On 10 June 2025, a landmark reform to Australian privacy law occurred with the introduction of a statutory tort for serious invasions of privacy, as well as broadening the scope of former legislation.
This reform marks a significant step forward in Australian privacy legislation, bringing Australia in line with similar jurisdictions such as the UK, Canada and New Zealand.
This new statutory tort (contained in Schedule 2 of the Privacy Act 1988 (Cth)) allows individuals to bring an action against another person or other entity (for example a corporation) who they consider has invaded their privacy by intruding upon their seclusion or misusing information relating to them.
There are two types of invasions of privacy introduced within the statutory tort, being:
- Intrusion upon seclusion – e.g. a physical intrusion into a private space
- The misuse of information relating to an individual.
Potential action could involve using hidden cameras or drones to spy on an individual, social media misuse, data breaches, and distributing (or threatening to distribute) intimate images or videos of an individual without consent.
Parties to the action
Only individuals can sue for serious invasions of privacy. Corporations do not have the benefit of this cause of action.
The plaintiff individual can sue any individual or organisation (including government).
Small businesses (annual turnover <$3 million) are now also covered by the updated Privacy Act, meaning that more stringent privacy measures may need to be taken by small business in response to these new risks as businesses could be liable either directly, or potentially through vicarious liability.
What needs to be proved for a successful claim?
There are 5 elements which need to be proved for a successful claim.
- There must exist an invasion of privacy, either by intruding upon the plaintiff’s seclusion (physical intrusion into private space), or by misusing information relating to the plaintiff.
- There must exist a reasonable expectation of privacy for the plaintiff in all the circumstances.
- The invasion of privacy itself must be intentional or reckless.
- The invasion of privacy must be serious, meaning only significant, not trivial, breaches are covered.
- The public interest in the plaintiff’s privacy outweighs any countervailing public interest.
A plaintiff does not need to prove actual damage or financial loss to bring a claim. The tort is actionable per se, meaning the invasion itself is enough if it is serious.
Is there a limitations period?
There is a strict limitation period for plaintiffs to bring a claim.
Plaintiffs over the age of 18 must commence proceedings within one year of becoming aware of the invasion of privacy, or three years from the date the invasion occurred, whichever is sooner.
Plaintiffs under the age of 18 would be excepted from the above strict limitations period and have until their 21st birthday to commence proceedings.
What are the defences to a claim?
Defences to a claim in invasion of privacy include (but are not limited to):
- If the invasion of privacy was authorised under Australian law or court/tribunal order;
- If the individual bringing the action consented to the invasion of privacy;
- If the invasion of privacy was necessary to prevent or lessen a serious threat to the life or safety of a person; and
- If the invasion of privacy was incidental to the exercise of a lawful right to defend persons or property.
Are there any exemptions?
Certain entities and individuals are exempt from this statutory tort.
Importantly, there exists an exemption for journalists, whereby if the invasion of privacy involves the collection or publication of journalistic material by a journalist, they are exempt from the operation of this tort.
Furthermore, state/territory authorities, intelligence agencies, law enforcement bodies and persons under the age of 18 are also exempt.
What are the available remedies?
Courts have the power to award a variety of remedies. Perhaps most importantly, courts can award damages for emotional distress, where damages for non-economic loss is capped at $478,550.
Other remedies which the court may grant in addition to, or instead of, damages include an account of profits, injunctions or declarations among others.
How we can help?
With the introduction of this new legislation, previously exempt entities are now exposed to new litigation risks. The message is clear that privacy must be treated as a core operational priority.
If you would like assistance reviewing your business’ privacy practices to ensure compliance or have any general enquiry on potential disputes involving this tort, please contact our office on (02) 9229 2222.