You Can Sue for Invasion of Your Privacy
A landmark privacy reform came into force on 10 February 2025, as Australia officially introduced a statutory tort for serious invasions of privacy. Enshrined in Schedule 2 of the Privacy Act 1988 (Cth), the new law empowers individuals to take civil action for significant breaches of their personal privacy—marking a major shift in how privacy is protected in the digital age.
The statutory tort, passed by Parliament in late 2024, forms part of the first tranche of sweeping national privacy reforms.
What Is the New Privacy Tort?
Under the new regime, individuals can sue if their privacy is seriously invaded—whether through unwanted surveillance or the misuse of private information. However, it’s not as simple as claiming an intrusion. Claimants must meet five strict criteria to succeed.
The Hurdles
To establish a claim, all of the following must be proven:
- Invasion of Privacy: This can occur through intrusion upon seclusion (e.g., unauthorized surveillance or physical entry into private spaces) or misuse of private information (e.g., improper collection or disclosure).
- Reasonable Expectation of Privacy: The court must find that a person in the claimant’s position would reasonably expect privacy, considering factors such as their age, role, cultural background, and how publicly available the information already was.
- Fault: The invasion must be intentional or reckless. Negligent conduct is not enough.
- Seriousness: The intrusion must be serious—determined by the level of distress, harm, or indignity caused.
- Public Interest Balancing: Courts will weigh the individual’s right to privacy against competing public interests, including freedom of speech, media reporting, and crime prevention.
Remedies Available to Victims
Courts can award:
- Injunctions: To immediately stop the invasion of privacy
- Damages: For emotional harm, capped at the greater of $478,550 or the maximum non-economic damages allowed in a defamation claim
- Other Orders: Including public apologies, correction notices, or declarations of a serious privacy breach
Who’s Exempt?
Notably, the law carves out several exemptions:
- Journalists and Media Organisations: Protected when gathering or publishing information deemed “journalistic material”
- Government and Law Enforcement: Exempt when acting in good faith in the course of official duties
- Children: Individuals under 18 are exempt from liability
Several legal defences also apply, such as lawful authority, consent, necessity, or where the information was part of public documents or legal proceedings.
Strict Time Limits Apply
Victims must file their claims within 1 year of discovering the privacy breach—or within 3 years of when it occurred, whichever comes first. For minors, cases must be filed before their 21st birthday. Courts may extend the limit to 6 years in exceptional circumstances.
The way forward
While the tort introduces a high bar—requiring serious harm and deliberate misconduct—organisations across media, tech, and private enterprise will need to review internal policies, especially regarding surveillance, data use, and information disclosure.
The public interest defence and journalist exemptions will offer some protection to media and whistleblowers. But for others, the line between public interest and personal intrusion will need to be tested in court.
