There is now a tort of serious invasions of privacy. It is a statutory tort. It became law on 10 June 2025.1 This note answers some key questions about the new tort.
Is the new tort just about conduct concerning personal information?
No. The new law is in Schedule 2 of the Privacy Act 1988 (Cth), but many of that Act’s provisions do not apply2 and a misuse of someone’s personal information is not required. Of the 5 elements a plaintiff would need to establish, the first is that there has been an invasion of the plaintiff’s privacy in one of two ways. The Act does not give a definition of “invasion of privacy”. One of the required ways is that there has been an intrusion on the plaintiff’s seclusion. This concept is not defined. The other is that the defendant has misused information relating to the plaintiff. This can be any kind of information (personal or not). Misusing information relating to an individual is defined to include collecting, using or disclosing information about the individual.3
Will the tort be committed if the plaintiff did not have a reasonable expectation of privacy in all of the circumstances?
No. Such a reasonable expectation is the second element to make out a case. The Act outlines several considerations for the court when deciding on this.4
Are the defendant’s intentions relevant?
Yes. The third element is that the invasion of privacy must have been intentional or reckless.
Is the tort committed for any kind of invasion?
No. The fourth element is that the invasion must be serious. No proof of damage is required. The statutory guideposts to the concept of seriousness point to a broad range of circumstances, including the degree of distress to the plaintiff’s dignity.
Is it a defence that there was a good reason for the defendant’s conduct?
Possibly. The fifth and final element of the tort is that the public interest in the plaintiff’s privacy must have outweighed any countervailing public interest. Relevant countervailing public interests are nonexclusively referred to in broad terms, which include freedom of expression (for example political and artistic expression) and “open justice”.5 Available defences include the plaintiff’s consent and acting with lawful authority. Where the invasion concerns a dealing with information about an individual, the truth or otherwise of that information is immaterial.
Is defamation law relevant to this tort?
Yes. Where the invasion concerns a publication of information within the meaning of defamation law, available defamation law defences apply.6 While an apology is not relevant to liability, it may be taken into account in determining an award of damages.7 There is a single publication rule to the effect that where there are substantially similar re-publications by the same publisher in materially the same way, the invasion occurs on the day of the first publication only.8
Are there some who cannot be a defendant?
Yes. These are mainly children (those under 18), journalists and those involved in law enforcement and the nation’s intelligence.9 Claims cannot be made or continued on behalf of, or against, a person who has died.10
Are there limitation periods caps on damages?
As to the limitation period, yes. This is generally the earlier of 1 year after the plaintiff became aware of the invasion and 3 years after the invasion of privacy occurred. For invasions concerning those under 18 years, the plaintiff has until their 21st birthday to commence proceedings. As to damages, there is a cap for the sum of non-economic loss and punitive damages of $478,550.11
Anna Sharpe is the Principal of Sharpe Ivo and chair of Queensland Law Society’s Privacy, Data, Technology and Intellectual Property Committee.
Footnotes
1 Under the Privacy and Other Legislation Amendment Act 2024 (Cth)
2 Paragraphs 6(2) and 6(3)
3 Paragraph 6(1)
4 Paragraph 7(5)
5 Paragraph 7(3)
6 Paragraphs 8(2) and 8(3)
7 Paragraph 11(6)
8 Paragraph19
9 Paragraphs 15, 18
10 Paragraph 20
11 Paragraph 11(5).
Share this article