Australia introduces landmark privacy tort. What does it mean for you?

On 10 June 2025, a significant reform to Australian privacy law took effect with the introduction of a statutory tort of serious invasions of privacy under the Privacy Act 1988 (Cth). For the first time, individuals now have a direct cause of action for serious breaches of privacy, bringing Australian law closer into line with comparable jurisdictions such as New Zealand, Canada and the United Kingdom. The reform has important implications for organisations, individuals and the media, creating new avenues for litigation and heightened obligations in managing personal information.

Summary

• On 10 June 2025, a new tort of serious invasions of privacy came into force in Australia. The tort is contained in Schedule 2 of the Privacy Act 1988 (Cth).
• Actions can be commenced in the Federal Circuit and Family Court of Australia (Div 2), State and Territory courts, and the Federal Court of Australia.
• The tort is actionable without proof of damage.
• Actions must be commenced either 1 year after the plaintiff became aware of the invasion, or 3 years after the invasion occurred - whichever is sooner.
• The tort has five elements:
  • An invasion into privacy (being either intrusion upon seclusion or misuse of information
  • Reasonable expectation of privacy
  • Invasion was intentional or reckless
  • Invasion was serious
  • The public interest in privacy outweighed by any countervailing public interest.
• A wide range of remedies are available to plaintiffs for breaches of the tort.
• Defences are available to defendants where the invasion was:
  • required/authorised by law;
  • expressly or impliedly consented to;
  • reasonably believed t be necessary to avoid threats to the life, health or safety of a person;
  • incidental to a lawful right of defence of persons or property; or
  • in the form of a publication to which certain defamation defences would apply.
• The tort contains limited exemptions for:
  • Journalists;
  • Agencies, State and Territory authorities, and their staff members;
  • Intelligence agencies and their staff members;
  • Law enforcement bodies and their staff members; and
  • Persons under the age of 18
• The tort is inspired by the privacy torts of New Zealand, Canada, and the UK, and cases from these jurisdictions provide guidance as to how our new tort will be interpreted and applied.

How did we get here?

The new tort of serious invasions of privacy has been a long time coming. When the High Court of Australia handed down its now famous decision in Victoria Park Racing & Recreation Grounds Co Ltd v Taylor (1937) 58 CLR 479, Australia was set on a path away from tortious privacy protections for years to come. In that judgment, Latham CJ famously espoused the following principle:

With regard to the question of privacy…neither this court nor a court of law will interfere on the mere ground of invasion of privacy.

In the subsequent decades, this principle was largely seen as precluding the development of a tort of privacy in Australia. While the Privacy Act 1988 (Cth) was introduced in the late 1980s, and breach of confidence is an available common law action, neither were robust enough to provide individuals with a direct cause of action for general breaches of their privacy.

When the High Court came to consider issues of privacy again in Australian Broadcasting Corp v Lenah Game Meats Pty Ltd (2001) 208 CLR 199, renewed hope for an Australian tort of privacy arose. Here, Gummow and Hayne JJ found that "Victoria Park does not stand in the path of the development of [a tort of invasion of privacy]," while Callinan J opined that:

the time is ripe for consideration whether a tort of invasion of privacy should be recognised in this country, or whether the legislatures should be left to determine whether provisions for a remedy for it should be made.

As envisaged by Callinan J, the question of whether a tort of privacy should be recognised has come before the courts on numerous occasions since Lenah Game Meats. In some of these decisions, Australian courts demonstrated a willingness to develop or recognise the tort, such as in Grosse v Purvis [2003] QDC 151, Giller v Procopets [2008] VSCA 236 and most recently in Waller v Barrett [2024] VCC 962. Although these were steps in the right direction, no authoritative adoption of such a tort into Australian common law eventuated. Similarly, in the wake of Lenah Games Meats, the Australian Law Reform Commission (ALRC) issued two reports (in 2008 and 2014) proposing that a tort of privacy be adopted to better protect the privacy of individuals, but neither led to any immediate statutory developments.

This was until 2022, when, some 21 years after Callinan J's words in Lenah Games Meats, the Commonwealth Attorney-General's Department decided that the time was finally ripe for an Australian tort of privacy. The Department conducted a thorough review of Australian privacy law, and drawing on the ALRC's previous proposals as well as developments in the privacy laws of New Zealand, Canada, and the UK, it recommended that a new statutory tort for serious invasions of privacy be adopted. This recommendation became the Privacy and Other Legislation Amendment Bill 2024 which passed through Parliament in 2024, and came into force on 10 June 2025 as Schedule 2 of the Privacy Act 1988 (Cth) (the Schedule).

This article will address the key questions surrounding the new tort to break down how it works.

What courts can hear actions under the tort?

Section 23 of the Schedule sets out which courts have jurisdiction to hear claims under the tort. Jurisdiction is conferred on Division 2 of the Federal Circuit and Family Court of Australia, and also extends to the State and Territory courts and the Federal Court of Australia.

Is there a limitation period to bringing an action under the tort?

Section 14 of the Schedule deals with the applicable limitation periods. If the plaintiff was under 18 years of age when the invasion occurred, proceedings must be commenced before the plaintiff's 21st birthday. For persons over the age of 18 when the invasion occurred, proceedings must be commenced within 1 year after the plaintiff became aware of the invasion, or 3 years after the invasion occurred - whichever is sooner. Does a person need to have suffered damage to have an actionable claim?

Under section 7(2) of the Schedule, claims for serious invasions of privacy are actionable without proof of damage.

What are the elements of the cause of action?

As defined in section 7 of the Schedule, the cause of action for the new privacy tort has five elements which must be proven by the plaintiff.

1. Invasion of the person's privacy

The first element is that there is a positive act which amounts to an actual invasion of the defendant's privacy by the plaintiff. This invasion can take two forms, being an intrusion upon the plaintiff's seclusion, and/or a misuse of information that relates to the plaintiff. Helpfully, these two types of invasions are given statutory definitions to aid in their interpretation. 'Intrusion upon seclusion' includes physical intrusion into a person's private space, as well as watching, listening to or recording the person's private activities or private affairs. 'Misuse of information' includes collecting, using or disclosing information about the individual.

2. Reasonable expectation of privacy

The second element of the tort is that a person in the position of the plaintiff would have had a reasonable expectation of privacy in all of the circumstances. In determining whether there would have been a reasonable expectation of privacy, courts may consider any factors that it thinks fit, including:

• the means, including the use of any device or technology, used to invade the plaintiff's privacy;
• the purpose of the invasion of privacy;
• attributes of the plaintiff including the plaintiff's age, occupation or cultural background;
• the conduct of the plaintiff, including whether the plaintiff invited publicity or manifested a desire for privacy;
• the place where the intrusion occurred;
• the nature of the information misused, including whether the information related to intimate or family matters, health or medical matters or financial matters;
• how the information misused was held or communicated by the plaintiff;
• whether and to what extent the information misused was already in the public domain.

In the New Zealand and Canadian contexts, the reasonable expectation of privacy element has been explained as a two-pronged test requiring a subjective expectation of solitude or seclusion and for this expectation to be objectively reasonable. Furthermore, in the UK, the question of whether there was a reasonable expectation of privacy has been framed as asking what a reasonable person of ordinary sensibilities would feel if he or she were placed in the same position as the plaintiff and faced with the same exposure or publicity.

3. Invasion was intentional or reckless

The third element is that the invasion of privacy was intentional or reckless. This introduces a fault element into the tort. The term 'intentional' is given its ordinary meaning, and as explained by the ALRC, can encompass either:

• a subjective desire or purpose to intrude or to misuse or disclose the plaintiff’s private information; or
• circumstances where such an intent may be imputed to the defendant on the basis that the relevant consequences—the intrusion, misuse or disclosure—were, objectively assessed, obviously or substantially certain to follow.

The term 'reckless' is given the same meaning as in the Commonwealth Criminal Code, which means that a person will be reckless if:

• he or she is aware of a substantial risk that privacy will be invaded; and
• having regard to the circumstances known to him or her, it is unjustifiable to take the risk.

4. Invasion was serious

The fourth requirement is that the invasion of privacy was serious. This introduces a minimum threshold seriousness into the tort, seeking to preclude actions where the invasion is anodyne or trivial. The term 'serious' is not given a statutory definition. Some guidance may be drawn from the construction of the 'serious harm' threshold in the analogous area of defamation law, which would see 'serious' defined as an invasion that is more than substantial, but not necessarily grave. Regardless, the determination of seriousness is entirely context-dependent, with courts left to make this assessment based on the specific facts and circumstances of each individual case. With this said, some factors that courts should consider when assessing seriousness are:

• the degree of any offence, distress or harm to dignity that the invasion of privacy was likely to cause to a person of ordinary sensibilities in the position of the plaintiff;
• whether the defendant knew or ought to have known that the invasion of privacy was likely to offend, distress or harm the dignity of the plaintiff;
• if the invasion of privacy was intentional, whether the defendant was motivated by malice.

5. Countervailing public interest

The fifth requirement is that the public interest in the plaintiff's privacy outweighs any countervailing public interest. In the UK context, this element has been described as the "ultimate balancing test" whereby the question for the court is whether there is sufficient public interest in the invasion of privacy to justify any resulting curtailment of the plaintiff's rights. UK courts have made clear that there are no hard and fast rules to this determination and the evaluation will be rooted in the facts of each particular case. Despite this, the Australian tort does provide some guidance, stating that without limitation, courts can consider the following factors when deciding whether a countervailing public interest exists:

• freedom of expression, including political communication and artistic expression;
• freedom of the media;
• the proper administration of government;
• open justice;
• public health and safety;
• national security;
• the prevention and detection of crime and fraud.

Ultimately, however, it will be for the courts to assess these factors against the nature and severity of the invasion to determine in which way the balance tilts.

What remedies can a plaintiff seek?

A range of remedies can be sought by plaintiffs for a serious invasion of their privacy, as contained in sections 12 and 13 of the Schedule. These include:

• an injunction restraining the defendant from invading the plaintiff's privacy
• damages (for economic loss, non-economic loss, emotional distress, as well as exemplary or punitive damages, but not aggravated damages)
• account of profits
• an apology
• a correction order
• a retrieval and destruction order
• a declaration.

The total amount of damages awarded, other than in respect of damages for economic loss, is capped at the same level as general damages for defamation (being $500,000 as at 1 July 2025).

What are the defences available to a defendant?

A range of defences are contained in section 8 of the Schedule which can be raised by defendants to avoid liability. This includes where:

• the invasion was required or authorised by or under an Australian law or court/tribunal order
• the invasion was expressly or impliedly consented to by the plaintiff or a person with authority to do so on their behalf
• the defendant reasonably believed that the invasion of privacy was necessary to prevent or lessen a serious threat to the life, health or safety of a person
• the invasion was incidental to the exercise of a lawful right of defence of persons or property, and was proportionate, necessary and reasonable
• the invasion was in the form of a publication as defined under defamation law, and the defendant would be able to satisfy the defamation defences of absolute privilege, publication of public documents, or fair report of proceedings of public concern in relation to the invasion.

As is the case in defamation law, early apologies are encouraged and are deemed not to constitute an admission of fault or liability.

Is anyone exempt from the ambit of the tort?

The journalism exemption

The most notable exemption from the operation of the new tort is the journalism exemption. Under s 15 of the Schedule, if an invasion of privacy involves the collection, preparation for publication, or publication of, journalistic material, then the tort does not apply to the journalists involved, the employers of journalists, persons engaging the journalists, or personal assisting the journalists.

'Journalist' is defined in broad terms to include any person who:

• works in a professional capacity as a journalist; and
• is subject to standards of professional conduct that apply to journalists, or a code of practice that applies to journalists.

Similarly, 'journalistic material' is also broadly defined, being any material that:

• has the character of news, current affairs or a documentary; or
• consists of commentary or opinion on, or analysis of, news, current affairs or a documentary; or
• consists of editorial content relating to news, current affairs or a documentary.

This is a powerful exemption that will enable journalists and news organisations to freely investigate and present valuable stories and continue their role as the fourth estate.

Other exemptions

A range of other exemptions are provided for in the Schedule. These are for:

• agencies and State and Territory authorities, as well as their staff members, performing their functions or exercising their powers in good faith;
• intelligence agencies, staff members of intelligence agencies performing their duties, powers or functions, and disclosures to intelligence agencies;
• law enforcement bodies, staff members of law enforcement bodies performing their duties, powers or functions, and disclosures to law enforcement bodies; and
• persons under the age of 18.

How have the analogous torts in other jurisdictions been applied?

As mentioned earlier, Australia's new privacy tort was inspired by the privacy protections in New Zealand, Canada, and the UK. The close similarities between our tort and the causes of action in these jurisdictions enable us to view their case law to understand how our tort may be interpreted and applied.

• Murray v Express Newspapers [2008] EWCA Civ 446 (UK) - JK Rowling and her husband were out for a walk to a café, pushing their 18-month-old child in a pram. A photographer took a photo of the family group, which was then sent to Express Newspapers and published in the Sunday Express magazine. The child's parents commenced an action for breach of privacy, and the respondent sought to strike out the claim. The Court found that the claim should not be struck out because the child had a reasonable expectation of privacy. The Court said that an expedition to a café of the kind which occurred here is part of each member of the family's private recreation time intended to be enjoyed by them and such that publicity of it is intrusive and such as adversely to affect such activities in the future.
• John v Associated Newspapers Ltd [2006] EWHC 1611 (UK) - Associated Newspapers obtained and sought to publish a photograph of Elton John on the street about to walk through the front gate to his property. Mr John sought an injunction to prevent this publication on the basis that the photograph infringed his privacy. The Court found that there was no privacy infringement here. The photograph did not reveal any information touching on anything private to Mr John, such as his health or relationships. He was simply walking on the street, so did not have a reasonable expectation of privacy.
• C v Holland [2012] 3 NZLR 672 (New Zealand) - Mr Holland secretly recorded two videos of C while she was showering at the property owned by Mr Holland and C's boyfriend. Mr Holland then stored these on his computer. The Court found that Mr Holland intruded into C's seclusion by intruding into her intimate personal space and activity without her consent. C had a reasonable expectation of privacy in showering alone at her boyfriend's property, and the intrusion was serious in that it was highly offensive to the reasonable person.
• Jones v Tsige [2012] ONCA 32 (Canada) - Ms Tsige and Ms Jones worked at a bank. When Ms Tsige entered into a relationship with Ms Jones' ex-husband, Ms Jones began accessing Ms Tsige's personal bank account information to observe her finances. This occurred 174 times over a four-year period. The Court found that Ms Tsige intruded into Ms Jones' seclusion by accessing her personal account information without consent. Even though Ms Tsige never used the information or disclosed it to anyone, the invasion was still intentional and highly offensive to a reasonable person.
• Stewart v Demme [2022] ONSC 1790 (Canada) - Ms Demme, a nurse, had an addiction to painkillers. Over a period of 10 years, she fueled her addiction by pretending to obtain painkillers for her patients but instead taking them herself. In doing this, she accessed the health records of over 11,000 patients. The patients affected commenced a class action against Ms Demme. The Court found that Ms Demme had intruded into the seclusion of the patients by improperly accessing their health records, and these patients expected their records to remain private. However, the intrusion here was not significant and highly offensive because Ms Demme had only accessed each record for a few seconds at a time, the information in the records was not particularly sensitive, and her only purpose for accessing the records was to obtain painkillers for herself.
• Warren v DSG Retail Limited [2021] EWHC 2168 (UK) - DSG Retail, a victim of a cyber-attack which resulted in the personal information of its customers being compromised, was found not to have misused information. The Court stated that an action for misuse of private information does not impose a data security duty on the holders of information, but is concerned with prohibiting positive actions by the holder of the information that are inconsistent with their obligations.

How exactly the tort will develop in Australia is something that will become clearer as cases for invasion of privacy begin to make their way through the courts. What is apparent however is that after many years and a number of false starts, Australians now have a clear cause of action available to them whenever serious invasions of privacy occur.