Records

6.123 Generally, the privacy principles in the Privacy Act only apply to personal information that is held, or collected for inclusion, in a ‘record’.^[140] The IPPs expressly refer to collection of personal information by agencies for inclusion in a ‘record’, storage and security of ‘records’, access to ‘records’ and so on. Section 16B provides that the Act applies to the collection of personal information by an organisation only if the information is collected for inclusion in a record or is held by the organisation in a record.

6.124 A number of the privacy Acts in other jurisdications, for example the Privacy and Personal Information Protection Act 1998 (NSW), are not expressly limited in this way. However, in Vice-Chancellor Macquarie University v FM, Spiegelman CJ—with whom the other members of the New South Wales Court of Appeal agreed—found that the New South Wales Act could only sensibly apply to information held in, or collected for inclusion in, a record:

Of particular significance is the body of consecutive sections between s 12 and s 19 of the [Privacy and Personal Information Protection] Act which adopt as their criterion of operation a reference to where a public sector agency ‘holds personal information’ … It is almost impossible to conceive how almost all of those other sections could operate in practice if they were intended to apply to information in the minds of employees acquired by direct visual or aural experience and never recorded in any manner.^[141]

6.125 A recordis defined in s 6(1) of the Privacy Act as follows:

(a) a document; or

(b) a database (however kept); or

(c) a photograph or other pictorial representation of a person;

but does not include:

(d) a generally available publication; or

(e) anything kept in a library, art gallery or museum for the purposes of reference, study or exhibition; or

(f) Commonwealth records as defined by subsection 3(1) of the Archives Act 1983 that are in the open access period for the purposes of that Act; or

(fa) records (as defined in the Archives Act 1983) in the custody of the Archives (as defined in that Act) in relation to which the Archives has entered into arrangements with a person other than a Commonwealth institution (as defined in that Act) providing for the extent to which the Archives or other persons are to have access to the records; or

(g) documents placed by or on behalf of a person (other than an agency) in the memorial collection within the meaning of the Australian War Memorial Act 1980; or

(h) letters or other articles in the course of transmission by post.

6.126 This section of the Report deals only with the first part of the definition, describing what is included in the definition of record. There were very few concerns raised about the second part of the definition, describing what is excluded from the definition of record, apart from one issue raised by the OPC about the definition of ‘generally available publication’. This issue is considered in the following section.

6.127 The first part of the definition—which defines a record as a document, a database (however kept), or a photograph or other pictorial representation of a person—covers a broad range of recorded information including electronic records about individuals and includes photos or videos, where the person can be identified from the context or in other ways. A person’s name appearing on a list of clients or patients may also fall within the definition of personal information because the context provides information about the individual.

6.128 The OPC commented that ‘used in conjunction with definitions in the Acts Interpretation Act 1901, the definition for record is adequately broad to take in new or evolving information storage media’.^[142] Section 25 of the Acts Interpretation Act provides:

In any Act, unless the contrary intention appears:

document includes:

(a) any paper or other material on which there is writing;

(b) any paper or other material on which there are marks, figures, symbols or perforations having a meaning for persons qualified to interpret them; and

(c) any article or material from which sounds, images or writings are capable of being reproduced with or without the aid of any other article or device.

record includes information stored or recorded by means of a computer.

writing includes any mode of representing or reproducing words, figures, drawings or symbols in a visible form.

6.129 Section 4 of the Freedom of Information Act 1982 (Cth) (the FOI Act) sets out the following inclusive definition of document:

(a) any of, or any part of any of, the following things:

(i) any paper or other material on which there is writing;

(ii) a map, plan, drawing or photograph;

(iii) any paper or other material on which there are marks, figures, symbols or perforations having a meaning for persons qualified to interpret them;

(iv) any article or material from which sounds, images orwritings are capable of being reproduced with or without the aid of any other article or device;

(v) any article on which information has been stored or recorded, either mechanically or electronically;

(vi) any other record of information; or

(b) any copy, reproduction or duplicate of such a thing; or

(c) any part of such a copy, reproduction or duplicate;

6.130 Section 3 of the Archives Act 1983 (Cth) defines ‘record’ as follows:

record means a document (including any written or printed material) or object (including a sound recording, coded storage device, magnetic tape or disc, microform, photograph, film, map, plan or model or a painting or other pictorial or graphic work) that is, or has been, kept by reason of any information or matter that it contains or can be obtained from it or by reason of its connection with any event, person, circumstance or thing.

6.131 As noted above, the Privacy and Personal Information Act 1998 (NSW) covers information ‘whether or not recorded in a material form’.^[143] The Victorian and Tasmanian Acts include the requirement for information to be recorded in the definition of ‘personal information’. Personal information is defined as ‘information or an opinion … that is recorded in any form’^[144] and ‘any information or opinion in any recorded format’.^[145]

6.132 The Western Australian Information Privacy Bill provides an inclusive definition of ‘record’ that sets out essentially the same elements as the Acts Interpretation Act definition of ‘document’, plus the following additional elements:

• any map, plan, diagram or graph;

• any drawing, pictorial or graphic work, or photograph; or

• any article on which information has been stored or recorded, either mechanically, magnetically or electronically.^[146]

6.133 It has been noted that the requirement that personal information be held or collected for inclusion in a record means that some potentially privacy-invasive practices, such as the use of live closed circuit television (CCTV), are not regulated by the Privacy Act.^[147] It has been argued that consideration should be given to ensuring that agencies and organisations are not allowed to breach the spirit of the Privacy Act by avoiding making a record.^[148]

Discussion Paper proposals

6.134 In IP 31, the ALRC asked whether the definitions, including the definition of record, in the Privacy Act were adequate and appropriate.^[149] In response, the OPC made a number of suggestions for improving the definition of ‘record’, including amending the definition to make it ‘stand alone’ and to clarify its scope and application to developing technology. The OPC also recommended removing the phrase ‘of a person’ from ‘a photograph or other pictorial representation of a person’ on the basis that a photograph may be ‘personal information’ even though it is not a photograph of a person. For example, a photograph of a house may be personal information if it is kept together with other information that identifies the resident.^[150]

6.135 In DP 72, the ALRC examined the approach adopted in the Victorian and Tasmanian legislation—that is, including the requirement that information be recorded as one element of the definition of ‘personal information’. The problem with this approach is that information does not fall within the definition of ‘personal information’ and, therefore, is not covered by the privacy legislation in Victoria and Tasmania until it has actually been included in a record. This means, for example, that where a doctor or psychologist is collecting information orally from a patient or client during a consultation, the privacy legislation, including the collection principle, does not apply to that exchange because the information is not yet included in a record.

6.136 On the other hand, s 16B(1) of the Privacy Act provides that the Act applies to the collection of personal information if the information is collected for inclusion in a record or generally available publication. This approach ensures that information that is in the process of being collected for inclusion in a record—for example, by doctors and psychologists in the course of a consultation—but has not yet been recorded, is covered by the Act. The ALRC was of the preliminary view that this approach was preferable and should also be adopted in the amended Privacy Act.

6.137 In addition, the ALRC did not propose adopting the approach in the New South Wales Privacy and Personal Information Act, which does not expressly require that information be held in a record or collected for inclusion in a record. The ALRC noted Spiegelman CJ’s view that the New South Wales Act should be interpreted to apply to information held, or collected for inclusion, in a record. It considered that such requirements should be set out expressly in legislation, rather than implied.

6.138 The ALRC further proposed that the Privacy Act should be limited to those situations in which information is held or collected for inclusion in a record. The ALRC noted that the Victorian Law Reform Commission is currently examining surveillance in public places, including live CCTV surveillance, as part of a larger inquiry into privacy. It is anticipated that the recommendations resulting from that inquiry will be considered by the Standing Committee of Attorneys-General. Other invasions of privacy involving personal information may be caught by the statutory cause of action for a serious invasion of privacy.^[151]

6.139 The term ‘record’ is defined in the Acts Interpretation Act. It includes ‘information stored or recorded by means of a computer’. The ALRC noted that this definition may not be sufficient in the context of the Privacy Act. It does not give an indication of the intended broad scope of the Privacy Act, which is not limited to information stored on computer. On this basis, the ALRC proposed that the term be defined separately in the Privacy Act, including a reference to information stored in electronic or other forms. The ALRC proposed that the definition of record in the Privacy Act be inclusive rather than exhaustive.

6.140 The ALRC considered the OPC’s submission that the definition of ‘record’ in the Privacy Act should ‘stand alone’ and that it is undesirable to rely on the definition of ‘document’ in the Acts Interpretation Act. While there are valid arguments to support both the current approach and developing a ‘stand alone’ definition, on balance the ALRC proposed that the definition continue to rely on the Acts Interpretation Act. The long title of that Act is ‘An Act for the Interpretation of Acts of Parliament and for Shortening their Language’. The ALRC expressed the preliminary view that it is appropriate to rely on the definitions provided in that Act unless the Australian Parliament intends a particular term to have a meaning that is different from the meaning set out in the Acts Interpretation Act. This promotes consistency and brevity in federal legislation.

6.141 The ALRC agreed with the OPC that photographs or other pictorial representations should be covered by the term ‘record’ in the Privacy Act and that they should not be limited by the phrase ‘of a person’. This can be achieved by relying on the definition of ‘document’ in the Acts Interpretation Act, which includes ‘any article or material from which sounds, images or writings are capable of being reproduced with or without the aid of any other article or device’. The term ‘images’ is wide enough to cover photographs and other pictorial representations.

6.142 The ALRC proposed, therefore, that the first inclusive part of the definition of ‘record’ in the Privacy Act should be amended to include a document, as defined by the Acts Interpretation Act,and information stored in electronic or other forms.^[152]

Submissions and consultations

6.143 In response to DP 72, the OPC again suggested that the definition should ‘stand alone’ to ensure it is accessible and easily understood. The OPC was also of the view that consistent definitions of ‘record’ and ‘document’ should be developed for the purposes of the Privacy Act, the Archives Act and theFOI Act. In addition, the OPC was of the view that the definition of ‘record’ should continue to refer expressly to photographs and pictorial representations despite the ALRC’s view that the definition of ‘document’ in the Acts Interpretation Act was broad enough to include them. The OPC was concerned that it may not be clear that ‘document’ is defined elsewhere to include photographs and pictures.^[153]

6.144 A number of stakeholders expressed support for the changes to the definition of ‘record’ proposed in DP 72.^[154] PIAC supported the proposed definition but expressed the view that it should be made clearer that the definition is an inclusive one, and that it relies on the definition of ‘document’ in the Acts Interpretation Act.^[155] The Cyberspace Law and Policy Centre also expressed support for the ALRC’s proposed definition but suggested that there may also be a need to clarify that ‘a person’ cannot constitute an ‘other form’ of storage of information.

A person should not be a ‘record’ of their own biometric data, and nor should a person be regarded as ‘storage’ of everything that they know. The latter possibility would defeat the purpose of the general restriction of the Act’s operation to personal information stored in records, excluding information only ‘stored’ in a person’s mind.^[156]

6.145 The Law Society of New South Wales suggested that the definition should be amended to read a document or ‘information however stored or retained and not destroyed’.^[157]

ALRC’s view

6.146 The ALRC has again considered the wisdom of relying on the definition of ‘document’ in the Acts Interpretation Act. The ALRC notes that in a recent Drafting Direction the Office of Parliamentary Counsel has indicated that:

Generally, if a particular expression is defined in an existing provision and you want to use that same expression with that defined meaning in another provision, you should consider repeating the whole of that definition rather than referring to the existing provision (even if this involves repeating large amounts of text). This is because it avoids the need for the reader to access another provision in order to find out the meaning of that expression.^[158]

6.147 On the other hand, the Office of Parliamentary Counsel have also stated that:

However, if you want to use an expression that is consistently used across the statute book with the same meaning, it may be preferable for the new provision to refer to the existing provision in which that expression is defined. This provides for greater consistency across the statute book by ensuring that the expression will always have the same meaning when used in various provisions. If the meaning of that expression needs to be changed across the statute book, it is easier to do so by amending a single definition to which all other provisions refer.^[159]

6.148 Again, on balance, and for the reasons discussed above, the ALRC has come to the view that it is appropriate to rely on the definition of ‘document’ in the Acts Interpretation Act. The recommendation below refers expressly to the Acts Interpretation Act to make this clear. This approach leaves open the possibility, suggested by the OPC, that the use of the term ‘document’ in the Privacy Act, the FOI Act and the Archives Act may be brought into line. Although the FOI Act currently includes a separate definition of ‘document’, it would be possible to ensure consistency across all these Acts by amending the FOI Act so that it, too, relies on the definition of ‘document’ in the Acts Interpretation Act.

6.149 The ALRC has made one small change to the proposal in DP 72, that is, a change from ‘information stored in electronic or other form’ to ‘information stored in electronic or other format’. This indicates that the definition of ‘record’ in the Privacy Act is not intended to capture information stored in a human body or brain.