and Practice (Report No 108, August 2008) 1451 [42.47] (‘For Your Information’).

[58] Ibid 1451 [42.47]; 1350 [42.45].

[59] See, eg, Nic Newman, How Publishers are Learning to Create and Distribute News on TikTok (Report, 8 December 2022) 3–4.

[60] Nigel Waters, ‘Can the Media and Privacy Ever Get On?’ (2002) 8(8) Privacy Law and Policy Reporter 149:1–8, 3.

[61] Standing Committee on Legal and Constitutional Affairs, Parliament of Australia, Advisory Report on the Privacy Amendment (Private Sector) Bill 2000 (Report, 26 June 2000) 40 [4.15] (‘Advisory Report on Privacy Amendment’).

[62] Ibid 40 [4.13] (emphasis added).

[63] For Your Information (n 57) 1449 [42.39]–[42.42].

[64] Ibid.

[65] Advisory Report on Privacy Amendment (n 61) 42–3 [4.25].

[66] Ibid 41 [4.20].

[67] Ibid 43 [4.26].

[68] For Your Information (n 57) 1446 [42.27].

[69] Ibid 1449 [42.39].

[70] See Lenah Game Meats (n 37) 285 [211] (Kirby J).

[71] ABC Submission (n 21) 5; SBS Submission (n 22) 11.

[72] Advisory Report on Privacy Amendment (n 61) 46 [4.38].

[73] See Privacy Act (n 5) pt V.

[74] PAR Report (n 4) 87.

[75] Ibid 88.

[76] Privacy Act (n 5) s 7B(4)(b)(i).

[77] Ibid s 7B(4)(b)(ii).

[78] PAR Report (n 4) 87–8.

[79] Nine, Submission No 943372243 to Attorney General’s Department, Privacy Act Review: Discussion Paper (25 January 2022) 5 (‘Nine Submission’).

[80] Ray Finkelstein and Rodney Tiffen, ‘When Does Press Self-Regulation Work?’ [2015] MelbULawRw 6; (2015) 38(3) Melbourne University Law Review 944, 950.

[81] PAR Report (n 4) 87.

[82] Broadcasting Services Act 1992 (Cth) s 6(1) (definition of ‘broadcasting service’) (‘BS Act’). The ACMA also regulates non-traditional forms of media including datacasting services and, following recent reform, online content service providers: Australian Communications and Media Authority Act 2005 (Cth) s 10(1).

[83] PAR Report (n 4) 88.

[84] Ibid.

[85] Ibid (emphasis added).

[86] Waters (n 60) 2.

[87] PAR Report (n 4) 88.

[88] BS Act (n 82) ss 140A–3.

[89] For Your Information (n 57) 1458 [42.74]; ‘Handling of Complaints’ Australian Press Council (Web Page, November 2019) <https://presscouncil.org.au/complaints/handling-of-complaints>.

[90] ‘The Independent Media Council Guidelines’, Independent Media Council (Web Page) [8] <http://www.independentmediacouncil.com.au/> (‘IMC Guidelines’).

[91] Daniel Ward, ‘Breaking News: An Assessment of the Finkelstein Report’s News Media Council’ (2012) 17 Media & Arts Law Review 337, 340-1.

[92] Waters (n 60) 2.

[93] Australian Press Council, Annual Report 2021-2022 (Report No 46, 13 July 2023) 18; Raymond Finkelstein, Independent Inquiry into the Media and Media Regulation (Report, 28 February 2012) 183 [6.68], 282 [11.12]; IMC Guidelines (n 90) [4].

[94] The PAR Report (n 4) cited submissions that six privacy complaints were upheld by the ACMA from 2017 to 2021, and five of 94 privacy complaints were upheld by the APC between 2017 and 2018: at 85.

[95] Ibid.

[96] Salinger Submission (n 23) 17.

[97] Ibid; Waters (n 60) 3; Electronic Frontiers Australia, Submission No 27128620 to Attorney General’s Department, Privacy Act Review: Discussion Paper (10 January 2021) 8 (‘Electronic Frontiers Submission’).

[98] Nine Submission (n 79) 4.

[99] Waters (n 60) 3; Salinger Submission (n 23) 17; ‘Australian Privacy Principles: Quick Reference’, Office of the Australian Information Commissioner (Web Page) <https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-quick-reference>.

[100] PAR Report (n 4) 91.

[101] Ibid.

[102] For Your Information (n 57) 1440 [42.4].

[103] See Canada Act 1982 (UK) c 2(b), sch B pt I (‘Canadian Charter of Rights and Freedoms’); Human Rights Act 1998 (UK) sch 1 pt I art 10.

[104] See Data Protection Act 2018 (UK) s 174 (‘DPA’); Personal Information Protection and Electronic Documents Act, SC 2000, c 5, s 4(2)(c) (‘PIPEDA’).

[105] See generally David Erdos, ‘Freedom of Expression Turned on its Head? Academic Social Research and Journalism in the European Union’s Privacy Framework’ (Oxford Legal Studies Research Paper No 53/2011, University of Oxford, November 2011); Barbara McDonald, ‘A Statutory Action for Breach of Privacy: Would it Make a (Beneficial) Difference?’ (2013) 36 Australian Bar Review 241, 259.

[106] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ L 119/1.

[107] DPA (n 104) sch 2 pt 5 para 26(2).

[108] Ibid sch 2 pt 5 paras 26(1), (3).

[109] Ibid s 6(1).

[110] Ibid s 125.

[111] Information Commissioner’s Office, Data Protection and Journalism Code of Practice (Draft Statutory Code of Practice, 6 July 2023) 35.

[112] Ibid 36.

[113] Ibid.

[114] Ibid.

[115] DPA (n 104) sch 2 pt 5 paras 26(5), (6).

[116] See eg SBS Submission (n 22) 11.

[117] See eg ‘Editorial Guidelines’, British Broadcasting Corporation (Web Page) 14 <https://www.bbc.com/editorialguidelines/guidelines>.

[118] DPA (n 104) sch 2 pt 5 para 26(3).

[119] Hugh Tomlinson, ‘The “Journalism Exemption” in the Data Protection Act: Part 1, The Law’, The International Forum for Responsible Media (Blog, 28 March 2017) <https://inforrm.org/2017/03/28/the-journalism-exemption-in-the-data-protection-act-part-1-the-law-hugh-tomlinson-qc/>.

[120] Miranda Mourby, Heather Gowans, Stergios Aidinlis, Hannah Smith and Jane Kaye, ‘Governance of Academic Research Under the GDPR: Lessons from the UK’ (2019) 9(3) International Data Privacy Law 192, 198.

[121] James Meese, Punit Jagasia and James Arvanitakis, ‘Citizen or Consumer? Contrasting Australia and Europe’s Data Protection Policies’ (2019) 8(2) Internet Policy Review 1, 3.

[122] See Office of the Australian Information Commissioner, ‘Australian Entities and the European Union General Data Protection Regulation’, Privacy Guidance for Organisations and Government Agencies (Website, 8 June 2018) <https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/more-guidance/australian-entities-and-the-european-union-general-data-protection-regulation>.

[123] James Meese and Rowan Wilken, ‘Google Street View in Australia: Privacy Implications and Regulatory Solutions’ (2014) 19(4) Media & Arts Law Review 305, 316.

[124] DPA (n 104) pt 6; ‘Complaining to the ICO About a Media Organisation’, Information Commissioner’s Office (Web Page) <https://ico.org.uk/for-the-public/data-protection-and-journalism/complaining-to-the-ico-about-a-media-organisation/>.

[125] Ibid ss 177(5)(b), 167–9.

[126] See ‘Action We’ve Taken’, Information Commissioner’s Office (Web Page) <https://ico.org.uk/action-weve-taken/>.

[127] PIPEDA (n 104) ss 3, 4(2)(c).

[128] Reference re Subsection 18.3(1) of the Federal Courts Act [2021] FC 723, [63] (emphasis added); A.T. v Globe24h.com [2017] FC 114, [68].

[129] DPI Final Report (n 26) 249, 345.

[130] Ibid 167.

[131] Ibid 250.

[132] Ibid 353; Petkova (n 3) 152.

[133] Finkelstein and Tiffen (n 80) 952.

[134] Lichtenberg (n 2) 329.

[135] Ibid.

[136] DPA (n 104) sch 2 pt 5 para 26(2)(b).

[137] Australian Communications and Media Authority, Privacy Guidelines for Broadcasters (Guidelines, September 2016) 6.

[138] Waters (n 60) 3; Electronic Frontiers Submission (n 97) 8; Salinger Submission (n 23) 17.

[139] Salinger Submission (n 23) 20.

[140] PAR Report (n 4) 110.

[141] Salinger Submission (n 23) 20.

[142] See For Your Information (n 57) 54–5.


AustLII: Copyright Policy | Disclaimers | Privacy Policy | Feedback
URL: http://www.austlii.edu.au/au/journals/UNSWLawJlStuS/2023/12.html