Approach
Australia
Statutory tort of serious invasions of privacy based on the ALRC Model
Hong Kong
Criminal Law
Practices concerned
Australia
Intrusion into seclusion or misuse of private information
Hong Kong
Disclosure of personal data of a data subject
Elements
Australia
- Reasonable expectation of privacy (objective but consider all circumstances).
- Fault requirement - committed intentionally or recklessly.
- Serious invasion of privacy.
- Public interest in privacy outweighs any countervailing public interests.
Hong Kong
- Without the relevant consent of the data subject; and
- With an intent to cause specified harm or being reckless as to whether any specified harm would be, or would likely be, caused to the data subject or any of their family member.
- Becomes second-tier if the disclosure caused specified harm.
Defences
Australia
The balancing exercise between public interest in privacy and countervailing public interests, in effect, provide a public interest defence. Countervailing public interest matters include, among others, freedom of expression and freedom of the media.
Further available defences may also include:
- Lawful authority
- Incidental to defence of persons or property
- Necessity
- Consent
- Absolute privilege
- Publication of public documents
- Fair reporting of public proceedings
Hong Kong
Available defences include:
- Lawful authority
- Crime prevention
- Reasonable belief of consent
- Disclosure solely for a lawful news activity with reasonable grounds to believe that the publication or broadcasting was in the public interest
Outcome
Australia
Remedies for the plaintiff may include:
- Damages
- Including damages for emotional distress and in exceptional circumstances, exemplary damages
- Capped at an amount not exceeding that on damages for non-economic loss in defamation
- Account of profits
- Interlocutory or other injunctions
- Delivery and destruction or removal order
- Correction order
- Apology order
Hong Kong
The defendant may face up to:
- For first-tier offences: HK$100,000 in fines and 2 years of imprisonment; and
- For second-tier offences: HK$1,000,000 in fines and 5 years of imprisonment.
Although the HK anti-doxxing provisions provide for injunctions and cessation notice, the power is exercised by the PCPD to demand actions to cease or restrict disclosure of doxxing contents.
Other jurisdictions
The approach taken with respect to doxxing varies between jurisdictions. In addition to Hong Kong, doxxing practices are also criminalised in California and the Netherlands. Singapore also criminalises publication of identity information of another person with intent to cause and which causes harassment, alarm, or distress. Courts in the UK, New Zealand and some states in Canada recognize the right to respect for privacy or a tort for invasion of privacy but it is notable that all these jurisdictions have over-arching human rights laws that include a right to privacy in some form. Meanwhile, statutory tort for invasion of privacy has been recognized in some states in the US and in Canada.
Our insights
As Australia has not developed a common law tort for privacy, the statutory tort will be a positive step in Australia’s effort to uphold privacy rights and curb doxxing acts, especially absent a human rights act of some form. The legislative reform can consider experiences from other jurisdictions in developing the most appropriate approach for Australia. As the comparison above demonstrates, the use of civil tort, as opposed to criminal law, is intended to ensure competing public interests (such as freedom of expression and journalism) are appropriately balanced against the need to protect against doxxing and provide appropriate redress for victims. A valid concern remains regarding the accessibility of these civil rights to ordinary individuals that are the victims of doxxing, in terms of speed, cost and effectiveness, at least in the short term. It remains to be seen whether the civil tort will be effective in deterring doxxing.
However, the introduction of the statutory tort for invasion of privacy will be a significant step in the ongoing reforms of Australian privacy law. In parallel, the Australian federal government will press on with reform of the Privacy Act as a whole, with draft legislation slated to be introduced as early as August 2024. We will continue to provide updates on privacy law reform in Australia as information becomes available.
Be prepared for continuing reforms in privacy and online safety
Organizations that collect, hold, or process personal information of customers, suppliers, (potentially) employees or the wider public will be expected to comply with changes to the privacy laws. In anticipation of the expedited doxxing and privacy reforms and without information on whether there will be any grace period, organizations should be prepared to evaluate their data governance strategies and data protection practices. When more details of the reforms are published in August, organizations can get prepared by having in place comprehensive and well-drafted policies and training materials, as well as practical and effective procedures. This will also help organizations to prepare for the wider reforms to the Privacy Act.
In addition, organizations and especially social media companies and digital service providers should familiarise themselves with the latest developments including the Australian Government’s recent announcement on trialling age assurance technology to protect children from harmful content and introducing legislation to criminalise the creation and non-consensual distribution of deepfake pornography. In addition, the upcoming Federal Court hearing testing the limits of the removal notice regime under the Online Safety Act in Australia will be of great interest both locally and globally. The Australian government has repeatedly demonstrated a willingness to introduce new and innovative laws to regulate emerging digital and cybersecurity issues, sometimes with unintended consequences for the broader business ecosystem. It is important to stay close to the reforms and understand the impact on your operations.
Tara Li, a trainee solicitor at our Hong Kong office, also contributed to this article.
