If you’ve ever felt helpless after someone invaded your privacy – whether through unauthorised surveillance, misuse of your personal information, or intrusive behaviour – you’re not alone. Until now, Australians have had limited legal options when their privacy was seriously violated, often having to rely on complex defamation laws or other indirect remedies.
This has now changed. Australia has taken a historic step forward in privacy protection with the passage of groundbreaking legislation that creates a statutory tort for serious invasions of privacy. This landmark legislation ends decades of uncertainty and fills a critical gap in Australian law, where privacy rights have largely depended on patchwork protections and limited common law recognition.
Common Law and Invasion of Privacy
While Australian common law has recognised the importance of protecting privacy, it has not previously recognised a tort of invasion of privacy, leaving individuals to rely on other causes of action, such as defamation law.
The Privacy and Other Legislation Amendment Act 2024 received Royal Assent and commenced on 11 June 2025, marking the first time Australians will have comprehensive legal recourse specifically designed to address privacy breaches.
The new statutory tort fills this gap, providing a clear and direct cause of action for serious invasions of privacy, and is expected to lead to the development of new common law principles and precedents in the area of privacy law.
Australian Privacy Principles
The Australian Privacy Principles (APPs) provide a framework for protecting individuals’ privacy and are an important part of the new statutory tort.
The APPs set out 13 principles to govern standards, rights and obligations for the handling of personal information, including collection, use, and disclosure. The new tort is designed to work in conjunction with the APPs to provide individuals with a comprehensive framework for protecting their privacy.
The New Statutory Tort
The new statutory tort for serious invasions of privacy provides individuals with a direct cause of action against those who have committed serious invasions of privacy, including those that involve physical intrusion, misuse of private information, or other forms of invasion.
The Australian Law Reform Commission (ALRC) has played a crucial role in the development of the new statutory tort, following its report on privacy laws. The report recommended the introduction of a statutory tort to provide individuals with a direct cause of action for serious invasions of privacy and ensure that it is effective in protecting individuals’ privacy. This legislation is expected to impact individuals, as well as businesses and organisations that handle personal information.
Elements of the Tort
The new statutory tort empowers individuals to take legal action when their privacy has been seriously invaded. To succeed in a claim, plaintiffs must establish four essential elements:
1. Reasonable Expectation of PrivacyThe invasion must occur in circumstances where the individual had a legitimate expectation of privacy. Courts will consider various factors to determine this threshold, though the legislation provides flexibility in assessment.
2. Intentional or Reckless Privacy InvasionThe defendant must have intentionally or recklessly invaded the plaintiff’s privacy through either:
- Intrusion upon seclusion (physical or digital surveillance, accessing private spaces)
- Misuse of private information (unauthorised disclosure or use of personal data)
The privacy breach must be serious, whether intentional or reckless. This requirement ensures the tort addresses genuinely harmful invasions rather than trivial inconveniences.
4. Public Interest Balancing TestPerhaps most significantly, the public interest in protecting the plaintiff’s privacy must outweigh competing public interests, including:
- Freedom of expression and the media
- Government administration
- Open justice principles
- Public health and safety
- National security
- Crime prevention and detection
Important note: The burden of proof for this balancing test rests with the plaintiff, addressing earlier concerns about potential overreach.
5. No Damage RequirementUnlike many other civil claims, the privacy tort is actionable without proof of financial damage. This recognition that privacy violations cause inherent harm makes it easier for individuals to seek legal remedies for serious breaches of their rights.
Comprehensive Remedies Available
Courts have broad discretionary powers to award appropriate remedies, including:
Financial Compensation:
- Compensatory damages (including for emotional distress)
- Exemplary or punitive damages (capped at $478,550 or maximum defamation non-economic damages)
- Account of profits from unauthorised use
Non-Monetary Remedies:
- Injunctive relief (including urgent interlocutory injunctions)
- Apology orders
- Correction orders
- Destruction or delivery orders for infringing material
- Declaratory relief
Note: Aggravated damages are specifically excluded under the new framework.
Time Limits for Legal Action
The legislation establishes clear timeframes for commencing privacy tort claims, including a standard limitation period and special circumstances that may apply.
Standard Limitation Period:
Proceedings must begin within one year of becoming aware of the privacy invasion, with a maximum of three years from the date of the invasion.
Special Circumstances:
- Minors: Claims must be filed before the plaintiff’s 21st birthday
- Court extensions: Available up to six years maximum, where circumstances made earlier filing unreasonable
- Single publication rule: Applies to determine limitation periods for publication-related invasions
GET HELP NOW WITH YOUR PERSONAL INJURY
Get in touch with our Personal Injury Compensation team
Implications of the New Statutory Tort for Businesses and Individuals
This new legislation will significantly impact various sectors across business, as well as individuals, and reflect this impact.
Corporate Responsibility and Liability
The new statutory tort imposes corporate responsibility and liability on organisations that handle personal information, ensuring they take steps to protect individuals’ privacy and prevent serious invasions of that privacy. The new tort is an important step in promoting corporate responsibility and accountability through:
- Enhanced compliance obligations for data handling
- Increased liability for employee or agent monitoring practices (vicarious liability)
- Greater scrutiny of marketing and customer data use
- Need for updated privacy policies and procedures
Media Organisations & Journalists
Recognising the importance of journalism in a democratic society, the legislation includes comprehensive journalism exemptions covering:
- Journalists and their employers
- Professional assistants and sources
- Collection, preparation, and publication of journalistic material, including news and current affairs reporting, documentary content, editorial commentary and analysis, and opinion pieces on matters of public interest
Courts must determine journalism exemption applications “as soon as practicable” to provide clarity and protect legitimate journalism activities. So far, the tort provides:
- Clear framework for legitimate journalism activities
- Protection for investigative reporting in the public interest
- Defined boundaries for privacy-related coverage
Individuals & Invasions of Privacy in the Digital Age
The digital age has created new challenges for protecting privacy, with the widespread collection and use of personal information. The new statutory tort is designed to address these challenges and provide individuals with a remedy for serious invasions of their privacy.
The tort is an important step in protecting individuals’ privacy in the digital age. It applies to invasions of privacy that occur online, including those involving social media, data breaches, or other forms of digital intrusion. The new legislation:
- Provides individuals with a direct course of action following a data breach or serious invasion of privacy.
- Applies to data breaches that involve the misuse of private information or other forms of invasion of privacy.
- Requires organisations that handle personal information to take steps to protect that information and prevent data breaches.
- Provides a strong incentive for organisations to prioritise data security and protect individuals’ privacy.
Defences and Exemptions
The new statutory tort includes defences and exemptions to ensure that it is applied fairly and consistently.
The legislation provides several important defences for defendants, including situations where the privacy invasion was:
- Legally required or authorised by law or court order
- Consented to by the individual (expressly or impliedly)
- Necessary to prevent serious threats to life, health, or safety
- Incidental to lawful self-defence of persons or property
- Protected by defamation law privileges (absolute privilege, public documents, fair reporting)
Exemptions apply to certain organisations and individuals, including:
- Government agencies and authorities
- Law enforcement bodies
- Intelligence agencies
- Minors under 18 years of age
The defences and exemptions are designed to balance the protection of privacy with other public interests and ensure that the tort is applied in a way that is fair and reasonable.
Federal Court and Invasion of Privacy
The Federal Court has jurisdiction to hear claims under the new statutory tort for serious invasions of privacy.
The court serves as an important forum for individuals to seek redress for serious invasions of their privacy, offering a range of remedies, including damages, injunctions, and apologies. The court’s decisions will play a critical role in shaping the development of the new tort and promoting privacy protection.
Preparing for the New Invasion of Privacy Tort
Since the 11 June commencement date, legal practitioners have seen significant litigation testing the boundaries and application of this new tort. While balancing competing interests, such as press freedom and public safety, this legislation provides Australians with long-awaited legal protection against serious privacy invasions. In these early stages, organisations need to:
- Review current privacy practices and data handling procedures
- Update policies and training for employees that reflect new legal obligations
- Assess potential liability for existing practices
- Seek legal advice on compliance strategies
Other Legislation Amendment
The new statutory tort is part of a broader package of reforms to the Privacy Act and other legislation that aims to strengthen privacy protection and provide individuals with greater control over their personal information.
The other legislation amendment bill includes changes to the Australian Consumer Law and other laws to promote privacy protection. If you are unsure about how changes to these other forms of legislation may affect you as a consumer, business or organisation, it’s best to seek out legal advice.
Key Takeaways
- Unlike other legal claims, you don't need to prove financial damage – the law recognises that privacy violations cause inherent harm worth compensating.
- You can seek financial compensation up to $478,550, court orders to stop ongoing invasions, destruction of private material, and even public apologies.
- You must start legal proceedings within one year of discovering the privacy invasion, with an absolute maximum of three years from when it occurred.
- To succeed, you must prove that protecting your privacy is more important than competing interests like media freedom, which you'll need to establish in court.
Stay Ahead of Changes in Legislation with the Right Advice
The new statutory tort for serious invasion of privacy is part of a global trend towards greater protection of individuals’ privacy. Other countries, such as the UK, have introduced similar torts to protect individuals’ privacy in the past, and this new legislation is designed to be consistent with international best practice.
For more information about how these changes may affect you or your organisation, contact Burke Mead Lawyers for a free consultation.
