A New Cause of Action for Serious Invasions of Privacy

Most citizens, and many lawyers, may not know that a new cause of action for serious invasions of privacy became law in November 2024 and started operation in June 2025. The mainstream media barely reported this reform. If it had, it would have had to tell readers and listeners that the new law exempts the media from its operation under a broad “journalistic materials” exemption.

This article provides an overview of the new federal law and sources to better understand its benefits and its limitations.

Where did the law come from?

Torts that protect privacy have always been with us: for example, trespass to land, private nuisance and battery. But those torts left large gaps in protecting individuals from intrusion upon their seclusion and against the misuse of private information. Specific privacy causes of action developed in the United Kingdom, New Zealand and Canada to fill those gaps. In Australia, the development of new privacy torts was left open by the High Court in 2001 in Lenah Game Meats.[1] But in the following decades, only a few inferior court judges in Australia recognised new causes of action for serious invasions of privacy, and their decisions were not appealed. Superior courts adapted the action for breach of confidence, finding it unnecessary to decide if a new cause of action should be recognised for misuse of private information. In Smethurst,[2] the plaintiffs, a journalist and a media organisation – presumably advisedly – did not rely on a cause of action for invasion of privacy when the opportunity arose over an unlawful police search of a journalist’s home and the seizure of data from her phone. The media organisation that ran the challenge to the legality of the raid may not have wanted the High Court to find such a cause of action existed.

The absence in Australia of any authoritative appellate court endorsement of new privacy torts is one reason that Australia has belatedly gone down the legislative path. The new law is based on the Australian Law Reform Commission’s 2014 report Serious Invasions of Privacy in the Digital Era. That report sat on the shelf for 10 years, until former Attorney-General Mark Dreyfus KC announced its adoption in principle. A hasty legislative process in late 2024 allowed the law to pass before the end of the Albanese government’s first term. During that process, media interests successfully made submissions to be exempt from the law. The government agreed to this over the objections of experts in the field, including Professor Barbara McDonald (who led the ALRC project in 2014) and Professor David Rolph. 

The law which establishes a cause of action for serious invasions of privacy is found in a new schedule 2 to the Privacy Act 1988 (Cth) (Privacy Act). The law recognises in cl 1 that:

• there is a public interest in protecting privacy; and
• the public interest in protecting privacy is balanced with other public interests.

Key features of the cause of action

Under cl 7(1), an individual has a cause of action in tort against another person if:

“(a) the defendant invaded the plaintiff’s privacy by doing one or both of the following:

(i) intruding upon the plaintiff’s seclusion;

(ii) misusing information that relates to the plaintiff; and

(b) a person in the position of the plaintiff would have had a reasonable expectation of privacy in all of the circumstances; and

(c) the invasion of privacy was intentional or reckless;

(d) the invasion of privacy was serious; and

(e) the public interest in the plaintiff’s privacy outweighed any countervailing public interest.”

These elements are explained in the following provisions. Also, concepts such as “a reasonable expectation of privacy” and the process by which privacy interests are weighed against competing interests like freedom of expression are the subject of a large body of caselaw in the UK, where courts developed a cause of action for misuse of private information more than 20 years ago. Australian courts are likely to draw on that caselaw.

Judges in common law jurisdictions such as the UK, Canada and New Zealand have developed either a seclusion tort or a private information tort, and sometimes both. Each cause of action has a common element: a reasonable expectation of privacy and a second stage inquiry (or sometimes a defence) that protects competing rights and interests, such as freedom of expression.

Rather than create a public interest or similar defence that the defendant must prove, the Australian statutory tort adopts the UK approach of requiring the claimant to prove both a reasonable expectation of privacy and that privacy interests should prevail over competing interests.

A key difference between the UK tort and the Australian statutory tort is that the Australian law has an explicit fault element:  intention or recklessness. The statutory tort is not available for a careless invasion of privacy, such as where the holder of private information negligently permits it to be stolen or hacked. The law of negligence or other laws address that kind of case.

Two types of invasion of privacy

The ALRC favoured the creation of a single cause of action to cater for either or both kinds of invasion of privacy, and this model was adopted. An individual’s privacy may be invaded by doing one or both of the following:

(a) intruding upon seclusion, such as by physically intruding into the plaintiff’s private space or by watching, listening or recording the plaintiff’s private activities or private affairs; or

(b) misusing private information, such as by collecting or disclosing private information about the plaintiff.

Clause 6 defines the terms “intruding upon the seclusion” and “misusing information”. 

One can have an intrusion upon seclusion without the collection of information, for example where a stalker observes a familiar and static private place. One can have the misuse of private information that is not gathered by an intrusion upon seclusion.  Factually, an intrusion upon seclusion and a misuse of the information thereby obtained may overlap. Kaye v Robertson[3] is a good example of an episode of both physical intrusion by journalists into the privacy of a seriously injured hospital patient, and misuse of the information thereby obtained. Many other cases involve both intrusion upon seclusion and misuse of information.[4] 

A reasonable expectation of privacy

Clause 7(5) does not limit the matters that may be considered in determining whether a person in the position of the plaintiff would have had a reasonable expectation of privacy in all of the circumstances. The court may consider the following:

“(a) the means, including the use of any device or technology, used to invade the plaintiff’s privacy;

(b) the purpose of the invasion of privacy;

(c) attributes of the plaintiff including the plaintiff’s age, occupation or cultural background;

(d) the conduct of the plaintiff, including whether the plaintiff invited publicity or manifested a desire for privacy;

(e) if the defendant invaded the plaintiff’s privacy by intruding upon the plaintiff’s seclusion—the place where the intrusion occurred;

(f) if the defendant invaded the plaintiff’s privacy by misusing information that relates to the plaintiff—the following:

(i) the nature of the information, including whether the information related to intimate or family matters, health or medical matters or financial matters;

(ii) how the information was held or communicated by the plaintiff;

(iii) whether and to what extent the information was already in the public domain.”

These considerations call for an objective consideration of whether the claimant had a reasonable expectation of privacy protection. The element is not satisfied by the claimant’s subjective expectation. The considerations resemble the kind of factors developed in the UK.[5]

Fault

As noted, the invasion must be “intentional or reckless” with “reckless” having the same meaning as in the Criminal Code (Cth). The ALRC recommended this form of fault element. 

The tort would not be actionable where there is merely an intention to do an act that has the consequence of invading a person’s privacy.[6] The ALRC clarified that its fault requirement does not mean that the defendant must have intended to commit a legal wrong or intended to fulfil the other ingredients for liability for the tort. Instead, it means that “the defendant needs to have been aware of the facts from which it can be objectively assessed whether or not the plaintiff had a reasonable expectation of privacy and of the facts that an intrusion or disclosure would (or in the case of recklessness, may) occur”.[7] This fault element is easily satisfied in an intrusion case like C v Holland[8] (secret filming of a person showering) or surreptitiously prying into someone’s bank account.[9] It would not be satisfied by the taking of a photograph of a public event, which, without the knowledge of the photographer, captures a private act in the background, since there would not be an intentional or reckless intrusion into the privacy of the affected individual.

Associate Professor Witzleb has argued that this fault requirement sets the bar too high and that a negligence standard would better align the privacy tort with other torts that protect dignitary interests and with the Privacy Act.[10]

Existing causes of action that do not have as demanding a fault element as the new statutory tort, or which do not balance protected interests such as property rights against public interests like freedom of speech, will remain attractive to some claimants.

Seriousness

The invasion must be “serious” and cl 7(6) identifies some considerations in that regard:

“(a) the degree of any offence, distress or harm to dignity that the invasion of privacy was likely to cause to a person of ordinary sensibilities in the position of the plaintiff;

(b) whether the defendant knew or ought to have known that the invasion of privacy was likely to offend, distress or harm the dignity of the plaintiff;

(c) if the invasion of privacy was intentional—whether the defendant was motivated by malice.”

Professors McDonald and Rolph note that this element relates to the invasion itself, rather than any harm that may flow from it, although obviously the two are linked.[11] They explain that it is not just a matter of excluding trivial claims that might in some cases have been struck out as an abuse of process, but of ‘reserving the court’s time for serious matters which go beyond what people should be expected to tolerate in a civil society’.[12]

The public interest in the claimant’s privacy must outweigh any countervailing public interest

This is a key provision that protects a range of interests that under cl 7(3) include:

“(a) freedom of expression, including political communication and artistic expression;

(b) freedom of the media;

(c) the proper administration of government;

(d) open justice;

(e) public health and safety;

(f) national security;

(g) the prevention and detection of crime and fraud.”

Many think that imposing the onus on a claimant to prove that privacy interests outweigh other interests like freedom of expression, rather than creating a public interest defence for the defendant to prove, provided appropriate protection for the media, making the broad exemption for “journalistic materials” in cl 15 unnecessary.

UK courts had developed a similar two stage scheme by which the claimant must first establish a reasonable expectation of privacy, after which the court moves to a second stage of weighing that privacy interest against other competing interests, including freedom of expression under Article 10. 

Neither the privacy right conferred by Article 8 nor the right conferred by Article 10 (freedom of expression) has precedence over the other.  The resolution of the competition between rights is fact-specific. Lady Hale in Campbell explained that the court looks at “the comparative importance of the actual rights being claimed in the individual case; then at the justifications for interfering with or restricting each of those rights; and applies a proportionality test to each”.[13] Lord Steyn in Re S (A Child) distilled the approach as follows:[14]

“First, neither article has as such precedence over the other. Secondly, where the values under the two articles are in conflict, an intense focus on the comparative importance of the specific rights being claimed in the individual case is necessary. Thirdly, the justifications for interfering with or restricting each right must be taken into account. Finally, the proportionality test must be applied to each.”

In HRH The Duchess of Sussex v Associated Newspapers Ltd,[15]Warby J (as Warby LJ then was) described the second stage inquiry under the misuse of private information tort:

“At stage two, the question is whether in all the circumstances the privacy rights of the claimant must yield to the imperatives of the freedom of expression enjoyed by publishers and their audiences …. The competing rights are both qualified, and neither has precedence as such. The conflict is not to be resolved mechanically, on the basis of rival generalities. The Court must focus intensely on the comparative importance of the specific rights being claimed in the particular case; assess the justifications for interfering with each right; and balance them, applying a proportionality test. The Court must have regard to the extent to which it is or would be in the public interest for the material to be published. The decisive factor at this stage is an assessment of the contribution which the publication of the relevant information would make to a debate of general interest. Other factors to be weighed in the balance are the subject-matter, how well-known the claimant is, the claimant’s prior conduct, and editorial latitude.”

In that case Warby J stated:

“Articles aimed solely at satisfying the curiosity of a particular readership regarding the details of a person’s private life, however well-known that person might be, cannot be deemed to contribute to any debate of general interest in society.”[16] 

Defences

Clause 8 of Sch 2 contains several defences:  the invasion was required or authorised by an Australian law or court or tribunal; consent; a reasonable belief of necessity to prevent a serious threat to life, health or safety; the invasion was incidental to defence of persons or property and proportionate, necessary and reasonable. Defences drawn from defamation law like absolute privilege, publication of public documents and fair reports of public proceedings also apply.

The invasion is actionable without proof of damage

Unlike negligence and many other actions that require proof of actual loss, and that do not compensate for distress, the statutory tort is actionable without proof of damage.[17]

Damages

Under UK law, compensation for the unlawful misuse of private information is available for the infringement of the right itself, namely the loss of control of information, as well as any distress.[18] Substantial damages may be awarded for the infringement of the right to control private information itself, not simply for consequential injury like distress. A controversial and unresolved issue in the UK is whether compensation is available for reputational harm. The caselaw on that point conflicts. In Pacini v Dow Jones & Co Inc[19] the law on the recoverability of damages for injury to reputation in non-defamation claims was said to be ‘uncertain and in flux’, even where the information is said to be false and defamatory.  That issue was left unresolved by the ALRC.

Clause 11 of  Sch 2 to the Australian law provides:

“Damages

(1)  Subject to this clause, the court may award damages to the plaintiff.

(2)  The court must not award aggravated damages.

(3)  The court may award damages for emotional distress.

(4)  The court may award exemplary or punitive damages in exceptional circumstances.

(5)  The sum of:

(a) any damages awarded for non‑economic loss; and

(b) any exemplary or punitive damages;

must not exceed the greater of:

(c) $478,550; and

(d) the maximum amount of damages for non‑economic loss that may be awarded in defamation proceedings under an Australian law.

(6) Without limiting the matters that the court may consider in determining the amount of damages, the court may consider the following:

(a) whether the defendant apologised to the plaintiff;

(b) if the defendant invaded the plaintiff’s privacy by publishing information that relates to the plaintiff—whether the defendant published a correction;

(c) whether the plaintiff received or agreed to receive compensation in relation to the invasion of privacy;

(d) whether the plaintiff or the defendant took reasonable steps to settle the dispute;

(e) whether the defendant engaged in conduct after the invasion of privacy, including during the proceedings, that was unreasonable and subjected the plaintiff to particular or additional embarrassment, harm, distress or humiliation.”

The command in cl 11(2) that the court must not award aggravated damages is curious, and hard to align with cl 11(6)(e) which contemplates regard to conduct that would justify such an award. The intent of cl 11(2) may be to reflect the ALRC recommendation that the court may not award a “separate sum” as aggravated damages. If this is the intent, the Act should have said so. If this is the intent, it reflects a similar approach in Australian defamation law where the authorities are generally against awarding a separate amount for aggravated damages, with aggravated damages, if justified, forming part of a single award of compensatory damages.[20] Another view of cl 11(2) is that because the tort is only actionable for intentional or reckless invasions, those aggravating features will arise in every successful case, making an award of aggravated damages for the invasion itself superfluous.

Other remedies

Under cl 11, other available remedies include:

(a) an account of profits;

(b) an injunction;

(c) an order requiring the defendant to apologise to the plaintiff;

(d) a correction order;

(e) an order that any material (including copies):

(i) that is in the defendant’s possession, or that the defendant is able to retrieve; and

(ii) that was obtained or made as a result of the invasion of privacy or was misused during the course of the invasion of privacy;

be destroyed, be delivered up to the plaintiff or be dealt with as the court directs;

(f) a declaration that the defendant has seriously invaded the plaintiff’s privacy.

Minors

Schedule 2 does not apply to an invasion of privacy by a person who is under 18 years of age. This might be said to render the law ineffective to prevent or compensate for serious acts of privacy invasion by minors who intrude upon the seclusion of other minors and share intimate images and information online. Remedies for this kind of misconduct must be found elsewhere in the criminal law or other torts like the tort for intentional infliction of emotional harm.

Exemptions

The law departs from the ALRC recommendations by including:

• a broad exemption for ‘journalists’, their employers and others who are engaged by them (such as a paparazzi photographer) for ‘journalistic material’ (cl 15); and
• exemptions for law enforcement and intelligence agencies (cll 16-17). 

The journalistic materials exemption is complex and uncertain in its scope.  It includes material that ‘has the character of news’. Its interpretation is likely to trouble courts and is the subject of a further article by us.

The law enforcement and intelligence agencies exemptions apply to a range of intelligence organisations, as well as federal, state and territory law enforcement and anti-corruption bodies acting in good faith in the performance or purported performance or exercise of powers and functions. The exemption departs from the ALRC proposal which addressed the activities of those bodies by a defence of lawful authority or requirement, rather than an exemption.

Limitation period

Under cl 14(1), a proceeding under the schedule must be commenced:

“(a) if the plaintiff was under 18 years of age when the invasion of privacy occurred—before the plaintiff’s 21st birthday; or

(b) otherwise—before the earlier of:

(i) the day that is 1 year after the day on which the plaintiff became aware of the invasion of privacy; and

(ii) the day that is 3 years after the invasion of privacy occurred.”

However, the plaintiff may apply to the court for an order that, despite cl 14(1), the plaintiff may commence a proceeding before a day specified in the order. The court may make the order if the court is satisfied that it was not reasonable in the circumstances for the plaintiff to have commenced proceedings in accordance with cl 14(1) in relation to the invasion of privacy. The day specified in the order must not be later than 6 years after the day on which the invasion of privacy occurred.

The limitation period in cl 14 is subject to the ‘single publication rule’ in cl 19 which is similar to the rule as to when time runs for a defamation action for multiple, successive publications of the same material.

Saving of other laws and remedies

Clause 21 explains that the new statutory cause of action “is not intended to limit the concurrent operation of any law, whether written or unwritten, of a State or a Territory”.  Therefore, existing actions may be used, and may provide benefits for claimants over the new statutory cause of action.  For example, a claim in trespass or private nuisance, which is based on a property right rather than an individual’s right to privacy, may provide incidental privacy protection against intrusion upon seclusion, and avoid the need to prove the elements of a specific privacy tort.[21]  However, someone whose privacy is invaded and who lacks title to sue for trespass or private nuisance may be well-advised to bring an action under the new statutory tort.

Existing causes of action, while leaving gaps in privacy protection, remain useful in many circumstances.  For example, in The Game Meats of Australia v Farm Transparency Ltd,[22] the Full Federal Court restrained publication of material that was obtained through trespass, reasoning that the trespasser held copyright of the material on a constructive trust for the claimant. 

Clause 21 means that existing causes of action for breach of confidence remain available for misuse of private information by media interests that may enjoy an exemption from the new statutory tort. An interesting question is whether cl 21 will allow Australian courts to further develop that cause of action into a tort, as occurred in the UK.

The statutory cause of action is for individuals, not corporations

The statutory cause of action is available to an individual, not non-natural persons like corporations. It is intended to implement Australia’s international obligations in relation to privacy, including Article 17 of the International Convention on Civil and Political Rights. This is consistent with privacy torts that have developed in other jurisdictions, which are based on human rights, and have their foundation in human dignity and personal autonomy.[23]

Corporations that are the subject of ‘privacy’ invasions (or more precisely infringement of their property or economic rights)[24] must seek a remedy under the general law or under legislation.

Schedule 2 sits outside the Privacy Act regulatory regime

The statutory tort for serious invasions of privacy is distinct from the regulatory regime established by the Privacy Actwhich requires compliance with the Australian Privacy Principles and is overseen by a regulator. The new cause of action is intended to operate similarly to other torts and be developed through jurisprudence. The Explanatory Memorandum explains that “it is intended that courts would draw on key concepts from other torts, including privacy torts in other jurisdictions”.[25]

Clause 2 states that Sch 2 is intended to be read and construed separately from the rest of the Act. Therefore, expressions and provisions in other parts of the Privacy Act are to be disregarded when determining the meaning of expressions used in Sch 2. Section 94A also states that Sch 2 is to be disregarded in determining the meaning of other parts of the Privacy Act. Therefore, Sch 2 should be read and construed as if it were a free-standing piece of legislation.  It is housed in the Privacy Actfor convenience because it was introduced along with a raft of amendments to that Act by the Privacy and Other Legislation Amendment Act 2024 (Cth).

Conclusion

The new statutory tort is long-overdue.  One of its main virtues is that it defines the cause of action, and expressly balances privacy interests against competing interests.  The statutory tort is more certain and comprehensive than a judge-made cause of action that is developed and defined slowly over the decades as cases haphazardly reach appeal courts. 

The statutory cause of action did not appear out of nowhere.  The ALRC report will be an important reference about its intended operation.  Caselaw from other jurisdictions, particularly from the UK, upon which the ALRC drew, will be an essential source for lawyers who will be asked to advise about the law’s meaning and application.

[1] Australian Broadcasting Corporation v Lenah Game Meats Pty Ltd [2001] HCA 63, (2001) 208 CLR 199.

[2] Smethurst v The Commissioner of Police [2020] HCA 14,(2020) 272 CLR 177.

[3] [1990] EWCA Civ 21, [1991] FSR 62.

[4] The Explanatory Memorandum to the Privacy and Other Legislation Amendment Bill 2024 (Cth) at[389] gives the example of ‘hacking into an individual’s private electronic device and disseminating intimate photographs’.

[5] Murray v Big Pictures (UK) Ltd [2008] EWCA Civ 446, [2009] Ch 48 at [36].

[6] Australian Law Reform Commission, Serious Invasions of Privacy in the Digital Era,Report No 123 (2014) at [7.31].

[7] Ibid at [7.35].

[8] [2012] NZHC 2155, [2012] 3 NZLR 672.

[9] Jones v Tsinge [2011] ONCA 32.

[10] Witzleb, ‘The Case for Negligence as the Mental Element of an Australian Statutory Privacy Tort’ (2023) 29 Tort L Rev 3

[11] McDonald and Rolph, ‘A new statutory tort for serious invasions of privacy’ (2025) 99 ALJ 351, 355.

[12] Ibid.

[13] Campbell v MGN Ltd [2004] UKHL 22, [2004] AC 457 at [140] (“Campbell”).

[14] [2004] UKHL 47, [2005] 1 AC 593 at [17] (emphasis in original).

[15] [2021] EWHC 273 (Ch) at [30] (emphasis added).

[16] Ibid at [103].

[17] Schedule 2, cl 7(2).

[18] Gulati v Mirror Group Newspapers Ltd. [2015] EWCA Civ 1291, [2015] QB 149 at [45].

[19] [2024] EWHC 1709 (KB) at [107].

[20] Wagner v Nine Network Australia Ltd [2019] QSC 284 at [196] – [205].

[21] As for private nuisance, see Fearn v Board of Trustees of the Tate Gallery [2024] AC 1 [111]-[113], [204]; Jeevan Hariharan, ‘The View from the Top: Visual Intrusion as Nuisance in Fearn v Tate Gallery’ (2023) 87 MLR 697, 709-714.

[22] [2025] FCAFC 104.

[23] Campbell v MGN Ltd [2004] UKSC 22, [2004] 2 AC 457[50]-[51],Nicole Moreham and Adam Speker (eds), The Law of Privacy and The Media (4th edn, OUP 2024), [2.53]-[2.71].

[24] As in Lenah Game Meats (n 1) or The Game Meat Company of Australia (n 21).

[25] Explanatory Memorandum, Privacy and Other Legislation Amendment Bill 2024 (Cth) at[358]