[Previous] [Next][Title]

1. Forms and sources of privacy law - Introduction

Graham Greenleaf, last amended 5 March 2003

= Required reading (Students are only required to read general materials and those relating to their jurisdiction, not materials from all jurisdictions. Obtain further advice from your teacher.)

= material added since the date of the class concerning this topic


This Reading Guide provides:

3.1. Sources of the legal protection of privacy

The legal protection of privacy at the national level stems from four main sources, varying very greatly between countries: All of these developments have been influenced by a number of important international agreements concerning both human rights generally, and data protection specifically. International courts have interpreted the human rights agreements, but not the data protection agreements.

 The most important development in the past 30 years has been the international emergence of comprehensive 'data protection' or 'information privacy' laws, so a consideration of the principles underlying such legislation provides a useful introduction to modern privacy law.

3.2. Overview of information privacy principles (IPPs)

'Information privacy principles' ('IPPs') is one generic name for various sets of 'fair information practices concerning personal information' which form the core of most comprehensive laws enacted around the world since the early 1970s to protect privacy in relation to information systems. They are also sometimes called 'Data Protection Principles' (DPPs) or even (for Australia's private sector 'National Privacy Principles' (NPPs).

We will use the expression 'Information privacy principles' ('IPPs') as the generic term.

3.2.1. OECD/Council of Europe IPPs (1981)

Following a decade of legislative development in North America and Europe during the 1970s, the OECD privacy Guidelines of 1981 (Organisation for Economic Cooperation and Development Guidelines on the Protection of Privacy and Transborder Flows of Personal Data , OECD, Paris, 1981) included a set of information privacy principles which have had a significant influence on the content of IPPs in national laws and international agreements since that time. The Committee of Experts that drafted the OECD Guidelines was chaired by Kirby J of Australia.

 A similar set of principles was included in the Council of Europe Convention for the Protection of Individuals with Regard to the Automatic Processing of Personal Data (Convention No 108) 1981.

 These and other international agreements are discussed in more detail in Reading Guide 3.

 Colin Bennett Regulating Privacy (Cornell, 1992) gives the most comprehensive account - from a political scientist's perspective - of the development of data protection in the 1970s and 1980s.

3.2.2. IPPs in the EU privacy Directive (1995)

The EU privacy Directive of 1995 is the most significant reformulation of IPPs since the OECD/Council of Europe formulations of the early 1980s.

3.2.3. General analyses and re-considerations of IPPs

After 30 years of development, it would not be surprising if there is a need to re-define IPPs, particularly in light of technological developments such as the Internet and biometrics.

 Here are a few examples of attempts at overall analysis and re-consideration of IPPs:

3.2.4. IPPs as a legal concept

'Privacy' appears to be of most value as a political concept, a rhetorical device by which to justify laws that protect a person's ability to control the use of personal information about them. It is not a concept that can be transformed directly into a legal right.

Data protection as a bundle of rights - 'Fair information practices'

`Information privacy' is best seen as a `bundle of rights', like copyright . We don't denigrate copyright as a legal right because it is not expressed as a unitary right, nor because it does not have a completely coherent underlying rationale. There are considerable similarities between copyright legislation and data protection legislation, illustrated in this table:
Data protection law Copyright law
No simple definition No simple definition
'Bundle of rights' ; eg
- access
- correction
- fair collection
- use and disclosure limitation
'Bundle of rights'; eg
- control copying
- control performances
- fair attribution
- right to royalties
'personal information' 'expressions'
Protects subjects Protects creators

'Informational self-determination': the West German Census Case (1983)

If there is a unifying factor in the various `privacy rights', then the German Census Case approach of `informational self determination' and the onus of proof it creates is probably as good a definition of the key elements as any, particularly because of its qualifications. The Court said:
Under the conditions of modern data processing, the protection of the individual against unlimited collection, storage, use and communication is covered by the general personal right to privacy embodied in [the German Basic Law or constitution]... this right ensures that the individual is authorised to principally determine himself the disclosure and use of his personal data
Restrictions on this right to 'informational self-determination' are only admissible in the prevailing interests of the general public. They require a constitutional legal basis which has to correspond to the clarity of standards governed by the rule of law. As far as regulations are concerned, the legislator has furthermore to observe the principle of reasonableness. In additional he has to make organisational and procedural arrangements which counteract the danger of violating the personal right to privacy

3.2.5. IPPs and the information system life-cycle

It is useful to map IPPs onto the 'life cycle' of the use of information within an organisation.

This device can also be used to help assess which principles are and are not covered by a particular set of IPPs.

 Is Clarke's model sufficiently comprehensive? For example, where do IPPs dealing with these matters fit?:

3.3. IPPs in national and provincial legislation

The IPPs in the national and provincial legislation of most relevance to this course are set out below.

3.3.1. IPPs in the Hong Kong Ordinance

3.3.2. IPPs in the New Zealand legislation

3.3.3. IPPs in Australian legislation

In Australia, there are now at least four somewhat different sets of IPPs which have been (or are proposed to be) included in legislation, in chronological order of development: All of these sets of information privacy principles are identifiably part of the same family, but all have significant differences from each other.

 The Privacy Act 1988 (Cth), like most other legislation around the world dealing with information privacy, is based around a set of information privacy principles. In fact, it is based around two slightly different sets: the Information Privacy Principles (IPPs) applying to the Commonwealth public sector, and the National Privacy Principles (NPPs) applying to the private sector.

The IPPs applying to the Commonwealth public sector

The s14 IPPs are the only set of information privacy principles which have been in operation in Australia for any significant period of time (12 years) and therefore serve as a reasonable starting point for discussion of information privacy principles generally.

The NPPs applying to the private sector

A summary of the 10 'National Privacy Principles' (NPPs) (by G Greenleaf) is as follows:
NPP 1 Collection
Summary - An organisation may only collect personal information which is necessary for its activities; only by lawful and fair means and not in an unreasonably intrusive way. Wherever reasonable, an organisation must collect personal information about a person only from that person, and must make the person aware of the purpose of collection, any laws requiring the collection, the organisations to which the information is usually disclosed, and other matters. If personal information is collected from a third party, the organisation must still take steps to inform the person about the collection and these matters.
NPP 2 Use and disclosure
Summary - An organisation may only use or disclose personal information for the purpose for which it was collected (the primary purpose), except for a use or disclosure (the secondary purpose) that the person would reasonably expect, or where the person has consented. Personal information may be used for the secondary purpose of direct marketing (even where this is not within a person's reasonable expectations) where it is impracticable for the organisation to seek the person's consent before that particular use, the person has been given an opportunity when first contacted to 'opt-out' from receiving further direct marketing communications, but the person has not opted out. There are special rules for sensitive information, and many other exceptions for health information, protection of individual and public health, other uses authorised by law, prevention, investigation and enforcement concerning breaches of the law, and similar matters.
NPP 3 Data quality
Summary - An organisation must take reasonable steps to make sure that the personal information it collects, uses or discloses is accurate, complete and up-to-date.
NPP 4 Data security (and destruction)
Summary - An organisation must take reasonable steps to protect personal information from misuse, loss or unauthorised access, modification or disclosure. An organisation must destroy or permanently de-identify personal information if it is no longer needed for any purpose under NPP 2.
NPP 5 Openness (of personal information policies)
Summary - An organisation must document its policies on its management of personal information and make the document available to anyone who asks for it. On request it must provide general information about what sort of personal information it holds, for what purposes, and how it collects, holds, uses and discloses that information.
NPP 6 Access and correction
Summary - A person generally has a right of access to personal information held by an organisation about him or her, subject to a list of exceptions. If an exception applies, the organisation must consider the use of a mutually agreed intermediary. If a person is able to establish that information about him or her is not accurate, complete and up-to-date, the organisation must take reasonable steps to correct the information. In any event, the person has a right to the addition of a statement claiming that information is incorrect.
NPP 7 Identifiers
Summary - Organisations must not use as their own identifiers any personal identifiers assigned by Commonwealth government agencies, and must not use or disclose such identifiers (with limited exceptions).
NPP 8 Anonymity
Summary - A person must have the option of not identifying himself or herself when entering transactions with an organisation wherever this is lawful and practicable.
NPP 9 Transborder data flows
Summary - An organisation in Australia may only transfer personal information to someone else in a foreign country if it reasonably believes that the recipient is subject to a law, binding scheme or contract which effectively upholds principles substantially similar to the NPPs. Transfers may also be made to organisations that have taken reasonable steps to ensure that the information will not be held, used or disclosed by the recipient of the information inconsistently with the NPPs, and for four other reasons.
NPP 10 Sensitive information (Collection limitations)
Summary - An organisation must not collect sensitive information unless the person has consented, or the collection is required by law, or in limited other circumstances. Special rules apply to health information.

3.4. Research resources on privacy and surveillance

This resources guide is intended to indicate the main general resources for each jurisdiction, and other indexes where resources can be found.

This version concentrates on web resources and is not yet completed.

3.4.1. General resources

3.4.2. Hong Kong resources

3.4.3. Australian resources

There are numerous Australian references in these Reading Guides. Here are some key resources:

3.4.4. New Zealand Resources

3.4.5. European resources

3.4.6. United States resources

3.4.7. Privacy tools

Test these privacy-enhancing tools.
[Previous] [Next][Title]