Reporting and remedies - Black holes of privacy

Graham Greenleaf‘What use are Privacy Commissioners?’

9 September 2003See http://www2.austlii.edu.au/~graham/ for updates / details

Overview - two black holes What evidence is there that Commissioners

do their job? Most important function: resolving complaints Is there accountability for public monies spent?

Outcomes of complaints - fair remedies? Does anyone get a remedy?

Reporting complaints - what law is applied? Track record of Asia-Pacific Commissioners Some practical improvements

Outcomes - Does anyone get a remedy? Evidence available?

√ Annual Reports - only public source ? websites? - could extract from reported cases -

should provide continuous data ? FOI requests? - no ‘document’ available?

Only some jurisdictions considered Privacy Comms - Australia; NSW; HK; NZ Other Comms (Canada, Korea) might differ Information Commissioners not considered -

mainly access, some correction, some broader

Outcomes - Australian PC 2001-02 Annual Report - no statistics!

Complaints tripled with private sector coverage (611) AR contains summaries of 11 complaints, of which one

resulted in $5000 compensation No statistics given of complaint outcomes at all

2000-01 AR included some outcome stats 133 closed complaints; uncertain % breaches found 9 cases in AR involved $52,000 compensation No information about other remedies

No genuine s52 determinations in 15 years No appeal right; No substantive case on the Act

ever before a Court for judicial review

Outcomes - NSW PC latest Annual Report 1999-2000 before

new Act commenced (1/7/00) No statistics or complaint resolutions yet

available under new Act Since 2000, about 20 cases to NSW ADT

7 decided as yet - 7 more than the Cth! AR 1999-2000 relevant to ‘non-IPP’

complaints, as they still apply 4 complaint resolutions summarised

Outcomes - Hong Kong PC PC Annual Report 200/01 (01/02 is similar)

789 complaints (up 39%); 68% vs private sector;14% vs government;18% vs 3rd

Ps Over 50% allege breaches of DPP 3 (use)

52 formally investigated (14% of 531 finalised) 26 (50%) found to involve contravention of PD(P)O 10 warning notices; 12 enforcement notices - but no idea

what actions required, or what results 4 referals to Police for prosecution but in 3 Police found

insufficient evidence; one unresolved Not one HK $1 under s66; any by mediation?

Comparison - 4 PCs Annual Reports

‘Will I get a remedy - and if so, what?’ is largely unanswered - evidence is not there

Some evidence of the % of successful complainants

Little evidence of what remedies result Damages - a few examples from Aus and NZ All of the PCs are below ‘best practice’ A systematic and comparable standard of

reporting is needed Asia-Pacific PCs could develop standards

Publication of Commissioners’ decisions - Why it needs reform For detailed criticisms of reporting practices:

Greenleaf ‘Reforming reporting of privacy cases’ <http://www2.austlii.edu.au/~graham/publications/2003/Reforming_reporting/>

Bygrave ‘Where have all the judges gone?’ (2000) European Commissioners were little better - improved?

Why reporting of Commissioners is needed Few court decisions means Commissioners’ views

in complaint resolutions are the de facto law Identifying non-compliance is more valuable (and

difficult) that ‘feel good’ exhortations to comply

Publication - Importance Publication is possible

Requires anonymisation in most cases Exceptions should not be the rule

Adverse consequences of lack of availability Interpretation unknown to parties / legal advisers Past remedies (‘tariff’) unknown Privacy remains ‘Cinderalla’ of legal practice No privacy jurisprudence is possible Deficiences in laws do not become apparent Commissioners can ‘bury their mistakes’ Justice is not seen to be done Deterrent effect is lost No accountability for high public expenditure

Publication - Australian P Comm (Federal)

AnRep has a few useless ‘media grab’ summaries No other mediation details 1988-2002 Comm avoids making binding Determinations (2

1993, 1 2003) despite powers to do so Dismisses matters under s40 - publication not required

Since Dec 2002, 14 useful summaries of mediations and determinations published on web

2x1993, 2x2002, 10x2003 Rate now is still only 1.25 per month

Any Federal Court decisions would be on AustLII (but there are none of relevance) - no appeal right

Publication - NSW P Comm No mediation details - no AR since 2000 ADT decisions available on AustLII

Publication - HK P Comm Complaint summaries on website only to 1998 2000/1 AnRep, only 8 complaint summaries ) No systematic reporting of significant complaints AAB complaint summaries are in AnRep, but not

on website; AAB cases not available on Internet No reporting of s66 cases in AnRep or website

There is only one

Publication - NZ P Comm

Conclusions

Publication - 7 recommendations Publicly stated criteria of seriousness

confirmation of adherence in each AnRep statistics on reported / resolved ratio

Complainants can elect to be named In default, name public sector respondents; private sector

respondents only exceptionally Report sufficient detail for a a full understanding of legal

issues, and the adequacy of the remedy Report regularly rather than in periodic batches 'One stop' reporting including reviews of Commissioner’s

decisions Encourage 3rd-P re-publication + citation standards

Publication - A central location<http://www.worldlii.org/int/special/privacy/>

Privacy & FOI Law Project = All specialist privacy and/or FOI databases located on any Legal Information Institute (LII)

Current coverage (all searchable in one search) Canadian Privacy Commissioner Cases (WorldLII) Privacy Commissioner of Australia Cases (AustLII) New Zealand Privacy Commissioner Cases (AustLII) Nova Scotia FOI & Privacy Review Office (CanLII) Queensland Information Comm. Decisions (AustLII) Western Australian Information Commissioner (AustLII) Privacy Law & Policy Reporter (AustLII)

Being added New South Wales Privacy Commissioner (AustLII) EPIC ALERT (WorldLII)

A seach for ‘disclos* near medical’