Statutory tort for serious invasions of privacy

From 10 June 2025, a new statutory cause of action in tort will allow a person to sue another for a serious invasion of privacy [Privacy Act 1988 (Cth) Schedule 2].

A plaintiff will have a cause of action against a defendant where [cl 7]:

the defendant invaded the plaintiff's privacy by
- intruding upon the plaintiff's seclusion, or
- misusing the plaintiff's information, and
a person in the plaintiff's position would have had a reasonable expectation of privacy, and
the invasion of privacy was intentional or reckless, and
the invasion of privacy was serious, and
the public interest in the plaintiff's privacy outweighs any other public interest.

Intruding upon the seclusion of an individual may involve physically intruding into the person's private space, or watching, listening to or recording the person's private activities or private affairs [cl 6]. This could involve, for example, spying on or filming someone in their own home.

Misusing an individual's information may involve collecting, using, or disclosing information [cl 6]. This could involve, for example, maliciously releasing an individual's information online without their consent (commonly known as doxxing). The misused information need not be true [cl 7(7)].

Factors relevant to whether a person in the plaintiff's position would have had a reasonable expectation of privacy include [cl 7(5)]:

the means used to invade the plaintiff's privacy
the purpose of the invasion of privacy
the plaintiff's age, occupation, cultural background and other attributes
the conduct of the plaintiff, including whether they invited publicity or indicated a desire for privacy
if the invasion of privacy was by the misuse of information, the nature and sensitivity of the information, how the information was held or communicated by the plaintiff, and whether the information was already public.

Factors relevant to whether an invasion of privacy will be regarded as serious include [cl 7(6)]:

the degree of any offence, distress or harm to dignity that the invasion of privacy was likely to cause a reasonable person in the plaintiff's position
whether the defendant knew or ought to have known that the invasion of privacy was likely to offend, distress or harm the dignity of the plaintiff
whether the defendant was motivated by malice.

A plaintiff need not prove any actual damage to succeed in a claim [cl 7(2)].

Remedies

The court may award damages to a successful plaintiff, including damages for emotional distress, and exemplary or punitive damages in exceptional circumstances [cl 11]. Damages for non-economic loss and any exemplary or punitive damages are capped at the greater of $478,550 or the maximum amount that may be awarded in defamation in Australia [cl 11].

In addition to, or instead of, awarding damages, the court may order remedies including an account of profits, an injunction, a correction order, a requirement that the defendant apologise to the plaintiff, and a declaration that the defendant has seriously invaded the plaintiff's privacy [cl 12]. An injunction may also be granted at any time during proceedings to restrain a defendant from invading the plaintiff's privacy [cl 9].

An apology from a defendant does not constitute an admission of fault or liability but may be considered by the court when determining any award of damages [cl 13].

Defences

The Privacy Act 1988 (Cth) sets out a number of defences to an action for a serious invasion of privacy [cl 8]. A claim may be successfully defended if:

the invasion of privacy was required or authorised by law or court order
the plaintiff or their agent expressly or impliedly consented to the invasion of privacy
the defendant reasonably believed that the invasion of privacy was necessary to prevent or reduce a serious threat to the life or safety of a person
the invasion of privacy was incidental to the exercise of a lawful right of defence of persons or property and was proportionate, necessary and reasonable
the invasion of privacy was constituted by the publication of information and the defendant would have a valid defence of absolute privilege, publication of public documents, or fair report of proceedings of public concern, under the law of defamation.

Exemptions

In addition to statutory defences, the Privacy Act 1988 (Cth) also exempts a number of persons and agencies from the operation of Schedule 2 including:

journalists and their employers and employees, if the invasion of privacy involved the collection, preparation or publication of journalistic material [cl 15]
government agencies or State or Territory authorities (including their staff), if the invasion of privacy occurred in good faith in the performance of their functions [cls 16, 16A]
law enforcement bodies and their staff [cl 16B]
intelligence agencies and their staff [cl 17]
persons under the age of 18 [cl 18].

An invasion of privacy will also be exempt from the operation of Schedule 2 if it is constituted by the disclosure of information to a law enforcement body or intelligence agency [cls 16B, 17].

Time limits

Proceedings for a serious invasion of privacy must be commenced within 1 year of the plaintiff becoming aware of the invasion of privacy, or within 3 years after the invasion of privacy occurred (whichever is earlier) [cl 14(1)(b)].

A plaintiff who was under the age of 18 at the time of the alleged invasion of privacy must commence proceedings before their 21st birthday [cl 14(1)(a)].

The court may extend the time within which a plaintiff may commence proceedings, but no later than 6 years after the invasion of privacy occurred [cl 14(2) - (4)].

Statutory tort for serious invasions of privacy : Last Revised: Fri May 9th 2025
The content of the Law Handbook is made available as a public service for information purposes only and should not be relied upon as a substitute for legal advice. See Disclaimer for details. For free and confidential legal advice in South Australia call 1300 366 424.

Legal Help for all South Australians

Refine results

Search by

Statutory tort for serious invasions of privacy

Connect with us