Last year brought a major shift in Australia’s privacy laws. What had once been a framework that really focused on individuals making complaints to the Office of the Australian Information Commissioner about privacy breaches, now provides individuals with a direct right to sue for invasions of privacy.
Importantly, for many years small Australian businesses (with an annual turnover of $3 million or less) fell outside the reach of privacy laws. That changed on 10 June 2025, when the new right to privacy was introduced without any exemptions for small business.
An Individual’s Right to Privacy
The new privacy laws give individuals a right to take legal action for serious invasions of their privacy. That emphasis on individuals matters. Although businesses cannot bring claims under the new laws, they are exposed to claims if they breach the laws.
A serious invasion of privacy can happen in two ways:
- intruding on someone’s private space (for example, physically intruding on someone’s private space or recording someone’s private affairs); or
- misusing their private information.
To bring a claim under the new laws, the invasion must be deliberate or reckless and serious. An invasion of privacy caused by negligence will not be enough to constitute a serious breach. In any claim a court has to weigh up competing public interests. In other words, the individual’s right to privacy must outweigh any broader public interest, such as for example the media’s freedom to report.
Potential Exposure to Legal Action
Despite the untested nature of the new laws, we suspect there are several everyday scenarios that are likely to be tested, including:
- CCTV surveillance in workplaces, especially in areas where staff reasonably expect privacy (such as break rooms or private offices);
- recording meetings or calls without consent, particularly where sensitive financial, legal or personal matters are discussed;
- data breaches caused by careless information-handling practices;
- using client personal or financial information for marketing or analytics without clear consent; and
- unauthorised disclosure of sensitive personal information discussed in the boardroom.
The first decision under the new privacy laws
Earlier this year, the first decision under the new privacy laws was handed down. In that case a court granted an injunction preventing the publication of private wedding photographs following a dispute between the parties. The proceedings arose in the following circumstances:
- Mr Smith’s development company lodged a development application for 100 Botany Road, Alexandria which included premises on Wyndham Street.
- Mr Williams later entered a short-term lease for a property on Wyndham Street.
- Two months before the lease ended, Mr Williams told Mr Smith he would oppose the development application.
- During a meeting, Mr Williams demanded $50,000 to remove his objections to the development application. Mr Smith refused the demand.
- Mr Williams then published Mr Smith’s wedding photos where Mr Smith appeared to be intoxicated to imply moral wrongdoing.
- The court found the photos were private as Mr Smith and his wife were not public figures and had no intention of publishing the photos publicly.
- The court granted an injunction preventing Mr Williams from further publishing the photos.
If the matter does not resolve a damages claim will likely follow and it will be interesting to see how the Court will assess damages. We are likely to see similar scenarios play out in court again as the boundaries of the new laws continue to be tested.
What damages can be claimed for a breach of the new privacy laws
If an individual is successful in establishing that their privacy has been seriously invaded, that individual can claim damages capped at $478,500.
Although there is a maximum damages cap of $478,500, individuals may also be entitled to an account of profits. In other words, where a business has earned revenue or other financial gain from an invasion of privacy, it may be required to account for those profits. This means that compensation can be awarded that exceeds maximum cap on damages.
Disclaimer
This information and the contents of this publication, current as at the date of publication, is general in nature to offer assistance to Cornwalls’ clients, prospective clients and stakeholders, and is for reference purposes only. It does not constitute legal or financial advice. If you are concerned about any topic covered, we recommend that you seek your own specific legal and financial advice before taking any action.