Privacy gets teeth: Australia’s new statutory tort and how it might look in practice

Authors:

Australia | Publication | June 2025

This article was co-authored with Chloe Marks.

As of 10 June 2025, every Australian now has the right to sue for serious invasions of privacy. This extraordinary new right marks the first time individuals can protect and defend their own privacy, instead of going through a government regulator. It is a milestone in a digital era in which individuals can be defamed, doxxed and damned with the touch of a button. We break down what this means for Australians and consider how the statutory tort may work in practice.

Elements of the new statutory tort
Defences to and exemptions from liability
Exemptions – Government
What remedies are available
What might the tort look like in practice?
Application of new statutory tort to these facts
Conclusion

Elements of the new statutory tort

The new tort is found in Schedule 2 to the Privacy Act and involves the following five elements, all of which must be proven to establish liability.

First, there must be an invasion of the plaintiff’s privacy. This can comprise an intrusion upon the plaintiff’s seclusion (such as recording the plaintiff’s private affairs) or misusing information that relates to the plaintiff (such as leaking the plaintiff’s personal information, or disclosing untrue information). The plaintiff does not need to prove any actual damage to succeed in a claim (see clause 7(2)).
Second, a person in the position of the plaintiff must have had a reasonable expectation of privacy in all the circumstances. Establishing the reasonableness of this expectation involves an evaluation of the circumstances surrounding the invasion of privacy. Examples of the factors which a court can examine are set out in clause 7(5).
Third, the required intention of the defendant must be proven. The plaintiff must prove that the defendant intentionally invaded the plaintiff’s privacy or was reckless as to the privacy of the plaintiff. An invasion of privacy that is merely accidental or careless will not be enough.
Fourth, the invasion of privacy must be serious. In determining seriousness, under clause 7(6), the court may consider:

a. The degree of any offence, distress or harm to dignity that the invasion of privacy was likely to cause to a person of ordinary sensibilities in the position of the plaintiff.

b. Whether the defendant knew or ought to have known that the invasion of privacy was likely to offend, distress or harm the dignity of the plaintiff.

c. If the invasion of privacy was intentional, whether the defendant was motivated by malice.

Fifth, the public interest in the plaintiff’s privacy must outweigh any countervailing public interest, including freedom of expression and national security.

If these five elements can be established by the plaintiff, then the defendant will be liable to the plaintiff (unless a defence or exemption applies).

Plaintiffs must commence proceedings within a reasonably short limitation period of one year of becoming aware of the invasion of privacy (see clause 14). However, the limitation period is longer in some cases, such as plaintiffs who were under 18 years when the invasion of privacy occurred.

The defendant can be an individual, a corporation or other entity – the defendant does not need to be covered by the Australian Privacy Principles.

Defences to and exemptions from liability

Schedule 2 to the Privacy Act sets out available defences to, or exemptions from, liability, for legitimate activities that are essential in a free, safe and democratic society.

A defendant can apply for a determination of whether an exemption applies before the substantive trial commences.

The Privacy Act exempts journalists (clause 15) and children (clause 18) from liability. For other persons who are not exempt under Schedule 2, a variety of defences are available. They include:

Where the invasion of privacy is required or authorised by or under an Australian law and/or court/tribunal order.
Where the plaintiff expressly or impliedly consents to the invasion of privacy.
If the defendant reasonably believed that the invasion of privacy was necessary to protect a person’s life, health or safety.
If the invasion of privacy was incidental to the exercise of a lawful right of defence of persons or property and was proportionate, necessary and reasonable.
If the conduct would be allowable under a defamation defence, such as absolute privilege, publication of public documents or fair report of proceedings of public concern.

Exemptions – Government

There are a number of exemptions that are specifically relevant to Commonwealth, State or Territory government entities. These are:

Clause	Who	When
16 and 16A	Agencies and State or Territory Authorities (other than an intelligence agency or law enforcement body), and their staff members	Invades an individual’s privacy in good faith in the: Performance or purported performance of a function Exercise or purported exercise of a power of the agency or authority.
16B	Law enforcement bodies (including staff members)	An invasion of privacy by a law enforcement body An invasion of privacy in the performance of a duty, power or function as a staff member An invasion of privacy involving a disclosure of information to a law enforcement body An invasion of privacy involving information that was disclosed by a law enforcement body
17	Intelligence agencies (including ASIO affiliate, agent or staff members)	An invasion of privacy by an intelligence agency In the performance of functions or services for ASIO by an ASIO affiliate In the performance of a duty, power or function as a staff member or agent An invasion of privacy involving a disclosure of information to an intelligence agency An invasion of privacy involving information that was disclosed by an intelligence agency

The explanatory memorandum to the Privacy and Other Legislation Amendment Bill 2024 (Cth) explains that including exemptions for government entities recognises that legitimate activities of government may be intrusive of privacy but are justifiable. The justifications include that these activities are necessary to ensure the proper administration of government and keep the broader community safe and secure. However, liability may still arise in some circumstances, such as where the invasion of privacy is not in good faith.

What remedies are available

First, damages may be awarded. Importantly, the Privacy Act creates a ‘damages cap’ for non-economic loss and exemplary or punitive damages, equal to the greater of $478,550, and the maximum amount of damages for non-economic loss that may be awarded in defamation law. Whilst aggravated damages are not available, damages for emotional distress, exemplary or punitive damages may be awarded.
Second, the court may grant an injunction restraining the defendant from invading the plaintiff’s privacy. If the invasion of privacy involves publishing information that relates to the plaintiff, the court must have particular regard to the public interest in the publication of the information when considering whether to grant the injunction.
Third, the court has the power to order other remedies, including an account of profits, a declaration, an apology, a correction, or the destruction of material. As such, there are a wide range of remedies which may be deployed to fit the circumstances of a case.

What might the tort look like in practice?

Given there is no case law yet on the application of the new statutory tort, we have considered how the tort may have applied to the factual circumstances in the recent notable privacy case of Waller (A Pseudonym) v Barrett (A Pseudonym) [2024] VCC 96 (Waller v Barrett). It is important to note that a direct application of the facts is not possible as the case did not proceed under statute, rather the court found liability under the common law. However, to illustrate how the statutory tort might apply if it were in force at the time, we provide a high-level consideration of the elements below.

Facts

Mr Barrett was the victim of a violent attack in 2010. His wife, who planned his attack with her lover, was later found guilty of his attempted murder. In the years that followed, Mr Barrett and his daughter, Ms Waller, became estranged. In January 2014, Ms Waller and Mr Barrett attended counselling in an attempt to reconcile. Ms Waller also sent a detailed email to her father explaining why she should be permitted to maintain contact with her two younger siblings.

In August 2014, Mr Barrett’s story was published in a book written by an investigative journalist. His story was also detailed in articles published in media outlets. Relevantly, these publications reported information that had been disclosed by Mr Barrett about Ms Waller, from their private counselling session and her email to him.

Ms Waller brought a claim against her estranged father, Mr Barrett, for breach of confidence, breach of statutory duty, negligence and invasion of privacy. Several of Ms Waller’s claims were successful on the grounds of breach of confidentiality and, more contentiously, a breach of a common law right of privacy. How might the case have been decided if the claims had been formulated as a serious invasion of privacy under the new tort?

Application of new statutory tort to these facts

Statutory Tort: Serious Invasion of Privacy
Element of tort	Application to facts of the case
#1 Invasion of Privacy: Intrusion or Misuse of Information	The facts establish that Mr Barrett disclosed information about Ms Waller’s private life, including the content of a counselling session and a private email, to journalists and authors resulting in publication. This conduct would likely fall within “misusing information that relates to the plaintiff” as defined in Schedule 2, which includes collecting, using, or disclosing information about the individual. Some of the information that was disclosed by Mr Barrett was untrue – this would also be actionable under the statutory tort.
#2 Reasonable Expectation of Privacy	The court in Waller v Barrett found that the information disclosed was highly personal and confidential. Applying the statutory test, it is likely that a person in Ms Waller’s position would have a reasonable expectation of privacy in relation to at least some parts of the information, especially given the sensitive family context and her vulnerability. The Privacy Act provides that the court may consider, among other things: The means used to invade privacy (here, disclosure to the media) The purpose of the invasion (disclosure to the media for publication) The attributes of the plaintiff (Ms Waller’s age, vulnerability, and trauma) The nature of the information (intimate, family, and health matters) Whether the information was already in the public domain (the court found that, despite some prior disclosures, the information retained its private character).
#3 Intentional or Reckless Conduct	The disclosures were made deliberately by Mr Barrett to journalists and the author of the book, with the knowledge that they would be published. The tort requires that the invasion of privacy must either be intentional or reckless. In the hypothetical case, it would not be enough that Mr Barrell intended to disclose information. The requisite intention must relate to the invasion of the plaintiff’s privacy by misusing information or intruding upon the plaintiff’s seclusion. This requirement will demand a careful examination of the precise intention of the defendant. On the facts here, it would be necessary to determine Mr Barrett’s precise intention when he disclosed the information to the journalists and author. It Mr Barrett merely intended the information to be published (with the invasion of privacy as an unintended consequence), that intention may not be sufficient to establish the claim. Ms Waller would need to demonstrate that Mr Barrett intentionally invaded her privacy by misusing the information. If intention cannot be proven, the alternative is to establish that there was a reckless invasion of Ms Waller’s privacy. The definition of “recklessness” used in the tort takes its meaning from the Criminal Code definition, and sets a higher bar than mere carelessness or negligence. Recklessness means that the defendant must have been aware of a substantial risk of an invasion of privacy and, in the circumstances known to the defendant, that it was unjustifiable to take that risk. Once again, the plaintiff must prove matters relating to the knowledge of the defendant. It is not clear that Mr Barrett specifically intended to invade Ms Waller’s privacy, or that he actually knew that there was a risk of Ms Waller’s privacy being invaded and decided to proceed anyway when it was unjustified to do so. In general, we consider that many potential plaintiffs may find it difficult to prove the requisite intention and knowledge.
#4 Seriousness of the Invasion	The Act sets out factors for seriousness, including the degree of offence, distress, or harm to dignity likely to be caused, and whether the defendant knew or ought to have known the likely impact. The court in Waller v Barrett found that the disclosures were particularly distressing to Ms Waller, given her vulnerability and the nature of the information. The publication of private communications and counselling session details may be considered “serious” under the statutory test, as details of private counselling sessions would not typically fall under a legitimate public interest that would justify such an intrusion to privacy.
#5 Public Interest Balancing	The statutory tort requires that the public interest in the plaintiff’s privacy outweighs any countervailing public interest (such as freedom of expression, media freedom, or public health and safety). It is likely that a court would find that the specific disclosures about Ms Waller’s private communications and counselling session were not justified by any public interest that would outweigh her right to privacy. It is possible that a court may view the journalism in that case to be tabloid journalism of little public value, which may be contrasted with other media reporting that has greater ramifications for the public.
Defences or Exemptions	Consent: There was no evidence that Ms Waller consented to the disclosures. Journalistic Exemption: The statutory tort contains an exemption for journalists and their employers to the extent the invasion involves the collection, preparation, or publication of journalistic material. However, this exemption does not apply to the conduct of Mr Barrett himself, who was not acting as a journalist but as a source. The exemption would protect the media outlets, not Mr Barrett. Other Defences: There is no indication that any other statutory defence (e.g. necessity, lawful authority) would apply.
Outcome	In Waller v Barrett, the County Court of Victoria recognised a common law invasion of privacy, building upon the equitable doctrine of breach of confidence, and awarded Ms Waller $30,000 in damages. Our broad hypothetical assessment of the statutory tort to the factual circumstances in Waller v Barrett, indicates that the elements of the statutory test may be met, provided that the plaintiff is able to establish the defendant’s intention or recklessness. A plaintiff in Ms Waller’s position would also need to be mindful of the statutory limitation periods.

This analysis illustrates how the statutory tort may be applied to circumstances where privacy is compromised. However, it is likely that the jurisprudence on the tort will take a while to develop. Despite this, business and government should be prepared that individuals who believe that their privacy has been invaded may add a claim under the new tort as an additional tool for seeking compensation or redress.

Conclusion

The privacy tort is a significant development that public and private organisations will need to grapple with, as Australians now possess a direct legal avenue to seek redress for profound infringements on their privacy. The emphasis on ‘serious’ invasion, coupled with intentional or reckless conduct, sets a high, but necessary, bar. While it will take some time for the implications of this new tort to become clearer through interpretation by the courts, for now it is important that organisations and individuals are aware of the tort and take steps to ensure that they are not in contravention of it. In an increasing digital world, the new statutory tort is a vital step towards safeguarding the fundamental right of privacy.

If you are interested in the other privacy reforms that were passed by Parliament last year, our colleagues Lisa Fitzgerald (Partner, Technology, Privacy and Data), Ka-Chi Cheung (Partner, Corporate and Commercial) and Michelle Martin (Senior Associate, Corporate and Commercial) explain the major privacy law reforms in their article here.