Skip to main content
Skip to secondary navigation
Menu
Australian Government - Office of the Australian Information Commissioner - Home

Chapter 5: Injunctions

pdfPrintable version111 KB

May 2018

Legislative framework

5.1 An injunction is a Court order directing a person to do a specific thing or, more commonly, to not do a specific thing.

5.2 Both the Privacy Act and the My Health Records Act empower the Commissioner to apply to a federal Court for an injunction against a person. This chapter relates to an injunction application made by the Commissioner.

Injunctions under the Privacy Act

5.3 Section 98 of the Privacy Act empowers the Commissioner (or any other person) to apply to the Federal Court or Federal Circuit Court for an injunction.

5.4 Where a person has engaged, is engaging, or is proposing to engage, in any conduct that constituted or would constitute a contravention of the Privacy Act, the Court may grant an injunction:

  • restraining a person from engaging in the conduct; and
  • if in the Court’s opinion it is desirable to do so, requiring the person to do an act or thing (s 98(1)).

5.5 The Court may also grant an injunction requiring a person to do an act or thing where the person has refused or failed, is refusing or failing, or is proposing to refuse or fail, to do that act or thing where that refusal or failure was, is, or would be a contravention of the Privacy Act (s 98(2)).

5.6 Where an application is made to a Court for an injunction under s 98, the Court may, if in the Court’s opinion it is desirable to do so, grant an interim injunction restraining a person from engaging in conduct pending the determination of the application (s 98(3)).

5.7 ‘Person’ in s 98 includes natural persons, bodies politic, corporations, companies and bodies corporate.[1]

Injunctions under the My Health Records Act

5.8 Under s 81 of the My Health Records Act, the Commissioner (or the My Health Record System Operator[2]) may apply to a Court for an injunction. Section 81 of the My Health Records Act triggers the provisions of Part 7 of the Regulatory Powers Act which deals with obtaining, imposing and discharging injunctions to enforce legislative provisions.

5.9 If a person has engaged, is engaging or is proposing to engage in any conduct that constituted, constitutes or would constitute a contravention of the My Health Records Act, a Court may grant an injunction:

  • restraining the person from engaging in the conduct; and
  • if in the Court’s opinion it is desirable to do so, requiring the person to do any act or thing.

5.10 The Court may also grant an injunction requiring a person to do an act or thing if the person has refused or failed, is refusing or failing, or is proposing to refuse or fail, to do that act or thing and that refusal or failure was, is, or would be a contravention of the My Health Records Act.

5.11 Under the My Health Records Act, a ‘Court’ means the Federal Court of Australia, the Federal Circuit Court, or a court of a State or Territory that has jurisdiction in relation to matters arising under the My Health Records Act (s 81(3)).

5.12 If an application is made to a Court for an injunction under s 81 of the My Health Records Act (see also Part 7 of the Regulatory Powers Act), the Court may grant an interim injunction restraining a person from engaging in conduct or requiring a person to do a thing, before considering the application and pending the determination of the application. See below for further information about interim injunctions.

5.13 ‘Person’, for the purpose of s 81 of the My Health Records Act, includes natural persons, bodies politic, corporations, companies and bodies corporate.[3]

Which Act to use?

5.14 Conduct that interferes, or would interfere, with an individual’s privacy but does not relate to a contravention of the My Health Records Act is governed by the Privacy Act, and the Commissioner may apply to a Court for an injunction under that Act.

5.15 Conduct that contravenes certain provisions of the My Health Records Act are deemed by s 73 of that Act to be an interference with an individual’s privacy for the purposes of the Privacy Act. Depending on the circumstances, the Commissioner may apply to a Court in relation to conduct that contravenes or would contravene certain provisions of the My Health Records Act, for an injunction under the My Health Records Act or the Privacy Act.

5.16 Section 81 of the My Health Records Act also empowers the My Health Record System Operator to make an application for an injunction. The OAIC may consult with the System Operator when investigating a complaint and considering whether to apply for an injunction, in line with the Agreement for information sharing and complaint referral relating to the personally controlled electronic health (eHealth) system between the OAIC and the System Operator.[4]

Back to Contents

Purpose and key features of an injunction

5.17 Injunctions are an important enforcement tool for compelling a person to modify their behaviour in order to prevent them from contravening, or from continuing to contravene, the Privacy Act or the My Health Records Act.

5.18 Generally, an injunction may be appropriate if the conduct:

  • is serious or has had, or is likely to have, serious or extensive adverse consequences
  • is systemic or poses ongoing compliance or enforcement issues
  • is deliberate or reckless or where the entity involved is not being cooperative, or
  • raises significant concerns of public interest.

5.19 The Commissioner may seek an injunction on its own or with civil penalty proceedings, or other enforcement action.

Interim injunctions

5.20 The OAIC may seek and obtain a temporary injunction (known as an ‘interim injunction’) on an urgent basis pending the Court’s determination of an application for a permanent injunction under s 98 of the Privacy Act or s 81 of the My Health Records Act (see also Part 7 of the Regulatory Powers Act). An interim injunction may prevent further harm or maintain the status quo. The interim injunction will be effective from the time the interim injunction is granted to the time that the Court’s final decision is made.

5.21 The OAIC may seek an interim injunction on an ‘ex parte’ basis, meaning that the Court may consider whether to make the order without the respondent participating. Ex parte interim injunctions will generally be sought by the OAIC at the start of Court proceedings and in urgent circumstances, where an injunction is required as soon as possible and it is not practicable for the OAIC to first contact the respondent. This type of injunction will usually only be effective for a short period – typically no more than one week. After this period, the OAIC will have to participate in a further Court hearing with the respondent present.

5.22 Under the Privacy Act, the Court can grant an interim injunction restraining a person from engaging in conduct only (s 98(3)). However, under the My Health Records Act, the Court has a general power to grant interim injunctions– meaning that an interim injunction compelling a person to do a particular act or thing may also be possible depending upon the circumstances.

5.23 To obtain an interim injunction under s 98(3) of the Privacy Act or s 81 of the My Health Records Act, the Commissioner must establish that:

  • there is a serious question to be tried in relation to the facts asserted to support the injunction application
  • the balance of convenience favours granting an injunction, in that the harm or inconvenience caused by the refusal of an injunction outweighs the harm or inconvenience that the respondent would suffer if the injunction were granted, and
  • it is desirable in all the circumstances to grant the interim injunction.

5.24 Factors relevant to the balance of convenience include:

  • the strength of the Commissioner’s case
  • the purpose served by the interim injunction (for example, is it designed to prevent the respondent from taking an action that would render granting a final injunction futile)
  • the effect of the injunction on the respondent and any third parties
  • the availability of alternative remedies
  • any delay in making the application, and
  • any undertakings offered by the respondent to cease (or not to commence) the relevant conduct.[5]

5.25 Where the Commissioner is applying for an ex parte interim injunction, the Commissioner will also be subject to a special ethical obligation usually described as the ‘duty of utmost disclosure’. This means that the Commissioner must disclose all factors relevant to a consideration of whether to grant an interim injunction – especially those factors which go against granting an injunction.

5.26 This duty is treated most seriously by the Court, and a failure to comply will normally result in a discharge of the injunction, with costs ordered against the applicant. A failure by the Commissioner to disclose relevant factors would also be a breach of the Commonwealth’s obligation to act as a model litigant under the Legal Services Directions.

Permanent injunctions

5.27 For a permanent injunction, the Commissioner must establish on the balance of probabilities that the facts asserted to support the injunction are made out.

5.28 The power to grant an injunction is a discretionary power and the Court will also consider whether it is desirable in all the circumstances to exercise that power having regard to the scope and purpose of the relevant Act.

Injunctions restraining a person from engaging in conduct

5.29 To grant an injunction restraining a person from engaging in conduct, the Court must be satisfied that:

  • a person has engaged in conduct in contravention of either the Privacy Act or the My Health Records Act, or
  • if an injunction is not granted, it is likely that the person will engage in conduct of that kind in contravention of either the Privacy Act or the My Health Records Act.

5.30 If the Court is satisfied that the person has engaged in conduct in breach of the Privacy Act or the My Health Records Act, the Commissioner is not required to establish that the person intends to engage again, or to continue to engage, in conduct of that kind (s 98(5)(a) of the Privacy Act and s 81 of the My Health Records Act (see also Part 7 of the Regulatory Powers Act)).

5.31 If the Court is satisfied that a person is likely to engage in conduct in contravention of either Act if an injunction is not granted, the Commissioner is not required to establish:

  • that the person has previously engaged in conduct of that kind, and
  • that there is an imminent danger of substantial damage to any person if the first mentioned person were to engage in conduct of that kind (s 98(5)(b) of the Privacy Act and s 81 of the My Health Records Act (see also Part 7 Regulatory Powers Act)).

5.32 Where the Court grants an injunction restraining a person from engaging in conduct that is, or would be, a contravention of the Privacy Act or the My Health Records Act, the Court may also make an order requiring the person to do any act or thing, if it is in the Court’s opinion desirable to do so (s 98(1)(b) of the Privacy Act and s 81 of the My Health Records Act (see also Part 7 of the Regulatory Powers Act)).

5.33 For example, a Court may grant a permanent injunction restraining a person from collecting certain information about consumers and requiring them to put in place specified risk management practices to prevent similar breaches from occurring again.

Injunctions requiring a person to do a particular act or thing

5.34 To grant an injunction requiring a person to do a particular act or thing, the Court must be satisfied that:

  • a person has refused or failed to do an act or thing in contravention of either the Privacy Act or the My Health Records Act; or
  • if an injunction is not granted, it is likely that the person will refuse or fail to do an act or thing in contravention of either the Privacy Act or the My Health Records Act.

5.35 If the Court is satisfied that a person has refused or failed to do a particular act or thing, the Commissioner is not required to establish that the person intends to refuse or fail again, or to continue to refuse or fail, to do that act or thing (s 98(6)(a) of the Privacy Act and s 81 of the My Health Records Act (see also Part 7 of the Regulatory Powers Act)).

5.36 If the Court is satisfied that a person is likely to refuse or fail to do a particular act or thing, the Commissioner does not have to establish:

  • that the person has previously refused or failed to do that act or thing, and
  • that there is an imminent danger of substantial damage to any person if the first mentioned person were to refuse or fail to do that act or thing

(s 98(6)(b) of the Privacy Act and s 81 of the My Health Records Act (see also Part 7 of the Regulatory Powers Act)).

5.37 For example, a Court may grant a mandatory injunction requiring a person to correct personal information it holds about individuals.

The content of injunctions

5.38 The form of any injunction sought must be certain and capable of enforcement. It must be clear and unambiguous to the affected person, and to the Court, what it is that they must do or not do.

5.39 The Court will not grant an injunction that simply requires a person to ‘comply with the Act’. An injunction must set out the specific acts that the person must do or not do.

5.40 An injunction should not prohibit conduct falling outside the boundaries of s 98 of the Privacy Act or s 81 of the My Health Records Act. That is, an injunction cannot operate on conduct that is not related to ensuring compliance with the Privacy Act or My Health Records Act.

Back to Contents

Procedural steps in seeking an injunction

5.41 When seeking an injunction, the OAIC will generally use the following steps:

  • Where the OAIC becomes aware that an entity might have engaged, be engaging, or proposes to engage in conduct that would contravene the Privacy Act or My Health Records Act, the OAIC will make preliminary inquiries about the matter.
  • The OAIC will review the matter against the Privacy regulatory action policy (including the factors set out in paragraph 38) / s 7.1 of the My Health Records Enforcement Guidelines, as applicable, as well as the additional factors outlined above, in paragraph 18, to assess whether seeking an injunction is an appropriate regulatory response, either by itself or in conjunction with other remedies.
  • Where an injunction is identified as an appropriate regulatory response in the circumstances, the OAIC will assess the matter to determine whether enough admissible evidence and arguments exist to satisfy the Court of the matters it must consider in determining whether to grant an injunction. The amount and type of evidence required to support an application for an injunction will depend on the type of injunction being sought (see above). External legal counsel may be briefed at this time.
  • Where the available evidence and arguments are considered sufficient, the Commissioner will consider and decide whether to commence proceedings. To make this decision, the Commissioner will refer to either the Privacy regulatory action policy (including the factors set out in paragraph 38) or s 11.3 of the My Health Records Enforcement Guidelines as applicable. Where proceedings are to be commenced, external legal counsel will usually be engaged to run the matter.
  • The appropriate Court documents to initiate proceedings will be prepared and lodged with the Court, and served on the respondent entity.
    • Generally, only persons who are parties to the legal proceedings in which an injunction is granted will be bound by the injunction. It is important to ensure that all persons the Commissioner seeks to bind by an injunction are joined as respondents in the proceedings.
    • This application must generally be accompanied by a supporting affidavit of the Commissioner, setting out:
      • the conduct, refusals or failures the Commissioner considers is, or would be, a breach of the Privacy Act or the My Health Records Act
      • the evidence on which the Commissioner bases this view, and
      • the specific orders that the Commissioner is seeking from the Court.
    • In very urgent circumstances, including where a matter is heard on an ex parte basis, (such as where the need for an injunction becomes apparent a matter of hours before the conduct is likely to occur), the Commissioner may provide the above information orally at hearing.
  • Following receipt of the Commissioner’s application, the Court will set down a time to hear the application for an injunction.
  • The OAIC will pursue the application in accordance with its model litigant obligations, any relevant Court rules and procedures, and any directions or orders issued by the Court.
  • Following judgment in the matter, the OAIC will generally publicly communicate the outcome of the proceedings.
  • If the OAIC is dissatisfied with the Court’s decision (for example, if the Court refused to grant an injunction), the OAIC may consider the possible grounds for appeal and whether or not to institute appeal proceedings. In making this decision, the OAIC will act in accordance with its model litigant obligations.
  • If the respondent appeals the decision, the OAIC will participate in the appeal proceedings and will act in accordance with its model litigant obligations.

Back to Contents

After an injunction has been granted

5.42 The Court may discharge or vary an injunction granted under s 98 of the Privacy Act or s 81 of the My Health Records Act (see also Part 7 of the Regulatory Powers Act).

5.43 If a person who is the subject of an injunction breaches the injunction, they may be held in contempt of Court, which is punishable by fines and/or imprisonment.

5.44 Where the OAIC believes that a respondent has breached an injunction, the OAIC will generally first bring suspected or actual non-compliance to the attention of the respondent and seek a response. This notification and response may resolve the breach.

5.45 If the breach remains unresolved, the OAIC may then consider whether it would be appropriate to bring proceedings for contempt of Court. This process requires the OAIC to apply to the Court, supported by evidence and submissions. The burden of proof for contempt proceedings is the criminal standard: the breach must be proven beyond reasonable doubt. Legal advice should be sought before any decision is made to bring contempt proceedings.

Back to Contents

Publication

5.46 Generally, the OAIC will publicly communicate the following information in connection with an injunction application:

  • that proceedings seeking an injunction against a particular respondent have been initiated[6]
  • the outcome of the injunction proceedings
  • where an injunction is granted, the orders made by the Court (subject to any limitations placed on the publication of the orders by the Court)
  • the lodgement of appeal proceedings by either the OAIC or the respondent, and
  • the outcome of any appeal proceedings.

5.47 Where an interim injunction has been granted, the OAIC will take care in its communications to avoid any suggestion that a finding has been made that a person has breached the Act. By their nature interim injunctions are granted without the Court having yet decided about whether there has been a breach of the Act.

5.48 Where a Court grants an injunction, the OAIC will, on its website <www.oaic.gov.au>, either publish, or provide a link to, the orders made by the Court. Where the Court has placed limitations on the publication of the orders, the OAIC may publish a redacted version of the orders, or a summary of the orders.

5.49 In addition, the OAIC may publicly communicate the fact that the respondent has breached the injunction, and any fine or other punishment metered to the respondent in connection with that breach.

Back to Contents

Footnotes

[1] Section 2C of the Acts Interpretation Act 1901 and s 6(4) of the Privacy Act.

[2] ‘System Operator’ is defined in s 14 of the My Health Records Act.

[3] Section 2C of the Acts Interpretation Act 1901.

[4] The agreement can be viewed at: <https://www.oaic.gov.au/about-us/corporate-information/mous/oaic-system-operator-information-sharing-agreement>.

[5] See Australian Broadcasting Corporation v O’Neill (2006) 227 CLR 57; Castlemain Tooheys Ltd v South Australia (1986) 161 CLR 148.

[6] The initiation of proceedings will not be publicly communicated in the event an ex parte injunction is being sought (an injunction granted by a Court without notice to the respondent who will be bound by the injunction).

Back to Contents