Information privacy principle 1 requires that ‘the information is collected for a lawful purpose connected with a function or activity of the agency, and the collection of information is necessary for that purpose’. Flying a drone recreationally is not an unlawful purpose, but it is not clear that collection of personal information by way of imagery is necessary for that purpose. Further, personal information may be collected incidentally when a drone is collecting imagery of an entirely different subject, and it is unclear whether this would contravene this principle.
Information privacy principle 4 requires, inter alia, that personal information shall not be collected by an agency ‘by means that, in the circumstances of the case … intrude to an unreasonable extent upon the personal affairs of the individual concerned’. Whereas intrusion on seclusion requires the intrusion to be ‘highly offensive’, the Privacy Act merely requires the collection of information to intrude to ‘an unreasonable extent’. The Office of the Privacy Commissioner notes that it is almost certainly unreasonably intrusive to capture imagery of ‘a person’s private front or back yard or any other place where they are likely to expect privacy’ (Privacy Commissioner, 2009, p.13), a position upheld in Armfield v Naughton.
The Australian sunbathing incident (Panahi, 2014) is illustrative of some of the difficulties faced in applying the Privacy Act to drones: real estate photography is a lawful purpose, but it is unclear whether the use of a drone to collect that imagery intrudes to an unreasonable extent on the privacy of a person in a neighbouring property. However, there may be an arguable case for an unreasonable intrusion when imagery is deliberately collected about an individual or property but consent has not been obtained, such as occurred in Armfield v Naughton.
Information privacy principle 6 requires that where an agency holds personal information in a form that can be readily retrieved, the individual concerned has a right to obtain confirmation of whether information is held and to access that information (i.e. view the footage that pertains to the individual). However, enforcing that right may be difficult, as it may be difficult to identify the drone operator.
In sum, footage deliberately collected without permission of someone’s front or backyard is likely to breach at least one information privacy principle and thus might be an ‘interference with privacy’, but the status of information collected incidentally to a lawful purpose is unclear.
Crimes Act and Summary Offences Act
Part 9A of the Crimes Act 1961 creates a number of ‘crimes against personal privacy’, including interception of private communications, disclosure of private communications unlawfully intercepted, and making, possessing and distributing intimate visual recordings. An intimate visual recording is one made without the knowledge or consent of the person who is the subject of the recording, where the recording is of a person who is in a place that would reasonably be expected to provide privacy, and the person is engaged in an activity of an intimate or personal nature, or the recording is made from under a person’s clothing. Such conduct must be intentional or reckless. Of note, an intimate visual recording can be made and transmitted in real time without retention or storage.
The prohibition against intimate visual recordings has potential application in some of the more extreme situations that might be envisaged involving drones. In the Australian sunbathing case, for example, the woman was in a place (a fenced backyard) that would reasonably be expected to provide privacy, and her state of dress meets the test in section 216G of the act. An important question is whether the conduct was intentional or reckless.
sUAS Guide / Q3 Update, October 2016 25