The new tort of ‘Serious Invasion of Privacy’ comes into force today

Background

A new cause of action for a serious invasion of privacy will be available to plaintiffs starting today, 10 June 2025. The long-awaited tort aims to protect a plaintiff either where their seclusion (physical privacy) has been intruded upon, or where personal information relating to them has been misused.

The new tort is provided by the Privacy and Other Legislation Amendment Bill 2024 (Cth) which inserts Schedule 2 into the Privacy Act 1988 (Cth) (the Act). Schedule 2 is intended to operate independently and outside the scope of the rest of the Act.

These changes come following years of advocacy from the Australian Law Reform Commission for a statutory cause of action which fills the gap for serious invasions of a plaintiff’s privacy, which have become an increasingly common occurrence in the digital age.[1]

Elements of the Tort

Overview

The elements for an invasion of privacy under the new tort are as follows:

A defendant will be taken to have invaded a plaintiff’s privacy where there is:
An intrusion by the defendant into the seclusion of the plaintiff; or
A misuse of the plaintiff’s personal information by the defendant; and
a person in the position of the plaintiff would have a reasonable expectation of privacy; and
the invasion of privacy was intentional or reckless; and
the invasion of privacy was ‘serious’; and
the public interest in the plaintiff’s privacy outweighs any opposing public interest.[2]

Breakdown of Elements

Intruding upon the seclusion of an individual is taken to include physical intrusions of a person’s space; or the unauthorised watching, listening, or recording of a person’s private activities or affairs.[3]

Misusing information broadly relates to the collection, use, or disclosure of information relevant to an individual.[4]

A reasonable expectation of privacy encompasses various considerations by the Court, including but not limited to:

The technology used in the invasion of privacy;
The purpose of the invasion of privacy;
The attributes of the plaintiff (e.g., age, background, or occupation);
The conduct of the plaintiff, and whether they “manifested” the desire for privacy;
Where the intrusion occurred; and
The nature of the information, how the information was held, and whether the information was already within the public domain.[5]

Reckless behaviour is an action taken by a person where they are aware that a substantial risk exists or will exist in circumstances where the taking of such risk is unjustifiable. Therefore, mere negligence will not suffice.

In finding a ‘serious’ invasion of privacy, the Court can consider:

The degree of any offence, distress or harm to the dignity of the plaintiff that was likely to occur;
Whether the defendant knew that the invasion was likely to offend, distress, or harm the plaintiff; or
If the invasion of privacy was intentional and/or motivated by malice.[6]

Opposing public interests to be considered by the Court include:

Freedom of expression;
Freedom of the media;
The proper administration of government;
Open justice;
Public health and safety;
National security; and
The prevention of crime and fraud.

Defences & Exemptions

The Act also introduces a variety of defences and exemptions available for a cause of action for invasion of privacy.

The available defences include:

The invasion of privacy was required by law;
The plaintiff or a person with their authority consented to the invasion of privacy;
The invasion of privacy was necessary for the safety of a person; or
The invasion of privacy was incidental in exercising the right to defend a person or property.[7]

Key persons and agencies will also be exempt from this new tort. This includes government agencies (if acting in good faith), law enforcement bodies, intelligence agencies, and people under the age of 18.[8]

There also exists a broad exemption for journalists that will provide protection where the invasion of privacy is done for the collection, preparation or publication of journalistic material.[9]

Intersection of Defamation

Alongside the standard defences, the Act also provides additional defences that apply to serious invasions of a plaintiff’s privacy in the form of a publication – which have their genesis in defamation law.

These defences include absolute privilege, the publication of public documents, and the fair reporting of proceedings of public concern.[10]

Although these defences overlap with those used in defamation law, there should not be any contradictions since the new tort is concerned with breaches of a plaintiff’s personal privacy, rather than their reputation.

Other Key Considerations

Limitation Period

A plaintiff looking to commence proceedings for an invasion of privacy must do so within one year of becoming aware of the invasion of privacy, or within three years of the date it occurred.[11]

Alternatively, if the Court is satisfied that it was unreasonable for the plaintiff to commence proceedings within the timeframe, then the Court can order that the plaintiff may commence proceedings outside the standard timeframe.[12]

Remedies

Whilst serious harm is not required to establish a breach of the new tort (a requirement in defamation actions) – if successful in a cause of action pursuant to the new tort, a plaintiff will be entitled to a remedy relative to the damage that was caused to them. This can include injunctive relief, damages, an order requiring that any private material be destroyed, or an account of profits.[13]

Although the Court cannot award aggravated damages, an order can include awards for emotional distress caused to the plaintiff as a result of the invasion of privacy. The Court can also award punitive or exemplary damages in exceptional circumstances.

Regardless, the sum of damages for non-economic loss combined with any punitive or exemplary damages cannot exceed $478,550[14] being the maximum amount of damages for non-economic loss that may be awarded in defamation proceedings.

[1] Australian Law Reform Commission, ‘Serious Invasions of Privacy in the Digital Era’ (Final Report, June 2014).

[2] Privacy Act 1988 (Cth) Sch 2 (the Act).

[3] Section 6 of the Act.

[4] Ibid.

[5] Section 7(5) of the Act.

[6] Section 7(6) of the Act.

[7] Section 8(1) of the Act.

[8] Sections 16-18 of the Act.

[9] Section 15 of the Act.

[10] Section 8(3) of the Act.

[11] Section 14(1) of the Act.

[12] Section 14(2) of the Act.