Privacy Legislation Amendment (Enforcement and Other Measures) Bill 2022 - Commentary on Ministerial Responses [2023] AUSStaCSBSD 25 (8 February 2023)

• Privacy Legislation Amendment (Enforcement and Other Measures) Bill 2022
• Broad discretionary power
• Availability of merits review119
• Reversal of the evidential burden of proof125

---

Privacy Legislation Amendment (Enforcement and Other Measures) Bill 2022

Purpose	This bill seeks to amend Privacy Act 1988, the Australian Information Commissioner Act 2010 and the Australian Communications and Media Authority Act 2005 to increase penalties under the Privacy Act 1988, provide the Australian Information Commissioner with greater enforcement powers, and provide the Commissioner and the Australian Communications and Media Authority with greater information sharing powers.
Portfolio	Attorney-General
Introduced	House of Representatives on 26 October 2022
Bill status	Passed both Houses

Broad discretionary power
Availability of merits review^[119]

2.119 Item 32 of Schedule 1 of the bill seeks to insert proposed subsection 52(5A) into section 52 of the Privacy Act 1988 (the Privacy Act). Section 52 currently provides that, after investigating a complaint about acts or practices that may be an interference with the privacy of an individual, the Commissioner may make a determination in relation to the investigation. A determination may include, for example, a declaration that the respondent has engaged in conduct constituting an interference with the privacy of an individual, or that an individual is entitled to compensation. An entity to which a determination relates must comply with certain declarations in the determination.^[120] Proposed subsection 52(5A) provides that the Commissioner may publish a determination made under section 52 before or after commencement of the bill on the Commissioner's website.^[121]

2.120 In Scrutiny Digest 7 of 2022 the committee requested the Attorney-General's advice as to:

• why it is necessary and appropriate to provide the Commissioner with a broad discretion to publish determinations made before or after the commencement of the bill;

• whether the bill can be amended to include additional guidance on the exercise of the power on the face of the primary legislation or, at a minimum, whether this information can be included within the explanatory memorandum; and

• whether the bill can be amended to provide that independent merits review will be available in relation to a decision made under proposed subsection 52(5A).^[122]

Attorney-General's response^[123]

2.121 The Attorney-General advised that it is appropriate to provide the Commissioner with an express power in proposed subsection 52(5A) to publish determinations as this would formalise existing practices. In this regard, the Attorney‑General noted that determinations are currently published on the Commissioner's website after being finalised and sent to the parties in reliance on the Commissioner's powers under section 12 of the Australian Information Commissioner Act 2010.^[124] The Attorney-General further advised that it would be within the reasonable expectations of all parties and the community that such information would be disclosed and published.

2.122 In addition, the Attorney-General explained that the Commissioner publishes determinations to ensure transparency and accountability around the use of its privacy regulatory powers, to encourage compliance by increasing awareness and knowledge of personal rights and obligations, and to deter contravening conduct. The Attorney-General also advised that the Commissioner provides parties the opportunity to examine and comment on the information the Commissioner relies on in making the determination, including by providing access to submissions and information made by other parties.

2.123 The Attorney-General noted that the Commissioner will generally publish the name of the respondent but will generally not publish the names of complainants, respondent individuals or any third-party individuals. Further, the Attorney-General noted that the Office of the Australian Information Commissioner will update its policies and procedures, including the publicly-available Guide to regulatory action and Guide to privacy regulatory action, to reflect the Commissioner's express power to publish determinations in proposed subsection 52(5A).

2.124 The minister advised that the decision to publish a determination will not be subject to independent merits review.

Committee comment

2.125 The committee thanks the minister for this response.

2.126 While noting the Attorney-General's advice that proposed subsection 52(5A) would formalise existing practices, the committee has generally not considered consistency with existing provisions to be sufficient justification for the inclusion of a broad discretionary power. In addition, it is apparent to the committee from the Attorney-General's explanation why the bill could not be amended to provide additional guidance on the exercise of this power. However, the committee also notes the Attorney-General's advice regarding the intention of this measure and that the Commissioner will adhere to principles of natural justice and procedural fairness in making a determination. The committee considers that it would have been helpful had this information been included in the explanatory memorandum to the bill, noting the importance of these explanatory materials as a point of access to understanding the law and, if needed, as extrinsic material to assist with interpretation.

2.127 In relation to the Attorney-General's advice that the decision to publish a determination will not be subject to independent merits review, the committee notes that no justification was provided for excluding merits review. As a decision to publish a determination could have adverse impacts, such as damage to a person's reputation, the committee expects the limitation on merits review to be soundly justified with reference to the Administrative Review Council's guidance document, What decisions should be subject to merits review?.

2.128 In light of the fact that the bill has already passed both Houses of Parliament, the committee makes no further comment on this matter.

Reversal of the evidential burden of proof^[125]

2.129 Item 39 of Schedule 1 to the bill seeks to amend existing section 66 of the Privacy Act to insert proposed subsection 66(1AA) into that section. Proposed subsection 66(1AA) makes it an offence for a body corporate to engage in conduct that constitutes a system of conduct or a pattern of behaviour which results in multiple instances of non-compliance with subsection 66(1). Proposed subsection 66(1) provides that a person who fails to answer a question or give information when required under the Privacy Act may be liable to a civil penalty. The new offence carries a maximum penalty of 300 penalty units. It is a defence under subsection 66(1B) if the person has a reasonable excuse.^[126] A defendant bears an evidential burden in relation to this defence.

2.130 In Scrutiny Digest 7 of 2022 the committee requested the minister's advice as to why it is appropriate to use a defence of reasonable excuse (which reverses the evidential burden of proof) for proposed subsection 66(1AA). The committee's consideration of the appropriateness of a provision which reverses the burden of proof is assisted if it explicitly addresses relevant principles as set out in the Guide to Framing Commonwealth Offences.^[127]

Attorney-General's response^[128]

2.131 The Attorney-General advised that it is not possible to rely on the general defences in the Criminal Code Act 1995 (Criminal Code) and therefore it is appropriate to use a defence of reasonable excuse.^[129]

2.132 The Attorney-General further advised that existing section 66 sets out guidance on when a defendant may have a reasonable excuse. The Attorney-General gave the example of existing subsection 66(1B), which provides that a journalist has a reasonable excuse if giving the information, answering the question or producing the document or record would tend to reveal the identity of a person who gave information or a document or record to the journalist in confidence. The Attorney-General advised that such conduct would not be covered by the defences of general application in Part 2.3 of the Criminal Code and therefore a more specific defence of reasonable excuse is necessary.

2.133 The Attorney-General also noted that the use of a defence, which reverses the burden of proof that would usually apply in an offence, is more readily justified as the offence in proposed subsection 66(1B) carries a relatively low penalty of 300 penalty units.

Committee comment

2.134 The committee thanks the Attorney-General for this response.

2.135 While noting the Attorney-General's advice that existing section 66 contains guidance on when a defendant may have a reasonable excuse, the committee notes that the guidance in existing subsection 66(1B) is limited to journalists. It is unclear to the committee that this guidance would apply in relation to proposed subsection 66(1AA), which provides that it is an offence for a body corporate to engage in conduct that constitutes a system of conduct or a pattern of behaviour which results in multiple instances of non-compliance with subsection 66(1). However, the committee also notes that existing subsection 66(10) sets out guidance on when a body corporate may not have a reasonable excuse.

2.136 The committee also notes that the Attorney-General's response does not address why it is appropriate that the defendant bears the evidential burden for providing a reasonable excuse defence. The relevant test, as set out in the Guide to Framing Commonwealth Offences, is that a matter should only be included in an offence‑specific defence where it is peculiarly within the knowledge of the defendant and is significantly more difficult and costly for the prosecution to disprove than for the defendant to establish. The committee notes that the Attorney-General's advice does not address this test. The committee does not consider that a reversal of the burden of proof is justified, merely because the offence does not carry custodial penalties. The committee also notes that the Attorney-General's advice does not contain any information regarding why it is not possible to include more specific defences within the bill.

2.137 In light of the fact that the bill has already passed both Houses of the Parliament, the committee makes no further comment on this matter.

---

[119] Schedule 1, item 32, proposed subsection 52(5A). The committee draws senators' attention to this provision pursuant to Senate standing order 24(1)(a)(ii) and (iii).

[120] See Privacy Act 1988, sections 36A and 52.

[121] Item 45 provides that proposed subsection 52(5A) applies in relation to determinations made by the Commissioner before or after commencement of the bill.

[122] Senate Scrutiny of Bills Committee, Scrutiny Digest 7 of 2022 (23 November 2022) pp. 36–38.

[123] The minister responded to the committee's comments in a letter dated 5 December 2022. A copy of the letter is available on the committee's website: see correspondence relating to Scrutiny Digest 1 of 2023 available at: www.aph.gov.au/senate_scrutiny_digest.

[124] The Commissioner relies on her powers under section 12 of the Australian Information Commissioner Act 2010.

[125] Schedule 1, item 40, proposed subsection 66(1B). The committee draws senators' attention to this provision pursuant to Senate standing order 24(1)(a)(i).

[126] Item 40 seeks to amend subsection 66(1B) to extend the existing defence of reasonable excuse to the new criminal offence in proposed subsection 66(1AA).

[127] Senate Scrutiny of Bills Committee, Scrutiny Digest 7 of 2022 (23 November 2022) pp. 38–39.

[128] The minister responded to the committee's comments in a letter dated 5 December 2022. A copy of the letter is available on the committee's website: see correspondence relating to Scrutiny Digest 1 of 2023 available at: www.aph.gov.au/senate_scrutiny_digest.

[129] The Criminal Code defences of general application include duress, mistake or ignorance of fact, intervening conduct or event and lawful authority.