It revealed that Australian regulators’ increasingly active policing of how organisations’ use and protect customer data could form the basis for civil actions to determine duties and standards of care. Tech and IP partner Kirsten Bowe said that trends seen overseas could have an impact on the Australian cybersecurity space.

“US Courts are seeing an influx in cybersecurity class action lawsuits, with approximately 25 major data breach class action lawsuits filed in 2020.  These lawsuits have not been limited to claims against the data controller to whom personal information has been disclosed, but also to service providers to the data controller,” she said.

“If these trends emerge in Australia, organisations will need to take care in complying with the regulatory obligations, as class actions may flow from enforcement activity by the OAIC, ACCC, and ASIC.”

VIEW ALL

Whilst the legal bases for Australian cybersecurity class actions “haven’t been fully tested before the Australian Courts”, and there is not currently a private right of action for a breach of the Privacy Act 1988, the High Court indicated recently that it “may be receptive to arguments that a common law right of privacy should be recognised in the future”, according to Ms Bowe.

“Moreover, from the bench, Keane J has recently commented in a lecture that it ‘would not be surprising’ for the High Court to accept a common law tort of privacy along US lines”. In the event of a data breach, causes of action available to an Australian claimant may include breach of contract, negligence, breach of confidence, or claims based on breach of statutory misleading or deceptive conduct provisions,” she explained.

“Significantly, the Privacy Act 1988 is currently being reviewed by the Australian Attorney-General’s Department. This review has sought public consultation on the potential to introduce a direct right of action for individuals as well as a statutory tort of privacy as recommended by the ACCC.”

When such class actions do begin to be litigated in Australia, the courts will need to determine the standard of care and assess “what constitutes reasonably prudent cybersecurity practices,” Ms Bowe added.

“In 2021, security is not absolute, hacking attacks are increasing in prevalence and sophistication, and industry standards are continually evolving. What reasonable steps should organisations (including service providers) be taking to prevent security breaches?

“If current US trends find their way to Australia, the standard of care will be high. Organisations and IT service providers will be expected to be informed and proactive in relation to managing cybersecurity risks,” she said.

Climate change is already the second-most active jurisdiction globally, and recent successful representative actions brought by youth litigants questioning government and business decision makers’ consideration of climate risk have only reinforced the trend.  

In terms of class actions in this area, KWM dispute resolution partner Edwina Kwan said that in light of recent high-profile judgments in both Europe and Australia, climate change activism and related litigation risk is likely to increase moving forward.

Moreover, both the release of the latest Intergovernmental Panel on Climate Change (IPCC) report and the upcoming United Nations Climate Change negotiations (COP26) in November 2021 will play roles in the increase of such class actions.

“Groups of children and youths have filed class actions or complaints against governments, government decision-makers, and corporations across the world, including in Canada, Colombia, the European Union, Peru, and the USA, to press for more ambitious climate change action and policy outcomes. Significantly, an increasing number of these claims have been successful,” she said.

“The trends suggest that where governments and businesses do not consider their climate change risks, and where government decision-makers do not consider climate impacts when approving fossil fuel projects, the Courts are increasingly receptive to intervening in what is a rapidly evolving area of law.”

Most recently, the Australasian Centre for Corporate Responsibility (ACCR) “greenwashing” case against oil and gas producer Santos in the Federal Court shows an emerging trend of the younger generation challenging government and businesses to act.

“In that case, ACCR alleges Santos has engaged in misleading or deceptive conduct by claiming that it produces ‘clean energy’ and ‘clean fuel’ and has a pathway to reach net-zero emissions,” Ms Kwan explained.

“This is the first time that activists have used misleading or deceptive conduct allegations to challenge a company’s net-zero emissions target. It is demonstrative of a broader trend of children and youths seeking court remedies to modify policy on the issue of climate change, rather than seeking damages.”

Cases like these will have an impact on both the legal profession and the issue of climate change in the near future – and governments and businesses need to think about climate change risks moving forward.

“Governments and businesses should ensure that they have implemented adequate procedures to consider and act upon climate change risks in their operations, and take steps to remain well apprised of developments in this dynamic area of law. Board directors should also carefully review disclosures that are made in relation to climate change commitments as they will need to demonstrate they have reasonable grounds to support any representations contained in those disclosures,” Ms Kwan added.

“Despite some success in these cases, each result is a unique product of its legal system and may not necessarily be easily replicated in other jurisdictions. Yet, there is a growing number of judicial systems that are receptive to these types of arguments, and this creates international precedents that are likely to influence and motivate strategic litigation across other jurisdictions.

“Understood in the context of a global movement of school strikes for climate and a generation of climate-literate young people, these recent cases demonstrate the rise of strategic litigation seeking to catalyse legal, policy and social action on the issue of climate change.”