Reporting and remedies - Black holes of privacy

1. Reporting and remedies - Black holes of privacy Graham Greenleaf ‘What use are Privacy Commissioners?’ 9 September 2003 See http://www2.austlii.edu.au/~graham/ for updates / details

2. Overview - two black holes • What evidence is there that Commissioners do their job? • Most important function: resolving complaints • Is there accountability for public monies spent? • Outcomes of complaints - fair remedies? • Does anyone get a remedy? • Reporting complaints - what law is applied? • Track record of Asia-Pacific Commissioners • Some practical improvements

3. Outcomes - Does anyone get a remedy? • Evidence available? • √ Annual Reports - only public source • ? websites? - could extract from reported cases - should provide continuous data • ? FOI requests? - no ‘document’ available? • Only some jurisdictions considered • Privacy Comms - Australia; NSW; HK; NZ • Other Comms (Canada, Korea) might differ • Information Commissioners not considered - mainly access, some correction, some broader

4. Outcomes - Australian PC • 2001-02 Annual Report - no statistics! • Complaints tripled with private sector coverage (611) • AR contains summaries of 11 complaints, of which one resulted in $5000 compensation • No statistics given of complaint outcomes at all • 2000-01 AR included some outcome stats • 133 closed complaints; uncertain % breaches found • 9 cases in AR involved $52,000 compensation • No information about other remedies • No genuine s52 determinations in 15 years • No appeal right; No substantive case on the Act ever before a Court for judicial review

5. Outcomes - NSW PC • latest Annual Report 1999-2000 before new Act commenced (1/7/00) • No statistics or complaint resolutions yet available under new Act • Since 2000, about 20 cases to NSW ADT • 7 decided as yet - 7 more than the Cth! • AR 1999-2000 relevant to ‘non-IPP’ complaints, as they still apply • 4 complaint resolutions summarised

6. Outcomes - Hong Kong PC • PC Annual Report 200/01 (01/02 is similar) • 789 complaints (up 39%); • 68% vs private sector;14% vs government;18% vs 3rd Ps • Over 50% allege breaches of DPP 3 (use) • 52 formally investigated (14% of 531 finalised) • 26 (50%) found to involve contravention of PD(P)O • 10 warning notices; 12 enforcement notices - but no idea what actions required, or what results • 4 referals to Police for prosecution but in 3 Police found insufficient evidence; one unresolved • Not one HK $1 under s66; any by mediation?

7. Comparison - 4 PCs Annual Reports • ‘Will I get a remedy - and if so, what?’ is largely unanswered - evidence is not there • Some evidence of the % of successful complainants • Little evidence of what remedies result • Damages - a few examples from Aus and NZ • All of the PCs are below ‘best practice’ • A systematic and comparable standard of reporting is needed • Asia-Pacific PCs could develop standards

9. Publication of Commissioners’ decisions - Why it needs reform • For detailed criticisms of reporting practices: • Greenleaf ‘Reforming reporting of privacy cases’ <http://www2.austlii.edu.au/~graham/publications/2003/Reforming_reporting/> • Bygrave ‘Where have all the judges gone?’ (2000) • European Commissioners were little better - improved? • Why reporting of Commissioners is needed • Few court decisions means Commissioners’ views in complaint resolutions are the de facto law • Identifying non-compliance is more valuable (and difficult) that ‘feel good’ exhortations to comply

10. Publication - Importance • Publication is possible • Requires anonymisation in most cases • Exceptions should not be the rule • Adverse consequences of lack of availability • Interpretation unknown to parties / legal advisers • Past remedies (‘tariff’) unknown • Privacy remains ‘Cinderalla’ of legal practice • No privacy jurisprudence is possible • Deficiences in laws do not become apparent • Commissioners can ‘bury their mistakes’ • Justice is not seen to be done • Deterrent effect is lost • No accountability for high public expenditure

11. Publication - Australian P Comm (Federal) • AnRep has a few useless ‘media grab’ summaries • No other mediation details 1988-2002 • Comm avoids making binding Determinations (2 1993, 1 2003) despite powers to do so • Dismisses matters under s40 - publication not required • Since Dec 2002, 14 useful summaries of mediations and determinations published on web • 2x1993, 2x2002, 10x2003 • Rate now is still only 1.25 per month • Any Federal Court decisions would be on AustLII (but there are none of relevance) - no appeal right

12. Publication - NSW P Comm • No mediation details - no AR since 2000 • ADT decisions available on AustLII

13. Publication - HK P Comm • Complaint summaries on website only to 1998 • 2000/1 AnRep, only 8 complaint summaries ) • No systematic reporting of significant complaints • AAB complaint summaries are in AnRep, but not on website; AAB cases not available on Internet • No reporting of s66 cases in AnRep or website • There is only one

14. Publication - NZ P Comm

15. Conclusions

16. Publication - 7 recommendations • Publicly stated criteria of seriousness • confirmation of adherence in each AnRep • statistics on reported / resolved ratio • Complainants can elect to be named • In default, name public sector respondents; private sector respondents only exceptionally • Report sufficient detail for a a full understanding of legal issues, and the adequacy of the remedy • Report regularly rather than in periodic batches • 'One stop' reporting including reviews of Commissioner’s decisions • Encourage 3rd-P re-publication + citation standards

17. Publication - A central location <http://www.worldlii.org/int/special/privacy/> • Privacy & FOI Law Project = All specialist privacy and/or FOI databases located on any Legal Information Institute (LII) • Current coverage (all searchable in one search) • Canadian Privacy Commissioner Cases (WorldLII) • Privacy Commissioner of Australia Cases (AustLII) • New Zealand Privacy Commissioner Cases (AustLII) • Nova Scotia FOI & Privacy Review Office (CanLII) • Queensland Information Comm. Decisions (AustLII) • Western Australian Information Commissioner (AustLII) • Privacy Law & Policy Reporter (AustLII) • Being added • New South Wales Privacy Commissioner (AustLII) • EPIC ALERT (WorldLII)

19. A seach for ‘disclos* near medical’