Roger Clarke's Web-Site


© Xamax Consultancy Pty Ltd,  1995-2016

Roger Clarke's 'What to do about Privacy and the Media'

Privacy and the Media - A Normative Analysis

Working Paper Version of 15 December 2012

Roger Clarke **

© Xamax Consultancy Pty Ltd, 2011-12

Available under an AEShareNet Free
for Education licence or a Creative Commons 'Some
Rights Reserved' licence.

This document is at

This version supersedes the earlier draft of March 2012 at


The eternal balancing act that is privacy protection is nowhere more challenging than in relation to the media. The negative impacts on the privacy of individuals have to be considered in the context of the media's vital role of informing the public, and hence underpinning democracy.

As a result, in many countries, the media have enjoyed special treatment, in that the data protection laws that have arisen since 1970 apply to them in only a qualified manner, or not at all. The serious misbehaviour of segments of the UK media in recent years may be an extreme case, but that country is not alone in having a seriously deficient regulatory environment.

The media is undergoing rapid change, induced by Internet technology and the undermining of both subscription and advertising revenues. Print and broadcast have been supplemented by networked media, and competition has been heightened by both new entrants and diversification among existing organisations. Many media organisations are in the process of undergoing not only convergence but also staff reductions. Meanwhile, electronic technologies have put many key capabilities in the hands of enthusiastic amateurs, resulting in the rise of 'the unofficial media'. In many jurisdictions, regulatory reform is urgently needed, but it must take into account the many ways in which the media sector is in flux.

This paper presents a normative proposal for the regulation of the media's impacts on privacy. The proposal takes into account the realities of 21st century media, identifies recurrent issues, analyses privacy needs, and reflects the varied terms of the many self-regulatory Codes of Conduct that exist in industry segments and individual media organisations. Although the empirical base is entirely from within one country, Australia, the privacy needs are recognised in international instruments, and the themes are common. The resulting proposal therefore has relevance in most countries.

The proposal developed in this paper can be used as a basis for the preparation of laws or Codes for print, broadcast, networked and/or converged media in any country. Alternatively, it may be used as a reference-point against which existing and proposed laws and Codes can be assessed.


1. Introduction

The term 'the media' refers variously to organisations, channels and technologies whereby information is communicated to large audiences. The scope encompasses news, propaganda, advertising and entertainment. The term generally does not extend to means whereby individual members of the audience seek and gain access to stored information, i.e. the media industry embodies supplier-push rather than consumer-pull. This paper does not address the propaganda, advertising and entertainment aspects of the media, but focusses on news and current affairs, including radio review programmes and video-documentaries. The profession of journalism, which underlies 'news and current affairs', plays a vital role in informing the public. Critical examination of media releases and investigative reporting result in the exposure of inappropriate behaviour, particularly by governments, and are crucial elements of an effective democracy.

In common with all other human undertakings, however, there are challenges in maintaining quality in the media. Areas of concern include inappropriate data collection practices, such as deceit, and insensitivity in dealing with vulnerable people; and inappropriate features of publications such as inaccuracy, unfairness, bias, failure to declare potential conflict of interest, insensitivity and unreasonable discrimination. Media organisations have, however, parlayed the widely-perceived importance of their work into substantial freedom from regulation.

This paper arises from a research project conducted during the period 2007-12, in both academic and advocacy contexts. It has been a period of turmoil in the media, particularly the print media, as a result of the rapid adoption of electronic access to publications, and the equally rapid and very substantial change in advertising spend. In the midst of this, the revelations about serious malpractice by the UK tabloid press led to the Leveson Inquiry and parallel concerns in Australia. The most relevant of the prior publications arising from the projects have been Clarke (2012a), which provides a comprehensive review of the landscape, Clarke (2012b), which identifies and evaluates existing media Codes, and Clarke (2013), which examines the use of surveillance technologies by the media.

This paper is specifically concerned with the impacts on individuals who come to the attention of the media, and in particular with privacy-invasive data collection practices and unjustified disclosure of personal data. Because of the limited controls that are applied to the media, there are frequent abuses of privacy by media organisations, and the aggrieved have little or no recourse available to them.

This paper identifies and analyses the privacy needs in the media area, and puts forward a specific proposal for a regulatory framework that carefully balances the privacy interest against the vital role that the media plays in democracies. It does this by undertaking a careful analysis of privacy needs within the specific context of the news media. It then articulates the abstract needs into specific, operational guidance, in the form of a Code Template. The purpose is to ensure privacy protections for people, by providing clear information to the staff of media organisations, and establishing a firm foundation for the assessment of complaints about media behaviour.

The analysis and the general and specific proposals presented in this paper have been developed within a single jurisdictional context, that of Australia. On the other hand, the privacy needs are recognised in international instruments, and the themes are common. In particular, they are prominent in the UK, in the form of the analysis and recommendations arising from the recent Inquiry into the Press (Leveson 2012). The resulting proposal therefore has general relevance.

The paper commences with a general description of contemporary media, media organisations and media behaviour. Subsequent sections examine the current regulatory framework, then identify the requirements, present a normative framework, and outline a Code Template containing specific guidance for media organisations and their staff.

2. The Media in the Early 21st Century

A series of broad waves of media can be usefully distinguished, each complementing rather than replacing earlier forms. A previous paper arising from this research program distinguished display media (from cave-paintings to scrolls and onwards to billboards), print media (pamphlets, books, newspapers and magazines), sound and recording media, broadcast media, and most recently networked media - at first 'wired' and now 'unwired' and supporting mobile users Clarke (2012a, pp.161-165). See also Gorman & McLean (2009).

As presaged above, the primary focus in this paper is on journalism - the preparation of news, current affairs and documentaries, by means of the discipline of collecting, analysing, cross-checking and presenting information regarding events and issues that are 'in the public interest'. Journalism includes 'opinion', but opinion needs to be clearly distinguished as such.

The ideals of journalism are frequently compromised, and sometimes corrupted or debased. The term 'advertorialism' is usefully applied where the analysis and cross-checking functions are compromised, and propaganda issued by government public relations and corporate marketing units is published with very limited editing, let alone critical consideration or an endeavour to achieve balance. Another form of compromise, which is of more direct relevance to this paper, might be termed 'voyeurnalism'. This involves the presentation of information that is not justifiable 'in the public interest' but rather is 'what the public is interested in', or 'what the public may be able to be caused to be interested in'. This paper is concerned primarily with journalism, but also to some extent with voyeurnalism, because of the prevalence with which it deals in content relating to identifiable individuals.

The quality press (once referred to as 'the broadsheets') presents itself as being committed to journalism, but increasing proportions of its publications have been lapsing into both advertorialism and voyeurnalism. The rest of the press (once referred to as 'the tabloids') focus on voyeurnalism, with varying depths of journalism veneer. In the broadcast media, portions of the radio market segment continue to evidence at least some journalism, but commercial television channels heavily compromise their news and current affairs programs towards sensationalist presentation and voyeurnalism.

The networked media wave has seen the emergence of new competitors, but also the search by existing organisations for synergies between new and old forms. The term 'media convergence' has been much-used to refer to the impacts of networks on previous media forms. In the context addresse by this paper, the significance of convergence is that it highlights the commonality of quality and privacy issues across all media forms.

Networked media has had two further impacts of relevance to the analysis that follows. As media organisations moved onto one another's turf, and as newcomers emerged, competition for content, for customer attention, and for susbcription revenue, have all greatly intensified. The longstanding media organisations have suffered even greater reductions in advertising revenue. Classified advertising has become more competable. In the display advertising area, meanwhile, the available revenue is not only spread more thinly over more channels, but a single organisation, Google, is extracting far higher margins than did the value-chains through which advertisements were placed in the past. In the new era of much-reduced revenues flowing to publishers, serious doubts have been expressed about the capacity of the media organisations that have conducted journalism to sustain the discipline of collecting, analysing, cross-checking and presenting information.

The other impact has been the growth in 'unofficial media', including personal web-sites containing commentary, image and video, 'web-site diaries' (blogs), video-postings (supported by, for example, YouTube), and 'social media' (particularly Facebook and Twitter). More formalised instances of collaborative news reporting also exist, and the 'Arab Spring' of 2011 featured a considerable amount of direct reporting via networked media. This is also having a diluting effect on longstanding media empires.

The following section provides a brief oevrview of existing regulatory arrangements in relation to privacy-abusive behaviour by the media, concluding that they are an abject failure.

3. The Existing Regulatory Framework

Considerable evidence exists of privacy-abuse by media organisations. Only a little of that evidence can be found in case law and in reports by quasi-judicial tribunals and self-regulatory organisations. That is because relatively few complaints are pursued through formal channels, few are successful, and even those decisions deliver so little satisfaction to complainants that few people waste their time initiating complaints. An earlier paper arising from this project presented a set of case studies that demonstrate the breadth of the abuses (Clarke 2012a, pp. 166-171. See also Clarke 2011).

The following sub-sections consider the extent to which effective privacy protection is afforded firstly by common law and statutory torts and by other legislative provisions, and secondly by other forms of regulation. Fuller treatment is provided in Clarke (2012a, pp. 173-176).

3.1 Formal Legal Protections

Tort law (such as trespass, nuisance, stalking and misrepresentation) has not been developed by Australian courts, and only a few aspects have been addressed by parliaments, with the result that torts provide very limited privacy protection Clarke (2012a, pp. 173-174).

Generic data protection legislation exists at federal level, in three of the States and both Territories. Most large and medium-sized Australian corporations are subject to a very weak, generic legislative scheme enacted in 1999 as amendments to the Privacy Act 1988 (Cth), and weakened yet further by an amendment in late 2012 (APF 2012b).

Media organisations are entirely exempt from the generic law, however. Exercise of the exemption merely requires that the media organisation be "publicly committed to observe [published] standards that deal with privacy in the context of the activities of a media organisation" (Privacy Act s.7B(4)). Media organisations are free to choose or create any 'standards' that they like, provided that they purport to "deal with privacy". There are no external standards or tests of credibility, and there is no requirement for consultation with the affected public. The ALRC Report considered the media exemption, but failed to recommend any change beyond suggesting that, to qualify for the media exemption, an organisation should be required to "deal adequately with privacy" (ALRC 2008a, at para. 42.24, emphasis in original). Over four years later, the Government has yet to respond to even that very limited proposal.

Separately, the ALRC recommended a statutory cause of action and that "acts and practices in the course of journalism should remain subject to the recommended statutory cause of action" (ALRC 2008b, Recommendation 74). During the height of public opprobrium about media misbehaviour in the UK, in September 2011, the Australian Government issued a Discussion Paper (DPMC 2011, APF 2011b, APF 2011c). The media responded with little reasoned argument but considerable bile (Clarke 2011, 2012a, pp. 178-180). The relevant Ministries were re-shuffled shortly afterwards, and there has been no further sign of any intention to proceed with legislation.

The NSW Law Reform Commission considered the use of surveillance by the media. Its recommendations would have applied to the media, although with qualifications and some exemptions (NSWLRC 2005). It subsequently recommended a statutory cause of action for invasion of privacy, which it proposed be generic, including application to the media, but carefully designed in order to ensure balance against other important public interests (NSWLRC 2009). The Victorian Law Reform Commission has also recommended a regulatory framework for surveillance, including by the media, and two statutory causes of action dealing with serious invasion of privacy caused by misuse of surveillance in a public place (VLRC 2010). However, no subsequent government in either NSW or Victoria has shown any interest in implementing their LRCs' recommendations.

Because the regulatory framework is almost non-existent, control over unreasonable media policies and practices depends on co-regulatory and self-regulatory arrangements.

3.2 Co-Regulation and Self-Regulation

In the case of commercial broadcast media, a co-regulatory scheme is in place, administered by the Australian Communications and Media Authority (ACMA). ACMA has comprehensively demonstrated that the arrangements are completely ineffective in relation to the protection of privacy (Clarke 2012a, pp. 184-185), to the extent that even media commentators have expressed derision (e.g. Ackland 2011).

Codes have been published variously by media organisations, by industry associations, and by the self-regulatory body for the print media, the Australian Press Council (APC). Existing Codes are documented in (Clarke 2012b). An examination of the existing Codes was undertaken as part of the current project and documented within Clarke (2012b). It showed that all of the Codes are highly deficient. Most limit themselves to abstract statements. All of them address only a sub-set of the concerns. Very few are backed up by effective business processes that enable people whose privacy has been abused to gain redress.

The case studies documented in Clarke (2012a, pp. 166-171) showed that the defects in the co-regulatory and self-regulatory schemes are so substantial that redress is seldom achieved. The Australian Law Reform Commission observed that "Such sanctions for breach as exist provide few, if any, real remedies for individuals whose privacy rights have been seriously affected" (ALRC 2008, at 42.24). The Finkelstein Inquiry into the Media and Media Regulation in Australia was in no doubt that serious problems exist and that the existing mechanisms "are not sufficient to achieve the degree of accountability desirable in a democracy" and "the problems ... are inherent, and cannot be easily remedied by piecemeal measures" (Finkelstein 2012, Executive Summary, paras. 6 and 7). In the UK, the Leveson Inquiry reached similar conclusions (Leveson 2012).

The evidence of privacy abuses combined with the inadequacies of the available protections have provided the base on which the following section builds the analysis of privacy requirements.

4. The Proposed Framework

This section presents the requirements for the effective protection of privacy, balanced against the public interest. The purposes of the analysis are to state requirements, to outline the arguments in support of them, and to lay the basis for a template Code. The study is specific to Australia. On the other hand, many aspects of the 'privacy and the media' landscape are shared with large numbers of other jurisdictions, particularly in democratic countries. The analysis therefore has international relevance.

The analysis and proposal draws heavily not only on several of the author's papers, but also on a series of activities conducted by a small task force of the Australian Privacy Foundation (APF), of which the author was a member. Eleven submissions, policy statements and letters are identified in the Reference List (APF 2007-2012), particularly APF (2009 and 2011c).

Privacy protection depends on a framework, by which is meant multiple infrastructural elements, linked within an architecture. At the core is a set of Principles, perhaps expanded into Standards, which provide abstract statements of the requirements that need to be satisfied. These are of no direct use to harried reporters, who by the nature of their work have to gather, analyse, make judgements and write very quickly. Nor do abstract statements help editors to assess drafts, or complaints-handlers to quickly resolve post-publication disputes. It is therefore essential that the abstract Principles be operationalised into Codes that provide practical guidance. The first two sub-sections outline the necessary structure.

Promulgation of documents achieves nothing, however, unless their contents are understood and applied. The third sub-section deals with their assimilation and use by reporters. The fourth discusses their relevance to dispute-resolution. Two further elements are necessary. The fifth sub-section describes the regulatory mechanism that is needed in order to ensure that Codes are taken seriously, and the final sub-section outlines a final fallback for serious and repeated breaches, in the form of a cause of action in the courts.

4.1 Principles and Standards

It has long been accepted that the quality of journalism is dependent on respect for a range of principles. For example, the Australian Journalist's Association brief statement, called a 'Code of Ethics', dates back to 1943 (MEAA 1996). Its statement of principle in relation to privacy is very limited, however:

11. Respect private grief and personal privacy. Journalists have the right to resist compulsion to intrude.

Principles are by their nature vague, abstract and aspirational. Principles are important, but are in themselves valueless as a means of protecting privacy. Principles need to be articulated to a sufficient level of detail that they provide guidance for the practice of journalism. Similarly, complaints-handling is dependent on the existence of criteria whereby the appropriateness of media behaviour can be assessed.

The Australian Press Council has had a project in train since 2010 to expand its Principles into Standards (APC 2011a, 2011b). After the elapse of over 2 years, however, only a single Standard has been published, relating to the reporting of suicides.

Even these lengthier Standards are unlikely to be sufficient to solve the problem. Journalists have always worked under time-pressure. Their plight has been exacerbated in recent years by the sharpening of competition, and cost-pressures resulting in fewer resources with which to sustain quality. In these circumstances, more than ever, guidance must be expressed in forms that are readily accessible to the busy media professional, and at a sufficient level of practical detail.

The appropriate way to achieve this is to ensure that each media professional has a Code available to them that operationalises the Principles and Standards within their particular context. The press, broadcast media and networked media each has its own modus operandi, its own sources and channels, and its own news-cycle. Politics, business, the courts, health, sport and social issues, all have their own norms. For a Code to be seen by each particular media professional as relevant to their world, a sufficiently large set of Codes is needed.

The following sub-section describes the central element of the proposed regime.

4.2 Codes

Each Code must be structured and expressed in ways useful to the particular category of media professional. They must be able to quickly locate and drill down to what they need. Relevant examples must be included, designed to encapsulate the accumulated experience in that context. Wherever possible, the examples should be based on relevant cases that have been determined by complaints-handlers, and other commonly encountered circumstances. In order to ensure comprehensiveness, however, some examples may need to be contrived. Together the examples must convey all key aspects of the balancing of the public interest in information against the privacy interests of individuals who are 'in the news'.

Neither the privacy interest nor the public interest is paramount. Appropriate balances must be found, and weighed against practicalities and costs. Counsels of perfection would be unfair in hectic operational environments. Nonetheless, Codes must define the black from the white, and indicate how the inevitable 'grey area' situations need to be approached.

To fit to the needs of media organisations, it is necessary to structure each Code into sections that correspond to the successive phases of media activity:

Both information-gathering and publication are subject to general requirements of justification and proportionality. Justification must be based on either the individual's consent or an overriding public interest. Proportionality must be based on relevance and necessity of the specific information to that interest.

A Code Template is provided as an Appendix to this paper. It expresses underlying Principles, provides Definitions of key terms, and declares the specific categories of activity that represent breaches. This section provides analysis that underlies the definitions but is not appropriate as part of the Code itself.

The interpretation of the term 'the public interest' is central to privacy protection. It must not be infected with elements of 'what the public is interested in'. Keating (2010) put it this way: "The public interest means publication or non-publication guided by what is in the interest of the public as a whole, not what readers or an audience might find interesting or titillating".

A definition of 'the public interest' has been used by the self-regulatory body for the print media, APC, since at least December 2001, and has recently been adopted by the oversight agency for the broadcast media, ACMA. The definition derives from a UK judgement in London Artists v Littler (1969) 2 QB 375 at 391. Lord Denning, then Master of the Rolls, said that "There is no definition in the books as to what is a matter of public interest. All we are given is a list of examples, coupled with the statement that it is for the Judge and not for the jury. I would not myself confine it within narrow limits. Whenever a matter is such as to affect people at large, so that they may be legitimately interested in, or concerned at, what is going on; or what may happen to them or to others; then it is a matter of public interest on which everyone is entitled to make fair comment" (emphases added).

The words "people at large ... may be legitimately interested in" appear to open the scope out to 'what the public is interested in' . However, those comments were made in a very specific context. In defamation law, the defence of fair comment is dependent on the comment being made "on a matter of public interest". The term 'a matter of public interest' in the 'defence of fair comment' context is very different from the term 'the public interest' in the privacy context. Moreover, a number of statutes use the term 'the public interest'. The term's meaning has to be interpreted in each specific context. Any suggestion that Denning's interpretation has any legal authority in the ontext of privacy is entirely spurious. The APC/ACMA definition is not an appropriate basis for a Code that relates to privacy protection.

Another serious inadequacy that is frequently embodied in discussion about the public interest is the loose notion of a 'public figure' and the assumption that a public figure necessarily sacrifices their privacy. On the contrary, people about whom media activities are justified in the public interest need to be considered individually, and compromises to their privacy must be justified in the particular circumstances that apply.

A News Ltd lawyer was quoted in Keating (2010) as saying that "the main problem is 'public interest' is a nebulous concept that is difficult to define and even more difficult to weigh against the circumstances of a case.  It's the practical application that will cause the problems". Keating argued that "Rather than abandoning the public interest, the media needs to put more time and effort into fostering a better practical understanding of the term". In fact, over a year earlier, the APF's Policy Statement had proposed a specific process, and specific interpretations of six public interest elements (APF 2009). The six elements, discussed in the Code Template below, are:

Relevance to:

  1. the Performance of a Public Office
  2. the Performance of a Corporate or Civil Society Function of Significance
  3. the Credibility of Public Statements
  4. Arguably Illegal, Immoral or Seriously Anti-Social Behaviour
  5. Public Health or Safety
  6. an Event of Significance

The Code Template also defines the term 'overriding public interest', and identifies a number of additional factors relevant to the assessment of justification and proportionality.

4.3 Processes for Assimilation and Application

Principles, Standards and Codes achieve nothing unless they are carried through into practice. To achieve this, the following process aspects are particularly important:

To ensure that new entrants to the profession are well-prepared, the educational processes for journalists must include emphasis on the ethical and legal obligations associated with news-gathering and publication. One approach to achieving this is to require them to familiarise themselves with and apply the Code Template or more specific Codes developed from it.

Within the workplace, induction and training must ensure that journalists have access to, and a clear understanding of, the Code. Periodic reminders and refreshers must be built into journalists' working lives.

There must be unequivocal mechanisms whereby journalists are subject to the Code, in particular by incorporating the Code within their terms of employment or of contract. Not only the media organisation, but also individuals, must have positive and legally-enforced obligations to apply the Code.

In order to ensure the Code's application, controls must be designed into media organisations' workflows, such that sub-editors and editors detect and address breaches by individual journalists and ensure that inappropriate information-gathering practices are avoided, and that inappropriate exposure of personal data does not survive through to actual publication.

These prescriptions might appear to be statements of the obvious, and to refer to values and processes engrained into the practice of journalism. On the contrary, however, evidence exists that, in mid-2011, the News Ltd Code was not commonly known within the company, and processes to apply it were, at best, informal (Simons 2011).

4.4 Processes for Review and Redress

There must be a positive obligation on media organisations to handle complaints about behaviour by media organisations and their employees and contractors. The reference-point for complaints-handlers needs to be the relevant Code, if one exists, or failing that then the Principles and Standards.

Complaints processes must be straightforward and accessible. There is a well-established international standard with which the processes need to comply (ISO 10002:2004). Because the Codes articulate and operationalise the Principles and Standards, most complaints should be able to be investigated quickly and resolved promptly.

The threshold tests for a complaint to succeed must not be set unduly high. In particular:

Impactful sanctions must be available when the seriousness of the breach calls for them. On the other hand, most complainants want an acknowledgement of error, an apology, and/or correction, retraction or clarification. The limited remedies available in print form, such as further publication and letters to the editor are complemented in networked media by such possibilities as changes to the archived copy, including visible changes such as the use of strikethrough.

There must be a clear channel whereby those people who are not satisfied with the media organisation's handling of the matter can seek review by an independent organisation, which must in turn have the obligation, the requisite powers, the resources and the commitment to resolve problems, and the commitment to impose sanctions where they are deserved.

4.5 A Regulator

Self-regulation is an excuse, not a solution. The failure of the various self-regulatory models is regularly demonstrated, through the lack of commitment by participants, lack of enforcement, lack of sanctions, and capacity for industry-members to declare themselves exempt. Self-regulation is not only a failure in theory, but a demonstrated failure in practice. It cannot be persisted with. On the other hand, given the importance of journalism to democracy, the fine judgement needed in making decisions, and the considerable risk of direct or indirect interference in the process by the government of the day or by public servants, a government regulatory agency for the media is not appropriate.

Consistently with the notion of co-regulation summarised in Clarke (1999), APF (2011c) proposed the following as being the key features of the necessary public regulatory body:

A properly-implemented co-regulatory scheme of this nature offers considerable advantages for all parties. The Australian and UK Inquiry Reports discuss aspects of the approach in considerable depth (Finkelstein 2012, Leveson 2012).

The risks to privacy are common to all forms of media, and the process of convergence reinforces the need for the regulatory body's scope to encompass all print media, all broadcast media and all networked media, and both private sector corporations and public sector organisations such as the Australian Broadcasting Corporation and the Special Broadcasting Service. The scope definition needs to be expressed broadly in order to ensure that the further new media that will doubtless emerge in the future are automatically within the regulatory body's ambit.

The regulatory body must have the power to determine and promulgate the Principles and Standards and the Codes that articulate them. However, in preparing and revising Principles, Standards, Codes and associated business processes, the regulatory body must have obligations:

There must be a positive obligation on the regulatory body to handle complaints about behaviour by media organisations and their employees and contractors. There needs to be a policy that complaints should be first handled by the media organisation whose behaviour is being complained about; but the regulatory body needs to have a discretion to handle complaints at first instance when the circumstances make that a more practicable procedure.

As with internal complaints-handling, the reference-point needs to be the relevant Code, if one exists, or failing that then the Principles and Standards. Complaints processes must be straightforward, accessible and compliant with the international standard (ISO 10002:2004). Because a clear framework is in place, most complaints should be able to be investigated quickly and resolved promptly.

The regulatory body must have available to it a comprehensive, gradated range of measures available to it in the form an 'enforcement pyramid' or 'compliance pyramid' (Ayres & Braithwaite 1992), with a broad base of education and guidance, mediation and arbitration, together with sanctions and enforcement mechanisms available when necessary to deal with serious or repeated breaches. There must be effective means whereby non-compliance by media organisations with the Principles, the Standards, the Codes or the regulatory body's determinations is subject to further sanctions sufficient to deter other organisations from such behaviour.

The regulatory body must have obligations to apply the review processes and remedies and to apply them appropriately, and the requisite resources to apply them. The regulatory body must have the powers necessary to protect the interests of the intended beneficiaries, and to protect itself. The regulatory body must have the resources necessary to enable it to perform its functions.

4.6 A Statutory Cause of Action

A privacy cause of action is a necessary, complementary privacy-protection measure. It needs to be applicable to every individual and organisation, with the media as just one specific area of application. The media must, however, have special protection by means of a clear and strong public interest test along the lines identified earlier, proposed by all three Law Reform Commissions, and expressed in greater detail in the Code Template.

The reasons the cause of action is necessary are that:

To be successful, a plaintiff should be required to show that they had a reasonable expectation of privacy and that the act was sufficiently serious to reasonably cause the person substantial offence or distress ('offensive intrusion'). Intention, recklessness, but also a serious lack of care, should all be actionable.

No such cause of action has emerged in Australian courts. As discussed above, the three Law Reform Commissions have all recommended the creation of a statutory tort. None has been enacted by any Australian Parliament, and it appears unlikely that the Commonwealth Government will proceed with the proposal canvassed in its issues paper in 2011. If this vacuum persists, then the elements described in the earlier sub-sections assume all the more importance.

5. The Code Template

The previous section presented the requirements for the effective protection of privacy, balanced against the public interest. In particular, Privacy Principles and Standards need to be articulated into Codes that provide clear and operationally useful guidance to particular categories of media professional. The Code Template presented in an Appendix to this paper is intended to provide a basis for the formulation of specific Codes. It comprises the following sections:

This section provides an outline of the approach adopted to the creation of the Code Template, and reports on trial applications.

5.1 Preparation

The drafting of the Code Template took into account the Foundation Principles that emerged from the analysis, and the body of case studies. These insights were complemented by a perusal of existing Codes. This enabled the adoption of terms used by media organisations, and assisted in ensuring the Template's comprehensiveness.

Clarity is important. Media professionals need a practical guidance document. The organisation and expression need to ensure that it is readily accessible by all interested parties. In order to achieve this, the Principles have been separated from the specific operational requirements, and three sections have been distinguished, relating to the phases of research, publication and complaint-handling. To ensure that terms are used in a consistent manner, explanations of their intended meanings have been consolidated into a definitions section.

The Code Template was designed to be applied in at least two ways:

The media as a whole needs a general body of principles and standards. On the other hand, there is considerable diversity in the modes of operation of print, broadcast and networked media, and in the extent to which media organisations conduct journalism, advertorialism and voyeurnalism. There are also different legal contexts, e.g. for print, for commercial broadcast, and for the two national broadcasters. Hence the text in the Code Template needs to be supplemented by examples that encapsulate accumulated experience in each particular context to which Codes are addressed. Generally, examples need to be based on real-world situations, including those encountered by professionals working in the particular context and relevant cases that have been determined by complaints-handlers. To ensure comprehensiveness, some examples may beed to be contrived.

5.2 Trial Application

The Code Template has been used as a basis for assessing a number of Codes that existed in Australia at the end of 2011. The assessments are provided in Clarke (2012b).

Several observations arise from these trials. It proved to be reasonably straightforward to compare the Codes against the Code Template. All of the Codes that were assessed failed against the requirements, many by a wide margin. The broadcast media Codes (ACMA 2009) satisfy almost none of the requirements.

The least-worst Code was found to be that of News Ltd (News Ltd 2006). That Code is moderately comprehensive, and noticeably more so than even those of the ABC and the Fairfax broadsheets. As noted earlier, however, the existence of the News Ltd Code was not well-known to staff-members, and hence the company's advantage, and its satisfaction of the needs identified in this paper, has been merely nominal.

The assessments also showed that the Code Template is in no sense 'privacy-absolutist'. As shown in the initial Working Paper (Clarke 2012c), a large majority of the privacy-protective features specified in the Code Template already appear in one or more of the existing Codes. For example, the Proportionality Principle (1.4) is evident in four Codes, provisions relating to all aspects of deceit (3.3) appear in at least two Codes each, care with the publication of sensitive personal data (4.6) appears in four, and so does a specification for a complaints-handling process (5.2). In addition, five of the six elements of the public interest are identified in the Code published by the Fairfax broadsheet, 'The Melbourne Age'.

6. Conclusions

An analysis of privacy needs was undertaken, in order to develop a set of Principles and to articulate them into a generic guidance document for the staff of media organisations. When compared against existing Codes, the resulting guidance document is not extremist or outlandish. It is, however, comprehensive, in that it addresses all of the privacy needs rather than the limited sub-set that is found in the mostly ad hoc and poorly-developed documents issued by media organisations, industry associations and self-regulatory and co-regulatory bodies.

The purpose of the Code Template is to provide a resource for organisations that develop Codes for media professionals in particular contexts, such as journalists in parliamentary press galleries, cameramen attending crime and accident scenes, and reporters doing live broadcasts from suburban streets. In addition to operational guidance, the Code Template, and especially Codes derived from it, provides a firm basis for the handling of complaints, including determination of whether or not particular media behaviour, and the publication of particular personal information, are justified by an overriding public interest, and proportionate in the circumstances.

The official media need to be seen to be professional and professionally responsible, in order to distinguish their product from that of the amateur media that have been enabled by Internet services. The official media also need to be highly efficient in their activities, due to their shrinking revenue-base. The Code Template offers assistance to media organisations in relation to the projection of their professionalism, and in relation to the efficiency of their information-gathering, publishing and complaint-handling functions.

Widespread dissatisfaction with media behaviour is evident in a variety of countries, most notably the UK and Australia. Adoption of this Code Template would materially assist media organisations in recovering their credibility and forestalling more drastic action that could threaten the media's crucial democratic functions.

Appendix: The Code Template

This Code applies to all activities of all media organisations and their employees and contractors that involve the gathering or publication of personal data about any person.

1. Foundation Principles

The following are Foundation Principles:

  1. Information Gathering:
    1. Personal data must not be sought or gathered, by or for a media organisation, unless a clear justification exists
    2. Personal behaviour must not be observed or recorded, by or for a media organisation, unless a clear justification exists
    3. In either case, the justification must be based on:
      • consent by the person to whom the data relates; or
      • an overriding public interest
    4. The nature of the activities, and their degree of intrusiveness:
      • must reflect the nature and extent of any consent provided; and
      • must be proportionate to the nature and significance of the public interest arising in the particular circumstances
  2. Publication:
    1. The identities of individuals, personal data about them, their communications, and records of their behaviour must not be published unless a clear justification exists, and any undertaking in relation to anonymity must be respected
    2. The justification must be based on:
      • consent by the person to whom the data relates; or
      • an overriding public interest
    3. The content and style of publication:
      • must reflect the nature and extent of any consent provided;
      • must be relevant to the public interest arising in the particular circumstances; and
      • must be proportionate to the nature and significance of the public interest arising in the particular circumstances
    4. Publication cannot be justified based on prior publication alone, whether the prior publication was by another media organisation or by anyone else, including by the individual concerned
  3. Review Processes and Remedies:
    1. Effective complaints-handling processes must be available to people who believe that these Principles have not been respected

2. Definitions

The following Definitions apply:

By 'personal data' is meant data about a person whose identity is apparent in the circumstances. It is not necessary for the person to be identifiable solely from the data published by the media organisation, if the media organisation was aware, or should reasonably have been aware, that other data is readily available that can be combined with the data it publishes in order to identify the person.

The notion 'the public interest' comprises six elements, but with the possibility of extension. The six elements are:

  1. Relevance to the Performance of a Public Office. This encompasses all arms of government, i.e. the parliament, the executive and public service, and the judiciary. The test of relevance is mediated by the significance of the role the person plays. For example, publication of the fact that a Minister's private life has been de-stabilised (e.g. by the death of a family member, marriage break-up, or a child with drug problems) is more likely to be justifiable than the same fact about a junior public servant. Publication of the identities and details of other individuals involved (e.g. the person who died, or the child with drug problems) is also subject to the relevance test, and is far less likely to be justifiable
  2. Relevance to the Performance of a Corporate or Civil Society Function of Significance. Senior staff of organisations outside the public sector also have significant economic and social impacts. The relevance test needs to reflect the size and impact of the organisation and its actions, the person's role and significance, and the scope of publication
  3. Relevance to the Credibility of Public Statements. Collection and disclosure of personal data may be justified where the information demonstrates inconsistency between a person's public statements and their personal behaviour, or demonstrates an undisclosed conflict of interest. However, the exposure of hypocrisy involves a proportionality test, based on the scope of the person's influence.
  4. Relevance to Arguably Illegal, Immoral or Seriously Anti-Social Behaviour. This applies to private individuals as well as people performing functions in organisations. For example, in the case of a small business that fails to provide promised after-sales service, or a neighbour who persistently makes noise late at night, some personal data is likely to be relevant to the story. Collection and disclosure of other personal data will, on the other hand, be very difficult to justify
  5. Relevance to Public Health or Safety. For example, disclosure of a person's identity may be justified if they are a traveller who recently entered Australia, they are reasonably believed to have been exposed to a serious contagious disease, and their present whereabouts is unknown
  6. Relevance to an Event of Significance. This is challenging, and requires care. For example, a 'human interest' story such as a report on bush fire-fighter heroics, may well justify the publication of some level of personal data in order to convey the full picture. Similarly, victims of serious crime come into the public eye for one or more short periods of time. Generally, consent is necessary; but where this is impractical and the story warrants publication, the varying sensitivities of individuals must be given careful consideration. This is especially important in the case of people caught up in an emergency or tragedy, who are likely to be particularly vulnerable

Other public interest elements may need to be recognised. However, in the handling of a complaint, any such justification must be argued, and the onus lies on the media organisation to demonstrate that the benefits of information gathering and/or publication outweigh the privacy interest.

For clarity, the expression 'the public interest' does not encompass what the public is interested in, nor what the public may be able to be encouraged to be interested in.

Dependence on the existence of a public interest is not enough. It is necessary that there be 'an overriding public interest'. By this is meant that the public interest must be of sufficient consequence that it outweighs the person's interest in privacy and any other conflicting interests such as public security and the effective functioning of judicial processes.

When assessing whether the public interest is sufficient to over-ride the privacy interest, and when assessing proportionality, several additional factors may need to be considered. The following factors have the effect of reducing the zone of privacy protection and increasing the scope for publication and to some extent also for information gathering:

  1. Self-Published Information. Where an individual has published personal data about themselves, that person's claim to privacy in respect of that data is significantly reduced. However it is not extinguished. In particular, justification becomes more difficult the longer the elapsed time since the self-publication took place, and the less widely the individual reasonably believed the information to have been made available. Further, to qualify as 'self-published', information must have been published by the individual themselves, not by another individual, even a relative or close friend or associate.
  2. Public Behaviour. Where data about an individual arises from public behaviour by that individual, the person's claim to privacy in respect of that behaviour is reduced. However, public behaviour does not arise merely because the individual is 'in a public place', because there are many circumstances in which people in a public place have a reasonable expectation of privacy. For example, 'public behaviour' does not include a quiet aside to a companion in a public place.
  3. Attention-Seekers. In the case of people who are willingly in the public eye (e.g. celebrities and notorieties), consent to collect and publish some kinds of personal data may be reasonably inferred. But this does not constitute 'open slather', and in particular denial of consent must be respected. Moreover, this mitigating factor is not applicable to the attention-seeker's family and companions.

On the other hand, there are factors that increase the zone of privacy protection and reduce the scope for information-gathering and publication, especially:

  1. Vulnerability of the Person whose privacy is being invaded, and of the people associated with them. Examples include children, the mentally disabled, homeless people, accident victims, the recently bereaved, and individuals associated with a person accused or convicted of a crime

3. Information-Gathering Behaviour

The following data-gathering activities are breaches of this Code, unless they are justified by an overriding public interest, taking into account relevant factors, and in particular the sensitivity of the context and the degree of discomfort, anger or distress that the performance of the activity may give rise to:

  1. activities that intrude into the person's private space
  2. activities that intrude into the person's reasonable expectations of privacy, notwithstanding that the person is in a public space
  3. activities that involve deception, such as the following:
  4. activities that exploit vulnerability, naiveté or ignorance about media organisations' collection practices. Particular concern arises in the case of children and people with limited mental capacity or experience
  5. activities that intrude into the private space of people in sensitive situations, such as accident victims, witnesses to accidents, and the bereaved
  6. activities that place pressure on a person to behave in a particular manner or to divulge sensitive data, such as conveying the implication that the person is under a legal or moral obligation, intimidation and excessive persistence
  7. activities that the person reasonably perceives to constitute trespass, nuisance, obstruction, pursuit, harassment or stalking

4. Publication

The following publication activities are breaches of the Code, unless they are justified by an overriding public interest, taking into account relevant factors, and in particular the sensitivity of the context and the degree of discomfort, anger or distress that the performance of the activity may give rise to:

  1. identification of an individual who has not provided consent, and especially of an individual who has requested anonymity or pseudonymity
  2. identification of an individual who the media organisation does or reasonably should know may be thereby placed at risk, even if they have provided consent
  3. identification of an individual who is associated with a person accused or convicted of a crime but who is not themselves directly implicated in the relevant activity
  4. disclosure of personal data that has been provided in confidence, or as background information to assist in understanding the circumstances
  5. disclosure of personal data that is not relevant to the matter, even if consent has been provided
  6. disclosure of sensitive personal data, even if the person concerned has given consent, unless that data is not merely relevant, but also demonstrably important, to the matter being reported
  7. disclosure of sensitive images, audio or video concerning a person, even if the person concerned has given consent, unless that data is not merely relevant, but also demonstrably important, to the matter being reported

A breach of any aspect of this section is not justified merely on the basis that the individual's identity or the personal data had been previously published by a media organisation, or was otherwise in the public domain. Each publication by each media organisation is subject to all of these requirements.

5. Review Processes and Remedies

Each media organisation must ensure that a person who considers that that media organisation, or an individual performing actions on its behalf, has breached this Code must have available to them:

  1. a process whereby a complaint can be made to that media organisation, in the justified expectation that the complaint will be considered and responded to
  2. a process whereby the complaint is considered and responded to by that media organisation
  3. a process whereby a complaint can be escalated beyond the media organisation
  4. access to a quasi-judicial organisation with sufficient powers that remedies can be determined that are commensurate with the seriousness of the breach
  5. access on appeal to judicial review


Ackland R. (2011) 'Muddle-headed watchdog leaves the privacy door ajar' The Sydney Morning Herald, 18 February 2011, at

ACMA (2009) 'Broadcasting Codes Index' Australian Communications and Media Authority, 2009, at

ALRC (2008a) 'For Your Information: Australian Privacy Law and Practice' Report 108, August 2008, Ch. 42 - Journalism Exemption, at

ALRC (2008b) 'For Your Information: Australian Privacy Law and Practice' Report 108, August 2008, Ch.74 - Protecting a Right to Personal Privacy, at

APC (2011a) 'General Statement of Principles', Australian Press Council, Date of Origin unclear, no prior versions visible, current version dated August 2011, at

APC (2011b) 'Statement of Privacy Principles', Australian Press Council, Date of Origin unclear, no prior versions visible, current version dated August 2011, at

APF (2007a) 'Submission to the Australian Law Reform Commission's Review of Privacy - Answers to questions in ALRC Issues Paper 31' Australian Privacy Foundation, January 2007, at pp. 14-15 of

APF (2007b) 'Submission to 'Australia's Right To Know' Coalition's Independent Audit into the State of Media Freedom in Australia' Australian Privacy Foundation, August 2007, at

APF (2007c) 'Supplementary Submission to 'Australia's Right To Know' Coalition's Independent Audit into the State of Media Freedom in Australia' Australian Privacy Foundation, October 2007, at

APF (2007d) 'Submission to the Australian Law Reform Commission re the Review of Australian Privacy Law - Discussion Paper 72' Australian Privacy Foundation, December 2007, at p. 68 of

APF (2009) 'APF Policy Statement re Privacy and the Media' Australian Privacy Foundation, March 2009, at

APF (2010) 'Privacy Aspects of the ABC Code' Letter to the Managing Director of the ABC, Australian Privacy Foundation, 18 August 2009, at

APF (2011a) 'A Privacy Right of Action' Policy Statement, Australian Privacy Foundation, 21 Jul 2011, at

APF (2011b) 'A Statutory Cause of Action' Submission to PM&C / Attorney-General's Dept, Australian Privacy Foundation, 4 Nov 2011, at

APF (2011c) 'An Appropriate Public Regulatory Body for Media Privacy' Submission to the Independent Media Inquiry, Australian Privacy Foundation, 18 Nov 2011, at

APF (2011d) 'Privacy Guidelines for Broadcasters' Letter to ACMA, 16 Dec 2011, at

APF (2012a) 'ACMA's Revised Privacy Guidelines for Broadcasters' Supplementary Submission to the Independent Media Inquiry , Australian Privacy Foundation, 9 January 2012, at

APF (2012b) ''Anti-Privacy Bill' Should be Scrapped' Media Release, Australian Privacy Foundation, 23 May 2012, at

Ayres I. & Braithwaite J. (1992) 'Responsive regulation: Transcending the deregulation debate' Oxford University Press, 1992

Clarke R. (1999) 'Internet Privacy Concerns Confirm the Case for Intervention', Communications of the ACM, 42, 2 (February 1999) 60-67, at

Clarke R. (2006) 'What's Privacy?' Xamax Consultancy Pty Ltd, Workshop Presentation for the Australian Law Reform Commission, July 2006, at

Clarke R. (2009) 'It's Time for Guidelines on 'Privacy and the Media'' Online Opinion, 18 May 2009, PrePrint at

Clarke R. (2011) 'Privacy Eye: media paranoia distorting facts on privacy tort' Crikey, 1 August 2011, at, PrePrint at

Clarke R. (2012a) 'Privacy and the Media - A Platform for Change?' Uni of WA Law Review 36, 1 (June 2012) 158-198, PrePrint at

Clarke R. (2012b) 'Privacy and the Media - Extracts from Media Organisation Codes of Conduct' Xamax Consultancy Pty Ltd, January 2012, at

Clarke R. (2012c) 'Privacy and the Media - A Code Template' Xamax Consultancy Pty Ltd, January 2012, at

Clarke R. (2013) 'Surveillance by the Australian Media, and Its Regulation' Forthcoming, Surveillance & Society, 2013, PrePrint at

Finkelstein (2012) 'Report of the Inquiry into the Media and Media Regulation' The Hon R Finkelstein QC assisted by Prof M Ricketson, Department of Broadband, Communications and the Digital Economy, 28 February 2012, at

DPMC (2011) 'Commonwealth Statutory Cause of Action for Serious Invasion of Privacy Issues Paper' Department of the Prime Minister and Cabinet, September 2011, at

Gorman L. & McLean D. (2009)  'Media and Society Into the 21st Century: A Historical Introduction' Wiley-Blackwell, 2nd Edition, 2009

ISO (2004) 'Quality management--Customer satisfaction--Guidelines for complaints handling in organizations' International Standards Organisation, ISO 10002:2004

Keating P. (2010) 'Protect privacy in information free-for-all', Opinion, The Sydney Morning Herald, 5 August 2010, at

Leveson (2012) 'An inquiry into the culture, practices and ethics of the press: report' The Leveson Inquiry, UK Official Document No 0780 2012-13, 29 November 2012, at

MEAA (1996) 'Media Alliance Code of Ethics' Media Entertainment and Arts Alliance, undated but apparently of November 1996, at

News Ltd (2006) 'Professional Conduct Policy' News Limited, March 2006, at

NSWLRC (2005) 'Surveillance: Final report' Report 108, NSW Law Reform Commission, May 2005, at

NSWLRC (2009) 'Invasion of privacy' Report 120, NSW Law Reform Commission, 2009, at

Simons M. (2011) 'More on the News Limited Code of Professional Conduct, and Knowledge of Same' Crikey Blog, 9 July 2011, at

VLRC (2010) 'Surveillance in public places: Final report' Victorian Law Reform Commission, August 2011, at


The author has been a Board member of the Australian Privacy Foundation since 1987 and its Chair 2006-12. This paper draws heavily on the APF's Policy Statements, and hence on the work of fellow Board members, particularly Nigel Waters.

Author Affiliations

Roger Clarke is Principal of Xamax Consultancy Pty Ltd, Canberra. He is also a Visiting Professor in the Cyberspace Law & Policy Centre at the University of N.S.W., and a Visiting Professor in the Research School of Computer Science at the Australian National University.

xamaxsmall.gif missing
The content and infrastructure for these community service pages are provided by Roger Clarke through his consultancy company, Xamax.

From the site's beginnings in August 1994 until February 2009, the infrastructure was provided by the Australian National University. During that time, the site accumulated close to 30 million hits. It passed 50 million in early 2015.

Sponsored by Bunhybee Grasslands, the extended Clarke Family, Knights of the Spatchcock and their drummer
Xamax Consultancy Pty Ltd
ACN: 002 360 456
78 Sidaway St, Chapman ACT 2611 AUSTRALIA
Tel: +61 2 6288 6916

Created: 14 October 2011 - Last Amended: 15 December 2012 by Roger Clarke - Site Last Verified: 15 February 2009
This document is at
Mail to Webmaster   -    © Xamax Consultancy Pty Ltd, 1995-2013   -    Privacy Policy