Office of the Australian Information Commissioner - Home

Australian Government - Office of the Australian Information Commissioner
Australian Government - Office of the Australian Information Commissioner

Main menu

Chapter 5: Injunctions

pdfPrintable version174.07 KB

Legislative framework

5.1 An injunction is a court order directing a person to do a specific thing or, more commonly, to not do a specific thing.

5.2 Both the Privacy Act and the Personally Controlled Electronic Health Records Act 2012 (Cth)(PCEHR Act) empower the Commissioner to apply to a federal court for an injunction against a person. This chapter relates to an injunction application made by the Commissioner.

Injunctions under the Privacy Act

5.3 Section 98 of the Privacy Act empowers the Commissioner (or any other person) to apply to the Federal Court or Federal Circuit Court for an injunction.

5.4 Where a person has engaged, is engaging, or is proposing to engage, in any conduct that constituted or would constitute a contravention of the Privacy Act, the Court may grant an injunction:

  • restraining a person from engaging in the conduct; and
  • if in the Court’s opinion it is desirable to do so, requiring the person to do an act or thing (s 98(1)).

5.5 The Court may also grant an injunction requiring a person to do an act or thing where the person has refused or failed, is refusing or failing, or is proposing to refuse or fail, to do that act or thing where that refusal or failure was, is, or would be a contravention of the Privacy Act (s 98(2)).

5.6 Where an application is made to a court for an injunction under s 98, the Court may, if in the Court’s opinion it is desirable to do so, grant an interim injunction restraining a person from engaging in conduct pending the determination of the application (s 98(3)).

5.7 ‘Person’ in s 98 includes natural persons, bodies politic, corporations, companies and bodies corporate.[1]

Injunctions under the PCEHR Act

5.8 Section 96 of the PCEHR Act empowers the Commissioner (or the PCEHR System Operator[2]) to apply to a court for an injunction.

5.9 If a person has engaged, is engaging or is proposing to engage in any conduct that constituted, constitutes or would constitute a contravention of the PCEHR Act, a Court may grant an injunction:

  • restraining the person from engaging in the conduct; and
  • if in the Court’s opinion it is desirable to do so, requiring the person to do any act or thing (s 96(1)).

5.10 The Court may also grant an injunction requiring a person to do an act or thing if the person has refused or failed, is refusing or failing, or is proposing to refuse or fail, to do that act or thing and that refusal or failure was, is, or would be a contravention of the PCEHR Act (s 96(2)).

5.11 Under the PCEHR Act, a ‘Court’ means the Federal Court of Australia, the Federal Circuit Court, or a court of a State or Territory that has jurisdiction in relation to matters arising under the PCEHR Act (s 5).

5.12 If an application is made to a Court for an injunction under this section, the Court may, if in the Court’s opinion it is desirable to do so, grant an interim injunction before considering the application, pending the determination of the application (s 96(3)).

5.13 ‘Person’ in s 96 includes natural persons, bodies politic, corporations, companies and bodies corporate.[3]

Which Act to use?

5.14 Conduct that interferes, or would interfere, with an individual’s privacy but does not relate to a contravention of the PCEHR Act is governed by the Privacy Act, and the Commissioner may apply to a court for an injunction under that Act.

5.15 Conduct that contravenes certain provisions of the PCEHR Act are breaches of the PCEHR Act and are also deemed by s 73 of that Act to be an interference with an individual’s privacy for the purposes of the Privacy Act. Depending on the circumstances, the Commissioner may apply to a court in relation to conduct that contravenes or would contravene certain provisions of the PCEHR Act, for an injunction under the PCEHR Act or the Privacy Act.

5.16 Section 96 of the PCEHR Act also empowers the PCEHR System Operator to make an application for an injunction. The Office of the Australian Information Commissioner (OAIC) may consult with the System Operator when investigating a complaint and considering whether to apply for an injunction, in line with the Agreement for information sharing and complaint referral relating to the personally controlled electronic health (eHealth) record system[4] between the OAIC and the System Operator.

Back to Contents

Purpose and key features of an injunction

5.17 Injunctions are an important enforcement tool for compelling a person to modify their behaviour in order to prevent them from contravening, or from continuing to contravene, the Privacy Act or the PCEHR Act.

5.18 Generally, an injunction may be appropriate in circumstances where the conduct:

  • is serious or has had, or is likely to have, serious or extensive adverse consequences
  • is systemic or poses ongoing compliance or enforcement issues
  • is deliberate or reckless or where the entity involved is not being cooperative, or
  • raises significant concerns of public interest.

5.19 The Commissioner may seek an injunction on its own or in conjunction with civil penalty proceedings, or other enforcement action.

Interim injunctions

5.20 The OAIC may seek and obtain a temporary injunction (known as an ‘interim injunctions’) on an urgent basis pending the Court’s determination of an application for a permanent injunction under s 98 of the Privacy Act or s 96 of the PCEHR Act. The purpose of an interim injunction is to prevent further harm or maintain the status quo. The interim injunction will be effective from the time the interim injunction is granted to the time that the Court’s final decision is made.

5.21 The OAIC may seek an interim injunction on an ‘ex parte’ basis, meaning that the Court may consider whether to make the order without the respondent participating in the hearing. Ex parte interim injunctions will generally be sought by the OAIC at the start of court proceedings and in urgent circumstances, where an injunction is required as soon as possible and it is not practicable for the OAIC to first contact the respondent. This type of injunction will usually only be effective for a short period of time – typically no more than one week. After this period, the OAIC will be required to participate in a further court hearing with the respondent present.

5.22 Under the Privacy Act, the Court can grant an interim injunction restraining a person from engaging in conduct only (s 98(3)). However, under the PCEHR Act, the Court has a general power to grant interim injunctions (s 96(3)) – meaning that an interim injunction compelling a person to do a particular act or thing may also be possible depending upon the circumstances.

5.23 To obtain an interim injunction under s 98(3) of the Privacy Act or s 96(3) of the PCEHR Act, the Commissioner must establish that:

  • there is a serious question to be tried in relation to the facts asserted in support of the injunction application
  • the balance of convenience favours the granting of an injunction, in that the harm or inconvenience that would be caused by the refusal of an injunction outweighs the harm or inconvenience that the respondent would suffer if the injunction were granted, and
  • it is desirable in all the circumstances to grant the interim injunction.

5.24 Factors relevant to the balance of convenience include:

  • the strength of the Commissioner’s case
  • the purpose that would be served by the interim injunction (for example, is it designed to prevent the respondent from taking an action that would render the granting of a final injunction futile)
  • the effect of the injunction on the respondent and any third parties
  • the availability of alternative remedies
  • any delay in making the application, and
  • any undertakings offered by the respondent to cease (or not to commence) the relevant conduct.[5]

5.25 Where the Commissioner is applying for an ex parte interim injunction, the Commissioner will also be subject to a special ethical obligation usually described as the ‘duty of utmost disclosure’. This means that the Commissioner must disclose all factors relevant to a consideration of whether to grant an interim injunction – especially those factors which go against the granting of an injunction.

5.26 This duty is treated most seriously by the court, and a failure to comply will normally result in a discharge of the injunction, with costs ordered against the applicant. A failure by the Commissioner to disclose relevant factors would also be a breach of the Commonwealth’s obligation to act as a model litigant under the Legal Services Directions.

Permanent injunctions

5.27 For a permanent injunction, the Commissioner is required to establish on the balance of probabilities that the facts asserted to support the injunction are made out.

5.28 The power to grant an injunction is a discretionary power and the Court will also consider whether it is desirable in all the circumstances to exercise that power having regard to the scope and purpose of the relevant Act.

Injunctions restraining a person from engaging in conduct

5.29 To grant an injunction restraining a person from engaging in conduct, the Court must be satisfied that:

  • a person has engaged in conduct in contravention of either the Privacy Act or the PCEHR Act, or
  • if an injunction is not granted, it is likely that the person will engage in conduct of that kind in contravention of either the Privacy Act or the PCEHR Act.

5.30 If the Court is satisfied that the person has engaged in conduct in breach of the Privacy Act or the PCEHR Act, the Commissioner is not required to establish that the person intends to engage again, or to continue to engage, in conduct of that kind (s 98(5)(a) of the Privacy Act and s 96(5)(a) of the PCEHR Act).

5.31 If the Court is satisfied that a person is likely to engage in conduct in contravention of either Act if an injunction is not granted, the Commissioner is not required to establish:

  • that the person has previously engaged in conduct of that kind, and
  • that there is an imminent danger of substantial damage to any person if the first mentioned person were to engage in conduct of that kind.

(s 98(5)(b) of the Privacy Act and s 96(5)(b) of the PCEHR Act).

5.32 Where the Court grants an injunction restraining a person from engaging in conduct that is, or would be, a contravention of the Privacy Act or the PCEHR Act, the Court may also make an order requiring the person to do any act or thing, if it is in the Court’s opinion desirable to do so (s 98(1)(b) of the Privacy Act and s 96(1)(b) of the PCEHR Act).

5.33 For example, a court may grant a permanent injunction restraining a person from collecting certain information about consumers and requiring them to put in place specified risk management practices to prevent similar breaches from occurring again.

Injunctions requiring a person to do a particular act or thing

5.34 To grant an injunction requiring a person to do a particular act or thing, the Court must be satisfied that:

  • a person has refused or failed to do an act or thing in contravention of either the Privacy Act or the PCEHR Act; or
  • if an injunction is not granted, it is likely that the person will refuse or fail to do an act or thing in contravention of either the Privacy Act or the PCEHR Act.

5.35 If the Court is satisfied that a person has refused or failed to do a particular act or thing, the Commissioner is not required to establish that the person intends to refuse or fail again, or to continue to refuse or fail, to do that act or thing (s 98(6)(a) of the Privacy Act and s 96(6)(a) of the PCEHR Act).

5.36 If the Court is satisfied that a person is likely to refuse or fail to do a particular act or thing, the Commissioner is not required to establish:

  • that the person has previously refused or failed to do that act or thing, and
  • that there is an imminent danger of substantial damage to any person if the first mentioned person were to refuse or fail to do that act or thing

(s 98(6)(b) of the Privacy Act and s 96(6)(b) of the PCEHR Act).

5.37 For example, a court may grant a mandatory injunction requiring a person to correct personal information it holds about individuals.

The content of injunctions

5.38 The form of any injunction sought must be certain and capable of enforcement. It must be clear and unambiguous to the affected person, and to the Court, what it is that they are required to do or not do.

5.39 The Court will not grant an injunction that simply requires a person to ‘comply with the Act’. An injunction must set out the specific acts that the person is required to do or not do.

5.40 An injunction should not prohibit conduct falling outside the boundaries of s 98 of the Privacy Act or s 96 of the PCEHR Act. That is, an injunction cannot operate on conduct that is not related to ensuring compliance with the Privacy Act or PCEHR Act.

Back to Contents

Procedural steps in seeking an injunction

5.41 When seeking an injunction, the OAIC will generally use the following process:

  • Where the OAIC becomes aware that an entity might have engaged, be engaging, or proposes to engage in conduct that would contravene the Privacy Act or PCEHR Act, the OAIC will make preliminary inquiries about the matter.

  • The OAIC will review the matter against either the Privacy regulatory action policy (including the factors set out in paragraph 38) or the PCEHR (Information Commissioner Enforcement Powers) Guidelines, as applicable, as well as the additional factors outlined above, in paragraph 18, to assess whether seeking an injunction is an appropriate regulatory response, either by itself or in conjunction with other remedies.

  • Where an injunction is identified as an appropriate regulatory response in the circumstances, the OAIC will assess the matter to determine whether or not sufficient admissible evidence and arguments exist to satisfy the Court of the matters it must consider in determining whether to grant an injunction. The amount and type of evidence required to support an application for an injunction will depend on the type of injunction being sought (see above). External legal counsel may be briefed at this time.

  • Where the available evidence and arguments are considered sufficient, the Commissioner will consider and decide whether to commence proceedings. To make this decision, the Commissioner will refer to either the Privacy regulatory action policy (including the factors set out in paragraph 38) or the PCEHR (Information Commissioner Enforcement Powers) Guidelines as applicable. Where proceedings are to be commenced, external legal counsel will usually be engaged to run the matter.

  • The appropriate court documents to initiate proceedings will be prepared and lodged with the court, and served on the respondent entity.

    • Generally, only persons who are parties to the legal proceedings in which an injunction is granted will be bound by the injunction. As such, it is important to ensure that all persons the Commissioner seeks to bind by an injunction are joined as respondents in the proceedings.

    • This application would generally need to be accompanied by a supporting affidavit of the Commissioner, setting out:

      • the conduct, refusals or failures the Commissioner considers is, or would be, a breach of the Privacy Act or the PCEHR Act

      • the evidence on which the Commissioner bases this view, and

      • the specific orders that the Commissioner is seeking from the court.

    • In very urgent circumstances, including where a matter is heard on an ex parte basis, (such as where the need for an injunction becomes apparent a matter of hours before the relevant conduct is likely to occur), the Commissioner may be able to provide the above information orally at hearing.

  • Following receipt of the Commissioner’s application, the Court will set down a time to hear the application for an injunction.

  • The OAIC will pursue the application in accordance with its model litigant obligations, any relevant court rules and procedures, and any directions or orders issued by the court.

  • Following judgment in the matter, the OAIC will generally publicly communicate the outcome of the proceedings.

  • If the OAIC is dissatisfied with the court’s decision (for example, if the court refused to grant an injunction), the OAIC may consider the possible grounds for appeal and whether or not to institute appeal proceedings. In making this decision, the OAIC will act in accordance with its model litigant obligations.

  • If the respondent appeals the decision, the OAIC will participate in the appeal proceedings and will act in accordance with its model litigant obligations.

Back to Contents

After an injunction has been granted

5.42 The Court may discharge or vary an injunction granted under s 98 of the Privacy Act or s 96 of the PCEHR Act (s 98(4) and s 96(4)).

5.43 If a person who is the subject of an injunction breaches the injunction, they may be held in contempt of court, which is punishable by fines and/or imprisonment.

5.44 Where the OAIC believes that a respondent has breached the terms of an injunction, the OAIC will generally first bring the issue of suspected or actual non-compliance to the attention of the respondent and seek a response. This notification and response may be sufficient to resolve the breach.

5.45 If the breach remains unresolved, the OAIC may then consider whether it would be appropriate to bring proceedings for contempt of court. This process requires the OAIC to make a formal application to the court, supported by evidence and submissions. The burden of proof for contempt proceedings is the criminal standard: the breach must be proven beyond reasonable doubt. Legal advice should be sought before any decision is made to bring contempt proceedings.

Back to Contents

Publication

5.46 Generally, the OAIC will publicly communicate the following information in connection with an injunction application:

  • the fact that proceedings seeking an injunction against a particular respondent have been initiated[6]
  • the outcome of the injunction proceedings
  • where an injunction is granted, the orders made by the court (subject to any limitations placed on the publication of the orders by the Court)
  • the lodgement of appeal proceedings by either the OAIC or the respondent, and
  • the outcome of any appeal proceedings.

5.47 Where an interim injunction has been granted, the OAIC will take care in its communications to avoid any suggestion that a finding has been made that a person has breached the Act. By their nature interim injunctions are granted without the Court having yet made a decision about whether there has been a breach of the Act.

5.48 Where a court grants an injunction, the OAIC will, on its website <www.oaic.gov.au>, either publish, or provide a link to, the orders made by the court. Where the court has placed limitations on the publication of the orders, the OAIC may publish a redacted version of the orders, or a summary of the orders.

5.49 In addition, the OAIC may publicly communicate the fact that the respondent has breached the injunction, and any fine or other punishment given to the respondent in connection with that breach.

Back to Contents

Footnotes

[1] Section 2C of the Acts Interpretation Act 1901 and s 6(4) of the Privacy Act.

[2] ‘System Operator’ is defined in s 14 of the PCEHR Act.

[3] Section 2C of the Acts Interpretation Act 1901.

[4] <www.oaic.gov.au/about-us/corporate-information/memorandums-of-understanding/oaic-system-operator-information-sharing-agreement>

[5] See Australian Broadcasting Corporation v O’Neill (2006) 227 CLR 57; Castlemain Tooheys Ltd v South Australia (1986) 161 CLR 148.

[6] The initiation of proceedings will not be publicly communicated in the event an ex parte injunction is being sought (an injunction granted by a court without notice to the respondent who will be bound by the injunction).

Back to Contents