Statutory tort for serious invasions of privacy

Changes to the Privacy Act which introduced a statutory tort for serious invasions of privacy commenced on 10 June 2025.

Individuals now have an additional avenue to seek redress for privacy harms in the courts.

The tort enhances individuals’ privacy rights and provides a flexible framework to address current and emerging privacy risks. It is broader in application than the Privacy Act, extending to individuals and other entities that may not necessarily be an Australian Privacy Principle entity. The relevant provisions are contained within Schedule 2 of the Privacy Act.

The Office of the Australian Information Commissioner does not have a direct role in administering the tort. Individuals should seek independent legal advice.

Statutory Tort

An individual (plaintiff) may have a cause of action against another person or organisation (defendant) who has invaded their privacy by doing one or more of the following, in instances where the plaintiff would have had a reasonable expectation of privacy in all the circumstances:

• intruding upon the individual’s seclusion – for example, by physically intruding into their private space;
• misusing information that relates to the plaintiff.

A plaintiff will also be required to demonstrate a number of other factors, including that the public interest in protecting their privacy outweighs any countervailing public interest.

Defences and exemptions

There are several defences and exemptions to the tort. For example, it is a defence if the defendant acted with consent or lawful authority. Exemptions apply in relation to a number of bodies, including but not limited to intelligence agencies, law enforcement bodies and in certain circumstances, journalists.

Timeframes

The statutory tort applies to conduct that occurs after 10 June 2025.

Proceedings under the statutory tort must be commenced within certain timeframes. If a plaintiff is under 18 years of age when the alleged invasion of privacy occurred, proceedings must commence before their 21st birthday. In other circumstances, the timeframe is the earlier of:

• 1 year after the day on which the plaintiff became aware of the invasion of privacy; and
• 3 years after the invasion of privacy occurred.

Remedies

The court may grant remedies as it considers appropriate. This may include, among other remedies, granting damages, an injunction or an order requiring an apology.

Note: This information is general in nature and is not legal advice. Individuals should seek independent legal advice.