4 Things to Know About Australia's New Statutory Tort of Privacy

From today (10 June 2025) Australia's statutory tort for serious invasions of privacy comes into force (Statutory Tort). Passed by Parliament late last year as part of the first tranche of privacy reforms, this significant legal development will be enshrined in Schedule 2 of the Privacy Act 1988 (Cth) (Privacy Act) from 10 June 2025.

The Statutory Tort: 4 Things You Need to Know

1. Five critical elements:

To establish a cause of action under this new tort, five elements must be present:

• Invasion of privacy: the defendant must have invaded the plaintiff’s privacy by intrusion upon seclusion (e.g., physically intruding into the plaintiff’s private space or recording the plaintiff’s private affairs) and/or misuse of information (e.g., collecting, using or disclosing the plaintiff’s information); 
• Reasonable expectation of privacy: a person in the position of the plaintiff would have had a reasonable expectation of privacy in all the circumstances. This may be determined by reference to wide a range of factors, including the purpose of the invasion of privacy, attributes of the plaintiff (e.g., age, occupation or cultural background) and the extent the information was already in the public domain;
• Fault: the invasion of privacy must be intentional or reckless. As such, proof of negligence is not sufficient to establish the fault element;
• Seriousness: the invasion of privacy must be serious. This may be determined by reference to various factors, including whether the invasion of privacy was intentional and whether the defendant knew or ought to have known that the invasion of privacy was likely to offend, distress or harm the dignity of the plaintiff; and 
• Public interest balancing: the public interest in the plaintiff’s privacy must outweigh any countervailing public interest such as freedom of expression, freedom of media and the prevention and detection of crime and fraud.

2. Remedies

Courts may award injunctions at any stage during the proceedings to restrain the defendant from continuing the invasion of privacy and award damages for non-economic loss, including for emotional distress, capped at the greater of $478,550 or the maximum non-economic loss available in a defamation claim. 

Other remedies to a successful plaintiff include: a correction order, a requirement that the defendant apologise to the plaintiff, or a declaration that the defendant had seriously invaded the privacy of the plaintiff. 

3. Strategic Defences and Exemptions

There are a number of defences available under the Privacy Act, including where the conduct was incidental to the exercise of a lawful right of defence of a person or property, the defences of lawful authority, consent, necessity, absolute privilege, publication of public documents and fair reporting of proceedings of public concern. 

Notably, the legislation explicitly exempts: 

• Journalists: the journalist exemption applies to the extent that the invasion of privacy involves the collection, preparation for publication or publication of “journalist material” by a journalist, the journalist’s employer or a person engaging or assisting a journalist;[1]
• Government agencies and state and territory authorities (and their staff): this exemption applies to the extent the government agencies, authorities or their staff invades the plaintiff’s privacy, in good faith, in performing their function or in exercising their power;
• Law enforcement bodies and intelligence agencies: this exemption applies to an invasion of privacy by the law enforcement body, intelligence agency, their staff member or their agent in the performance of their duties, or to the extent it involves a disclosure of information to or by the law enforcement body or intelligence agency; and
• Persons under 18: this exemption applies to an invasion of privacy by a person under 18 years of age.

4. Limitation period 

Claims must be brought within 1 year of the plaintiff becoming aware of the invasion of privacy, or within 3 years after the invasion of privacy had occurred, whichever occurs sooner. For plaintiffs under 18 years of age, proceedings must be commenced before turning 21. Courts may extend this period to 6 years after the invasion of privacy has occurred if it is satisfied that it was not reasonable for the plaintiff to bring proceedings within the ordinary period. 

Business Impact: Key Considerations

1. A higher standard of privacy protection?

While the “reasonable expectation of privacy” appears to impose a high standard of privacy, multiple safeguards in the Privacy Act aim to protect defendants from frivolous or unsubstantiated privacy claims. This includes the requirement of intention or recklessness, the seriousness threshold, the public interest balancing test, and specific exemptions and limitation periods.

These mechanisms aim to ensure that only genuinely serious privacy invasions are actionable. 

2. How does it compare with other causes of action? 

Two causes of action related to the Statutory Tort are breach of confidence and defamation. In general, a breach of confidence claim arises where there is an unauthorised use or disclosure of confidential information, and a defamation claim arises where material which harms a person’s reputation is published. 

These causes of action are similar and may be brought as alterative claims to the Statutory Tort as the same information or conduct in question could give to rise to all three causes of action. However, the Statutory Tort has unique characteristics – it cannot be defeated merely because the information in question is in the public domain (unlike breach of confidence) or if the misused information was untrue (unlike defamation).

3. The Statutory Tort and privacy laws in overseas jurisdictions – do they matter?

As indicated in the Attorney General’s Privacy Act Review Final Report, many legal concepts in the Statutory Tort are drawn from the privacy laws in overseas jurisdictions, like the UK, Canada and New Zealand. 

While overseas court decisions may give an indication of what to expect in Australia, how the Statutory Tort will apply in practice is ultimately a matter for the Australian courts to determine.  

What should we do? 

Our view remains that businesses operating in Australia, should not panic as a result of these changes. However, we do recommend that they conduct privacy impact assessments of their current practices, review their privacy governance frameworks and ensure relevant stakeholders (including at least management with operational responsibility for privacy/data governance and the risk committee) understand the implications of this new cause of action as it comes into force on 10 June 2025. 

Our team of privacy experts are on hand to answer any questions you may have about this law reform may impact your business. 

[1] The Privacy Act defines “journalist” as a person who works in a professional capacity as a journalist and is subject to professional standards or a code of practice, and “journalist material” as material with the character of commentary or opinion on or consist of analysis of or editorial content relating to news, current affairs or a documentary.