Australien | Publikation | Juni 2025
This article was co-authored with Chloe Marks.
As of 10 June 2025, every Australian now has the right to sue for serious invasions of privacy. This extraordinary new right marks the first time individuals can protect and defend their own privacy, instead of going through a government regulator. It is a milestone in a digital era in which individuals can be defamed, doxxed and damned with the touch of a button. We break down what this means for Australians and consider how the statutory tort may work in practice.
The new tort is found in Schedule 2 to the Privacy Act and involves the following five elements, all of which must be proven to establish liability.
a. The degree of any offence, distress or harm to dignity that the invasion of privacy was likely to cause to a person of ordinary sensibilities in the position of the plaintiff.
b. Whether the defendant knew or ought to have known that the invasion of privacy was likely to offend, distress or harm the dignity of the plaintiff.
c. If the invasion of privacy was intentional, whether the defendant was motivated by malice.
If these five elements can be established by the plaintiff, then the defendant will be liable to the plaintiff (unless a defence or exemption applies).
Plaintiffs must commence proceedings within a reasonably short limitation period of one year of becoming aware of the invasion of privacy (see clause 14). However, the limitation period is longer in some cases, such as plaintiffs who were under 18 years when the invasion of privacy occurred.
The defendant can be an individual, a corporation or other entity – the defendant does not need to be covered by the Australian Privacy Principles.
Schedule 2 to the Privacy Act sets out available defences to, or exemptions from, liability, for legitimate activities that are essential in a free, safe and democratic society.
A defendant can apply for a determination of whether an exemption applies before the substantive trial commences.
The Privacy Act exempts journalists (clause 15) and children (clause 18) from liability. For other persons who are not exempt under Schedule 2, a variety of defences are available. They include:
There are a number of exemptions that are specifically relevant to Commonwealth, State or Territory government entities. These are:
| Clause | Who | When |
|---|---|---|
| 16 and 16A | Agencies and State or Territory Authorities (other than an intelligence agency or law enforcement body), and their staff members |
of the agency or authority. |
| 16B | Law enforcement bodies (including staff members) |
|
| 17 | Intelligence agencies (including ASIO affiliate, agent or staff members) |
|
The explanatory memorandum to the Privacy and Other Legislation Amendment Bill 2024 (Cth) explains that including exemptions for government entities recognises that legitimate activities of government may be intrusive of privacy but are justifiable. The justifications include that these activities are necessary to ensure the proper administration of government and keep the broader community safe and secure. However, liability may still arise in some circumstances, such as where the invasion of privacy is not in good faith.
Given there is no case law yet on the application of the new statutory tort, we have considered how the tort may have applied to the factual circumstances in the recent notable privacy case of Waller (A Pseudonym) v Barrett (A Pseudonym) [2024] VCC 96 (Waller v Barrett). It is important to note that a direct application of the facts is not possible as the case did not proceed under statute, rather the court found liability under the common law. However, to illustrate how the statutory tort might apply if it were in force at the time, we provide a high-level consideration of the elements below.
Mr Barrett was the victim of a violent attack in 2010. His wife, who planned his attack with her lover, was later found guilty of his attempted murder. In the years that followed, Mr Barrett and his daughter, Ms Waller, became estranged. In January 2014, Ms Waller and Mr Barrett attended counselling in an attempt to reconcile. Ms Waller also sent a detailed email to her father explaining why she should be permitted to maintain contact with her two younger siblings.
In August 2014, Mr Barrett’s story was published in a book written by an investigative journalist. His story was also detailed in articles published in media outlets. Relevantly, these publications reported information that had been disclosed by Mr Barrett about Ms Waller, from their private counselling session and her email to him.
Ms Waller brought a claim against her estranged father, Mr Barrett, for breach of confidence, breach of statutory duty, negligence and invasion of privacy. Several of Ms Waller’s claims were successful on the grounds of breach of confidentiality and, more contentiously, a breach of a common law right of privacy. How might the case have been decided if the claims had been formulated as a serious invasion of privacy under the new tort?
| Statutory Tort: Serious Invasion of Privacy | |
|---|---|
| Element of tort | Application to facts of the case |
| #1 Invasion of Privacy: Intrusion or Misuse of Information | The facts establish that Mr Barrett disclosed information about Ms Waller’s private life, including the content of a counselling session and a private email, to journalists and authors resulting in publication. This conduct would likely fall within “misusing information that relates to the plaintiff” as defined in Schedule 2, which includes collecting, using, or disclosing information about the individual. Some of the information that was disclosed by Mr Barrett was untrue – this would also be actionable under the statutory tort. |
| #2 Reasonable Expectation of Privacy |
The court in Waller v Barrett found that the information disclosed was highly personal and confidential. Applying the statutory test, it is likely that a person in Ms Waller’s position would have a reasonable expectation of privacy in relation to at least some parts of the information, especially given the sensitive family context and her vulnerability. The Privacy Act provides that the court may consider, among other things:
|
| #3 Intentional or Reckless Conduct | The disclosures were made deliberately by Mr Barrett to journalists and the author of the book, with the knowledge that they would be published. The tort requires that the invasion of privacy must either be intentional or reckless. In the hypothetical case, it would not be enough that Mr Barrell intended to disclose information. The requisite intention must relate to the invasion of the plaintiff’s privacy by misusing information or intruding upon the plaintiff’s seclusion. This requirement will demand a careful examination of the precise intention of the defendant. On the facts here, it would be necessary to determine Mr Barrett’s precise intention when he disclosed the information to the journalists and author. It Mr Barrett merely intended the information to be published (with the invasion of privacy as an unintended consequence), that intention may not be sufficient to establish the claim. Ms Waller would need to demonstrate that Mr Barrett intentionally invaded her privacy by misusing the information. If intention cannot be proven, the alternative is to establish that there was a reckless invasion of Ms Waller’s privacy. The definition of “recklessness” used in the tort takes its meaning from the Criminal Code definition, and sets a higher bar than mere carelessness or negligence. Recklessness means that the defendant must have been aware of a substantial risk of an invasion of privacy and, in the circumstances known to the defendant, that it was unjustifiable to take that risk. Once again, the plaintiff must prove matters relating to the knowledge of the defendant. It is not clear that Mr Barrett specifically intended to invade Ms Waller’s privacy, or that he actually knew that there was a risk of Ms Waller’s privacy being invaded and decided to proceed anyway when it was unjustified to do so. In general, we consider that many potential plaintiffs may find it difficult to prove the requisite intention and knowledge. |
| #4 Seriousness of the Invasion | The Act sets out factors for seriousness, including the degree of offence, distress, or harm to dignity likely to be caused, and whether the defendant knew or ought to have known the likely impact. The court in Waller v Barrett found that the disclosures were particularly distressing to Ms Waller, given her vulnerability and the nature of the information. The publication of private communications and counselling session details may be considered “serious” under the statutory test, as details of private counselling sessions would not typically fall under a legitimate public interest that would justify such an intrusion to privacy. |
| #5 Public Interest Balancing | The statutory tort requires that the public interest in the plaintiff’s privacy outweighs any countervailing public interest (such as freedom of expression, media freedom, or public health and safety). It is likely that a court would find that the specific disclosures about Ms Waller’s private communications and counselling session were not justified by any public interest that would outweigh her right to privacy. It is possible that a court may view the journalism in that case to be tabloid journalism of little public value, which may be contrasted with other media reporting that has greater ramifications for the public. |
| Defences or Exemptions | Consent: There was no evidence that Ms Waller consented to the disclosures. Journalistic Exemption: The statutory tort contains an exemption for journalists and their employers to the extent the invasion involves the collection, preparation, or publication of journalistic material. However, this exemption does not apply to the conduct of Mr Barrett himself, who was not acting as a journalist but as a source. The exemption would protect the media outlets, not Mr Barrett. Other Defences: There is no indication that any other statutory defence (e.g. necessity, lawful authority) would apply. |
| Outcome | In Waller v Barrett, the County Court of Victoria recognised a common law invasion of privacy, building upon the equitable doctrine of breach of confidence, and awarded Ms Waller $30,000 in damages. Our broad hypothetical assessment of the statutory tort to the factual circumstances in Waller v Barrett, indicates that the elements of the statutory test may be met, provided that the plaintiff is able to establish the defendant’s intention or recklessness. A plaintiff in Ms Waller’s position would also need to be mindful of the statutory limitation periods. |
This analysis illustrates how the statutory tort may be applied to circumstances where privacy is compromised. However, it is likely that the jurisprudence on the tort will take a while to develop. Despite this, business and government should be prepared that individuals who believe that their privacy has been invaded may add a claim under the new tort as an additional tool for seeking compensation or redress.
The privacy tort is a significant development that public and private organisations will need to grapple with, as Australians now possess a direct legal avenue to seek redress for profound infringements on their privacy. The emphasis on ‘serious’ invasion, coupled with intentional or reckless conduct, sets a high, but necessary, bar. While it will take some time for the implications of this new tort to become clearer through interpretation by the courts, for now it is important that organisations and individuals are aware of the tort and take steps to ensure that they are not in contravention of it. In an increasing digital world, the new statutory tort is a vital step towards safeguarding the fundamental right of privacy.
If you are interested in the other privacy reforms that were passed by Parliament last year, our colleagues Lisa Fitzgerald (Partner, Technology, Privacy and Data), Ka-Chi Cheung (Partner, Corporate and Commercial) and Michelle Martin (Senior Associate, Corporate and Commercial) explain the major privacy law reforms in their article here.
Publikation
Following a relatively promising start to the year for mergers and acquisitions (M&A) activity, the US tariff announcements shook dealmaker confidence, triggering global trade uncertainty and stalling M&A deals across the global M&A landscape.
Subscribe and stay up to date with the latest legal news, information and events . . .
© Norton Rose Fulbright LLP 2025
