Australia introduces statutory tort of serious invasion of privacy (APAC)

Late last year, the Australian Government enacted a series of reforms to the Privacy Act 1988 (Cth). One of those reforms, the introduction of a new statutory tort of serious invasion of privacy, comes into effect on 10 June 2025.

Australia’s evolving legal recognition of privacy rights

Unlike the US, where several privacy torts have existed for almost a century, Australian common law has never recognised a right of privacy. In 1937, the High Court in Victoria Park Racing and Recreation Grounds Co Ltd v Taylor held that a landowner had no right to prevent a person from looking into their property, and subsequent decisions have reaffirmed that principle.

Nevertheless, it has been clear for some time that the lack of a right to privacy in Australia has become increasingly problematic. Australians are becoming increasingly concerned about how their personal information is handled by businesses, about the intrusiveness of surveillance, and about the rise of artificial intelligence. Until now, those who considered that their privacy rights had been infringed have had to rely on a variety of other laws – employment laws about workplace surveillance, defamation law, laws against trespass, or criminal laws prohibiting stalking and harassment.

The new statutory tort of serious invasion of privacy

The creation of a “statutory tort” (i.e. a cause of action similar to a tort but set out in legislation) of serious invasion of privacy has been proposed for many years. The tort created by the Privacy and Other Legislation Amendment Act 2024 (Cth) (the Act) is similar in form to that proposed by the Australian Law Reform Commission in 2014.

Under the new tort, a plaintiff will be able to establish a cause of action if:

1. there has been a serious invasion of the plaintiff’s privacy, either by:
   1. an intrusion upon the plaintiff’s seclusion (which may include where a defendant watches or eavesdrops on the private activities or affairs of the plaintiff); or
   2. a misuse of the plaintiff’s personal information;
2. the plaintiff had a reasonable expectation of privacy in the circumstances;
3. the invasion of privacy was intentional or reckless;
4. the invasion of privacy was serious; and
5. the public interest in the plaintiff’s privacy outweighs any countervailing public interest. “Countervailing public interests” include freedom of expression, freedom of the press and public health and safety.

Significantly, a plaintiff does not need to prove that they have suffered loss or damage in order to take action.

Defences include that:

1. the plaintiff had consented;
2. the invasion of privacy was authorised by law; and
3. the invasion of privacy was necessary to prevent or lessen a serious threat to the life, health or safety of a person or defend property.

Key exemptions

In response to concerns that the tort would have a chilling effect on media reporting on the private lives of public figures, the Act provides for an exemption for journalists and media outlets, where the invasion involves the collection, preparation for publication or publication of journalistic material. A “journalist” is limited to professional journalists who are subject to the standards of professional conduct or a code of practice that applies to journalists (and so the tort would still apply to the acts of amateur “citizen journalists” who report on social media).

The Act also exempts the acts of any person under 18 years of age, and the acts of law enforcement and intelligence services.

Remedies, caps on damages, and limitation periods

Courts will be entitled to award damages (including for emotional distress) or an account of profits, grant injunctions, and make a range of other orders including requiring an apology from the defendant. The Act caps damages for non-economic loss and punitive damages at the greater of A$478,550 or the maximum amount of damages for non-economic loss that could be awarded under defamation proceedings in Australia.

Plaintiffs are required to commence proceedings within three years of the invasion of privacy occurring, or within a year of becoming aware of the invasion of privacy, whichever is earlier.

Comment

Australia is not traditionally a highly litigious society, but Australians are becoming more conscious of their privacy rights, and the first two Australian data breach class actions are currently underway. It will be interesting to see whether the new statutory tort leads to significant volumes of litigation.

It is also worth noting that, with the re-election of a majority Labor government at the Australian federal election in May 2025, further reforms to the Privacy Act 1998 (Cth) are expected in the near future.