• The Commission’s approach
• Scope of the proposed legislation
• Regulation of overt and covert surveillance

2.1 In Chapter 1, the Commission discusses the fragmented and inadequate nature of the current laws governing surveillance. This lack of adequate regulation has spurred momentum in many States and Territories for the introduction of more comprehensive surveillance legislation. Until recently, the law in each State and Territory governed only the use of listening devices. Since 1997, additional laws in some States have regulated the use of video cameras¹ and tracking devices² in limited circumstances. The latest legislative moves have been in Western Australia³ , Victoria⁴ and the Northern Territory,⁵ which have recently introduced surveillance devices laws covering listening, optical surveillance and tracking devices, and, in some cases, computer or data surveillance devices.⁶ These laws deal generally with the covert monitoring of private conversations and activities.

2.2 This chapter presents a framework for the recommendations made throughout this Report which, if implemented, will provide New South Wales with an extremely comprehensive system of surveillance regulation. It recommends that surveillance and surveillance device be defined broadly to have maximum application to activities that may impinge on the privacy of others. Rather than targeting particular devices or activities, the legislation recommended by the Commission will provide a broad scheme of regulation to deal with both overt and covert surveillance, applying generally and more specifically in the context of employment.⁷ The Commission recommends that surveillance should be considered to be overt when conducted with the knowledge of the subject, and should be regulated flexibly by eight legislative principles supplemented by Codes of Practice.⁸ Where surveillance is conducted covertly without the subject’s knowledge, prior authorisation will be required.⁹ The regulatory scheme recommended in this Report will apply to any person wishing to conduct overt or covert surveillance for any purpose, including law enforcement officers, private investigators, the media, retail traders or employers. It will cover the use of a CCTV camera in a service station through to the bugging of a politician’s home by the police or an investigative journalist.

2.3 The legislative framework recommended by the Commission differs from surveillance devices legislation in other Australian jurisdictions, both in scope and approach. Those differences, and the reasons for them, are highlighted in this chapter.

THE COMMISSION’S APPROACH

Privacy and surveillance

2.4 Most people, if asked to focus on the issue, would probably assert the importance of respect for personal privacy. In response to the question of whether surveillance technology should be used legitimately to deter crime or other anti-social behaviour and promote the public interest, the same number of people would probably answer in the affirmative. Initially, the Commission held the view that regulating surveillance would be an exercise in achieving a balance between protecting privacy and permitting surveillance for legitimate purposes. During the course of its research and enquiries, however, the Commission has developed the view that this balancing approach is inherently flawed.

2.5 True balance assumes equal weight on either side. In reality, however, this is not the case. The unprecedented development of surveillance technology, particularly in the last decade, has resulted in its increased availability and use (beyond those considered to be “traditional” users, such as law enforcement agencies). Surveillance devices are also becoming more sophisticated, making it possible to monitor, retain and match every detail of a person’s life, down to his or her DNA profile, without the subject having the slightest awareness. The law has lagged behind this technological explosion, leaving most surveillance activity completely unregulated. The growth of the internet has taken the capacity to monitor and disseminate personal details to a new level. This convergence of events has come at a cost to personal privacy, tipping the scales so far in favour of surveillance that the concept of true balance is no longer possible, if indeed it ever was.¹⁰

2.6 Surveillance is undoubtedly gathering momentum. There are those who would argue that this indicates that public acceptance of surveillance has increased in inverse proportion to the diminished public perception of the importance of privacy: that even those against surveillance view it as a “necessary evil”, and that the legislation should reflect this public acceptance. Pinning down public opinion or acceptance levels is at best, difficult, and at worst, can be dangerous. In many cases, the public has no choice but to accept that privacy has to some extent become a tradeable commodity.¹¹ Further, the proliferation of surveillance and the corresponding lack of privacy has not happened because of public acceptance, but, as outlined above, because the availability of affordable technology and the lack of adequate regulation has allowed it to happen. Privacy, as a principle, and as a legislative touchstone, has not become less valuable simply because the means for its easy violation exist.

2.7 In making recommendations for comprehensive proposed surveillance legislation, the Commission has taken the approach that personal privacy is paramount, but that intrusions into it by way of surveillance are sometimes necessary for the greater public benefit. Those intrusions, particularly when conducted without the knowledge of the subject, should occur only when reasonably able to be justified, and when supported by clear rules. This approach may be criticised by those who consider it to be too weighted towards privacy, or too restrictive.¹² Given that most surveillance activity in New South Wales is currently unregulated, it is understandable that any curb on its use may be interpreted by some as unduly restrictive. Criticism may also come from those who consider the Commission’s recommended regime to be too liberal in permitting surveillance to occur at all.¹³ The Commission considers, however, that the recommendations in this Report represent the best way of giving effect to the two propositions mentioned at the start of this section: namely, facilitating and controlling legitimate surveillance within the over-arching consideration of respect for personal privacy.

SCOPE OF THE PROPOSED LEGISLATION

2.8 This chapter contains the Commission’s recommendations for wide-ranging surveillance laws covering all types of surveillance,¹⁴ regardless of who conducts it, whether it is conducted covertly or openly in public, or the type of device used. Definitions of surveillance, surveillance device, overt and covert surveillance are set out below later in this chapter.¹⁵ Such a broad regulatory regime was not originally envisaged, and many other options were examined. After much research and consideration, however, the broad approach seemed the most effective way of achieving comprehensive privacy protection and flexible regulation of legitimate surveillance. Before launching into the detail of the recommended reforms, it may help to explain the reasoning process that led to the adoption of this approach.

Background

2.9 The Commission’s Terms of Reference require consideration of the current scope of the Listening Devices Act 1984 (NSW) (“LDA”), the need to regulate visual surveillance equipment, and any related matter. In considering the LDA, it became immediately clear that the legislation is deficient in at least the following two respects:

• it fails to recognise other types of surveillance beyond the use of listening devices;¹⁶ and
• it operates to prohibit covert or secretive surveillance, subject to exceptions, with no application to broader issues of overt surveillance.

2.11 The visual surveillance element of the Terms of Reference required examination of issues beyond those which could be dealt with by expanding the LDA. Visual surveillance is used widely, with Closed Circuit Television (“CCTV”) or security cameras in banks, railway stations, streets, shops and office buildings having become commonplace. Such use is usually visible and random, may be for purposes as diverse as crime prevention, public safety, or even employee monitoring, and, as noted in Chapter 1, is currently unregulated by law. It would not be appropriate or practical to regulate such use through a warrants system (as used in the LDA), since that presupposes an identifiable target and purpose. The options for dealing with such public or overt surveillance were, therefore, to leave it unregulated by legislation, to prohibit its use outright, or to develop a way to regulate it in a manner more flexible than that required for covert surveillance.

2.12 Recommending a complete prohibition of CCTV and other forms of overt visual surveillance would not only be unrealistic, but unsound given its potential benefit. Leaving it unregulated by legislation is problematic in that visual surveillance, even when conducted overtly, may still present a significant privacy threat and would leave those affected by breaches of privacy without a legal remedy.²¹ The Commission concluded that a new form of legislative regulation for overt surveillance was needed, and not just for visual surveillance. Overt surveillance may be conducted with devices apart from visual ones, just as covert surveillance involved the use of equipment other than listening devices.

2.13 Therefore, the Commission developed the view that a dual system of legislative regulation should be developed:

• one based on the warrants system in the LDA, but expanded to cover other devices, to regulate covert surveillance; and
• another, more flexible system to regulate the overt use of any surveillance device.

• the type of devices covered;
• the type of activity covered; and
• the category of people who may conduct surveillance.

Restricting the type of device

2.15 Apart from the LDA in New South Wales, other surveillance legislation covers listening devices,²² video,²³ tracking²⁴ and computer or data surveillance devices,²⁵ or a combination of these, to varying degrees.²⁶ There can be little doubt that the use of these devices should be regulated to the same extent as listening devices. Listening devices are not inherently distinct from other forms of surveillance devices, nor do they pose a greater threat to privacy than other electronic devices with surveillance capabilities. Indeed, visual surveillance can be extremely invasive and can identify individuals more clearly than audio devices, leading to the comment in R v McNamara²⁷ that “the use of a video camera … is in some respects a more intrusive device than a sound transmitter”.²⁸

2.16 The major rationale for limiting the legislative scope to specific, identifiable devices would appear to be that it brings an element of certainty to the regulatory scheme. In an era where it is impossible to identify with any accuracy the nature and capacity of surveillance devices currently in use, let alone anticipate future developments, it is tempting to limit legislation to cover only those devices which are considered familiar. The Commission considers that while certainty is a desirable goal for legislation, surveillance presents such a threat to privacy, and is in such widespread use, that its effective regulation should not be compromised for the sake of certainty alone.

2.17 Technology has developed to such an extent that an individual’s privacy may be invaded through the use of computer, digital, laser, infra-red and satellite equipment to the same, or greater, extent as through the use of video or sound equipment. It seems as illogical to exclude such devices from the scope of the legislation as it does to restrict legislation to listening devices alone. The LDA was technologically obsolete almost from the moment it was enacted. Any device-specific surveillance legislation will meet the same fate and require constant updating as technological developments inevitably outpace the law. Furthermore, the arbitrary regulation of particular devices will lead to the same gaps and anomalies that characterise the LDA.²⁹ Why should surveillance conducted with a video camera or a tracking device be regulated when surveillance conducted by thermal-imaging equipment has no controls placed upon it? The Commission can find no valid policy rationale for drawing such a distinction. A breach of privacy occasioned through the use of a surveillance device has occurred in both cases.

2.18 Globalisation and convergence of technology further erode the effectiveness of device-specific legislation in preventing privacy breaches.³⁰ Globalisation and convergence refer to the interlinking of device capacities, enabling recordings, images or data obtained in one form to be transmitted or transformed into another. Both of these factors, enhanced significantly by the boom in internet use, have removed the technological barriers between surveillance devices and the international flow of information obtained as a result of their use. It is possible to record an activity with a video camera, for example, and display the results on a website which may be accessed by millions of people worldwide. From there, the images could be downloaded to a computer database and stored, or matched electronically with other information to form a profile of the subject of the initial surveillance. Another possibility is that a remote scanning device could be used to read the electromagnetic radiation emitted by the computer screen and convert it back to its original form.³¹ In this example, controlling the use of video cameras but not computer or scanning equipment, would not represent sufficient privacy protection or adequate regulation of surveillance devices.

2.19 Ultimately, surveillance and the use of surveillance devices defies technical limitations and makes precise delineation impossible. It is for this reason that any attempt to regulate it through legislation limited to a few devices will inevitably be ineffectual. Consequently, the Commission recommends a broad definition that is not device-specific and which encompasses any equipment which is being used to conduct surveillance. The recommended definitions of surveillance and surveillance device are discussed below at paragraph 2.33-2.39.

Restricting the type of activity covered

The public/private distinction

2.20 There is a view that in regulating surveillance, a distinction should be made between surveillance of activity in private and public places.³² According to this view, surveillance in a public place should not be regulated because individuals do not have a reasonable expectation of privacy in such a place. It is said, for example, that if a person can overhear the conversation or observe the activities of another person in a public place, it would be unrealistic to require a person listening to the same conversation or observing the same activity to obtain prior authority to monitor it electronically.³³ The Australian Law Reform Commission (“ALRC”), in its report on privacy, took the position that it is neither desirable nor feasible to regulate the use of surveillance or recording by means of optical devices in streets, parks and other such public places. The Report stated that people in a public place “must anticipate that they may be seen, and perhaps recorded, and must modify their behaviour accordingly”.³⁴

2.21 All legislative models examined by the Commission, including the current LDA in New South Wales, reflect this thinking in regulating only private conversations or activity. The core elements of the definition of private conversation and private activity are similar across jurisdictions, with minor variations. Generally, a private conversation or activity is defined as one in which the parties reasonably expect, or is conducted in circumstances which may reasonably indicate, that the conversation or activity should be listened to or observed only by themselves.³⁵ In addition, other legislation provides that a private conversation or activity is not one made in any circumstances in which the parties to it ought reasonably expect that it may be overheard (or observed) by someone else.³⁶

2.22 There are a number of difficulties with regulating only activity considered to be private or not conducted in a public place. First, determining exactly what a public place is can be a difficult exercise. Many places to which the public has free or conditional access are privately owned, or may have private areas within them, and may also be workplaces. This lack of clarity in determining the difference between a public and a private place may result in rather arbitrary delineations. An interesting example of a Code of Practice from the United Kingdom states that “public place” includes shopping centres, football fields, public houses, highways, parks and railway stations, and may extend to private land capable of being seen or overheard by the general public (such as front or back gardens or driveways).³⁷ In New South Wales, a conversation between parties to litigation held in a private room in a court house was not considered to be “private” within the meaning of the LDA.³⁸ Conversely, but also in New South Wales, it was held that a conversation taking place in an office did not cease to be private because the door to the office was open and a passer-by may have been able to overhear.³⁹ Consequently, public areas can be private and private areas can be public.

2.23 The concept of “private” areas is also becoming less meaningful as the traditional line between public and private space diminishes with technological advances. With the proliferation of CCTV and other types of “public” surveillance, intrusions into what used to be considered private spheres have become greater. The emergence of the internet and the consequent surveillance of web-sites and e-mails has raised new issues as to what, if anything, can be considered private in cyberspace.⁴⁰ Yet, as noted at paragraph 2.6 above, the fact that increasingly more surveillance is happening does not necessarily mean that this should dictate legislative policy.

2.24 It is similarly difficult to establish satisfactorily when a person “ought reasonably to expect” that a conversation or activity might be overheard or observed by another. One view is that one ought to expect that any activity or conversation outside the home or outside a closed office may be overheard or observed. This view lacks credence in today’s society where, increasingly, business and personal dealings, which the parties would prefer to be kept to themselves, are conducted in public places such as restaurants, cafes, airport lounges and shops. In the United States, courts have held that people are reasonably entitled to expect a degree of privacy even in public places such as telephone booths⁴¹ and public toilets.⁴² In contrast, in a recent Australian case, a conversation held in an open area of a bridal shop was not considered to be private under the previous Victorian LDA⁴³ because the parties “ought reasonably” to have expected that they would be overheard by others.⁴⁴ In giving judgment, Justice Crispin described the behaviour of the defendants, in covertly recording the conversation and broadcasting it on national television, to be “generally reprehensible”, yet the conduct was not regulated by the LDA, and consequently no relief was available under that Act.

2.25 In Victoria, legislators have attempted to introduce more certainty as to what activity is or is not covered by the Surveillance Devices Act 1999 (Vic) (“Victorian Act”). The Victorian Act states that activity is not private, and therefore not regulated by the Act, if it occurs “outside a building”.⁴⁵ A possible rationale for such a provision may be that people should accept that activities conducted in the open are more susceptible to being observed by others than those conducted indoors. The Commission is of the view that this approach is unduly arbitrary and leaves a significant amount of invasive activity unregulated.⁴⁶ For example, why would activity conducted on a deserted beach be considered to be more public, and therefore open to unregulated visual surveillance, than the same activity conducted in a crowded movie theatre or restaurant? In the Second Reading Debate on the Bill, the point was made that video surveillance from a private home of people picnicking on a public beach is inappropriate and “un-Australian”.⁴⁷ Yet, such behaviour would not be prohibited under the Victorian Act. Nor would the intrusive photographs taken of former Senator Bob Woods engaged in a painful and personal conversation with his wife in the backyard of the couple’s home.⁴⁸

2.26 The Commission is of the view, therefore, that surveillance legislation which includes in its scope only activity that is considered to be private, is weak and unsound in policy and practice. It leaves too much potentially inappropriate activity unregulated and provides insufficient privacy protection.⁴⁹ Apart from the difficulties outlined in the paragraphs above, such an approach is based on the flawed assumption that a person’s legitimate expectation of privacy and freedom from surveillance depends on where they happen to be at any given time. Privacy is a personal, not a property interest,⁵⁰ and should not diminish because a person is in a public place.

2.27 The Commission’s recommendations on the scope of surveillance activity that should be regulated, differ from other surveillance legislation in two major respects. First, the public/private distinction is rejected for the reasons outlined above. Instead, the Commission considers that a more relevant distinction is whether the surveillance is conducted with (overtly) or without (covertly) the knowledge of the subject of the surveillance.⁵¹ The second respect in which the recommendations in this Report differ in approach from that taken in existing surveillance legislation is that overt surveillance is included in the regulatory scheme.

Restricting who may conduct surveillance

2.28 Some surveillance legislation applies only to particular categories of people,⁵² or restricts the category of people who may apply for a warrant to conduct covert surveillance.⁵³ The main category of people to whom surveillance is restricted in this way is law enforcement agencies. Some legislation also contains provisions allowing parties to a conversation or activity to monitor or record that conversation or activity, while prohibiting non-parties to conduct such surveillance. This is known as participant monitoring, and is discussed at paragraphs 2.99-2.107.

Some legislation limited to law enforcement agencies

2.29 The New South Wales LDA is not limited to law enforcement agencies, but members of such agencies are the only people recorded as applying for warrants.⁵⁴ There are a number of possible explanations for this, without assuming that surveillance activity is relevant only to law enforcement agencies. It is possible that others are using equipment apart from listening devices (for example, most private investigators use visual surveillance equipment) or it could be that listening devices are being used illegally.

2.30 Any new legislation that deals with all types of surveillance and surveillance devices will, therefore, impinge upon activity like that undertaken by private investigators or the media, unless the scope of the legislation is restricted to exclude this type of surveillance. As the Commission has shown, other jurisdictions, such as Victoria, provide only for law enforcement agencies to obtain warrants to conduct covert surveillance, and exempt from the scope of the legislation any activity conducted “outside a building”.⁵⁵ Consequently, law enforcement agencies must obtain a warrant in Victoria to conduct covert surveillance inside a building, whereas the media or a private investigator may conduct the same surveillance, equally covert and equally invasive of individual privacy, provided the activity in question occurs “outside”.

2.31 This example illustrates that, for the same reasons the Commission considers it arbitrary and artificial to regulate only certain types of surveillance activity, it is also inappropriately selective to regulate surveillance conducted only by particular categories of people. Surveillance is undoubtedly a beneficial crime-fighting tool, and surveillance legislation should facilitate its effective use by law enforcement agencies. Surveillance is not, however, the sole domain of law enforcement. Apart from creating anomalies, limiting regulation in this way could lead to surveillance work traditionally undertaken by law enforcement agencies being conducted by, or even out-sourced, to private investigators to avoid the legislative restrictions placed on enforcement agencies.⁵⁶

2.32 In making recommendations for surveillance legislation, the Commission’s main focus is on protecting privacy, and enabling surveillance to occur in circumstances where a breach of privacy is justified. In accordance with this view, the potential for privacy invasion through the use of surveillance equipment is the same regardless of who is using the equipment. Surveillance legislation should, therefore, apply to every person or agency conducting surveillance. There may need to be different approaches to the way that surveillance is regulated depending on who is conducting it or the purpose for which it is being conducted. With regard to overt surveillance, different agencies or organisations will have their own Codes of Practice, based on principles set out in the legislation, to accommodate their particular needs.⁵⁷ With covert surveillance, the Commission has developed three slightly different, but complementary, approaches to regulating surveillance depending on whether it is conducted by law enforcement agencies, in the public interest or in an employment context.⁵⁸

Definitions

2.33 For the reasons set out in the paragraphs above, the Commission recommends the introduction of broad, flexible legislation to regulate surveillance, both overt and covert, through the use of any surveillance device, regardless of who conducts it or the activity being observed. The recommended legislative definitions of surveillance device and surveillance follow.

Surveillance device

2.34 To satisfy the approach advocated by the Commission, the definition of surveillance device for the purpose of the proposed legislation must not be technology specific, but must be broad enough to cover all of the equipment that could conceivably be used to conduct surveillance now and in the future. The Commission is of the view that a list of technology would result in debates over whether a particular device falls within the ambit of the law,⁵⁹ and could render the legislation obsolete as new technology emerges. Nor, in the Commission’s view, should the definition be limited only to electronic devices, as was suggested to the Commission.⁶⁰ While it is tempting to see surveillance devices in terms of highly technical electronic equipment, surveillance may be conducted through the use of other equipment which may best be described as electro-magnetic, acoustic, mechanical, etc. Spying on the activity of another may be conducted by a global positioning tracking device or a telescope.

2.35 In seeking a comprehensive definition of surveillance device, definitions in other legislation were examined. Given that most surveillance legislation is device-specific, their definitions are not completely relevant to the open-ended approach recommended in this Report. However, they provide a useful starting point. The common element in most definitions is the reference to a surveillance device as any “instrument, device or equipment” capable of being used either “alone or in conjunction with any other instrument, device or equipment” to record or monitor words, and in some cases, images.⁶¹ This form of words is attractive in that it is not limited to devices of any particular type or nature (for example, electronic, mechanical, visual, etc), and includes devices with multiple capacities. It also covers equipment used to enhance the effectiveness of other surveillance devices, such as amplification equipment.

2.36 The key factor for the Commission in defining a surveillance device is not the nature or quality of the device itself, but the fact that it may be used for the purpose of conducting surveillance. The definition of surveillance device should therefore be linked to and dependent on the definition of surveillance, which is discussed in the section below. For example, medical imaging equipment, such as ultrasound and x-ray technology, is technically a surveillance device. Where, it is being used purely for diagnostic purposes and not for “surveillance” (according to the Commission’s recommended definition), the use of such equipment would not be regulated by the proposed surveillance legislation.⁶² To take another example, a video camera will only be a surveillance device for the purpose of the proposed legislation where it is being used intentionally to monitor a person’s activity in order to uncover information about that person.⁶³ It will not be a surveillance device under the proposed legislation where it is used to record a family picnic. Similarly, hearing aids used by a hearing-impaired person to raise hearing to a level considered to be normal will not be caught by the proposed legislation.⁶⁴ Where, however, a hearing aid is used to enhance hearing to a better than normal level for the purpose of eavesdropping, then it would be a surveillance device for the purpose of the proposed legislation.⁶⁵

Recommendation 1

The proposed Surveillance Act should define “surveillance device” to mean any instrument, apparatus or equipment used either alone, or in conjunction with other equipment, which is being used to conduct surveillance.

Surveillance

2.37 One of the most difficult tasks confronting the Commission during this inquiry has been formulating a precise definition of surveillance. While it is a commonly used and accepted term, surveillance is also an extremely nebulous concept.⁶⁶ As such, it defies precise definition. Perhaps this is why the Commission has been unable to find a suitable definition of surveillance in any of the legislative models it examined. As noted in paragraph 2.36 above, however, a definition of surveillance, which complements and is dependent on the definition of surveillance device, needs to be formulated to help clarify the scope of the proposed legislation.⁶⁷ The LDA does not define surveillance by means of a listening device. It prohibits the use of a listening device to “record or listen to” private conversations.⁶⁸ This is similar to equivalent legislation in other States and Territories,⁶⁹ and to Commonwealth legislation.⁷⁰

2.38 Breaking the concept down to its elements, it is apparent that surveillance involves using a surveillance device to monitor, either through listening to, watching, or collecting data (in whatever form) about, people, places or objects. It may or may not involve the recording of the conversation, activity or information monitored. Surveillance may be directed at a particular target or may be random, but is always a deliberate or intentional act of monitoring conducted for the purpose of acquiring information about the subject of the surveillance. It may be conducted with or without the knowledge of the subject. The information obtained may relate to the physical or genetic characteristics, behaviour or activity of a person, the whereabouts of a person or an object, or the compiling of a personal or consumer profile based on all of the above.

2.39 Surveillance is sometimes limited to “real time” activity, that is, activity that occurs simultaneously with the monitoring. For example, the LDA defines a listening or surveillance device in terms of its ability to listen to or record a conversation or activity “simultaneously with its taking place”. The effect of including such a limitation in the proposed legislation would be that the use of a device to read or record material stored on a computer database, including e-mail stored in the mail box of the sender or recipient, would be excluded from the scope of the legislation and therefore unregulated.⁷¹ The Commission considers the limitation of surveillance to “real time” activity difficult to justify from a policy perspective. It is hard to see why the use of a surveillance device, such as a computer, to monitor stored data to uncover information about a person should be unregulated simply because the information had been entered into the computer’s database prior to the monitoring occurring. Monitoring of stored material may be just as intrusive on individual privacy as observing or recording real time activity, and therefore, in accordance with the Commission’s emphasis on privacy as the basis of the proposed legislation, should be included in the definition of surveillance.

Recommendation 2

The proposed Surveillance Act should define “surveillance” as the use of a surveillance device in circumstances where there is a deliberate intention to monitor a person, a group of people, a place or an object for the purpose of obtaining information about a person who is the subject of the surveillance.

Recommendation 3

The proposed Surveillance Act should define “monitor” (as used in the definition of surveillance) as listening to, watching, recording, or collecting (or enhancing the ability to listen to, watch, record or collect) words, images, signals, data, movement, behaviour or activity.

2.40 The advantages of the broad, inclusive approach recommended by the Commission include the elimination of the arbitrary gaps and regulatory anomalies discussed in this chapter, and the extension of privacy protection to as wide a range of activity as reasonably possible. The proposed approach provides those conducting surveillance with the security of knowing that they are acting within the law, and affords those who may be adversely affected by unlawful surveillance with an avenue of redress. The major disadvantage with this approach, however, is that it lacks a degree of certainty. As the Commission has pointed out, the very nature of surveillance is that it is uncertain and limitless. It is impossible, for example, to state exactly what type of device is included or excluded from the scope of the legislation. The important factor will be whether the use of any device amounts to surveillance as defined by the legislation.

2.41 Taking a broad legislative approach also means that the outer scope of the Commission’s recommendations blend into other regulatory regimes. For example, in regulating computer surveillance of stored e-mail and other material, the proposed surveillance legislation will complement the Telecommunications (Interception) Act 1979 (Cth) (“Interception Act”) (since most e-mail travels along telephone lines),⁷² the Privacy Act 1988 (Cth),⁷³ and the Privacy and Personal Information Protection Act 1998 (NSW) (as the line between data surveillance and data protection is blurred).⁷⁴ At first, the Commission viewed the hazy delineation between these regimes as a problem, and investigated ways to clarify the regulatory boundaries. Any attempt at clarification, however, resulted in the same arbitrariness which we have been at pains to avoid. The Commission considers that the surveillance, privacy and telecommunications regimes, while not duplicating one another, should link together to form a web of privacy laws to guard against activity falling through gaps between the laws.

2.42 Basically, therefore, all activity that meets the definitions of surveillance and surveillance device will fall within the ambit of the proposed legislation, unless specifically excluded. The following discussion expands on the areas of potential overlap already mentioned between surveillance and other regimes, and highlights two areas to be included within the scope of the proposed legislation which some may find controversial: surveillance in private homes and surveillance by the media.

The internet and e-mail

2.43 It is not an overstatement to say that the rise of the internet and the boom in e-mail traffic over the past decade has been something of a communications revolution, particularly in the workplace. Being an international network of interconnected computers, it is the most effective means of sending information to a large number of people at once. It is this interconnectedness which presents the greatest opportunity for surveillance and threat to privacy. Until recently, e-mail systems generated the illusion of privacy. E-mail users often require a password to access their e-mail account. Messages appear to have no permanent existence unless they are printed out because the user has the option of deleting them from their computer. This apparent privacy can cause e-mail users to correspond in a manner more frank or personal than would be the case in a traditional letter.⁷⁵

2.44 The assumption of internet and e-mail privacy has been shattered with the growing awareness that the very technology making communication easier is also making it easier to spy on personal communications.⁷⁶ For example, “cookies” located on web servers may trace the web sites that a user has visited.⁷⁷ Other technology includes a “beacon” placed inside a target computer which “emits a signal whenever the user logs on to the internet”, alerting the person conducting the monitoring and allowing him or her to “enter the computer’s hard drive for as long as the user stays on-line”.⁷⁸ In the United States, the Federal Bureau of Investigation uses a computer system, known as “Carnivore”, capable of collecting e-mail and other cyber data by hooking on to the server of an Internet Service Provider.⁷⁹ Perhaps the most disturbing recent development has been a survey of employers which revealed that seventy-five per cent of Australian companies periodically monitor their employees’ e-mails, usually by covert surveillance.⁸⁰ E-mail may not only be read while stored in a computer or on a server, but may be retrieved even if it has been deleted.⁸¹

2.45 These threats to privacy have prompted calls to regulate internet and e-mail surveillance.⁸² The question is, how? The United Kingdom has introduced legislation which extends telecommunications interception laws to cover internet communications at any time during their transmission, including when stored in the computer of the sender or recipient.⁸³ The United States is also looking to regulate internet and e-mail surveillance.⁸⁴

2.46 The situation in Australia is more complicated due to the difference in Federal/State legislative powers. The Commonwealth Constitution gives the Commonwealth Government the power to regulate “postal, telegraphic, telephonic and other like services”.⁸⁵ This power is not exclusive to the Commonwealth, and co-exists with the residual powers of the States.⁸⁶ The Commonwealth has used this power to enact the Interception Act, which prohibits, except where specifically authorised, the interception of communications passing over a telecommunication system.⁸⁷ The Interception Act applies only to interceptions conducted without the knowledge of the person making the communication, that is, covertly.⁸⁸ So far as telephone interceptions are concerned, it has been held that the Interception Act is intended to cover the field, thus displacing, by virtue of section 109 of the Constitution, any State legislation which might otherwise be applicable.⁸⁹

2.47 As the internet and most e-mail systems operate through telephone lines, it is arguable that they could be caught by the Interception Act.⁹⁰ Being a relatively new and rapidly developing area there is no authority on this point.⁹¹ The Interception Act is a law designed primarily to regulate the interception of voice communications. Whether or not the Interception Act is adequate in its current form to regulate internet and e-mail communications is not an issue for the Commission to determine.⁹² The safe assumption, however, is that the regulation of any interception of internet or e-mail communications occurring along a telephone line is a Commonwealth matter.⁹³

2.48 What role, then, can New South Wales have in regulating surveillance of internet and e-mail communications? The Interception Act applies only to communications in their passage across a telecommunications system. Surveillance of internet and e-mail communications may occur at points either before or after they have passed through the telecommunications system. For example, e-mail may be monitored, read or down-loaded when in the mailbox or the hard drive of the sender or recipient, that is, before or after it has passed through the telecommunications system. The Commission is of the view that the proposed surveillance legislation should operate to regulate the monitoring of e-mail or internet communications at these points. As with any type of surveillance under the proposed legislation, the monitoring may be overt or covert, depending on whether the subject of the surveillance had prior knowledge. The Commission discusses the requirements for proving knowledge on the part of the subject, and different approaches to regulating overt and covert surveillance, later in this chapter.⁹⁴

2.49 The interplay of State and Commonwealth laws in this respect would be somewhat analogous to the current situation whereby the interception of a telephone call at a point along the telephone line is regulated by the Interception Act, but using a tape recorder placed at the receiver to monitor the same call is regulated by the LDA.⁹⁵ The Commission acknowledges that this two-tier system of regulation is not ideal. It places the onus on anyone wishing to conduct internet or e-mail surveillance to know the capacities of their monitoring software so that the point of surveillance could be determined, and this may not always be clear. For this reason, the Commission initially considered exempting internet or e-mail surveillance from the regulatory scope of the legislation. However, the law as it currently stands does not provide sufficient protection against the privacy threats presented by the internet. The Commission is of the view that it is better to sacrifice some clarity for the sake of comprehensive regulation.

2.50 In the future, the Commonwealth may introduce comprehensive legislation to regulate all aspects of internet and e-mail communications. If that should occur, then the surveillance legislation recommended in this Report would have no application at all to such communications. A national, comprehensive regulatory scheme for the internet would certainly be attractive. The Commission cannot, however, recommend exempting internet and e-mail communications from the operation of the proposed surveillance legislation based on a contingency that may or may not happen in the future. Until any further legislative moves are made by the Commonwealth, the proposed surveillance legislation should work as a “catch-all” to regulate the aspects of internet and e-mail surveillance not covered by the Interception Act.

Surveillance in private homes

2.51 The increased availability and affordability of surveillance technology has resulted in a growing number of people using surveillance equipment, video, audio-visual or sensor devices, usually in their homes. While primarily used for home security purposes, an emerging trend is to install video cameras to monitor baby-sitters, or even other family members.⁹⁶ The Commission initially considered creating an exemption from the proposed legislation for surveillance conducted in private homes. On further reflection, however, the Commission realised that this could lead to serious breaches of privacy. For example, security cameras operating from a private home could be used to monitor activity in a neighbour’s backyard. Complications also arise in multiple occupancy dwellings, where the interests of owners and residents may conflict. In one case reported to the Commission, the owners of a strata development installed video cameras in the common area to monitor people entering and leaving the lifts. The cameras were, however, trained on the front door of one of the home units, causing the resident to complain to the Privacy Committee of New South Wales (as it then was).⁹⁷

2.52 The adage that a “man’s home is his castle” is all very well, but the rights of a property owner or resident must be measured against other legitimate interests. The Commission is of the view that the fact that a home is private does not mean that anyone who dwells, visits or works there (as in the baby-sitter example given above) must surrender their privacy. As the Commission noted above,⁹⁸ privacy is a personal, not a property interest, and should not diminish because a person has entered the home of another. Accordingly, the Commission sees no reason to distinguish between regulating surveillance conducted in a private home and surveillance conducted anywhere else.

2.53 It should be remembered that the manner in which surveillance devices are used in homes in many cases would not amount to surveillance within the Commission’s proposed definition, and would therefore not be regulated under any surveillance legislation. A video or sound recording of a child’s birthday party, for example, would not fall within the definition of surveillance recommended by the Commission, as it is not made for the purpose of monitoring the children, but for recreational purposes⁹⁹ and as an electronic keepsake.

2.54 Where activity does fall within the Commission’s recommended definition, compliance with the proposed legislation would not be unduly onerous for those conducting surveillance in a private home. The Commission considers that where surveillance is undertaken in a random, non-targeted fashion as part of a home security system, no prior authorisation should be needed. However, those conducting this type of surveillance must abide by the eight legislative principles¹⁰⁰ (preventing inappropriate use of surveillance equipment and the material obtained as a result) developed by the Commission to regulate overt surveillance.¹⁰¹

2.55 There may be occasions, however, where a resident wishes to conduct targeted surveillance of a particular subject within their home. To take the baby-sitter example again, a parent may have reason to suspect that the baby-sitter is harming the child and may wish to have video evidence before terminating the employment or calling the police, but not want the baby-sitter to be aware of the surveillance. In this situation, prior authorisation would be required under the Commission’s recommendations. Indeed, this type of surveillance is already covered by the Workplace Video Surveillance Act 1998 (NSW) (“Workplace Video Surveillance Act”) as it is in the context of an employment relationship.¹⁰²

Surveillance by the media

2.56 The media are, of course, major users of surveillance technology. Microphones and cameras, with and without sound capacity, are the tools of the media’s trade. In many cases, these cameras and microphones are used to film or record the views of people on particular subjects. At other times, hidden cameras or microphones are used, primarily with a view to exposing some scandal, corruption or cover-up. While it may not be readily apparent, the use of microphones and cameras by the media in this way amounts to surveillance within the Commission’s recommended definition of surveillance,¹⁰³ as it involves the use of a surveillance device to monitor people or places with a view to finding out information.

2.57 The Commission has considered the issue of whether or not to exempt the media from the scope of its recommendations for proposed legislation. Media organisations strongly argued for an exemption, claiming that regulation under the proposed surveillance legislation would be contrary to the public interest and would compromise freedom of speech.¹⁰⁴ The views in favour of and against regulation of the media are discussed extensively in Chapter 6.

2.58 Freedom of speech is a matter of fundamental importance, and the media have a significant role in upholding that freedom and presenting the public with information. This Report makes recommendations which, if implemented, will regulate the use of surveillance devices and the information obtained as a result. Restrictions placed on information gathering by covert means do not automatically amount to limitations on the freedom of the press or of free speech. The proposed legislation recommended by the Commission is not aimed at restricting freedom of speech in terms of what the media prints or broadcasts. It will merely ensure that, in upholding that freedom, the media respect other equally important public interests. In this way, the proposed legislation would be no more restrictive of freedom of speech than the current LDA, the criminal law, or the laws of trespass, defamation and contempt. Even if freedom of speech were an issue in this context, it is not an absolute freedom, and must sit with other fundamental interests.

2.59 Compliance by the media with the proposed surveillance law need not be unduly onerous. So far as filming or recording conducted overtly is concerned, the media will be required to comply with the eight legislative principles recommended by the Commission,¹⁰⁵ and supplement those principles with a Code of Practice. This should present no difficulty since media industry Codes of Practice already exist.¹⁰⁶

2.60 Of greater significance is covert surveillance undertaken by the media. Such surveillance, while undoubtedly valuable in revealing corrupt or illegal activity, also has an enormous capacity to invade privacy. Yet, it is not regulated by any statute in New South Wales. The Surveillance Devices Act 1998 (WA) (“Western Australian Act”) contains a section permitting surveillance in the public interest.¹⁰⁷ Before material obtained as a result of such surveillance may be published, authorisation must be obtained from a judge.¹⁰⁸ This provision applies to, and has been used by, the media.¹⁰⁹ The Commission recommends that the proposed legislation should contain a separate part applying to anyone (including the media) wishing to conduct surveillance in the public interest, but should require authorisation prior to conducting the surveillance, rather than before publication occurs.¹¹⁰

2.61 The Commission acknowledges that failing to exempt the media from its proposed regulatory scheme will generate controversy. However, the Commission does not accept the argument that including the media within the scope of new surveillance laws will act as a curb on freedom of speech or expression. It will merely ensure that, in upholding freedom of speech, the media respect other equally important public interests and act in accordance with the law.

What is not covered?

Telecommunication interception

2.62 As noted above, the Interception Act has been held to cover the field so far as telecommunications interception is concerned, making it a matter for the Commonwealth to legislate upon.¹¹¹ Accordingly, the recommendations in this Report do not affect the interception of any communication in its passage along a telecommunications system.

Surveillance provided for under a Commonwealth or another New South Wales law

2.63 Surveillance powers of various sorts are provided for under Commonwealth legislation and other New South Wales laws. At the Commonwealth level, the Interception Act, the Customs Act 1901 (Cth), the Australian Federal Police Act 1979 (Cth) and the Australian Security Intelligence Organisation Act 1979 (Cth) all contain surveillance powers. At the State level, the Casino Control Act 1992 (NSW) specifically provides for a casino surveillance system to be supervised by the Director of Casino Surveillance.¹¹² Another example is the Road Transport (Safety and Traffic Management) Act 1999 (NSW) which provides for speed cameras.

2.64 As the laws of New South Wales cannot bind the Commonwealth, the Commission is of the view that the proposed surveillance legislation should specifically exempt surveillance activity which is provided for under a Commonwealth law. The LDA currently contains a similar provision.¹¹³ Where surveillance is authorised under another law of New South Wales, however, the Commission considers that those laws should be amended specifically to provide that the proposed surveillance legislation has no application. The Commission favours this approach rather than providing for a general exemption in the proposed legislation for surveillance powers contained in other Acts. The requirement to amend existing legislation (or to insert a provision in future laws) stating that the surveillance legislation does not apply will help focus Parliamentary attention on the adequacy of surveillance powers and privacy protections in those other laws.

Recommendation 4

The proposed Surveillance Act should exempt from its scope surveillance conducted under a Commonwealth law.

Recommendation 5

The proposed Surveillance Act should regulate all surveillance activity within its scope, unless other New South Wales laws specifically exempt the operation of the surveillance legislation.

Surveillance conducted without the use of a surveillance device

2.65 The definition makes it clear that the proposed legislation will only cover surveillance where a device is used. Direct observation by law enforcement agencies without the use of any device would, for example, be excluded.

Surveillance which is unintentional or for recreational purposes

2.66 Electronic equipment capable of being used as surveillance devices, once the domain of private investigators and police, has become more available and affordable for use as a recreational tool. The amateur photographer is now able to use sophisticated video and sound equipment with pan and zoom capacity in his or her weekend recreational pursuits. With the proliferation of this type of equipment, it is conceivable that private activity may be recorded or monitored accidentally or unintentionally. For example, a video camera being used to record a family outing may also film and record a private transaction in the background. Cameras and other equipment may also be left on accidentally. The LDA currently contains an exception in relation to the unintentional use of a listening device.¹¹⁴ This type of activity would not be covered under the Commission’s definition of surveillance, which requires monitoring to be intentional.

2.67 Similarly, amateur and professional photography or film-making would not be included in the Commission’s definition of surveillance. These pursuits are for the purpose of recording events for posterity, and not the purpose of discovering information about the subject of the surveillance.

Data surveillance

2.68 Specific issues arise concerning the inclusion of data surveillance within the scope of the proposed legislation. These are discussed below.

Surveillance and data protection

2.69 At one time, the distinction between surveillance and data protection was simple: surveillance involved the use of equipment such as cameras and listening devices while data protection regulated the use of personal information collected by agencies, either in paper form or on an electronic database. However, with rapid developments in, and convergence of technologies, the line between data surveillance and data protection has become difficult to decipher. Data surveillance can include the use of a computer to retrieve personal information from a database or to match information obtained from one database with that obtained from another. So can data protection. Data surveillance may involve the use of devices to obtain biometric information such as finger or retina prints, or genetic characteristics.¹¹⁵ So can data protection. Even activity that appears clearly to be surveillance may impact on data protection, and vice versa. For example, surveillance video material may be converted into data and stored on a database, while information on a database or computer screen may be “read” by electro-magnetic devices and become surveillance material. In taking a broad regulatory approach, the Commission’s recommendations encompass data surveillance. The difficult issue, however, is where to draw the line between data surveillance and data protection.

2.70 Limited data protection regulation already exists. The Privacy Act 1988 (Cth) (“Commonwealth Privacy Act”) and the Privacy and Personal Information Protection Act 1998 (NSW) (“New South Wales Privacy Act”) regulate the collection, storage, use and disposal of personal information about individuals held by certain Commonwealth and State government agencies, respectively.¹¹⁶ Both Acts define “personal information” to include information held on a “database” and need not be recorded in material form. ¹¹⁷ These Acts cover situations where information has been collected directly from individuals, stored on a database and retrieved at a later date. By regulating the use of the information collected, the Acts also cover data matching.¹¹⁸

2.71 The data protection regime in Australia has been rightly criticised for covering only information held by public sector agencies. Increasing amounts of information is held on “corporate” databases, which may be shared, matched or “warehoused” without any regulation, prompting growing public concern over potential privacy threats.¹¹⁹ To address these concerns, and to satisfy the European Union Directive on data protection,¹²⁰ the Commonwealth has introduced the Privacy Amendment (Private Sector) Act 2000 (Cth), which extends information privacy principles to elements of the private sector. When it commences in December 2001, that legislation will extend regulation to the collection, storage and use of personal information held by applicable private sector organisations in New South Wales.

2.72 Whether or not that legislation will provide sufficient privacy protection has been significantly debated,¹²¹ and is not the focus of this Report. If the proposed surveillance legislation were to apply to the type of data surveillance covered by the New South Wales Privacy Act and the Commonwealth private sector legislation, the result would be that database managers would be required to comply with two regulatory regimes in relation to the collection, use and storage of the same data. This would not only be confusing, but would do little to enhance the privacy of the people who supplied the information. The Commission considers, therefore, that the collection, retrieval and matching of information on computer databases is more appropriately dealt with by way of data protection legislation rather than surveillance laws.¹²²

Recommendation 6

The random or overt collection, retrieval and matching of information on computer databases should be excluded from the scope of the proposed Surveillance Act.

Coverage of covert data surveillance

2.73 The proposed surveillance legislation should apply to the covert monitoring of data through the use of a surveillance device. This would include, for example, situations where a computer, or a device placed inside or outside a computer, is used to collect and/or record data, including e-mail, as it is being entered into a computer. It would also include using a computer or other device to “hack” into a database of stored material. These acts involve deliberate attempts to uncover information without the knowledge of the person to whom that information relates. This type of activity is beyond the scope of data protection legislation, as it is obtained indirectly by stealth and need not be personal information. As such, the Commission believes that covert data surveillance should fall within the scope of the proposed legislation.

Recommendation 7

The covert use of a surveillance device to monitor data relating to particular individuals or groups, as it is entered into a technology system or stored on a database, should be regulated under the proposed Surveillance Act.

Data surveillance by employers

2.74 Employers have an interest in ensuring that employees’ time is spent productively. To this end, some employers may have a policy of monitoring the number of key strokes their employees enter into a computer, or the number and type of e-mails employees receive. Employers may also wish to monitor documents on databases to check that employees are performing work adequately and not spending time with personal work. Some of this data surveillance involves data protection issues. The Commission recommended above that the use of a device to retrieve or match information on a database should not be regulated by the proposed surveillance legislation, but should more appropriately be regulated by data protection laws. That is the Commission’s position so far as surveillance generally is concerned. Where, however, that type of data surveillance occurs in the context of an employment relationship, the Commission is of the view that it is more of a surveillance than a data protection issue, and consequently the surveillance legislation should apply. The relationship between employers and employees involves special rights and responsibilities which justify additional protective measures in some circumstances.¹²³ The Commission believes that data surveillance is one of those circumstances.

2.75 Employers may wish to conduct data surveillance randomly and overtly, as part of an overall company policy. In order to be considered overt, the surveillance must be conducted only after the requisite notice has been given to all employers.¹²⁴ If data surveillance is carried out overtly, employers must comply with the eight principles governing overt surveillance, one of which is that overt surveillance must be reasonable in the circumstances. Consequently, if the data surveillance is unduly intrusive, it may be considered unreasonable and would potentially be in breach of the proposed legislation.¹²⁵

2.76 Any surveillance conducted by employers without the requisite notice will be deemed to be covert surveillance. Employers may wish to conduct covert data surveillance, either themselves or through a private investigator, where, for example, the employer suspects fraud or theft and wishes to obtain evidence. As with any covert surveillance, prior authorisation must be sought and obtained before covert data surveillance may proceed. Paragraphs 2.97-2.98 and Chapter 7 detail the authorisation procedure for covert surveillance conducted by employers.

Recommendation 8

Data surveillance of employees conducted by employers, either overtly or covertly, should be regulated by the proposed Surveillance Act.

2.77 As the Commission noted earlier in this chapter, the approach taken in surveillance legislation in other jurisdictions is to limit regulation to private conversations and activity, generally conducted without the knowledge and consent of the subject of the surveillance. The Commission’s recommendations differ from this approach by basing regulation, not on the type of activity which is under surveillance, but on the type of surveillance being conducted. The Commission has identified two broad types of surveillance: overt and covert.

Overt surveillance

2.78 Since overt and covert surveillance are to be regulated in very different ways, the Commission considers that the distinction between the two forms of surveillance should be made clear. Overt surveillance is usually conducted randomly for safety or security purposes. Examples include cameras used in banks and at Automatic Teller Machines, and closed circuit television cameras used in public mall areas and car parks. Such surveillance generally occurs openly, the key indicator being knowledge on the part of the subject. The way in which surveillance is regulated under the Commission’s proposed new scheme will depend on whether the subject of the surveillance knows that the surveillance is occurring. Because of the significance for the regulatory scheme of determining when knowledge is present, the Commission considers that it should be clearly and objectively definable. The Commission recommends that knowledge should be assumed, and surveillance therefore treated as overt, where adequate prior notice of the nature of the surveillance is given. Adequate notice should consist of the person or agency conducting surveillance proving the presence of:

• clearly visible signs which are able to be understood by everyone (including, for example, people from non-English speaking backgrounds and people with a disability);¹²⁶ or
• other warnings of the type of surveillance occurring, such as audio announcements or written notification (where practicable); and
• clearly visible and recognisable surveillance equipment which indicates the type of surveillance that is occurring, eg audio, visual or both, etc.

Recommendation 9

The proposed Surveillance Act should define overt surveillance to be surveillance which occurs in circumstances where adequate notice of the surveillance has been given prior to, or simultaneously with, the occurrence of the surveillance.

Recommendation 10

For the purpose of Recommendation 9, adequate notice is proven to be given through any of the following or similar means:

• signs which are clearly visible and widely understood (for example, by people from non-English speaking backgrounds and people with a disability); or
• other warnings of the type of surveillance occurring, such as audio announcements or written notification (where practicable); and
• surveillance equipment which is clearly visible and recognisable.

Notice required for surveillance by employers¹²⁷

2.80 Where overt surveillance is conducted generally, it will be irrelevant whether or not any individual subject to the surveillance has actual knowledge of its occurrence. The Commission considers that in the employment context, a more stringent approach is appropriate, whereby actual knowledge is required.¹²⁸ The reason for requiring actual knowledge in the employment context is two-fold. First, unlike overt surveillance of a shopping mall or railway station where hundreds of people will be randomly monitored daily, in the employment context those employees who will be affected by overt surveillance can be identified. Accordingly, it is possible to ensure affected employees have actual knowledge of the surveillance. Secondly, where an employer uses surveillance devices, employees are potentially subject to continuous surveillance and consequent privacy invasions for prolonged periods. This contrasts with the temporary invasion involved in most forms of overt surveillance conducted outside the employment context. Spending eight hours a day, five days a week under continuous CCTV surveillance has significantly higher privacy implications than being caught by CCTV for fifteen minutes while one waits for a train.

2.81 Consequently, the Commission recommends that actual knowledge should be ensured by the provision of written notification to each employee prior to the commencement of any surveillance. The current Workplace Video Surveillance Act approach of requiring at least 14 days notice, unless consent to a lesser period is obtained, is considered to be an appropriate time frame. Any employee who commences work following the commencement of overt surveillance must be provided with similar written notice.

2.82 Associated with the requirement that employees be provided with actual knowledge of overt surveillance is our recommendation that the knowledge be fully informed. Notification of the bare fact of surveillance will be insufficient to satisfy the significant privacy implications of overt surveillance by an employer. Accordingly, the Commission recommends that the written notice must provide the details set out in the recommendation below.¹²⁹

Recommendation 11

Surveillance in the employment context should be considered overt if employees are provided with written notification of the intended surveillance at least 14 days (or, if the employer has obtained the consent of the employee to a lesser period of notice, that period) prior to its commencement.

In the case of new employees, where surveillance has already commenced, surveillance in the employment context would be considered overt if they are provided with written notification of the surveillance at the time when an offer of employment is made.

Recommendation 12

For the purposes of overt surveillance in the employment context, written notice should contain the following information:

(a) the location of the surveillance;

(b) the nature and capacity of the surveillance devices;

(c) whether the surveillance will be continuous and, if not, the hours of operation;

(d) the purpose of the surveillance; and

(e) the person responsible for the conduct of the surveillance.

Overt surveillance and consent

2.83 The Commission has considered the question of whether, in addition to knowledge, consent should be an element in proving that surveillance is overt. Clearly, where the subject consents freely and expressly to surveillance occurring, that surveillance will be overt since there can be no consent without knowledge of surveillance. However, the Commission has decided against recommending that consent be an essential element in overt surveillance for the following reasons.

2.84 For consent to be real, it should at least involve the two elements of knowledge and choice. In many situations, however, it is not possible to determine whether consent is given freely, and it is therefore often implied from the circumstances. For example, when a person enters a service station to buy petrol, he or she notices a sign indicating that the area is under video surveillance. On one interpretation, that person may be deemed to be consenting to the surveillance by entering the premises knowing that video cameras are operating there. The reality may be, however, that since most if not all petrol stations employ some form of electronic surveillance, there is nowhere else to buy petrol that is not also under surveillance. In this situation, while the person knows the surveillance is occurring, he or she is not presented with a choice since the only alternative is to submit to the surveillance or run out of petrol. Consequently, any attempt to infer consent from such a situation is largely illusory.

2.85 In addition to conceptual difficulties surrounding consent, the Commission also considers it impractical to require consent before overt surveillance can be conducted. Many forms of overt surveillance target a large number of surveillance subjects and are usually random in nature. Obtaining the express consent of all potential people would be impossible since there is no way of knowing who those people are. Consequently, the Commission is of the view that consent should not be required by those subject to overt surveillance.

Regulation of overt surveillance

2.86 The Commission sets out its recommendations regarding the regulation of overt surveillance in Chapters 3 and 4. Briefly, the proposed legislation should set out basic principles with which people conducting overt surveillance should have to comply. Those principles would, for example, provide that those who undertake overt surveillance must:

• not contravene reasonable expectations of privacy eg be in toilets or change-rooms;
• use the surveillance for lawful and not unlawful purposes;
• not exceed the purpose for which the surveillance is intended;
• have in place secure systems for the collection, use, storage and destruction of surveillance material eg security procedures for video and audio tapes, proper training and probity checks on staff, etc;
• make their surveillance systems and devices available for inspection and monitoring by the Privacy Commissioner; and
• ensure that material obtained through surveillance is used only in a fair manner by authorised persons.

Covert surveillance

2.88 Surveillance will be covert under the Commission’s recommendations where it is conducted without first notifying the subject. Generally, but not always, covert surveillance tends to be targeted towards a specific individual, group or object, and is undertaken to discover particular information or evidence about the subject of the surveillance. Various laws and guidelines contain definitions of covert surveillance.¹³³ The Macquarie Dictionary defines covert as covered, sheltered, concealed, secret or disguised. The Commission is of the view that any surveillance conducted in circumstances which fail to satisfy the notice requirements for overt surveillance will be deemed to be covert.

Recommendation 13

Any surveillance conducted in circumstances that fail to satisfy the notice requirements for overt surveillance should be considered to be covert for the purposes of the proposed Surveillance Act.

Regulation of covert surveillance

2.89 All surveillance legislation examined by the Commission, including the LDA, regulates covert surveillance by prohibiting it unless a warrant is obtained from a judge, or the surveillance falls under an exception in which case a warrant is not needed. The Commission considers that a warrants scheme is the most appropriate way to regulate covert surveillance. Requiring the approval of an independent arbiter before conducting surveillance helps to minimise the serious threat to individual privacy presented by covert surveillance, and ensures that it is conducted only where justified. The Commission considers, however, that the presence of too many ill-defined exceptions can undermine the privacy protection offered by a warrants system. In order to avoid this, the Commission has examined the scope of activity covered by the warrants and exceptions in the LDA and other surveillance legislation, and discovered three main areas where covert surveillance would be legitimately conducted. Those areas are law enforcement, the public interest,¹³⁴ and in the course of employment.

2.90 Accordingly, the Commission has devised a three-pronged approach to regulating covert surveillance based on those areas mentioned above, with prior authorisation required for each. Where prior authorisation cannot possibly or practicably be obtained, surveillance may be conducted and retrospectively validated by the appropriate authorising body. Regulating covert surveillance in this way removes the need for the legislation to contain exceptions, since all surveillance must be authorised either before or after the fact. Since covert surveillance conducted by either law enforcement agencies, in the public interest or by employers, will clearly be for different purposes, the Commission is of the view that three separate but parallel systems of authorisation should operate. The question of which body has the power to authorise surveillance will depend upon either who was conducting the surveillance or the purpose for which it was conducted. Those three systems are explained briefly below, but see Chapters 5, 6 and 7 for more detail.

Covert surveillance by law enforcement officers

2.91 The regime recommended by the Commission to regulate covert surveillance conducted by law enforcement officers is similar to the warrants scheme in the LDA. Generally, a warrant must be obtained from a judge before a law enforcement officer may conduct covert surveillance. Retrospective warrants may be obtained to validate covert surveillance where prior authorisation was not possible, for example, in an emergency or during an undercover operation. The procedure for applying for and obtaining warrants would be largely the same as in the LDA, subject to a few differences. Officers would still have to submit a written affidavit explaining the type of surveillance to be conducted, why it is justified, and what likely use will be made of the material collected.

2.92 The Commission’s recommendations depart from the LDA to the extent that only law enforcement officers will be able to apply for a warrant from a judge. Anyone else wishing to conduct covert surveillance must seek authorisation under either the public interest process or the employment system. For the sake of clarity, anyone who is a law enforcement officer must use the warrants system and not the public interest system, even though law enforcement can be said to be upholding a public interest. “Law enforcement officer” should be defined broadly to include commonly regarded law enforcement agencies such as the police, the Independent Commission Against Corruption or the Police Integrity Commission, etc. It should also include any office holder specifically empowered to enforce a particular law, for example, fisheries inspectors, unless those laws specifically exempt the operation of the proposed surveillance legislation.¹³⁵ The law enforcement warrants system should also include people acting on behalf of law enforcement officers, such as informers.

Covert surveillance in the public interest

2.93 There will be times when covert surveillance would be justified in situations involving a public interest, other than when conducted by law enforcement officers or in an employment context. Examples include a private inquiry agent investigating insurance fraud or a journalist pursuing a corruption scandal. The Western Australian Act contains a section on surveillance in the public interest. Under the Western Australian Act, a person may conduct audio or visual surveillance (or both) in certain circumstances if it is in the public interest to do so.¹³⁶ Public interest is defined to mean “the interests of national security, public safety, the economic well-being of Australia, the protection of public health and morals and the protection of the rights and freedoms of citizens”.¹³⁷ Anyone wishing to publish or communicate the information obtained as a result of covert surveillance in the public interest must obtain a publication order from a Judge.¹³⁸

2.94 The Commission considers that, while the idea of obtaining a publication order before surveillance material can be released is sound, it still allows for too great a breach of privacy since the surveillance may be conducted without any prior authorisation. Consequently, the Commission recommends that authorisation should be obtained before the covert surveillance is conducted, rather than before release of the surveillance material. A more detailed explanation of the reasons why the Commission favours prior public interest authorisation is in Chapter 6.

2.95 The Commission is of the view that authorising covert surveillance in the public interest involves different policy questions from hearing a warrant application by a law enforcement officer. Accordingly, the Commission recommends that a separate system of authorisation should apply for covert surveillance in the public interest. That system could be administered either through a court or a tribunal, with the application procedures mirroring as closely as possible the procedures for covert surveillance by law enforcement officers and employers. ¹³⁹

2.96 Emergency situations should also be covered, where a prior authorisation is not practicable or possible. In such cases, a retrospective authorisation should be available. An application for a retrospective authorisation should explain why a prior authorisation was not possible. If a person conducts covert surveillance and does not apply for a retrospective authorisation, the surveillance will be considered unlawful and the information obtained may not be released.

Covert surveillance by employers¹⁴⁰

2.97 Currently, the Workplace Video Surveillance Act requires an employer, or anyone acting on behalf of an employer, who conducts covert video surveillance of employees to obtain prior authorisation from a magistrate. The proposed surveillance legislation would, if implemented, incorporate the operation of the Workplace Video Surveillance Act into its broader scope. The Commission considers that prior authorisation for covert surveillance by, or on behalf of an employer, should be obtained from a Judicial Member of the NSW Industrial Relations Commission or an Industrial Magistrate rather than from a Magistrate. This is because of those persons’ specialist knowledge of employment relations. As with covert surveillance conducted by law enforcement agencies or in the public interest, there should be a provisions for surveillance by an employer to be retrospectively validated in circumstances where prior authorisation is not possible or practicable.

2.98 The Commission is of the view that, as far as possible, the provisions relating to surveillance by employers should mirror those conducted by anyone else, except where the nature of the employment relationship justifies differences. Circumstances which justify different provisions for employee surveillance are noted throughout this Report.¹⁴¹

Participant monitoring

2.99 The LDA currently permits a party to a conversation to record that conversation, without a warrant and without the knowledge of the other parties, where the recording is reasonably necessary for the protection of the recording party’s lawful interests, or where the recording is not made for the purpose of communicating or publishing its contents to others.¹⁴² This practice, known as “participant monitoring”, is one of the most controversial surveillance issues.¹⁴³

2.100 It is controversial because the interests that need to be protected or promoted are not easily distinguishable. Where a private conversation is recorded covertly by a third party, there is a clear breach of privacy and confidentiality. The only question is whether, and in what circumstances, that breach can be justified by other interests, such as the public interest in fighting crime. Where a private conversation is recorded by a party to that conversation without the knowledge or consent of the other parties, the situation is less clear.

2.101 Proponents of participant monitoring believe that it is a necessary, accurate, effective and reliable evidence-gathering tool, particularly for undercover law enforcement officers.¹⁴⁴ Participant monitoring is also practised in the commercial and business sectors, and by emergency services, to guard against possible future allegations of illegal or improper conduct. The major argument in favour of participant monitoring is that, as a party to a conversation or activity, a person has an express or implied right to hear the words spoken during that conversation or view the activity. The argument follows that the right to record the conversation or activity flows from the right to observe and be a party to it, and is no more intrusive on privacy than if the person took written notes.¹⁴⁵ In reaching the view that participant monitoring should be permitted without restriction, the ALRC considered that prohibiting or regulating participant monitoring would lead to undesirable results, and render conduct illegal which should otherwise be acceptable, such as preventing people from recording conversations with their doctors or with the police.¹⁴⁶

2.102 Those arguing against participant monitoring view it as a fundamental breach of privacy,¹⁴⁷ since all parties to a conversation or activity should reasonably be able to expect that the conversation or activity will not be monitored, unless all parties expressly consent.¹⁴⁸ Some commentators have expressed the concern that the participant monitoring provisions are too vague, are open to misinterpretation and abuse, and are often used as a means of escaping the need to get a warrant.¹⁴⁹ Regarding participant monitoring by law enforcement agencies, it has been said that:

[t]he danger here is that any person can be targeted for unlimited, highly intrusive electronic surveillance without law enforcement officers having first satisfied a judge or other independent person that there are reasonable grounds to believe or suspect that evidence relevant to the commission of an offence may be obtained.¹⁵⁰

2.104 The Commission considers that allowing a person to conduct surveillance without a warrant merely because they are a party to the activity being monitored presents too great a threat to privacy.¹⁵³ The participant monitoring provisions in the LDA are vague and uncertain. They are couched in broad language which has not been tested by the courts and which raises questions concerning who the “principal party” to a conversation is, and what that party’s “lawful interests” are. This uncertainty creates a significant opportunity for people to conduct unjustified covert surveillance by simply becoming a party to an activity, thereby undermining the safeguards contained in the authorisation procedures recommended for covert surveillance.

2.105 The main objection the Commission has to participant monitoring is that it is based on the flawed assumption that covert surveillance is automatically more acceptable and less of a privacy breach because it is conducted by a party to a conversation rather than a third party. Inviting a person to talk, or impliedly consenting to involve a person in a conversation or activity, is not the same as permitting that person to record the activity. Different questions of knowledge and consent arise. The Commission also rejects the argument that covert recording by a party to a conversation or activity should be allowed, since there is no distinction between electronic recording and taking written notes. Again, different questions and degrees of knowledge and consent are involved. A conversation or activity may be recorded covertly, but it is very difficult to imagine notes being written covertly during a conversation. Notes may be written up later from memory, but this evidence will be less compelling and accurate than a permanent, contemporaneous recording of activity in which the person’s gestures and voice, including pauses, intonations and interjections, may be heard and observed out of context. A recording may also be copied and heard by a greater number of people, and will carry more evidentiary weight in court than written notes or oral testimony. Accordingly, the Commission considers that an electronic recording of a conversation or an activity can and should be distinguished from written notes and should be subject to greater control.

2.106 The concept of participant monitoring as included in current legislation also reflects an outdated and narrow approach to technology. It has relevance only to the monitoring or recording of conversations or activity, generally through audio or visual means or by picking up a telephone extension, where the parties to that conversation or activity are identifiable. Participant monitoring has little meaning when applied to computer or internet surveillance where the concept of a “party” is less clear.¹⁵⁴ It is consequently a device-specific concept, which is at odds with the broad general approach recommended by the Commission in this Report.

2.107 In recommending that participant monitoring provisions not be included in the proposed surveillance legislation, the Commission is not suggesting that there should be no controls on a party to a conversation or activity conducting covert monitoring, or that a party should be totally prohibited from doing so. The real question is not whether the person conducting the covert electronic monitoring participates in the conversation or activity, but in what situations should such monitoring be allowable or justifiable and what privacy safeguards should be put in place. For example, when an undercover police officer records a conversation or films an activity covertly in an emergency situation to prevent a serious threat to public safety, this should be allowed under the proposed legislation, not because the police officer was a party to the conversation, but because the circumstances justified covert surveillance in that instance. Accordingly, the Commission recommends that the proposed surveillance legislation should not distinguish between monitoring conducted by parties and non-parties, but should facilitate covert surveillance when it can be justified in any particular situation.

Recommendation 14

The proposed Surveillance Act should not contain participant monitoring provisions with regard to covert surveillance. Covert surveillance should be permitted only when justified and authorised in particular circumstances, regardless of whether the monitoring is conducted by a party or an outsider.

2.108 With both overt and covert surveillance, specific consideration has been given to the use of surveillance in the employment context. Not only does surveillance in the employment context have serious privacy implications, it raises broader industrial issues grounded in the respective, and often conflicting, interests of employees and employers.¹⁵⁵ It is because of the particular privacy issues and the additional industrial dimension that the Commission has identified this field of surveillance to require specific consideration.

2.109 An important, preliminary matter is to identify when surveillance can be said to occur in the employment context for the purpose of requiring special consideration and regulation. The approach adopted in the Workplace Video Surveillance Act is to regulate the surveillance of an employee by an employer in the workplace. Accordingly, in terms of the Workplace Video Surveillance Act, the employment context is identified by reference to both an employment relationship and a physical location. This approach has the attraction of making it straightforward to identify when the Act will apply. By limiting its application to the workplace, the Act avoids the more difficult question of whether surveillance of an employee by an employer, not on work premises, should ever belong in the employment rather than the general context of surveillance regulation.

2.110 The Commission considers that restricting the employment context to surveillance that occurs in the workplace will exclude situations that should properly be included. Employers may wish to carry out surveillance of employees in a range of situations that, although related to their employment, occur off work premises. For example, an employer may wish to video an employee having a meal at a restaurant during his or her lunch break, suspecting the employee of consuming alcohol. Similarly, an employer could be interested in videoing the activities of an employee who is absent from work because of illness. Such instances of surveillance may have serious implications for the employee, such as forming the basis of dismissal. They are also matters in which an employer may legitimately be interested. In the view of the Commission, it is illogical and inappropriate to exempt this type of surveillance from our consideration of surveillance in the employment context and any specific provisions that may flow from that consideration.

2.111 Extending the reach of the employment context beyond surveillance occurring on work premises raises the issue of where to draw the line; should any surveillance of an employee by an employer be included? In the Commission’s view, surveillance of an employee by an employer, other than on work premises, should only occur in the employment context when it is conducted for an employment-related purpose.¹⁵⁶ This leaves surveillance of an employee by an employer, not on work premises and not for an employment-related purpose under the general regime. This approach is consonant with the underlying basis of separating the employment context from the general context; namely the industrial dimension.

Recommendation 15

In the proposed Surveillance Act, employment specific provisions should apply:

(a) when an employer is undertaking surveillance of an employee on work premises; or

(b) when an employer is undertaking surveillance of an employee not on work premises but for an employment-related purpose.

Meaning of “employer” and “employee”

2.112 The Workplace Video Surveillance Act defines “employer” and “employee” by reference to a contract of employment or apprenticeship.¹⁵⁷ This approach excludes volunteer workers and independent contractors. However, as the basis of providing specific consideration to surveillance in the employment context is the industrial dimension, the Commission considers that it is appropriate to limit the concept of an employment context, and therefore any employment specific provisions, to those persons in a formal, employment relationship.¹⁵⁸

2.113 Under the Workplace Video Surveillance Act approach, surveillance of an employee by an employer, who is not the employee’s employer, will be caught. For example, if the owner of a retail store were to conduct surveillance of a Telstra technician, visiting the retail store in the course of his or her employment, that instance of surveillance would fall within the Workplace Video Surveillance Act. The effect of this is that persons not in a formal, employment relationship are caught by employment-specific provisions. Given that the Commission recommends comprehensive regulation of covert surveillance, the possibility that this type of “employment” surveillance would be left unregulated will be removed. Accordingly, the Commission considers that the current Workplace Video Surveillance Act approach should be tightened and therefore recommends that “employer” and “employee” should be defined in such a way that restricts the employment context to a direct employer-employee relationship.

Recommendation 16

“Employer” and “employee” should be defined in the proposed Surveillance Act by reference to a contract of employment or apprenticeship, to which both are parties.

2.114 In summary, the Commission is recommending surveillance legislation extremely broad in scope, covering the intentional use of any device to monitor a person, place or object with a view to discovering information about the subject of the surveillance. The legislation will regulate surveillance of any activity which falls within its scope, not just activity considered to be private. It will cover surveillance conducted with and without the knowledge of the subject, and regardless of who conducts it. Overt surveillance conducted by anyone will be regulated by eight legislative principles, supplemented by codes of practice for larger users. The principles will cover the proper use of surveillance devices, and the use, storage and disposal of material obtained as a result of overt surveillance. Covert surveillance will be governed by three clear, distinct, yet parallel, schemes of prior authorisation. The applicable scheme will depend on whether the surveillance is conducted by, or on behalf of, a law enforcement officer, an employer, or in the public interest. The terms of each authorisation will dictate the proper use of the surveillance device and the material obtained from that use.

2.115 Deviation from the overt surveillance principles or the provisions of the legislation concerning covert surveillance authorisations will result in a breach of the legislation. Various consequences will follow a breach of the legislation, depending on the nature and extent of the breach. For example, the publication or use of surveillance material may be prevented or restricted, and criminal sanctions may apply. Breach of the legislation may also give rise to a civil action for damages.¹⁵⁹

2.116 As noted at the outset of this chapter, the Commission believes this regulatory regime to be the most effective and comprehensive method of achieving the aim of protecting privacy against encroaching surveillance technology, and regulating the breach of privacy where the surveillance can properly be justified.