The statutory tort for serious invasion of privacy commenced on 10 June 2025. Since then, defending a privacy claim in Australia has become a genuine possibility for people who would once have described their conduct as ordinary diligence: a landlord checking on a tenant, an employer investigating a leak, a spouse gathering evidence before separation. Schedule 2 of the Privacy Act 1988 (Cth) does not single out malicious conduct. It asks whether an invasion occurred, whether it was serious, and whether any defence applies.
That framing matters. A defendant can act in good faith, for a sound commercial or personal reason, and still be sued. The question is not whether the motive was decent. It is whether the conduct met the elements of the tort and whether one of the statutory answers is available.
What a plaintiff must establish
The cause of action sits in Part 2 of Schedule 2. A plaintiff must show that the defendant intruded upon their seclusion, or misused information relating to them. They must also show that a person in their position would have had a reasonable expectation of privacy in all the circumstances. The invasion must have been intentional or reckless, and it must have been serious. Finally, the public interest in the plaintiff's privacy must outweigh any countervailing public interest.
Two features of that list tend to surprise defendants. The first is that negligence is not enough. Careless handling of private material may raise other problems, including an OAIC complaint or a different cause of action, but it does not make out this tort. The second is that the plaintiff need not prove loss. The tort is actionable per se, so damage is not an element. It may, however, bear on seriousness.
Truth is not a defence. Where the claim concerns misuse of information, the legislation makes clear that it does not matter whether the information was accurate. A defendant who published a correct account of private events has no answer on that ground alone.
Where legitimate surveillance sits
Surveillance is not prohibited by the tort. What the tort captures is intrusion upon seclusion that meets the elements above. A camera covering your own front gate is a different proposition from a camera angled over a neighbour's fence into their living room. A tracking device on a company vehicle is a different proposition from one placed on a former partner's car.
The seriousness threshold does real work here. Not every intrusion is actionable. The court may weigh the likely offence, distress or harm to dignity that a person of ordinary sensibilities in the plaintiff's position would experience. It may also consider what the defendant knew, and whether malice motivated an intentional invasion. That last factor cuts both ways: a defendant who acted without malice is better placed on seriousness, but a plaintiff who can point to malice has a stronger case.
State and territory surveillance laws sit alongside the tort without replacing it. They create criminal offences, not civil remedies. A person cannot sue under the Surveillance Devices Act. But a breach of state law can strengthen a tort claim, and compliance with state law does not automatically answer one. The interaction between the two is one of the areas the courts have yet to settle.
Exemptions and defences are not the same thing
This is the procedural point that most often catches defendants and their advisers out. Schedule 2 separates exemptions in Part 3 from defences in Part 2, and the two operate at different stages.
An exemption removes a class of person or activity from liability altogether. A defence is raised against a cause of action that has already been made out. Defences are generally raised and determined at trial.
Part 3 exemptions include journalists and their employers and assistants for journalistic material, government agencies acting in good faith, law enforcement bodies and intelligence agencies, and persons under 18. The journalist exemption is narrow. It turns on professional capacity and subjection to a code of practice or professional standards. Bloggers, social media users, influencers and citizen journalists fall outside it. A guide to privacy tort exemptions on this site sets out the categories in more detail.
The defences that matter for surveillance defendants
Part 2 defences are where most surveillance matters will be won or lost. They include:
- Lawful authority. The invasion was required or authorised by or under an Australian law or a court or tribunal order.
- Consent. The plaintiff, or a person with authority to act for them, expressly or impliedly consented to the invasion.
- Necessity. The defendant reasonably believed the invasion was necessary to prevent or lessen a serious threat to life, health or safety.
- Defence of persons or property. The invasion was incidental to the exercise of a lawful right of defence of a person or property, and was proportionate, necessary and reasonable.
- Defamation-related defences. Where the invasion involved publication, absolute privilege, publication of public documents, and fair report of proceedings of public concern are available.
Each defence requires evidence, and each has limits. Consent must be real, not assumed from silence. Necessity depends on the defendant's reasonable belief at the time, not on how events later unfolded. Defence of property requires proportionality, which means a response that goes further than the threat justifies will not be protected.
The public interest balancing test is an element of the claim rather than a defence, but it functions similarly in practice. The court weighs the plaintiff's privacy against countervailing interests, including freedom of expression, freedom of the media, the proper administration of government, and the prevention and detection of crime and fraud. A defendant with evidence of a genuine countervailing interest should lead it.
Workplace monitoring and internal investigations
Employers face a particular exposure. The statutory tort is not subject to the employee records exemption that applies to the Australian Privacy Principles, although the Schedule 2 exemption has its own limits. Monitoring that is disclosed, proportionate and conducted for a legitimate business purpose may be defensible on grounds of implied consent, lawful authority, or because the employee did not have a reasonable expectation of privacy in the circumstances. Covert monitoring of private communications, without notice or justification, is much harder to defend. An article on employer privacy risk on this site covers the practical steps.
Businesses that are APP entities also face a separate enforcement regime through the OAIC. That pathway is free, does not require a lawyer, and is limited to APP entities, with modest outcomes and no punitive damages. It is slow. The tort is the stronger avenue for serious invasions, and it reaches individuals, small businesses and neighbours that the OAIC cannot touch.
Urgent injunctions and the ex parte risk
The tort remains untested in Australia. There is no Australian case law on the statutory tort as at February 2026, and courts may consider overseas jurisprudence as persuasive only. A defendant can nonetheless face an urgent injunction without notice, and should be prepared for that possibility.
Where a court is considering an injunction restraining publication, it must have particular regard to the public interest in publication. A defendant served with an urgent application should be ready to address that interest directly. A guide to the first 72 hours after an accusation on this site sets out the immediate steps.
An apology, and what it does not do
An apology does not constitute an admission of fault or liability. The court may, however, take it into account when determining damages. For defendants in negotiation, that is a useful distinction: an apology can be offered as part of a resolution without handing the plaintiff a concession on liability.
The tort remains largely untested. There is no Australian case law on the defences as at February 2026, and the leading commentary describes the tort as awaiting its defining case. Courts are likely to consider UK, New Zealand and Canadian privacy jurisprudence as persuasive, but it does not bind them. Defendants should plan on the basis of the statutory text and the policy behind it, not on assumed outcomes.
Assessing exposure
For a defendant, the assessment comes down to a sequence of questions. Was there an intrusion or a misuse of information? Would a reasonable person in the plaintiff's position have expected privacy? Was the conduct intentional or reckless? Was it serious? And is there a defence or exemption that fits the facts?
Answering those questions honestly, early, and with the evidence in hand is what separates a manageable claim from an expensive one. Defendants who wait for a demand letter to arrive before reviewing their conduct lose the chance to preserve records, correct inaccurate assumptions, and consider whether an exemption may apply.
Time limits apply. Under Schedule 2, the limitation period is the earlier of one year from awareness or three years from the invasion, and for minors it runs to one year after turning 18. Urgent injunction applications can be brought at short notice. If you have conducted surveillance, published private information, or received a demand or court application, contact us for a confidential assessment. Where publication has also damaged reputation, our colleagues at defamationlawyer.au can advise on the overlapping claim.
This article provides general information only. It is not legal advice and should not be relied on as such. You should obtain advice about your own circumstances before acting.
