1. Surveillance - Approaches to regulation Privacy & Surveillance Topic 8 Nigel Waters & Professor Graham Greenleaf September 2008

2. 2 Defining surveillance ‘the systematic collection and monitoring of personal data, for the purpose of social control’ (Rule – summarised in Bennett)‏Bennett Personal v Mass data surveillance (Clarke)‏ Personal v Mass data surveillance Monitoring (visual, audio, movements, data)‏ Generally over a period of time

3. September 20083 Regulating Surveillance Surveillance authorisation vs. Surveillance limitation Relationship between Surveillance and Privacy laws Most privacy laws only about information privacy: 'personal information in records' Exception PPIPA (NSW) – 'violation of privacy' and no 'record' limitation, only 'collected or held' (possession or control)‏

4. September 20084 Surveillance laws in Australia Surveillance Authorisation laws: Data-matching Program (Assistance & Tax) Act 1990 (Cth)‏ AML-CTF Act 2006 (Cth) (formerly FTRA, CTRA 1988)‏ Many provisions Cth & State laws giving power to acquire information in bulk and/or in relation to specific targets (search and seize)‏

5. September 20085 Surveillance laws in Australia Hybrid - both limitation and authorisation: Telecommunications Interception and Access) Act 1979 (Cth) (formerly TIA)‏ Surveillance Devices Act 2004 (Cth)‏ State Surveillance or Listening Device laws (all states)‏ Sectoral e.g. Workplace Surveillance Act 2005 (NSW) (formerly Workplace Video Surveillance Act 1998)‏

6. September 20086 Forms of ‘surveillance’ Two main modes of surveillance: Monitoring - surveillance of the person Actions (filming, CCTV, thermal imaging, keystroke monitoring)‏ Movements (GPS or other tracking; including location by telephone) (see Clarke on person tracking)‏person tracking Aural surveillance other than communications Interception of communications between people Telecommunications interception - special rules for telecommunications systems - voice and Internet issues Overlaps with local system monitoring of calls, email Other aural (listening devices) interception Interception of mail

7. September 20087 Forms of ‘surveillance’ (2)‏ We use ‘surveillance’ to mean direct or indirect tracking of people Surveillance can appear to be of objects Often as an indirect way of tracking people’s movements/location (see Clarke on person tracking)‏person tracking Often as a way of inferring actions by people (eg changes to web sites, status of digital objects for IP purposes)‏

8. September 20088 Forms of ‘surveillance’ (3)‏ Different types of surveillance legislation Distinction in terms of awareness: Overt - where subject is aware that surveillance is occurring at the time Covert - where subject is not aware Distinctions in terms of location: Public places - subject has a right of presence Subject’s own premises - home, own office Where subject is a licencee on premises shops, apartment blocks, etc Workplace - special considerations Communications while in a comms system

9. September 20089 Forms of ‘surveillance’ (4)‏ Distinctions in terms of technology ‘Technology neutral’ regulation Technology-specific regulation (eg listening devices; video; telecomms)‏

10. September 200810 Relationship between surveillance & information privacy laws Operate in parallel: consider both (if personal information and (except in NSW?) in records)‏ Surveillance laws may operate where exceptions to info. privacy laws apply (e.g. media, employment, small business (e.g. private detectives))‏ Info privacy laws may not explicitly require notice (either because no 'personal information and/or 'record' or because not 'solicited' - collecting by ‘observation’)‏ Surveillance laws will often require notice But is collection without notice ‘unfair’?

11. September 200811 Relationship between surveillance & information privacy laws (2)‏ Surveillance laws affect what is ‘fair’, ‘lawful’ and 'non-intrusive' collection Surveillance can easily exceed minimum collection requirements Surveillance laws could be relevant to interpretation of minimality requirements

12. September 200812 Regulation of surveillance in NSW Surveillance which is expressly regulated: Telecommunications interception (by Cth)‏ Private conversations recorded by listening devices Surveillance of employees within the workplace Act previously only covered video surveillance New Act now covers other forms of employee surveillance And, where applicable, by information privacy laws NPPs (by private sector); Cth IPPs (by Cth agencies, including of their own employees) and NSW IPPs (by NSW agencies, including of their own employees)‏

13. September 200813 NSW - Workplace Video Surveillance Act Workplace Video Surveillance Act 1998 (NSW)‏ Workplace Video Surveillance Act 1998 Note: This Act is now repealed, replaced by the 2005 Act See RG 16.3.1. for detailed readingsRG 16.3.1 Covered covert video surveillance of employees in the workplace s4 definition of ‘covert video surveillance’ 3 step test for what is not ‘covert’ (unregulated) - effect is that unless employees are given notice, surveillance will be covert Surveillance agreed for other purposes is not covert Covered closed-circuit TV and other ‘electronic systems for visual monitoring’ ‘Workplace’ had a wide definition Also covered where employer ‘causes’ surveillance to occur

14. September 200814 NSW - Workplace Video Surveillance Act (2)‏ Only allowed if to detect unlawful activity Not allowed re absenteeism or performance monitoring (must use overt surveillance)‏ Magistrate had to authorise covert surveillance Overt surveillance had to observe the Overt Surveillance Code would affect interpretation of relevant IPPs and NPPs

15. September 200815 NSW - Workplace Video Surveillance Act (3) - cases Few cases but they would still be relevant to the new Act: see Harding article Harding article Staal and Western Sydney Area Health Service [2004] NSWIRComm 27 - found 4 breaches: Surveillance before time authorised by Magistrate Was supposed to be limited to ‘staff car park areas’ but extended well beyond (‘workplace’ has a wide meaning)‏ Video not provided to employees within reasonable period of request No report on surveillance provided to Magistrate (s23)‏ Result was that employees reinstated - these factors contributed to procedural unfairness in dismissal [contra casino example] ACI glass case: secret camera in employees dressing room - fine $500 Harper (solicitor): secret camera in female staff toilets - fine $1,056

16. September 200816 NSW - Workplace Surveillance Act Workplace Surveillance Act 2005 (NSW)‏ Workplace Surveillance Act 2005 Extended beyond 1998 Act to cover employee surveillance using ‘camera surveillance’, ‘computer surveillance’ or ‘tracking surveillance” (s3 definitions)‏s3 definitions Employers claim 90% of NSW employers use some such form of surveillance and 80% probably in breach (SMH 7/10/05)‏ Covert surveillance = surveillance not complying with Pt 2 notice requirements (s3) (if covert, requires Pt 4 authority)‏ Pt 2 notice requirements (overt surveillance)‏ Only limit on overt surveillance in this Act Written notice 14 days before surveillance commences, specifyng type, how carried out, from and to when and whether continuous Each form of surveillance has additional requirements (ss11-13)‏

17. September 200817 Workplace Surveillance Act 2005 Workplace Surveillance Act 2005 (NSW) (2)‏ Pt 3 Prohibited surveillance Change rooms or bathrooms prohibited (s15)‏ Employees when not at work prohibited (s16)‏ Use or disclosure of overt surveillance records prohibited except for 4 specified purposes (s18)‏s18 Pt 4 Covert surveillance authorisation Limited to purpose only of establishing unlawful activity of employees while at work; monitoring of work performance, change rooms etc prohibited (s20)‏ Defence (ie no need for authorisation) where surveillance solely for workplace security; records may then be inadmissable for other reasons (s22)‏

18. September 200818 Workplace Surveillance Act 2005 Workplace Surveillance Act 2005 (NSW) (3)‏ Surveillance authority Application is to a Magistrate, with grounds (s23)‏ Grounds must be reasonable, including privacy considerations (ss25-26)‏ Surveillance supervisor designated (s27)‏ Conditions on subsequent actions taken (s29)‏ Employer must report back to Magistrate (s35)‏ Records of covert surveillance require security (s36) and must only be used or disclosed for long list of specified purposes (s37)‏s37 Breaches may lead to prosecution but not to civil actions for damages

19. September 200819 Telecommunications interception Telecommunications (Interception and Access) Act 1979 (Cth) [TIAA] Telecommunications (Interception and Access) Act 1979 See RG 12 T(I) Act issues - at 12.4 & 12.6RG 12 T(I) Act issues s7 - general prohibition of interception of communications ‘passing over a telecommunications system’ Issues remain as to where is the system boundary‏ Generally, not applicable to 'in-house' private networks (would be subject to Surveillance or Listening Device laws)‏

20. September 200820 Telecommunications interception (2)‏ Exceptions: Interception permitted if: Warrant obtained - now obtainable from designated AAT members (and still judges but rarely used)‏ With ‘the knowledge of the person making the communication’ (s6(1)) - often requires both parties to be notified – see Participant Monitoring Guideline 2004Participant Monitoring Guideline 2004 For the operation and maintenance of the system (s7(2))‏

21. September 200821 Telecommunications interception (3)‏ Consequences of illegal interception Offence Civil damages (s107A) against person contravening s7 No reported cases awarding them as yet Safeguards? Limited range of offences for which warrants available (but expanding)‏ Breadth of warrants – expanding (named persons, 'B- party')‏ AGs annual report to Parliament

22. September 200822 Telecommunications interception (4)‏ 2006-07 Annual Report No of warrants issued was 3,287, of which only 7 were withdrawn or refused. (2,934 for 2005-06, 5 withdrawn/refused)‏ Two new categories introduced in 2006: 57 applications for stored communications (emails, SMS etc). 71 applications for 'B-party' warrants (third party non-suspects in communication with suspects)‏

23. September 200823 Surveillance Device laws Historically, a variety of listening device laws covering audio monitoring/recording (other than telephone interception subject to Commonwealth law (TIA)) – generally prohibition, with exceptions, including authorisations for law enforcement etc SCAG/APMC review agreed on national model surveillance legislation to update listening devices and cover other types of surveillance and device (uniform regulation of specific technologies - not quite ‘technology neutral’) Most States have legislated a version of the model law (Commonwealth only authorisation not prohibition, which is effected by State laws)‏

24. September 200824 Surveillance Device laws (2)‏ Model surveillance law only applies to use of devices in private places Public places: 2005 COAG committed to development of a national framework for the use of CCTV for counter- terrorism purposes, including a National Code of Practice for CCTV systems for the mass passenger transport sectorCode of Practice

25. September 200825 Surveillance Devices Act 2004Surveillance Devices Act 2004 (Cth)‏ Four categories of device: data surveillance devices listening devices optical surveillance devices tracking devices Prescribed Federal and State agencies (15 in 2007) can apply for use in connection with specified offences Authorised by Federal judges, magistrates and designated AAT members (and exceptionally, senior public servants)‏ All except data can be used without warrant if access to premises or vehicles with permission

26. September 200826 Surveillance Devices regulation (Cth)‏ TIAA Annual Report 2006-07: 321 warrants issued (mostly to AFP and mostly for multiple devices)‏ 68 tracking devices without warrant Use of listening and tracking devices by the Australian Security Intelligence Organisation (ASIO) is separately regulated under the ASIO Act 1979 (Cth)‏ Aviation Transport Security Act 2004 (Cth): Code for the use of optical surveillance devices at airports and on board aircraft

27. September 200827 NSW - Listening Devices Act 1984Listening Devices Act 1984 See RG 16.3.2. Listening devices. Now repealedRG 16.3.2. Only applied where TIA (Cth) did not ‘Listening device’ covered listening or recording Covered only ‘private’ verbal conversations Intended to be listened to only by the parties Exceptions included Warrant issued (including to private detectives)‏ All parties consent Recordings by one party allowed if ‘reasonably necessary’ to protect their ‘lawful interest’ Very substantial case law: AustLII NoteupAustLII Noteup

28. September 200828 Surveillance Devices Act 2007 (NSW)‏ Surveillance Devices Act 2007 Follows model law Also, for public places: Policy Statement and Guidelines for the Establishment and Implementation of Closed Circuit Television (CCTV) in Public PlacesPolicy Statement and Guidelines

29. September 200829 Victorian Surveillance Devices Act 1999Surveillance Devices Act Follows SCAG model legislation Surveillance devices covered: Use of listening devices and optical surveillance devices (s6, s7); to record private conversation or activity without the consent of each party involved but does not apply where Activities carried on outside a building; OR Circumstances in which parties ought reasonably expect to be observed Use of tracking devices (s8) to record the location of a person/object without that person's knowledge, Use of data surveillance devices(s9) (by law enforcement officers only) to monitor input and output from a computer without the person's knowledge.

30. September 200830 Victorian Surveillance Devices Act 1999 (Vic) (2)‏ See McLeod ‘Sneaky cameras’ - implications for pressSneaky cameras’ - regulates installation, use and maintenance of specified surveillance devices. Requires law enforcement officers to obtain warrants or emergency authorisations for installation and use of surveillance devices; Creates offences relating to the improper installation or use of surveillance devices; Restricts communication and publication of records of private conversations and activities obtained requires secure storage and destruction of records obtained by law enforcement officers.

31. September 200831 Victorian Surveillance Devices Act 1999 (Vic) (3)‏ Few cases as yet - AustLII ‘Noteup’AustLII ‘Noteup’ R v KS & Said [2003] VSC 418 - R v KS & Said Installation of listening device was legal, but statements were held inadmissible as conduct of authorities undermined the right to silence, at least in relation to a juvenile.

32. September 200832 Victoria – Surveillance Law reform Victorian Law Reform Commission: Final Report on Workplace Privacy (2005)‏ Final Report on Workplace Privacy The government has banned surveillance in workplace toilets, changerooms, lactation rooms and washrooms LRC proposals now an input to model national legislation - see Surveillance in Public Places inquiry 2006- ongoing Surveillance in Public Places

33. September 200833 NSW LRC recommendations 2005 Report Approach 2005 Report ‘Technology neutral’ - does not depend on devices Few differences based on location Different approaches to overt and covert Privacy NSW supported but wanted stronger [italics below]; now superceded by Surveillance Devices Act 2007 (NSW)‏ Privacy NSW Overt surveillance principles 1. should not be used to breach an individual's reasonable expectation of privacy [OR must be reasonably necessary for a lawful purpose] 2. must only be undertaken for an acceptable purpose.

34. September 200834 NSW LRC recommendations (2)‏ Overt surveillance principles (cont)‏ 3. must be conducted in a manner which is appropriate for purpose. 4. notice provisions shall identify the surveillance user. 5. Surveillance users must be accountable for their surveillance devices and the consequences of their use. 6. Surveillance users must ensure all aspects of their surveillance system are secure.

35. September 200835 NSW LRC recommendations (3)‏ Overt surveillance principles (continued)‏ 7. Material obtained through surveillance to be used in a fair manner and only for the purpose obtained [specific principle governing disclosures needed] 8. Material obtained through surveillance must be destroyed within a specified period [should specify periods] Breach of overt surveillance principles would lead to civil action for damages or other remedies [Privacy NSW and PPIPA procedures should be main enforcement mechanism]

36. September 200836 NSW LRC recommendations (4)‏ Covert surveillance principles Prior approval of an independent arbiter  If by, or on behalf of, law enforcement officers, to be regulated by a warrants procedure with applications made to "eligible judges" [should only be for serious indictable offences]  If by employers, to be authorised by members of the Industrial Relations Commission. [employer must establish there is good reason for not involving Police]  If conducted in the public interest by anyone else, to be authorised by an appropriate issuing authority (court or a tribunal).  [‘public interest’ should be defined for this context]

37. September 200837 NSW LRC recommendations (5)‏ Covert surveillance principles (continued)‏ If not possible or practicable, may, where appropriate, be obtained retrospectively Act to specify measures for accountability for the conduct of covert surveillance and the use of material obtained as a result Remedies for breach of covert surveillance provisions criminal offence civil action for damages or other appropriate remedies