The New Personal Right to Privacy

Australians will soon benefit from a new legal right to privacy, with the introduction of a statutory tort that allows individuals to take action against serious invasions of their privacy.

The statutory tort forms part of various other reforms introduced by the Privacy and Other Legislation Amendment Bill 2024 (Cth), which will see Australia’s long-awaited shift towards the privacy law frameworks of the UK, US, New Zealand and Canada.

What is considered an invasion of privacy?

From 10 June 2025, individuals will be able to take action against someone who has seriously invaded their privacy – by either intruding upon their seclusion, or misusing private information relating to them.

This might include:

• installing hidden cameras to watch and record someone’s private activities;
• sharing another person’s explicit material online; or
• publishing personal health records or financial information.

To have a cause of action, an individual will also need to establish that:

• they had a reasonable expectation of privacy in all the circumstances;
• the invasion was intentional or reckless;
• the invasion was serious; and
• that their right to privacy outweighs any countervailing public interest (for example, freedom of political communication, freedom of the media, the proper administration of government and justice, or public health and safety).

Exemptions & Defences

Certain individuals and bodies will be exempt from the tort. Those that will be exempt include:

• journalists – where the conduct involves the collection or preparation of material for publication;
• agencies and state and territory authorities – where the invasion was done in good faith to perform its functions or exercise a power;
• law enforcement bodies – including disclosures made to and from it;
• intelligence agencies – including disclosures made to and from it;
• persons under the age of 18; and
• deceased persons.

There will also be also a range of defences available, including where the invasion of privacy was required or authorised by a law or court/tribunal order, where the individual consented to the invasion of privacy, where the defendant considered the invasion of privacy to be necessary, and where the invasion of privacy was a lawful and proportionate consequence incidental to the exercise of the right to defend persons or property.

Limitation Period

Individuals seeking to bring a claim under the new tort must do so within a year of becoming aware of the invasion of privacy or, otherwise, within 3 years of the invasion.

Remedies

If the court finds that a serious invasion of privacy has occurred, a range of remedies will be available. They include:

• damages, which must not exceed the greater of $478,550 and the maximum damages for non-economic loss that may be awarded in defamation proceedings (which is currently $478,500);
• an injunction (including an interlocutory injunction);
• a correction order, an order for an apology, or a declaration that there has been a serious invasion privacy; and/or
• an account of profits.

Implications for Businesses

Although companies cannot bring a claim under this tort, they can still be held liable. Therefore, organisations should assess their corporate responsibility risks related to privacy rights. This may entail auditing internal procedures concerning data protection and storage, and reviewing existing contracts to prevent improper use or distribution of private materials.

Queries