By: Richard Leder, Georgie Austin, Nicole Gabryk, Zoë Burchill and Isabelle Ferrali

At a glance

  • From 10 June 2025, serious invasions of privacy will become legally actionable in Australia. This marks a major reform, introducing a new privacy tort that allows individuals to bring claims for either intrusions upon seclusion (such as unauthorised surveillance) or misuse of private information.
  • To succeed, plaintiffs must satisfy several key legal thresholds: there must be a reasonable expectation of privacy, the conduct must be intentional or reckless (not merely negligent), and the invasion must be serious. Courts will also weigh whether the public interest in protecting privacy outweighs competing interests such as freedom of expression or public safety.
  • The Act includes targeted exemptions and tailored remedies. Exemptions apply to journalists, law enforcement, intelligence agencies, and minors. Available remedies include injunctions, damages (including for emotional distress), account of profits, and destruction or return of private material.

Introduction and context to the reforms

From 10 June 2025, serious invasions of privacy will be actionable in Australia. This follows decades of judicial consideration as to whether and if so how, the right to privacy should be recognised and protected.

The Privacy and Other Legislation Amendment Act 2024 (Cth) (the Act),1 introduces a new statutory tort for serious invasions of privacy, and will be contained in Schedule 2 of the Privacy Act 1988 (Cth).2

The introduction of the new tort responds to longstanding concerns regarding deficiencies in Australia’s privacy laws. As far back as 2008, recommendations were made by the Australian Law Reform Commission’s, ‘For Your Information: Australian Privacy Law and Practice’ report.3 The ALRC Report responded to concerns surrounding the rapid advances in information, storage, surveillance and other relevant technologies, as well as changing community perceptions of privacy and the extent to which it should be protected by legislation.4

Recommendation 74 specifically addressed the protection of the right to personal privacy and made a series of recommendations relating to a new statutory cause of action for serious invasions of privacy.5 In large part, the sentiments of those recommendations are reflected in the new tort that comes into effect on 10 June 2025.

This new tort provides a recourse for persons who are affected by an invasion of privacy which might fall outside the scope of the Privacy Act and is intended to be a stand-alone provision which is independent from the Privacy Act and should be interpreted separately from the provisions in the Privacy Act. We have covered the broader privacy reforms across our Cyber, Privacy & Technology Reports. Click here to view our most recent release.

Elements of the tort

Element Comment
The defendant will have invaded the plaintiff’s privacy if they do one or both of the following:

 

1. Intruded upon the plaintiff’s seclusion,6

2. Misused information that relates to the plaintiff.7

 Intrusion upon seclusion relates to a person’s physical privacy. It may involve conduct such as watching, listening or recording someone’s private affairs.8

 

Misusing information relates to the security of personal information. It can include the collection, use or disclosure of information about an individual.9
A person in the position of the plaintiff would have had a reasonable expectation of privacy in the circumstances.10 The court can consider:

 

1. the means, including the use of any device or technology, used to invade the plaintiff’s privacy,

2. the purpose of the invasion of privacy,

3. attributes of the plaintiff including the plaintiff’s age, occupation or cultural background,

4. the conduct of the plaintiff, including whether the plaintiff invited publicity or manifested a desire for privacy,

5. if the defendant invaded the plaintiff’s privacy by intruding upon the plaintiff’s seclusion, the place where the intrusion occurred,

6. if the defendant invaded the plaintiff’s privacy by misusing information that relates to the plaintiff, including the following:

a) the nature of the information, including whether the information related to intimate or family matters, health or medical matters or financial matters,

b) how the information was held or communicated by the plaintiff,

c) whether and to what extent the information was already in the public domain.11
The invasion of privacy was intentional or reckless.12 The invasion must be either intentional or reckless, as distinct from mere negligence.

 

Under Section 5.4 of the Criminal Code Act 1995 (Cth), a person is reckless if they are aware that a substantial risk exists or will exist, and in the circumstances, it is an unjustifiable risk to take.

This is a higher threshold than the civil standard of negligence that is often applied to other torts.
The invasion of privacy was serious.13 The court may consider:

 

1. the degree of any offence, distress or harm to dignity that the invasion of privacy was likely to cause to a person of ordinary sensibilities in the position of the plaintiff,

2. whether the defendant knew or ought to have known that the invasion of privacy was likely to offend, distress or harm the dignity of the plaintiff,

3. if the invasion of privacy was intentional, whether the defendant was motivated by malice.14
The public interest in the plaintiff’s privacy outweighed any countervailing public interest.15 As outlined in the Act, any of the following matters of public interest may constitute a countervailing public interest:

 

1. freedom of expression, including political communication and artistic expression,

2. freedom of the media,

3. the proper administration of government,

4. open justice,

5. public health and safety,

6. national security,

7. the prevention and detection of crime and fraud.16

Defences

The Act provides for several defences to the new tort. They attempt to balance other public interests with the protection against invasions of privacy.

There is also a media exemption, discussed below.

Defences Comment
The invasion of privacy was required or authorised by or under an Australian law or court/tribunal order.17 This could include mandatory reporting obligations or compliance with a compulsory court process.
The plaintiff, or person with lawful authority to do so for the plaintiff, expressly or impliedly consented to the invasion of privacy.18 For example, instances where a person agreed to give another person access to their electronic device or social media account.
The defendant reasonably believed that the invasion of privacy was necessary to prevent or lessen a serious threat to the life, health or safety of a person.19 This may occur in circumstances where the defendant found themselves in or was responding to imminent danger or an emergency involving the plaintiff.
The invasion was incidental to the exercise of lawful defence of persons or property, and was proportionate, necessary and reasonable.20 For example, a person may record or film another person illegally entering or damaging their property.

Overlap with Defamation Law

There are also several defences which find their genesis in defamation law. In certain instances, where a defendant is found to have invaded the plaintiff’s privacy by publishing, within the meaning of Australian defamation law, information that relates to the plaintiff, each of the following are available defences:

Defences Comment
Absolute Privilege.21 For example, information that is provided in judicial or parliamentary proceedings.
Publication of public documents.22 This could include the publication of a written court order or a judgment.
Fair report of proceedings of public concern.23 The reporting of events occurring in a court room or parliamentary inquiry is one example.

These defences closely mirror defences contained within the Defamation Act 2005. For example, Section 27 (relating to Absolute Privilege), Section 28 (relating to the publication of public documents) and Section 29 (relating to fair reporting of proceedings of public concern) of the Defamation Act are reflected verbatim in the new tort.

Whilst there is overlap between defamation law and the new tort, there remain distinct differences. The new tort seeks to protect a person’s privacy, whereas defamation protects a person’s reputation. Relatedly, the new tort does not require information to be published and if a defendant is found to have invaded the plaintiff’s privacy by misusing information that relates to the plaintiff, it is immaterial whether the information was true.24 In defamation law, publication is a key element and truth is a complete defence to a defamation action. Practitioners should therefore be mindful of the particulars of the harm the plaintiff seeks to remedy. In some instances, defamation and privacy interests may both be affected. As the interplay in relation to damages is yet to be determined, it would be wise for practitioners to plead the two causes of action separately.

The absence of a truth defence highlights a fundamental distinction between the protection afforded by defamation and by the new privacy tort. If something is defamatory but true, the publisher has a defence. However it will often be the case that privacy is invaded by revealing something that is true. If truth protected the publisher of the private information, the new tort would lose most of its impact.

A striking example of this is the 2001 media publication of photos of supermodel Naomi Campbell leaving a drug rehab clinic. She sued alleging that her privacy had been invaded by the publication of the photos and her claim was ultimately upheld by the House of Lords, on the basis that there had been a misuse of her private information (MOPI). While this decision was founded on the European Convention of Human Rights, which is not operative in Australia, it is often pointed to as the rationale behind a privacy tort.

Exemptions

Certain key exemptions apply. The above provisions do not apply where:

Exemptions Comments
The invasion of privacy involves the collection, preparation for publication or publication of journalistic material by a:

 

1. Journalist,25

2. Employer of, or a person engaging, a journalist,26

3. Person assisting a journalist who is employed by the employer of the journalist,27

4. Person assisting a journalist in a professional capacity.28

 A journalist is a person who:

 

1. works in a professional capacity as a journalist,29 and

2. is subject to a standards of professional conduct that apply to journalists or a code of practice that applies to journalists.30

Even though we do not yet know how the exemption will be interpreted, the exemption appears to be geared towards traditional media and journalists who are governed by professional standards.

The Supplementary Explanatory Memorandum to the Act indicates that the purpose of this language is to promote the right of freedom of expression.31 In particular, the definition of journalist ‘reflects the current media operating environment, where journalists may work as contractors as well as employees, or sell their material to publishers for publication’.32

Material is journalistic material if it:

1. has the character of news, current affairs or a documentary,33 or

2. consists of commentary or opinion on, or analysis of, news, current affairs or a documentary,34 or

3. consists of editorial content relating to news, current affairs or a documentary.35

This is likely to be the most contentious aspect of the new tort. The language is broad, leaving open considerable scope for interpretation. The purpose of this definition of journalist material is made clear in the Supplementary Explanatory Memorandum which states that: ‘the effect of the expansion of the journalist exemption would be to ensure the correct operation of the balance between freedom of expression and the right to protection against arbitrary and unlawful interference with privacy.

The safeguards are built into the mechanism of the statutory tort to ensure an appropriate balance between these interests would continue to apply’.36 Despite this, commentators are concerned about the considerable power given to journalists and consequently, the narrowed scope for potential claims, especially against large media defendants.
The invasion of privacy is by an agency or a State or Territory authority to the extent that the agency invades the person’s privacy in good faith such as:

 

1. In the performance or purported performance of a function of the agency or authority,

2. In the exercise or purported exercise of a power of the agency or authority,

3. This extends to staff members of the agency or authority.37

  The introduction of this exemption limits the circumstances in which an individual could take action and therefore limits the effect of the right to privacy.

 

However, the Supplementary Memorandum indicates that the ‘limitation is reasonable, necessary and proportionate as the exemption is restricted to activities that are connected to functions and powers of a government agency or State or Territory authority that are performed in good faith’.38

At face value, an exemption of this sort is logical if one accepts the role of government is, in part, to monitor individuals engaging in illegal conduct. However, one would be remiss not to highlight the significant power this language affords authorities and agencies to execute their functions.
The invasion of privacy is by a law enforcement body and extends to:

 

1. The law enforcement body,

2. A staff member of a law enforcement body in the performance of the person’s duties as a staff member,

3. A disclosure of information to a law enforcement body,

4. Information that was disclosed by a law enforcement body.39

 This is likely to be an uncontroversial inclusion given most people accept covert activities are necessary in order to facilitate a range of safety and accountability mechanisms to protect the community.

 
The invasion of privacy is by an intelligence agency and extends to:

 

1. The intelligence agency,

2. A person who is an ASIO affiliate, agent or staff member of an intelligence agency in the performance of functions or services of ASIO,

3. A disclosure of information to an intelligence agency,

4. Information that was disclosed by an intelligence agency.40

 In this context, ‘agency’ would have the same meaning as in the Privacy Act 1998 (Cth) and ‘ASIO affiliate’ would have the same meaning as in the Australian Security Intelligence Organisation Act 1979 (Cth).
The invasion of privacy is by a person who is under 18 years of age.41 This means that civil liability under the tort does not apply to children. This position reflects the view that age is a factor in an individual’s understanding of the implications of their conduct.

 

This is an interesting inclusion given the complexities surrounding widespread social media and internet use by young people.

Remedies

Harm is not required to establish a breach of the statutory tort, as distinct from defamation. In saying this, the Act provides a suite of remedies that are tailored to address the varying degrees of damage and diverse circumstances in which the plaintiff may have been harmed.42 These remedies include:

Remedies Comments
Injunctions

 

The court may, at any stage of the proceedings, grant an injunction restraining the defendant from invading the plaintiff’s privacy.43

 If the invasion involved publishing information that relates to the plaintiff, the court must have particular regard to the public interest in the publication.
Damages

 

1. This does not include an award for aggravated damages.

2. It does include awards for emotional distress.

3. In exceptional circumstances, the court may award exemplary or punitive damages.

4. Damages for non-economic loss cannot exceed $478,550 (or the maximum amount that may be awarded in defamation proceedings).44

 In the context of damages, the court may consider whether the defendant has apologised to the plaintiff, whether the defendant published a correction, and whether during the course of proceedings, the defendant engaged in conduct that subjected the plaintiff to additional embarrassment, harm, distress or humiliation.

 
An order that any material (including copies) be destroyed, be delivered to the plaintiff or be dealt with as the court directs.45

 

1. This includes material that is in the defendant’s possession, or that the defendant is able to retrieve,46 and

2. Material that was obtained, made or misused as a result of the invasion.47
Account of profits

 

Applicable in circumstances where the defendant has profited from their wrongdoing, requiring them to hand over the profits to the plaintiff.48

Limitation periods

A plaintiff must commence proceedings within one year of becoming aware of the invasion of privacy or within three years of the invasion of privacy having occurred, whichever is earlier. These limitation periods do not apply where a plaintiff is under 18 years when the invasion of privacy occurred – in which case the proceedings must be commenced before their 21st birthday, or a plaintiff obtains a court order extending the time for commencing proceedings where it was not reasonable in the circumstances for the plaintiff to have commenced the proceedings within the limitation period.49

Relatedly, a single publication rules has been introduced where an invasion of privacy relates to a publication for the purposes of determining the limitation period.50

Comparison to other jurisdictions

United Kingdom

The United Kingdom’s MOPI tort closely mirrors the new Australian tort.

The case of HRH The Duchess of Sussex v Associated Newspapers Limited [2021] EWHC Civ 1810 is aninteresting example to consider. The claim related to the publication in several articles of the contents of a 5-page handwritten letter which Meghan Markle had sent her father in 2018. This case highlighted well the two-stage test for the tort of misuse of private information in the UK:

At [30]: ‘At stage one the question is whether the claimant enjoyed a reasonable expectation of privacy in respect of the information in question. One way the question has been put is to ask whether a reasonable person, placed in the same position as the claimant and faced with the same publicity, would feel substantial offence. There must be something of a private nature that is worthy of protection. In some cases, the answer will be obvious, but the methodology is to make a broad objective assessment of all the circumstances of the case’. Note the factors listed at [30] mirror our new Australian tort very closely in relation to reasonable expectation of privacy.

At [31]: ‘At stage two, the question is whether in all the circumstances the privacy rights of the claimant must yield to the imperatives of the freedom of expression enjoyed by publishers and their audiences’. This is reflected in our new Australian tort in that public interest in the plaintiff’s privacy must outweigh any countervailing public interest, including and not limited to, freedom of the media.

The ‘balancing act’ (undertaken to assess Meghan Markle’s’ privacy rights relative to freedom of expression) found that the disclosures in the articles were ‘manifestly excessive’. Campbell was relied upon in this context: ‘a person may attract or even seek publicity about some aspects of his or her life without creating any public interest in the publication of personal information about other matters’. A similar balancing act will likely be undertaken under our new Australian tort given the need to balance privacy with freedom of the media.

Finally in relation to the UK, jurisprudence indicates that a MOPI requires a positive action on behalf of the defendant. For example, in Warren v DSG Retail Ltd [2021] EWHC 2168, it was found that a company who suffers a cyber-attack through which customer data is stolen cannot be held liable for misuse of that information.

United States

Australia’s new tort mirrors the US in relation to the intrusion upon a person’s seclusion, which relates to physical privacy as distinct from misusing information. Interestingly, in the ALRC Report it was stated that the Act should contain a non-exhaustive list of the types of invasion. For example, a serious invasion of privacy may occur where: (a) there has been an interference with an individual’s home or family life, (b) an individual has been subjected to unauthorised surveillance, (c) an individual’s correspondence or private written, oral or electronic communication has been interfered with, misused or disclosed, or (d) sensitive facts relating to an individual’s private life have been disclosed.51

Despite this recommendation, the new tort has instead adopted the language used by the US’ tort of privacy, where it is said that a right to privacy is invaded by ‘unreasonable intrusion upon the seclusion of another’.52 It will be interesting to see if the interpretation of this element aligns with US jurisprudence which confirms that you do not need to physically invade someone’s privacy to be seen as invading their physical privacy.53

[1] Privacy and Other Legislation Amendment Act 2024 (Cth) (the Act).

[2] Privacy Act 1988 (Cth).

[3] Australian Law Reform Commission, ‘For Your Information – Australian Privacy Law and Practice’ (Report, May 2008) (the ALRC Report).

[4] Ibid page 19.

[5] Ibid page 88.

[6] Section 7(1)(a)(i) of the Act.

[7] Section 7(1)(a)(ii) of the Act.

[8] Section 6 of the Act.

[9] Ibid.

[10] Section 7(1)(b) of the Act.

[11] Section 7(5) of the Act.

[12] Section 7(1)(c) of the Act.

[13] Section 7(1)(d) of the Act.

[14] Section 7(6) of the Act.

[15] Section 7(1)(e) of the Act.

[16] Section 7(3) of the Act.

[17] Section 8(1)(a) of the Act.

[18] Section 8(1)(b) of the Act.

[19] Section 8(1)(c) of the Act.

[20] Section 8(1)(d) of the Act.

[21] Section 8(3)(a) of the Act.

[22] Section 8(3)(b) of the Act.

[23] Section 8(3)(c) of the Act.

[24] Section 7(7) of the Act.

[25] Section 15(1)(a) of the Act.

[26] Section 15(1)(b) of the Act.

[27] Section 15(1)(c) of the Act.

[28] Section 15(1)(d) of the Act.

[29] Section 15(2)(a) of the Act.

[30] Section 15(2)(b) of the Act.

[31] Supplementary Explanatory Memorandum to the Privacy and Other Legislation Amendment Bill 2024 (Supplementary Explanatory Memorandum).

[32] Ibid page 9.

[33] Section 15(3)(a) of the Act.

[34] Section 15(3)(b) of the Act.

[35] Section 15(3)(c) of the Act.

[36] Supplementary Explanatory Memorandum page 9.

[37] Section 16 of the Act.

[38] Supplementary Explanatory Memorandum page 6.

[39] Section 16B of the Act.

[40] Section 17 of the Act.

[41] Section 18 of the Act.

[42] Section 12 of the Act.

[43] Section 12(2)(b) of the Act.

[44] Section 11 of the Act.

[45] Section 12(2)(e) of the Act.

[46] Section 12(2)(e)(i) of the Act.

[47] Section 12(2)(e)(ii) of the Act.

[48] Section 12(2)(a) of the Act.

[49] Section 14 of the Act.

[50] Section 19 of the Act.

[51] The ALRC Report page 88.

[52] American Law Institutes’ Restatement (Second) of Torts on privacy section 652B.

[53] Bisbee v John C Conover Agency, Inc App Div 1982.