A proposal for systematic reporting of Privacy Commissioners' resolutions of complaints

Graham Greenleaf [*]

1 August 2001

 Submission to the Federal, New South Wales and Victorian Privacy Commissioners
A version is to be published in Privacy Law & Policy Reporter
 

  • 1. Purpose of proposal
  • 2. Need for reporting
  • 3. Existing models
  • 4. Elements of a complaint reporting system
  • 5. Publication of reported complaints

    • 1. Purpose of proposal

    The principal purpose of this proposal is to assist discussions with the Australian Federal Privacy Commissioner and the NSW Privacy Commissioner, both of whom have been requested to consider establishing systems to report their resolutions of significant privacy complaints, and who have indicated their willingness to do so.

     Aspects of this proposal may also be of interest to other Privacy Commissioners in the region, namely those in New Zealand, Hong Kong (both of whom have taken steps to report complaint resolutions), the Canadian Commissioners (some of whom report complaint resolutions), and the new Victorian Commissioner.

    2. Need for reporting

    At present there is no reporting of complaints resolved by either the Federal or NSW Commissioners, beyond scant details provided in their annual reports, and release (twice in the past) of determinations by the Federal Commissioner under s52. For example, the Federal Commissioner's Annual Report 1998-99 gives brief details of nine settled complaints (out of 91 closed that year), but not even of all of those resulting in compensation. The details are not enough for anyone to understand the legal significance (if any) of the issues resolved by the Commissioner in resolving the complaint.

    As a result, potential complainants or respondents (or their professional advisers) have precious little information about how the Act is interpreted from prior complaints experience, or the remedies which have been granted in the past.

    Problems caused by the lack of reporting are discussed in G Greenleaf 'Enforcement of the Privacy Act: Problems and potential' Privacy Law 2001 Conference, IIR Conferences, Sydney (May 2001) - available at <http://www2.austlii.edu.au/~graham/publications/2001/enforcement.html>. This paper does not include sufficient discussion of s40 of the Federal Act, however.

     The problem of lack of sufficient reporting has been noted in relation to other jurisdictions: see L Bygrave Where have all the judges gone? Reflections on judicial involvement in developing data protection law Part 1 (2000) 7 PLPR 11 and Part II (2000) 7 PLPR 33.

     The need for greater disclosure and transparency of the handling of decisions, as illustrated by demands from Canadian lawyers to the Canadian Privacy Commissioner, was also a theme in the introductory remarks by Susanna Lobez (ABC Law Report/Law Matters) at the launch of the Federal Privacy Commissioner's public opinion research (31 July 2001).

    3. Existing models

    3.1. Reporting of complaint resolution by Commissioners

    The two closest Australian models for reporting Privacy Commissioner's complaints are probably: These are both good examples of reasoned decisions by Commissioners (not complaint resolutions by conciliation, however) in relation to complaints against agencies, with serious attention to explaining the legal reasoning involved.

    Valuable regional models for some aspects of reporting of complaint resolutions can be found as follows:

    The (Federal) Privacy Commissioner of Canada seems to be the only regional Commissioner to provide no information about decided matters on his web site at <http://www.privcom.gc.ca/index_e.asp>.

     The only other Commissioner in an English-speaking country, the UK Information Commissioner (formerly Data Protection Registrar), is starting to provide via her web site decisions by the Data Protection Tribunal at <http://www.dataprotection.gov.uk/> (under 'Guidance and Other Publications'), but not any details of complaint determinations.

    3.2. Reporting of referrals or appeals from Commissioners

    Once decisions on privacy complaints go beyond Commissioners, all Australian jurisdictions provide accessible reports of the decisions of the succeeding levels of dispute resolution. The decisions of the Federal Court, Federal Magistrates Court, VCAT and NSW ADT are all included on AustLII. There is therefore no issue concerning the availability of these decisions in Australia.

    4. Elements of a complaint reporting system

    4.1. Choice of complaints reported

    It is unrealistic and unnecessary to expect Commissioner's offices to prepare for reporting details of the outcomes of every complaint they resolve, as many will be trivial or repetitive of settled matters and only of statistical interest (which is a separate question).

     It is sufficient if 'significant' complaints are reported. Some agreed parameters on what constitutes a 'significant' complaint are needed, in relation to both legal issues and remedies. However, agreement on this need not delay the Commissioners reporting matters which they consider significant.

    4.2. Official citations for each complaint

    It should be possible for all those who wish to refer to a complaint to do so by an official citation that unambiguously refers to the same complaint. This has now been achieved by the system of 'Court designated citation' adopted by most Australian Courts and Tribunals, and illustrated most extensively by the databases on AustLII.

    For example, the citations for the most recent decisions of the Federal Court, Qld and WA Information Commissioners, NSW ADT, and VCAT are:

    Adopting the naming convention used for other Courts and Tribunals, the citation for the first decision for 2001 of each of the Australian, NSW and Victorian Privacy Commissioners would be in the form: The practice has been adopted in Australia that citations of Federal bodies end with 'A' for 'Australia' (eg 'FCA', 'HCA') whereas those for State and Territory bodies start with the abbreviation for the State. 'Cmr' is used for 'Commissioner', whereas 'Comm' is used for 'Commission'. This may be slightly inconsistent, but it is now the settled practice and should be followed.

    4.3. Naming of respondents and complainants

    The most important thing to stress here is that the question of naming either respondents or complainants in the reports of complaints is a separate issue and is not essential for a valuable reporting system. Resolution of this question should not impede or delay implementation of a reporting system, which may be on an anonymous basis if necessary ('X and Department Y' or 'X and Insurance Company Z').

     The privacy Acts in each jurisdiction may also impose limitations on identified reporting but not on de-identified reporting. This must be considered separately in each jurisdiction.

     However, there are good reasons to support the naming of both respondents and (in some cases, with consent) complainants, as well as reasons against.

    4.4. Level of detail needed

    In a nutshell, the level of detail needed is that which is sufficient for interested parties to obtain a full understanding of the legal issues involved and the essential steps in the Commissioner's reasoning leading to their resolution. In relation to remedies, sufficient of the factual circumstances are needed for the adequacy of the remedy to be understood (subject to the privacy interests of the complainant).

     The Qld and WA Information Commissioners both provide good models of the level of detail that is desirable.

    4.5. Regularity of reporting

    The best practice, both from the perspective of the Commissioners' offices, and the needs of the recipients, is for complaints to be reported and disseminated as they are completed, rather than in periodic batches.

    From my own experience, it is more difficult to prepare an official report on a complaint resolution the further back in the past the complaint was completed. It is done best if done fresh.

    Similarly, those preparing secondary reports of complaints do not want to deal with large batches of them, but would prefer to receive complaints one at a time (so they can be digested) as soon as possible after they are dealt with (while they are still 'news').

     It would be desirable if the Commissioners could resolve to disseminate complaint reports within a month of a complaint being finalised.

    5. Publication of reported complaints

    Once Commissioners prepare complaint reports systematically, details of those complaints need to be published in various ways, which could include the following: All of these forms of publication are desirable and should be encouraged.

    [*] Distinguished Visiting Professor, University of Hong Kong Faculty of Law (2001-02); Co-Director, Baker & McKenzie Cyberspace Law & Policy Centre (UNSW); Co-Director, AustLII; thanks to Roger Clarke and Tim Dixon for valuable suggestions on an earlier draft.