By Luke Geary, Partner, Luke Borgert, Senior Associate & Samantha Bond, Graduate

On 10 June 2025, the Privacy and Other Legislation Amendment Act 2024 (Cth) introduced a statutory tort for serious invasions of privacy into Schedule 2 of the Privacy Act 1988.[1]

Prior to this amendment, individuals seeking to protect their privacy interests needed to solely rely on the Australian Privacy Principles (APPs) – a regulatory compliance regime which applies to specified organisations. Individuals seeking direct compensation were limited to relying on other torts such as defamation.

This new legislation provides the elements for a cause of action for serious invasions of privacy, alongside defences, remedies and exemptions. The tort will require a plaintiff to establish the following key elements: that the defendant invaded the plaintiff’s privacy; that there was a reasonable expectation of privacy; that the invasion of privacy was intentional or reckless; that the invasion was serious and that the public interest in privacy outweighed any countervailing interests.[2]

A defendant is said to have ‘invaded the privacy’ of a person by intruding upon the plaintiff’s seclusion (e.g., physically intruding into the person’s private space or watching, listening to or recording the person’s private activities or private affairs) or (misusing information that relates to the plaintiff (e.g., collecting, using or disclosing information about the individual). [3] In considering the ‘seriousness’ of the invasion of privacy, regard will be had to, among other things, the offence, distress or harm to dignity caused by the conduct.[4]

The various defences include (without limitation) where the defendant acts: with lawful authority; with consent of the plaintiff; or as necessary to prevent or less a serious threat to life, health or safety. Exemptions exist for intelligence agencies and law enforcement, persons under the age of 18, and journalists or other persons in certain circumstances.

The Court may grant a broad range of remedies including (without limitation): compensation for damages, an injunction, an apology, an account of profits, and/or a declaration that the defendant seriously invaded the plaintiff’s privacy.[5] An award for damages for non-economic loss may include damages for “emotional distress” however this component must not exceed the maximum amount of damages for non-economic loss that may be awarded under defamation proceedings (currently $520,000).[6]

The first case to consider the statutory tort for serious invasions of privacy was Kurraba Group Pty Ltd & Anor v Williams [2025] NSWDC 396.[7] The case concerned an application for injunctive relief following the misuse of private wedding photographs that were never intended to be made public.[8]

Whilst no final determination of the tort was required, the Court held there was a “serious question to be tried”, noting that, “the second plaintiff and his wife were not public figures and had no intention of publishing their wedding photographs to any media or other mass publication organisation”.[9] The defendant was restrained, pending final determination, from further publication and misuse of the wedding photographs.

This landmark new legislation should be viewed as more than a mere a compliance obligation. Unlike the Australian Privacy Principles, the tort creates a direct right of action for individuals. This only heightens the need for organisations to have a strong culture of privacy protection regarding any personal information in its possession.

[1] Privacy Act 1988 (Cth), Schedule 2

[2] Privacy Act 1988 (Cth), Schedule 2, s 7(1).

[3]Privacy Act 1988 (Cth), Schedule 2, s 6.

[4] Privacy Act 1988 (Cth), Schedule 2, s 7(6).

[5] Privacy Act 1988 (Cth), Schedule 2, ss 11 & 12.

[6] Privacy Act 1988 (Cth), Schedule 2, s 11(5).

[7] Kurraba Group Pty Ltd & Anor v Williams [2025] NSWDC 396

[8] Kurraba Group Pty Ltd & Anor v Williams [2025] NSWDC 396, [26].

[9] Kurraba Group Pty Ltd & Anor v Williams [2025] NSWDC 396, [26].