Roger Clarke's Web-Site

 

© Xamax Consultancy Pty Ltd,  1995-2017


Roger Clarke's 'Code for Privacy and the Media'

Privacy and the Media
A Code Template

Version of 17 January 2012

Roger Clarke **

© Xamax Consultancy Pty Ltd, 2011-12

Available under an AEShareNet Free
for Education licence or a Creative Commons 'Some
Rights Reserved' licence.

This document is at http://www.rogerclarke.com/DV/PandM-CodeTemplate.html

This is a supporting document for http://www.rogerclarke.com/DV/PandM.html


Contents


1. Introduction

As is shown in the primary paper, and in greater detail in a companion document, in 2011, the privacy protections available against inappropriate media behaviour fell vastly short of the public's need. A further companion document presents the requirements for the effective protection of privacy, balanced against the public interest. In particular, it requires that Privacy Principles and Standards be articulated into Codes that provide clear and operationally useful guidance to particular categories of media professional.

This document presents a template Code, which can be used by media organisations to upgrade their own Codes, and by other parties to assess the adequacy of media organisations' Codes. In each particular Code, the text needs to be supplemented by examples that encapsulate accumulated experience in the particular context to which the Code is addressed. Generally, examples need to be based on real-world situations, including those encountered by professionals working in the particular context and relevant cases that have been determined by complaints-handlers, but some may beed to be contrived in order to convey key aspects of the balancing among interests.

The ultimate purposes are:

  1. to provide clear guidance to the staff of media organisations
  2. to provide a clear basis for the assessment of complaints about media behaviour
  3. to ensure privacy protections for people

This template has been used as a basis for assessing the Codes that existed in 2011. The assessments are provided in a companion document.

All existing Codes fail dismally against these requirements. Interestingly, the least-worst is that of News Ltd.

On the other hand, the majority of the privacy-protective features specified in the Code Template appear in one or more of the existing Codes. This is shown by the cross-references to the individual Codes shown at the end of each provision within the Template Code.


2. Applicability of the Code

The Code applies to all activities of all media organisations and their staff and contractors that involve the gathering or publication of personal data about any person.


3. Foundation Principles

The following are Foundation Principles:

  1. Information Gathering:
    1. Personal data must not be sought or gathered, by or for a media organisation, unless a clear justification exists [News 4.1]
    2. Personal behaviour must not be observed or recorded, by or for a media organisation, unless a clear justification exists [News 4.1]
    3. In either case, the justification must be based on either:
      • consent by the person to whom the data relates; or
      • an over-riding public interest
    4. The nature of the activities, and their degree of intrusiveness:
      • must reflect the nature and extent of any consent provided; and
      • must be proportionate to the nature and significance of the public interest arising in the particular circumstances [APC PP1; SMH Fairness, Privacy; Age 11; ABC S 6.1]
  2. Publication:
    1. The identities of individuals, personal data about them, and records of their behaviour must not be published unless a clear justification exists, and any undertaking in relation to anonymity must be respected [Age 12, 13]
    2. The justification must be based on either:
      • consent by the person to whom the data relates; or
      • an over-riding public interest [APC GP5]
    3. The content and style of publication:
      • must reflect the nature and extent of any consent provided;
      • must be relevant to the public interest arising in the particular circumstances; and
      • must be proportionate to the nature and significance of the public interest arising in the particular circumstances [APC PP2]
    4. Publication cannot be justified based on prior publication alone, whether the prior publication was by another media organisation or by anyone else, including by the individual concerned
  3. Review Processes and Remedies:
    1. Effective complaints-handling processes must be available to people who believe these Principles have not been respected

4. Definitions

The following Definitions apply:

By 'personal data' is meant data about a person whose identity is apparent in the circumstances.

It is not necessary for the person to be identifiable solely from the data published by the media organisation, if the media organisation was aware, or should reasonably have been aware, that other data is readily available that can be combined with the data it published in order to identify the person.

The notion 'the public interest' comprises six elements, with the possibility of extension. The six elements are:

  1. Relevance to the Performance of a Public Office. This encompasses all arms of government, i.e. the parliament, the executive and public service, and the judiciary. The test of relevance is mediated by the significance of the role the person plays. Publication of the fact that a Minister's private life has been de-stabilised (e.g. by the death of a family member, marriage break-up, or a child with drug problems) is more likely to be justifiable than the same fact about a junior public servant. Publication of the identities and details of other individuals involved (e.g. the person who died, or the child with drug problems) is also subject to the relevance test, and is far less likely to be justifiable [Age 2]
  2. Relevance to the Performance of a Corporate or Civil Society Function of Significance. The relevance test needs to reflect the size and impact of the organisation and its actions, the person's role and significance, and the scope of publication [Age 2]
  3. Relevance to the Credibility of Public Statements. Collection and disclosure of personal data may be justified where it demonstrates inconsistency between a person's public statements and their personal behaviour, or demonstrates an undisclosed conflict of interest [Age 2]
  4. Relevance to Arguably Illegal, Immoral or Seriously Anti-Social Behaviour. This applies to private individuals as well as people performing functions in organisations. For example, in the case of a small business that fails to provide promised after-sales service, or a neighbour who persistently makes noise late at night, some personal data is likely to be relevant to the story. Collection and disclosure of other personal data will, on the other hand, be very difficult to justify [Age 2]
  5. Relevance to Public Health or Safety. For example, disclosure of a person's identity may be justified if they are a traveller who recently entered Australia, they are reasonably believed to have been exposed to a serious contagious disease, and their present whereabouts is unknown [Age 2]
  6. Relevance to an Event of Significance. This is challenging, and requires care. For example, a 'human interest' story such as a report on bush fire-fighter heroics, may well justify the publication of some level of personal data in order to convey the full picture. Generally, consent is necessary; but where this is impractical and the story warrants publication, the varying sensitivities of individuals must be given sufficient consideration. This is especially important in the case of people caught up in an emergency or tragedy, who are likely to be particularly vulnerable

Other public interest elements may need to be recognised. However, in the handling of a complaint, any such justification must be argued, and the onus lies on the media organisation to demonstrate that the benefits of information gathering or publication outweigh the privacy interest.

For clarity, the expression 'the public interest' does not encompass what the public is interested in, nor what the public may be able to be encouraged to be interested in.

By 'an over-riding public interest' is meant that the public interest must be of sufficient consequence that it outweighs the person's interest in privacy and any other conflicting interests such as public security and the effective functioning of judicial processes

When assessing whether the public interest is sufficient to over-ride the privacy interest, and when assessing proportionality, several additional factors may need to be considered. The following factors have the effect of reducing the zone of privacy protection and increasing the scope for publication and to some extent also for information gathering:

  1. Self-Published Information. Where an individual has published personal data about themselves, that person's claim to privacy in respect of that data is significantly reduced. However it is not extinguished. In particular, justification becomes more difficult the longer the elapsed time since the self-publication took place, and the less widely the individual reasonably believed the information to have been made available. Further, only information published by the individual themselves affects the relevance test, not publication by another individual, even a relative or close friend or associate.
  2. Public Behaviour. Where data about an individual arises from public behaviour by that individual, the person's claim to privacy in respect of that behaviour is reduced. However, public behaviour does not arise merely because the individual is 'in a public place', because there are many circumstances in which people in a public place have a reasonable expectation of privacy. For example, 'public behaviour' does not include a quiet aside to a companion in a public place.
  3. Attention-Seekers. In the case of people who are willingly in the public eye (e.g. celebrities and notorieties), consent to collect and publish some kinds of personal data may be reasonably inferred. But this does not constitute 'open slather', and in particular denial of consent must be respected. Moreover, this mitigating factor is not applicable to the attention-seeker's family and companions.

On the other hand, there are factors that increase the zone of privacy protection and reduce the scope for information-gathering and publication, especially:

  1. Vulnerability of the Person whose privacy is being invaded, and of the people associated with them. Examples include children, the mentally disabled, homeless people, accident victims, the recently bereaved, and individuals associated with a person accused or convicted of a crime

5. Information-Gathering Behaviour

The following data-gathering activities are breaches of this Code, unless they are justified by a public interest of sufficient significance to warrant the activity, taking into account relevant factors, and in particular the sensitivity of the context and the degree of discomfort, anger or distress that the performance of the activity may give rise to:

  1. activities that intrude into the person's private space
  2. activities that intrude into the person's reasonable expectations of privacy, notwithstanding that the person is in a public space
  3. activities that involve deception [MEAA 8; SMH Fairness, Privacy; Age 11; News 3.2; ABC P5; ABC S 5.8], such as the following:
  4. activities that exploit vulnerability, naiveté or ignorance about media organisations' collection practices. Particular concern arises in the case of children and people with limited mental capacity or experience [MEAA 8; APC PP7; SMH Privacy; Age 21]
  5. activities that intrude into the private space of people in sensitive situations, such as accident victims, witnesses to accidents, and the bereaved [MEAA 8; APC PP7; SMH Respect; Age 14; News 9.1; ABC S 7.5]
  6. activities that place pressure on a person to behave in a particular manner or to divulge sensitive data, such as conveying the implication that the person is under a legal or moral obligation, intimidation and excessive persistence [News 7.1 (intimidation only), 7.4 (persistence only)]
  7. activities that the person reasonably perceives to constitute trespass, nuisance, obstruction, pursuit, harassment or stalking [News 7.1 (harassment only), 7.4 (obstruction and pursuit only)]

6. Publication

The following publication activities are breaches of the Code, unless they are justified by a public interest of sufficient significance to warrant the publication, taking into account relevant factors, and in particular the sensitivity of the context and the degree of discomfort, anger or distress that the performance of the activity may give rise to:

  1. identification of an individual who has not provided consent, and especially of an individual who has requested anonymity [News 6.1; ABC S 5.2]
  2. identification of an individual who the media organisation does or reasonably should know may be thereby placed at risk, even if they have provided consent [Age 13]
  3. identification of an individual who is associated with a person accused or convicted of a crime but who is not themselves directly implicated in the relevant activity [News 4.2]
  4. disclosure of personal data that has been provided in confidence, or as background information to assist in understanding the circumstances [MEAA 3; News 6.2]
  5. disclosure of personal data that is not relevant to the matter, even if consent has been provided
  6. disclosure of sensitive personal data, even if the person concerned has given consent, unless that data is not merely relevant, but also demonstrably important, to the matter being reported [Age 17; News 8.1 (defined list only); CTV (very limited); ABC S 7.5]
  7. disclosure of sensitive images, audio or video concerning a person, even if the person concerned has given consent, unless that data is not merely relevant, but also demonstrably important, to the matter being reported [Age 16, CTV (sub-set only); ABC S 7.5]

A breach of any aspect of this section is not justified merely on the basis that the individual's identity or the personal data had been previously published by a media organisation, or was otherwise in the public domain. Each publication by each media organisation is subject to all of these requirements.


7. Review Processes and Remedies

A person who considers that a media organisation, or an individual performing actions on its behalf, has breached this Code must have available to them:

  1. processes whereby a complaint can be made to that media organisation, in the justified expectation that the complaint will be considered and responded to (News 22.3, ABC, SBS)
  2. processes whereby the complaint is heard by that media organisation [MEAA, News 22.3, ABC, SBS)
  3. processes whereby a complaint can be escalated beyond the media organisation (APC, ACMA)
  4. a quasi-judicial organisation with sufficient powers that remedies can be determined that are commensurate with the seriousness of the breach
  5. access on appeal to judicial review

Author Affiliations

Roger Clarke is Principal of Xamax Consultancy Pty Ltd, Canberra. He is also a Visiting Professor in the Cyberspace Law & Policy Centre at the University of N.S.W., and a Visiting Professor in the Research School of Computer Science at the Australian National University.



xamaxsmall.gif missing
The content and infrastructure for these community service pages are provided by Roger Clarke through his consultancy company, Xamax.

From the site's beginnings in August 1994 until February 2009, the infrastructure was provided by the Australian National University. During that time, the site accumulated close to 30 million hits. It passed 50 million in early 2015.

Sponsored by Bunhybee Grasslands, the extended Clarke Family, Knights of the Spatchcock and their drummer
Xamax Consultancy Pty Ltd
ACN: 002 360 456
78 Sidaway St, Chapman ACT 2611 AUSTRALIA
Tel: +61 2 6288 6916

Created: 28 December 2011 - Last Amended: 17 January 2012 by Roger Clarke - Site Last Verified: 15 February 2009
This document is at www.rogerclarke.com/DV/PandM-CodeTemplate.html
Mail to Webmaster   -    © Xamax Consultancy Pty Ltd, 1995-2017   -    Privacy Policy