Chapter 6: Injunctions

Legislative framework

6.1 An injunction is a Court order directing a person to do a specific thing or, more commonly, to not do a specific thing.

6.2 The Privacy Act, the My Health Records Act and the Competition and Consumer Act empower the Commissioner to apply to a federal Court for an injunction against a person. This chapter relates to an injunction application made by the Commissioner.

Injunctions under the Privacy Act

6.3 Section 80W of the Privacy Act with Part 7 of the Regulatory Powers Act empowers the Commissioner (or any other person) to apply to the Federal Court or Federal Circuit Court for an injunction.

6.4 Where a person has engaged, is engaging, or is proposing to engage, in any conduct that constituted or would constitute a contravention of the Privacy Act, the Court may grant an injunction:

• restraining a person from engaging in the conduct; and
• if in the Court’s opinion it is desirable to do so, requiring the person to do an act or thing (s 121(1) of the Regulatory Powers Act).

6.5 The Court may also grant an injunction requiring a person to do an act or thing where the person has refused or failed, is refusing or failing, or is proposing to refuse or fail, to do that act or thing where that refusal or failure was, is, or would be a contravention of the Privacy Act (s 121(2) of the Regulatory Powers Act).

6.6 Where an application is made to a Court for an injunction under s 80W, the Court may, if in the Court’s opinion it is desirable to do so, grant an interim injunction restraining a person from engaging in conduct pending the determination of the application (s 122 of the Regulatory Powers Act).

6.7 ‘Person’ in Part 7 of the Regulatory Powers Act includes natural persons, bodies politic, corporations, companies and bodies corporate.[1]

Injunctions under the My Health Records Act

6.8 Under s 81 of the My Health Records Act, the Commissioner (or the My Health Record System Operator[2]) may apply to a Court for an injunction. Section 81 of the My Health Records Act triggers the provisions of Part 7 of the Regulatory Powers Act which deals with obtaining, imposing and discharging injunctions to enforce legislative provisions.

6.9 If a person has engaged, is engaging or is proposing to engage in any conduct that constituted, constitutes or would constitute a contravention of the My Health Records Act, a Court may grant an injunction:

• restraining the person from engaging in the conduct; and
• if in the Court’s opinion it is desirable to do so, requiring the person to do any act or thing.

6.10 The Court may also grant an injunction requiring a person to do an act or thing if the person has refused or failed, is refusing or failing, or is proposing to refuse or fail, to do that act or thing and that refusal or failure was, is, or would be a contravention of the My Health Records Act.

6.11 Under the My Health Records Act, a ‘Court’ means the Federal Court of Australia, the Federal Circuit Court, or a court of a State or Territory that has jurisdiction in relation to matters arising under the My Health Records Act (s 81(3)).

6.12 If an application is made to a Court for an injunction under s 81 of the My Health Records Act (see also Part 7 of the Regulatory Powers Act), the Court may grant an interim injunction restraining a person from engaging in conduct or requiring a person to do a thing, before considering the application and pending the determination of the application. See below for further information about interim injunctions.

6.13 ‘Person’, for the purpose of s 81 of the My Health Records Act, includes natural persons, bodies politic, corporations, companies and bodies corporate.[3]

Injunctions under the Competition and Consumer Act

6.14 Under s 56EX of the Competition and Consumer Act, the Commissioner may apply to a Court for an injunction. Section 56EX of the Competition and Consumer Act triggers the provisions of Part 7 of the Regulatory Powers Act.

6.15 If a person has engaged, is engaging or is proposing to engage in any conduct that constituted, constitutes or would constitute a contravention of a privacy safeguard, a Court may grant an injunction:

• restraining the person from engaging in the conduct; and
• if in the Court’s opinion it is desirable to do so, requiring the person to do any act or thing.

6.16 The Court may also grant an injunction requiring a person to do an act or thing if the person has refused or failed, is refusing or failing, or is proposing to refuse or fail, to do that act or thing and that refusal or failure was, is, or would be a contravention of a privacy safeguard.

6.17 Under the Competition and Consumer Act, a ‘relevant court’ means the Federal Court of Australia, the Federal Circuit Court, or a court of a State or Territory that has jurisdiction in relation to the matter (s 56EX(3)).

6.18 If an application is made to a Court for an injunction under s 56EX of the Competition and Consumer Act (see also Part 7 of the Regulatory Powers Act), the Court may grant an interim injunction restraining a person from engaging in conduct or requiring a person to do a thing, before considering the application and pending the determination of the application. See below for further information about interim injunctions.

6.19 ‘Person’, for the purpose of s 56EX of the Competition and Consumer Act, includes natural persons, bodies politic, corporations, companies and bodies corporate.[4]

Which Act to use?

6.20 Conduct that interferes, or would interfere, with an individual’s privacy, but does not relate to a contravention of the My Health Records Act or to a privacy safeguard set out in Part IVD of the Competition and Consumer Act, is governed by the Privacy Act, and the Commissioner may apply to a Court for an injunction under that Act.

6.21 Conduct that contravenes certain provisions of the My Health Records Act are deemed by s 73 of that Act to be an interference with an individual’s privacy for the purposes of the Privacy Act. Depending on the circumstances, the Commissioner may apply to a Court in relation to conduct that contravenes or would contravene certain provisions of the My Health Records Act, for an injunction under the My Health Records Act or the Privacy Act.

6.22 Section 81 of the My Health Records Act also empowers the My Health Record System Operator to make an application for an injunction. The OAIC may consult with the System Operator when investigating a complaint and considering whether to apply for an injunction, in line with the Agreement for information sharing and complaint referral relating to the personally controlled electronic health (eHealth) system between the OAIC and the System Operator.[5]

6.23 For conduct that is a breach of a privacy safeguard, the Commissioner may apply to a Court for an injunction under the Competition and Consumer Act.

Purpose and key features of an injunction

6.24 Injunctions are an important enforcement tool for compelling a person to modify their behaviour in order to prevent them from contravening, or from continuing to contravene, the Privacy Act, the My Health Records Act, or a privacy safeguard set out in Part IVD of the Competition and Consumer Act.

6.25 Generally, an injunction may be appropriate if the conduct:

• is serious or has had, or is likely to have, serious or extensive adverse consequences
• is systemic or poses ongoing compliance or enforcement issues
• is deliberate or reckless or where the entity involved is not being cooperative, or
• raises significant concerns of public interest.

6.26 The Commissioner may seek an injunction on its own or with civil penalty proceedings, or other enforcement action.

Interim injunctions

6.27 The OAIC may seek and obtain a temporary injunction (known as an ‘interim injunction’) on an urgent basis pending the Court’s determination of an application for a permanent injunction under s 80W of the Privacy Act, s 81 of the My Health Records Act or s 56EX of the Competition and Consumer Act (see also Part 7 of the Regulatory Powers Act). An interim injunction may prevent further harm or maintain the status quo. The interim injunction will be effective from the time the interim injunction is granted to the time that the Court’s final decision is made.

6.28 The OAIC may seek an interim injunction on an ‘ex parte’ basis, meaning that the Court may consider whether to make the order without the respondent participating. Ex parte interim injunctions will generally be sought by the OAIC at the start of Court proceedings and in urgent circumstances, where an injunction is required as soon as possible and it is not practicable for the OAIC to first contact the respondent. This type of injunction will usually only be effective for a short period – typically no more than one week. After this period, the OAIC will have to participate in a further Court hearing with the respondent present.

6.29 Under s 122(1) of the Regulatory Powers Act, the Court has a general power to grant interim injunctions — meaning that an interim injunction restraining a person from engaging in conduct or an interim injunction compelling a person to do a particular act or thing may be possible depending upon the circumstances.

6.30 To obtain an interim injunction under s 80W of the Privacy Act, s 81 of the My Health Records Act or s 56EX of the Competition and Consumer Act, the Commissioner must establish that:

• there is a serious question to be tried in relation to the facts asserted to support the injunction application
• the balance of convenience favours granting an injunction, in that the harm or inconvenience caused by the refusal of an injunction outweighs the harm or inconvenience that the respondent would suffer if the injunction were granted, and
• it is desirable in all the circumstances to grant the interim injunction.

6.31 Factors relevant to the balance of convenience include:

• the strength of the Commissioner’s case
• the purpose served by the interim injunction (for example, is it designed to prevent the respondent from taking an action that would render granting a final injunction futile)
• the effect of the injunction on the respondent and any third parties
• the availability of alternative remedies
• any delay in making the application, and
• any undertakings offered by the respondent to cease (or not to commence) the relevant conduct.[6]

6.32 Where the Commissioner is applying for an ex parte interim injunction, the Commissioner will also be subject to a special ethical obligation usually described as the ‘duty of utmost disclosure’. This means that the Commissioner must disclose all factors relevant to a consideration of whether to grant an interim injunction – especially those factors which go against granting an injunction.

6.33 This duty is treated most seriously by the Court, and a failure to comply will normally result in a discharge of the injunction, with costs ordered against the applicant. A failure by the Commissioner to disclose relevant factors would also be a breach of the Commonwealth’s obligation to act as a model litigant under the Legal Services Directions.

Permanent injunctions

6.34 For a permanent injunction, the Commissioner must establish on the balance of probabilities that the facts asserted to support the injunction are made out.

6.35 The power to grant an injunction is a discretionary power and the Court will also consider whether it is desirable in all the circumstances to exercise that power having regard to the scope and purpose of the relevant Act.

Injunctions restraining a person from engaging in conduct

6.36 To grant an injunction restraining a person from engaging in conduct, the Court must be satisfied that:

• a person has engaged, is engaging in or is proposing to engage in conduct in contravention of either the Privacy Act, the My Health Records Act or a privacy safeguard set out in Part IVD of the Competition and Consumer Act.

6.37 The Court may grant an injunction restraining a person from engaging in conduct whether or not:

• it appears to the court that the person intends to engage again in conduct of that kind,
• the person has previously engaged in conduct of that kind, and
• there is an imminent danger of substantial damage to any person if the first mentioned person were to engage in conduct of that kind (s 124(1) of the Regulatory Powers Act).

6.38 Where the Court grants an injunction restraining a person from engaging in conduct that is, or would be, a contravention of the Privacy Act, or the My Health Records Act or a privacy safeguard as set out in Part IVD of the Competition and Consumer Act, the Court may also make an order requiring the person to do any act or thing, if it is in the Court’s opinion desirable to do so (s 80W of the Privacy Act, and s 81 of the My Health Records Act and s 56EX of the Competition and Consumer Act (see also Part 7 of the Regulatory Powers Act)).

6.39 For example, a Court may grant a permanent injunction restraining a person from collecting certain information about consumers and requiring them to put in place specified risk management practices to prevent similar breaches from occurring again.

Injunctions requiring a person to do a thing

6.40 To grant an injunction requiring a person to do a thing, the Court must be satisfied that:

• a person has refused or failed, or is proposing to refuse or fail, to do a thing; and
• the refusal or failure was, is, or would be a contravention of either the Privacy Act, the My Health Records Act or a privacy safeguard set out in Part IVD of the Competition and Consumer Act.

6.41 The Court may grant an injunction requiring a person to do a thing whether or not:

• it appears to the Court that the person intends to refuse or fail again to do the thing,
• the person has previously refused or failed to do that thing, and
• there is an imminent danger of substantial damage to any person if the first mentioned person were to refuse or fail to do that thing (s 124(2) of the Regulatory Powers Act).

6.42 For example, a Court may grant a mandatory injunction requiring a person to correct personal information it holds about individuals.

The content of injunctions

6.43 The form of any injunction sought must be certain and capable of enforcement. It must be clear and unambiguous to the affected person, and to the Court, what it is that they must do or not do.

6.44 The Court will not grant an injunction that simply requires a person to ‘comply with the Act’. An injunction must set out the specific acts that the person must do or not do.

6.45 An injunction should not prohibit conduct falling outside the boundaries of s 80W of the Privacy Act, s 81 of the My Health Records Act or s 56EX of the Competition and Consumer Act. That is, an injunction cannot operate on conduct that is not related to ensuring compliance with the Privacy Act, My Health Records Act, or a privacy safeguard set out in Part IVD of the Competition and Consumer Act.

Procedural steps in seeking an injunction

6.46 When seeking an injunction, the OAIC will generally use the following steps:

• Where the OAIC becomes aware that an entity might have engaged, be engaging, or proposes to engage in conduct that would contravene the Privacy Act, My Health Records Act or a privacy safeguard set out in Part IVD of the Competition and Consumer Act, the OAIC will make preliminary inquiries about the matter.
• The OAIC will review the matter against the Privacy Regulatory Action Policy (including the factors set out in paragraph 38) or s 7.1 of the My Health Records Enforcement Guidelines or the CDR regulatory action policy as applicable, as well as the additional factors outlined above, in paragraph 25, to assess whether seeking an injunction is an appropriate regulatory response, either by itself or in conjunction with other remedies.
• Where an injunction is identified as an appropriate regulatory response in the circumstances, the OAIC will assess the matter to determine whether enough admissible evidence and arguments exist to satisfy the Court of the matters it must consider in determining whether to grant an injunction. The amount and type of evidence required to support an application for an injunction will depend on the type of injunction being sought (see above). External legal counsel may be briefed at this time.
• Where the available evidence and arguments are considered sufficient, the Commissioner will consider and decide whether to commence proceedings. To make this decision, the Commissioner will refer to either the Privacy Regulatory Action Policy (including the factors set out in paragraph 38) or s 11.3 of the My Health Records Enforcement Guidelines or the CDR regulatory action policy as applicable. Where proceedings are to be commenced, external legal counsel must be engaged to run the matter unless the Attorney-General has approved the use of in-house lawyers to conduct the litigation as solicitor on the record or as counsel.[7]
• The appropriate Court documents to initiate proceedings will be prepared and lodged with the Court, and served on the respondent entity.
  • Generally, only persons who are parties to the legal proceedings in which an injunction is granted will be bound by the injunction. It is important to ensure that all persons the Commissioner seeks to bind by an injunction are joined as respondents in the proceedings.
  • This application must generally be accompanied by a supporting affidavit of the Commissioner, setting out:
  • the conduct, refusals or failures the Commissioner considers is, or would be, a breach of the Privacy Act, the My Health Records Act or a privacy safeguard set out in Part IVD of the Competition and Consumer Act
  • the evidence on which the Commissioner bases this view, and
  • the specific orders that the Commissioner is seeking from the Court.
  • In very urgent circumstances, including where a matter is heard on an ex parte basis, (such as where the need for an injunction becomes apparent a matter of hours before the conduct is likely to occur), the Commissioner may provide the above information orally at hearing.
• Following receipt of the Commissioner’s application, the Court will set down a time to hear the application for an injunction.
• The OAIC will pursue the application in accordance with its model litigant obligations, any relevant Court rules and procedures, and any directions or orders issued by the Court.
• Following judgment in the matter, the OAIC will generally publicly communicate the outcome of the proceedings.
• If the OAIC is dissatisfied with the Court’s decision (for example, if the Court refused to grant an injunction), the OAIC may consider the possible grounds for appeal and whether or not to institute appeal proceedings. In making this decision, the OAIC will act in accordance with its model litigant obligations.
• If the respondent appeals the decision, the OAIC will participate in the appeal proceedings and will act in accordance with its model litigant obligations.

After an injunction has been granted

6.47 The Court may discharge or vary an injunction granted under s 80W of the Privacy Act, s 81 of the My Health Records Act or s 56EX of the Competition and Consumer Act (see also Part 7 of the Regulatory Powers Act).

6.48 If a person who is the subject of an injunction breaches the injunction, they may be held in contempt of Court, which is punishable by fines and/or imprisonment.

6.49 Where the OAIC believes that a respondent has breached an injunction, the OAIC will generally first bring suspected or actual non-compliance to the attention of the respondent and seek a response. This notification and response may resolve the breach.

6.50 If the breach remains unresolved, the OAIC may then consider whether it would be appropriate to bring proceedings for contempt of Court. This process requires the OAIC to apply to the Court, supported by evidence and submissions. The burden of proof for contempt proceedings is the criminal standard: the breach must be proven beyond reasonable doubt. Legal advice should be sought before any decision is made to bring contempt proceedings. The OAIC must not decide to bring contempt proceedings unless it has received written legal advice from lawyers whom the OAIC is allowed to use in the proceedings indicating that there are reasonable grounds for starting the proceedings.[8]

Publication

6.51 Generally, the OAIC will publicly communicate the following information in connection with an injunction application:

• that proceedings seeking an injunction against a particular respondent have been initiated[9]
• the outcome of the injunction proceedings
• where an injunction is granted, the orders made by the Court (subject to any limitations placed on the publication of the orders by the Court)
• the lodgement of appeal proceedings by either the OAIC or the respondent, and
• the outcome of any appeal proceedings.

6.52 Where an interim injunction has been granted, the OAIC will take care in its communications to avoid any suggestion that a finding has been made that a person has breached the relevant Act or privacy safeguard. By their nature interim injunctions are granted without the Court having yet decided about whether there has been a breach of the relevant Act or privacy safeguard.

6.53 Where a Court grants an injunction, the OAIC will, on its website www.oaic.gov.au, either publish, or provide a link to, the orders made by the Court. Where the Court has placed limitations on the publication of the orders, the OAIC may, subject to those limitations, publish a redacted version of the orders, or a summary of the orders.

6.54In addition, the OAIC may publicly communicate the fact that the respondent has breached the injunction, and any fine or other punishment meted to the respondent in connection with that breach.