Why the privacy debate ignores the third-party doctrine
Privacy debates often centre on familiar threats: facial recognition, police databases, metadata retention and encrypted phones. Less attention goes to the companies assembling personal information before government agencies see it. That gap obscures a powerful assumption about what happens when information moves from one person or organisation to another.
In the United States, the third-party doctrine provides much of this hidden framework. Voluntary disclosure to another party can weaken the reasonable expectation of privacy protected against government search. Australia frequently borrows American legal language when discussing surveillance, yet the doctrine does not automatically control here.
Australian privacy law combines the federal Privacy Act 1988, state and territory regimes, common-law remedies, contracts and consumer protection. The Office of the Australian Information Commissioner oversees the Australian Privacy Principles. There is no general federal constitutional privacy right, so imported constitutional rules require careful translation.
Everyday life makes the stakes concrete. A shopper in Sydney uses a supermarket loyalty app, a commuter in Melbourne taps a transport card, and a patient in Brisbane joins a telehealth service. Each transaction involves multiple recipients and purposes. The issue is whether the conditions of sharing match what people reasonably expect.
The hidden rule behind shared information
The third-party doctrine grew from a 1967 United States Supreme Court ruling on telephone tapping. Its later applications rested on the idea that people expect privacy from government only while information remains with someone they regard as trusted. Handing records to a bank, employer or another party can place the material outside that expectation. This limits constitutional protection; it does not mean shared information has no value.
It is also frequently mistaken for a universal rule about personal information. Sensitive disclosures can retain protection because the recipient’s relationship and duties matter, while routine commercial transfers may establish a weaker expectation. Voluntariness, foreseeability and subsequent use therefore require separate examination, especially when private firms routinely collect information that later agencies acquire.
Why public debate looks elsewhere
Public argument concentrates on state power because agencies are visible, coercive and answerable to Parliament. Commercial collection is dispersed among app operators, advertising firms, data brokers and cloud providers. Their choices determine the dataset available to police, intelligence services and courts. Government access can become one customer of an information market built through private incentives and weaker public scrutiny.
The mismatch also concerns incentives. Buyers reward detailed profiles, while individuals bear fragmented and difficult-to-measure costs. These commercial dynamics are explored further in Eassim's privacy commentary. A privacy debate confined to government requests consequently overlooks who gathers information, what they charge for it and how easily it changes hands.
An Australian legal counterpoint
The Australian starting point differs markedly. Under the Privacy Act, most organisations must follow the Australian Privacy Principles, but the small-business exemption excludes many firms with turnover below $3 million. It does not apply to health-service providers or certain businesses trading in personal information. Federal notification and oversight duties consequently reach some everyday services while leaving others outside that framework.
State regimes add another layer. New South Wales uses the Privacy and Personal Information Protection Act 1998, while Victoria combines the Privacy and Data Protection Act 2014 with the Health Records Act 2001. The Australian Consumer Law also allows the ACCC to challenge misleading privacy claims. A business cannot describe its practices as “anonymous” or promise no sharing if its actual arrangements permit the opposite.
| Issue | United States | Australia |
|---|---|---|
| Constitutional baseline | The Fourth Amendment limits unreasonable government searches | No general federal constitutional privacy right |
| Third-party disclosure | Voluntary sharing can weaken a reasonable expectation of privacy | No automatic equivalent; statutory, common-law, contractual and consumer protections remain relevant |
| Commercial reuse | Generally treated outside Fourth Amendment scrutiny | Federal and state regimes, contract and consumer law may constrain it |
| Sensitive information | Some intimate and medical disclosures retain protection | Consent, confidentiality and health-privacy rules can remain binding after disclosure |
Business models magnify the problem
Australian customers provide examples at every scale. A supermarket app can connect purchases to a household profile, a bank rewards programme can add transaction and location signals, and a fitness platform can infer health details. Information may pass to an analytics contractor, advertising partner or broker. Someone choosing groceries has not thereby agreed to an enduring dossier assembled across unrelated services.
Contract terms do not remove the difficulty. A policy may refer to “trusted partners” without identifying meaningful categories of recipient, and consent can be bundled with a service people need to use. Transparency and purpose limitation remain important Australian safeguards, yet enforcement across numerous small databases is costly. Richer profiles improve targeting, while privacy costs are dispersed among people with few alternatives.
Consent under public pressure
Health policy exposes the strain in the concept of voluntariness. Australia’s COVID-era border restrictions and state check-in systems normalised the collection of location and venue information. The site’s public health mandate analysis examines cases where health mandates move toward coercion. Information supplied under threat of penalty, or pressure to enter a workplace, should not be described as freely given merely because its recipient calls it public-health data.
Combining datasets creates further complications. Precise source records can be linked using stable identifiers, narrowing the distance between what authorities publish and what they can identify. Aggregation sometimes lowers risk, but it also makes re-identification testing more important. Public trust depends on knowing which agencies receive information, why they need it, how long they retain it and whether independent oversight can examine their matching practices.
Limits on voluntary disclosure
Technical exceptions have prevented the doctrine from becoming absolute. United States courts have recognised that disclosure does not automatically surrender every privacy interest. Information shared with a physician or trusted adviser can remain protected because the relationship and the sensitivity of the subject matter affect the arrangement. A commercial database is different: it is usually created for purposes the individual neither sets nor fully understands.
Those limits make the third-party assumption a contested allocation of power. Compulsion, materially different reuse and opaque transfers among affiliates may matter more than the bare fact of disclosure. In Australia, purpose limits, confidentiality duties, contract and misleading-conduct rules address parts of this problem without importing an American exception wholesale. The comparison offers a warning about hidden assumptions, not a template for Australian law.
A practical privacy test
A practical test follows from these distinctions. For any collection, identify the recipient, whether the handover is genuinely voluntary, the purpose of use and the foreseeable downstream audience. Apply the same questions to a COVID check-in record, a supermarket profile and a health app. Identical data types can produce different results when consent, trust and institutional power differ.
The site’s business reporting illustrates the commercial setting in which organisations balance customer expectations against operational realities. Small traders need proportionate controls, but customers have not abandoned privacy because a policy mentions it. Disclosure begins a chain of responsibility rather than ending a private life. The practical takeaway is to judge privacy by the recipient, purpose and conditions of disclosure, rather than by a label that erases meaningful consent.
