Privacy and Information Technology

David Cosgrave, a solicitor involved in establishing the Internet Association's Code of Conduct, looks at some relevant privacy issues.

Your credit card company knows that you like four star hotels and musicals. Your internet service provider knows what model computer you own and that you are interested in nude photographs of celebrities. What will they do with this information?

Our privacy, that illusive quality of personal seclusion, is shrinking as the information revolution expands.

"Privacy" means different things, depending on its context. The growth of information technology, and the internet, raise concerns about "information privacy". This phrase addresses the individual's claim to control how their "personal information" about them - another idea of uncertain proportions - is acquired, disclosed and used.

The need for information privacy is based on two propositions.

First, that control over our personal information is important because mere awareness by others of certain types of information is potentially harmful.

Second, that personal information can be used improperly, unfairly or for purposes other than those intended by an individual.

The erosion of information privacy by technology occurs in three ways:

• Greater Access to Information.
  This is not simply because previously confidential information is now public, but rather because technology is changing what "public" means. Computer networks ensure that "public access" can mean the entire on-line world.
  
  
• Collection of Information
  The power of electronic databases to collate and share otherwise meaningless information allows an extensive profile of an individual to be created.
  
  
• Storage of Information
  The ubiquity of information technology allows more and more redundant information about us to be kept for longer periods.

The State of the Law

Maintaining, let alone increasing the degree of privacy that we used to take for granted, will require organised and widespread regulatory controls. Unfortunately, the rights and regulation we currently have are inadequate.

The High Court, in a 1937 decision, refused to recognise a right of privacy at common law. Although there have been recent indications of a more sympathetic approach, there is no common law right to privacy in Australia.

One attempt to repair this deficiency is the Commonwealth Privacy Act. This was drafted to accompany the Australia Card Bill, amid concern that the Australia Card's introduction would compromise individual privacy. Introducing the Bill, the then Attorney General stated:

With the greater range of services being provided by the Government, the greater is the accumulation of personal information about individuals. More than anything else, the capacity of modern computers to search and process information offers the greatest potential of invasion of personal privacy by misuse.

The Privacy Act controls three types of information:

• personal information collected by Federal departments or agencies;
• tax file numbers; and
• consumer credit files held and circulated by private credit reporting agencies.

In 1991 the Commonwealth Government also introduced the Data-Matching Program (Assistance and Tax) Act to regulate government data matching programs.

At the time of writing, no comparable State legislation to either the Privacy Act or the Data-Matching Program (Assistance and Tax) Act is in force. The Commonwealth government has announced its intention to amend the Privacy Act to cover the private sector.

Similar principles to those contained in the Privacy Act have been used in the recent European Union Directive on data protection.

Under this Directive, which European Union members must implement by 1998, an individual's prior consent is required before their personal information can be used. To obtain a valid consent from an individual, they must be told what the intended use is. An individual also has the right to deny access and to seek enforcement of their privacy rights.

In effect, the Directive establishes that an individual can own their personal information. By establishing this express right of ownership, the Directive has also created a market in personal information. For example, some European stores offer a discount scheme in exchange for permission to gather data on their client's purchases.

Conclusion

Information technology is rapidly destroying many characteristics of our vague and protean concept of privacy. This change forces us to consider afresh what information we want kept private and how best to achieve it.

More effective legislation, if it expressly acknowledges our ownership of or personal information and gives us the means to protect it, would be one goal. Another may be to recognise that, in a consumer-driven society, personal information has a market value which ensures its protection if there is money to be made. There may be a market for organisations to act as privacy guardians, screening an individual's contacts with the outside world.

see also
Index on privacy material

Return to APC News 1997 Index

[ return to top ]

Documents with the icon require the Acrobat Reader, a Free Utility from Adobe. Click here for more information.