Roger Clarke's 'Code for Privacy and the Media'
Version of 17 January 2012
Roger
Clarke
**
©
Xamax Consultancy Pty Ltd, 2011-12
Available under an AEShareNet 
licence or a Creative
Commons 
licence.
This document is at http://www.rogerclarke.com/DV/PandM-CodeTemplate.html
This is a supporting document for
http://www.rogerclarke.com/DV/PandM.html
1.
Introduction
As is shown in
the
primary paper, and in greater detail in
a
companion document, in 2011, the privacy protections available against
inappropriate media behaviour fell vastly short of the public's need. A further
companion
document presents the requirements for the effective protection of privacy,
balanced against the public interest. In particular, it requires that Privacy
Principles and Standards be articulated into Codes that provide clear and
operationally useful guidance to particular categories of media professional.
This document presents a template Code, which can be used by media
organisations to upgrade their own Codes, and by other parties to assess the
adequacy of media organisations' Codes. In each particular Code, the text
needs to be supplemented by examples that encapsulate accumulated experience in
the particular context to which the Code is addressed. Generally, examples
need to be based on real-world situations, including those encountered by
professionals working in the particular context and relevant cases that have
been determined by complaints-handlers, but some may beed to be contrived in
order to convey key aspects of the balancing among interests.
The ultimate purposes are:
- to provide clear guidance to the staff of media organisations
- to provide a clear basis for the assessment of complaints about media
behaviour
- to ensure privacy protections for people
This template has been used as a basis for assessing the Codes that existed
in 2011. The assessments are provided in
a
companion document.
All existing Codes fail dismally against these requirements. Interestingly,
the least-worst is that of News Ltd.
On the other hand, the majority of the privacy-protective features specified in
the Code Template appear in one or more of the existing Codes. This is shown
by the cross-references to the individual Codes shown at the end of each
provision within the Template Code.
2.
Applicability
of the Code
The Code applies to all activities of all media organisations and their
staff and contractors that involve the gathering or publication of personal
data about any person.
3.
Foundation
Principles
The following are Foundation Principles:
- Information Gathering:
- Personal data must not be sought or gathered, by or for a media
organisation, unless a clear justification exists [News 4.1]
- Personal behaviour must not be observed or recorded, by or for a media
organisation, unless a clear justification exists [News 4.1]
- In either case, the justification must be based on either:
- consent by the person to whom the data relates; or
- an over-riding public interest
- The nature of the activities, and their degree of intrusiveness:
- must reflect the nature and extent of any consent provided; and
- must be proportionate to the nature and significance of the public
interest arising in the particular circumstances [APC PP1; SMH Fairness,
Privacy; Age 11; ABC S 6.1]
- Publication:
- The identities of individuals, personal data about them, and records of
their behaviour must not be published unless a clear justification exists, and
any undertaking in relation to anonymity must be respected [Age 12, 13]
- The justification must be based on either:
- consent by the person to whom the data relates; or
- an over-riding public interest [APC GP5]
- The content and style of publication:
- must reflect the nature and extent of any consent provided;
- must be relevant to the public interest arising in the particular
circumstances; and
- must be proportionate to the nature and significance of the public
interest arising in the particular circumstances [APC PP2]
- Publication cannot be justified based on prior publication alone, whether
the prior publication was by another media organisation or by anyone else,
including by the individual concerned
- Review Processes and Remedies:
- Effective complaints-handling processes must be available to people who
believe these Principles have not been respected
4.
Definitions
The following Definitions apply:
By 'personal data' is meant data about a person whose identity
is apparent in the circumstances.
It is not necessary for the person to be identifiable solely from the data
published by the media organisation, if the media organisation was aware, or
should reasonably have been aware, that other data is readily available that
can be combined with the data it published in order to identify the person.
The notion 'the public interest' comprises six elements, with
the possibility of extension. The six elements are:
- Relevance to the Performance of a Public Office. This
encompasses all arms of government, i.e. the parliament, the executive and
public service, and the judiciary. The test of relevance is mediated by the
significance of the role the person plays. Publication of the fact that a
Minister's private life has been de-stabilised (e.g. by the death of a family
member, marriage break-up, or a child with drug problems) is more likely to be
justifiable than the same fact about a junior public servant. Publication of
the identities and details of other individuals involved (e.g. the person who
died, or the child with drug problems) is also subject to the relevance test,
and is far less likely to be justifiable [Age 2]
- Relevance to the Performance of a Corporate or Civil Society
Function of Significance. The relevance test needs to reflect the
size and impact of the organisation and its actions, the person's role and
significance, and the scope of publication [Age 2]
- Relevance to the Credibility of Public Statements.
Collection and disclosure of personal data may be justified where it
demonstrates inconsistency between a person's public statements and their
personal behaviour, or demonstrates an undisclosed conflict of interest [Age 2]
- Relevance to Arguably Illegal, Immoral or Seriously Anti-Social
Behaviour. This applies to private individuals as well as people
performing functions in organisations. For example, in the case of a small
business that fails to provide promised after-sales service, or a neighbour who
persistently makes noise late at night, some personal data is likely to be
relevant to the story. Collection and disclosure of other personal data will,
on the other hand, be very difficult to justify [Age 2]
- Relevance to Public Health or Safety. For example,
disclosure of a person's identity may be justified if they are a traveller who
recently entered Australia, they are reasonably believed to have been exposed
to a serious contagious disease, and their present whereabouts is unknown [Age
2]
- Relevance to an Event of Significance. This is
challenging, and requires care. For example, a 'human interest' story such as
a report on bush fire-fighter heroics, may well justify the publication of some
level of personal data in order to convey the full picture. Generally, consent
is necessary; but where this is impractical and the story warrants
publication, the varying sensitivities of individuals must be given sufficient
consideration. This is especially important in the case of people caught up in
an emergency or tragedy, who are likely to be particularly vulnerable
Other public interest elements may need to be recognised. However, in the
handling of a complaint, any such justification must be argued, and the onus
lies on the media organisation to demonstrate that the benefits of information
gathering or publication outweigh the privacy interest.
For clarity, the expression 'the public interest' does not encompass what the
public is interested in, nor what the public may be able to be encouraged to be
interested in.
By 'an over-riding public interest' is meant that the public
interest must be of sufficient consequence that it outweighs the person's
interest in privacy and any other conflicting interests such as public security
and the effective functioning of judicial processes
When assessing whether the public interest is sufficient to over-ride the
privacy interest, and when assessing proportionality, several
additional factors may need to be considered. The following
factors have the effect of reducing the zone of privacy protection and
increasing the scope for publication and to some extent also for information
gathering:
- Self-Published Information. Where an individual has
published personal data about themselves, that person's claim to privacy in
respect of that data is significantly reduced. However it is not extinguished.
In particular, justification becomes more difficult the longer the elapsed time
since the self-publication took place, and the less widely the individual
reasonably believed the information to have been made available. Further, only
information published by the individual themselves affects the relevance test,
not publication by another individual, even a relative or close friend or
associate.
- Public Behaviour. Where data about an individual arises
from public behaviour by that individual, the person's claim to privacy in
respect of that behaviour is reduced. However, public behaviour does not arise
merely because the individual is 'in a public place', because there are many
circumstances in which people in a public place have a reasonable expectation
of privacy. For example, 'public behaviour' does not include a quiet aside to
a companion in a public place.
- Attention-Seekers. In the case of people who are
willingly in the public eye (e.g. celebrities and notorieties), consent to
collect and publish some kinds of personal data may be reasonably inferred.
But this does not constitute 'open slather', and in particular denial of
consent must be respected. Moreover, this mitigating factor is not
applicable to the attention-seeker's family and companions.
On the other hand, there are factors that increase the zone of privacy
protection and reduce the scope for information-gathering and publication,
especially:
- Vulnerability of the Person whose privacy is being
invaded, and of the people associated with them. Examples include children,
the mentally disabled, homeless people, accident victims, the recently
bereaved, and individuals associated with a person accused or convicted of a
crime
5.
Information-Gathering
Behaviour
The following data-gathering activities are breaches of this Code, unless
they are justified by a public interest of sufficient significance to warrant
the activity, taking into account relevant factors, and in particular the
sensitivity of the context and the degree of discomfort, anger or distress that
the performance of the activity may give rise to:
- activities that intrude into the person's private space
- activities that intrude into the person's reasonable expectations of
privacy, notwithstanding that the person is in a public space
- activities that involve deception [MEAA 8; SMH Fairness, Privacy; Age
11; News 3.2; ABC P5; ABC S 5.8], such as the following:
- masquerade as another person [MEAA 8; News 3.1]
- misrepresentation or subterfuge intended to cause a person to provide
information (sometimes called 'pretexting') [Age 11; ABC S 5.8]
- observation or recording under circumstances in which the person would not
reasonably expect observation or recording to be taking place [Age 11; News
5.1; ABC S 5.8]
- activities that exploit vulnerability, naiveté or ignorance about
media organisations' collection practices. Particular concern arises in the
case of children and people with limited mental capacity or experience [MEAA 8;
APC PP7; SMH Privacy; Age 21]
- activities that intrude into the private space of people in sensitive
situations, such as accident victims, witnesses to accidents, and the bereaved
[MEAA 8; APC PP7; SMH Respect; Age 14; News 9.1; ABC S 7.5]
- activities that place pressure on a person to behave in a particular
manner or to divulge sensitive data, such as conveying the implication that the
person is under a legal or moral obligation, intimidation and excessive
persistence [News 7.1 (intimidation only), 7.4 (persistence only)]
- activities that the person reasonably perceives to constitute trespass,
nuisance, obstruction, pursuit, harassment or stalking [News 7.1 (harassment
only), 7.4 (obstruction and pursuit only)]
6.
Publication
The following publication activities are breaches of the Code, unless they
are justified by a public interest of sufficient significance to warrant the
publication, taking into account relevant factors, and in particular the
sensitivity of the context and the degree of discomfort, anger or distress that
the performance of the activity may give rise to:
- identification of an individual who has not provided consent, and
especially of an individual who has requested anonymity [News 6.1; ABC S 5.2]
- identification of an individual who the media organisation does or
reasonably should know may be thereby placed at risk, even if they have
provided consent [Age 13]
- identification of an individual who is associated with a person accused or
convicted of a crime but who is not themselves directly implicated in the
relevant activity [News 4.2]
- disclosure of personal data that has been provided in confidence, or as
background information to assist in understanding the circumstances [MEAA 3;
News 6.2]
- disclosure of personal data that is not relevant to the matter, even if
consent has been provided
- disclosure of sensitive personal data, even if the person concerned has
given consent, unless that data is not merely relevant, but also demonstrably
important, to the matter being reported [Age 17; News 8.1 (defined list only);
CTV (very limited); ABC S 7.5]
- disclosure of sensitive images, audio or video concerning a person, even
if the person concerned has given consent, unless that data is not merely
relevant, but also demonstrably important, to the matter being reported [Age
16, CTV (sub-set only); ABC S 7.5]
A breach of any aspect of this section is not justified merely on the basis
that the individual's identity or the personal data had been previously
published by a media organisation, or was otherwise in the public domain. Each
publication by each media organisation is subject to all of these requirements.
7.
Review
Processes and Remedies
A person who considers that a media organisation, or an individual
performing actions on its behalf, has breached this Code must have available to
them:
- processes whereby a complaint can be made to that media organisation, in
the justified expectation that the complaint will be considered and responded to
(News
22.3,
ABC,
SBS)
- processes whereby the complaint is heard by that media organisation
[MEAA,
News
22.3,
ABC,
SBS)
- processes whereby a complaint can be escalated beyond the media
organisation
(APC,
ACMA)
- a quasi-judicial organisation with sufficient powers that remedies can be
determined that are commensurate with the seriousness of the breach
- access on appeal to judicial review
Author
Affiliations
Roger Clarke is Principal of
Xamax
Consultancy Pty Ltd, Canberra. He is also a Visiting Professor in the
Cyberspace
Law & Policy Centre at the
University
of N.S.W., and a Visiting Professor in the
Research
School of Computer Science at the
Australian
National University.
Created: 28 December 2011 -
Last Amended: 17 January 2012
by Roger Clarke
- Site Last Verified: 15 February 2009
This document is at www.rogerclarke.com/DV/PandM-CodeTemplate.html
Mail to Webmaster -
© Xamax Consultancy Pty Ltd, 1995-2022 -
Privacy Policy
