03 9070 9810

Employer Reading Your Emails? Know Your Rights Under the New Law

The statutory tort for serious invasion of privacy now applies to workplace monitoring. No proof of damage required.

Book a Confidential Assessment ($770)

Max file size: 20MB

Workplace Email Surveillance and the Statutory Tort

If your employer is reading your emails, logging your keystrokes, or tracking your device activity without your knowledge, you may have a civil claim under the statutory tort for serious invasion of privacy (Schedule 2, Privacy Act 1988 (Cth)), which commenced on 10 June 2025.

This is a significant change in Australian law. The Australian Privacy Principles contain a broad employee records exemption, meaning the privacy regulator (the OAIC) has historically been unable to act on complaints about how employers handle employee information. The statutory tort contains no such exemption. It applies to the workplace. It applies to employee records. And it gives individual employees a direct right of action in court.

Not all workplace monitoring is actionable. Employers have legitimate reasons to monitor company systems, and disclosed, proportionate monitoring may well be defensible. The line between lawful oversight and actionable invasion turns on specific facts: what was monitored, whether you were told, whether the scope was proportionate to the stated purpose, and whether you had a reasonable expectation of privacy in the circumstances.

The clock is ticking. You may have as little as 12 months to act. The limitation period runs from when you became aware (or ought to have become aware) of the invasion. If you have recently discovered covert monitoring, seek advice promptly.

Discovered covert monitoring at work?

A confidential initial assessment is $770 (fixed fee). We will tell you where you stand and what your options are.

When Does Workplace Monitoring Cross the Line?

The distinction between lawful oversight and actionable invasion of privacy.

Computer keyboard with monitoring software interface representing workplace surveillance

Covert Monitoring Without Disclosure

Employer surveillance of employees becomes most vulnerable to a privacy claim when it is conducted without the employee's knowledge. If your employer installed keystroke logging software on your device, read your personal email accounts, or monitored your browsing activity without ever disclosing this to you, the conduct is more likely to meet the seriousness threshold under clause 7 of Schedule 2. The absence of disclosure goes directly to the question of whether the invasion was intentional or reckless, and whether you retained a reasonable expectation of privacy. A workplace policy buried in an intranet no one reads may not constitute effective disclosure.

Business and personal email interfaces showing privacy boundaries

Monitoring of Personal Communications

There is an important distinction between monitoring company email systems and intercepting personal communications. An employer who reads messages sent from a work email address on a company device occupies different ground from one who accesses a personal email account, reads private messages on a personal phone, or monitors communications unrelated to work. The further the monitoring extends beyond work systems and work-related content, the stronger the argument that it constitutes an intrusion upon seclusion. Accessing a personal account, even from a work device, is likely to engage a reasonable expectation of privacy.

Multiple monitoring screens showing excessive employee surveillance systems

Disproportionate or Blanket Surveillance

Even disclosed monitoring may be actionable if it is grossly disproportionate to any legitimate business purpose. An employer who installs screen recording software that captures every second of every employee's activity, records webcam footage during work hours, or deploys keystroke loggers across the entire workforce without any specific concern or investigation is engaging in the kind of conduct the statutory tort was designed to address. Proportionality matters. Monitoring one employee's access to a specific database following a data breach is different from recording every employee's screen in perpetuity.

The Law: How the Statutory Tort Applies to Workplace Monitoring

Why the Statutory Tort Matters for Employees

Before 10 June 2025, Australian employees had limited civil remedies for invasive workplace monitoring. The Australian Privacy Principles (Schedule 1 of the Privacy Act) contain an employee records exemption at section 7B(3), which means that acts and practices relating to current and former employee records are exempt from the APPs. The OAIC cannot investigate a complaint about an employer reading your emails if it relates to an employee record.

The statutory tort for serious invasion of privacy (Schedule 2) is a separate regime. It does not incorporate the employee records exemption. Any individual can bring a claim against any person, corporation, or government body. This includes claims by employees against their employers.

Elements of the Claim

To succeed, a plaintiff must establish that the defendant invaded their privacy by intrusion upon seclusion or by misuse of private information, that the invasion was intentional or reckless (not merely negligent), and that the invasion was serious. The court applies a balancing test, weighing the plaintiff's privacy interest against any countervailing public interest, including the defendant's legitimate reasons for the conduct.

Workplace email monitoring may engage either or both limbs of the tort. Reading an employee's emails in real time or accessing stored communications is an intrusion upon seclusion. Disclosing the contents of those emails to others within or outside the organisation is a misuse of private information.

Employer Defences

Employers facing a claim have several potential defences under Part 2 of Schedule 2. The most commonly relevant in workplace monitoring cases are likely to be:

  • Consent: Express or implied consent to the monitoring. A clear, specific, and acknowledged workplace monitoring policy may support implied consent. A vague reference in a 90-page employment contract is less likely to suffice.
  • Lawful authority: Where monitoring is required or authorised by law or a court order.
  • Necessity: Where the employer reasonably believed the monitoring was necessary to prevent or lessen a serious threat to health or safety.
  • Defence of property: Where the monitoring was incidental to defending property (for example, investigating suspected theft of trade secrets) and was proportionate, necessary, and reasonable.

It is worth noting that exemptions under Part 3 of Schedule 2 are procedurally different from defences. Government employers may seek a pre-trial exemption determination. Private sector employers will generally rely on defences raised and determined at trial.

Remedies

The court may award damages for emotional distress and loss of dignity without requiring proof of financial loss. The tort is actionable per se. Non-economic loss is capped at approximately $478,550 (indexed). In cases involving particularly egregious conduct, the court may also award exemplary damages, which are not subject to the cap. The court may grant an injunction to restrain ongoing monitoring, order the deletion of material obtained through the invasion, and make other orders it considers appropriate.

Overlapping Claims

Workplace privacy invasions frequently overlap with other causes of action. If your employer disclosed private information about you that also damaged your reputation, you may have a concurrent defamation claim. We act in both privacy and defamation litigation. For more on the interaction between these causes of action, see our page on invasion of privacy vs defamation. For claims involving disclosure of health information, see leaked medical records.

The OAIC Pathway

You may also consider a complaint to the OAIC under the Australian Privacy Principles. However, as noted above, the employee records exemption means the OAIC cannot act on many workplace privacy complaints. Where your employer is an APP entity and the conduct falls outside the exemption, the OAIC pathway is free and does not require a lawyer. Its limitations are significant: outcomes tend to be modest, there are no punitive damages, and resolution is slow. For serious invasions, the statutory tort is the stronger avenue. See OAIC complaint vs suing for invasion of privacy for a detailed comparison.

We Also Act for Employers

Sutton Laurence King Lawyers represents both plaintiffs and defendants in privacy litigation. If you are an employer who has received a pre-action demand or been served with proceedings arising from workplace monitoring, we can advise on your defence options, assess the strength of any available defences or exemptions, and represent you in court or in settlement negotiations. An apology under clause 13 of Schedule 2 does not constitute an admission of fault or liability, which may be relevant to resolution strategy. See employer invasion of privacy for more information.

Need to speak with a privacy lawyer about workplace monitoring?

Fixed fee initial assessment. Confidential. Available for urgent matters Australia-wide.

Why Clients Instruct Us for Workplace Privacy Claims

A practice built around the statutory tort and its related fields.

No Employee Records Exemption

The statutory tort applies to employee records. Unlike the OAIC complaint pathway, you are not shut out by the APPs' employee records exemption. We know this distinction and how to use it.

Fixed Fee Entry Points

Confidential initial assessment at $770 and pre-action demand letters at $990. You know your costs before you commit. No open-ended retainer to get started.

We Act for Both Sides

We represent both employees bringing claims and employers defending them. This gives us a clear understanding of how each side approaches these matters.

Defamation Law Background

The statutory tort borrows heavily from defamation law, including its damages cap, defences, and publication framework. Our defamation practice at defamationlawyer.au informs our work in privacy.

Urgent Injunction Capability

If your employer is conducting ongoing covert monitoring, an urgent injunction may be appropriate to restrain the invasion. We handle injunction applications with after-hours availability for urgent matters.

Australia-Wide, Federal Jurisdiction

The statutory tort is Commonwealth legislation. We act for clients across all states and territories. Our principal offices are in Melbourne, with capacity to act in Sydney and all other capitals.

Frequently Asked Questions: Employer Monitoring Emails and Workplace Surveillance

There is no simple yes or no answer. Employer email monitoring is not automatically unlawful, but it is not automatically lawful either. The legality depends on several factors: whether the monitoring was disclosed to you, whether it was limited to work email systems or extended to personal accounts, whether it was proportionate to a legitimate business purpose, and whether you had a reasonable expectation of privacy in the circumstances. Under the statutory tort for serious invasion of privacy (Schedule 2, Privacy Act 1988), covert or disproportionate monitoring of employee communications may give rise to a civil claim. The tort does not require you to prove financial loss.

If the monitoring was intentional or reckless (not merely negligent) and meets the seriousness threshold, you may be able to bring a claim under the statutory tort. The court will weigh your privacy interest against any countervailing public interest, including your employer's legitimate business reasons. Claims are more likely to succeed where monitoring was covert, extended beyond work systems, or was grossly disproportionate. You do not need to prove financial loss. The limitation period is one year from when you became aware of the invasion or three years from its occurrence, whichever is earlier.

The employee records exemption at section 7B(3) of the Privacy Act applies to the Australian Privacy Principles (Schedule 1). It means the OAIC generally cannot investigate complaints about how employers handle employee records. However, the statutory tort for serious invasion of privacy is in Schedule 2, which is a separate regime. Schedule 2 does not incorporate the employee records exemption. You can bring a claim under the statutory tort regardless of whether the conduct involves an employee record.

Keystroke logging and screen recording are forms of surveillance that may constitute intrusion upon seclusion under the statutory tort. These tools capture everything you type or do on a device, including personal passwords, private messages, and activity unrelated to work. If deployed without disclosure or in a manner disproportionate to any stated business need, they are likely to engage a reasonable expectation of privacy. The analysis is similar to email monitoring, but the scope of intrusion is often broader, which may strengthen the seriousness argument.

A clear and specific monitoring policy, genuinely brought to your attention and acknowledged by you, may support an employer's defence of implied consent. However, a vague clause buried in a lengthy contract, or a generic IT policy on a company intranet, is less likely to constitute effective consent. The court will consider whether you were given meaningful notice of the specific type and scope of monitoring being conducted. A policy that authorises monitoring of company email does not necessarily authorise keystroke logging, webcam recording, or access to personal accounts.

The court may award damages for emotional distress, loss of dignity, and anxiety without requiring proof of financial loss. Non-economic loss is capped at approximately $478,550 (indexed). In cases of particularly serious or deliberate conduct, the court may also award exemplary damages, which are not subject to the cap. The court can also grant injunctions to restrain ongoing monitoring, order deletion of material obtained through the invasion, and make other appropriate orders. For a fuller discussion, see our page on compensation and damages claims.

This depends on the circumstances. In some cases, raising the issue directly may prompt your employer to cease the monitoring and resolve the matter without litigation. In other cases, alerting your employer may cause them to destroy evidence. A confidential initial assessment with a privacy solicitor will help you determine the appropriate first step. We can also send a pre-action demand letter on your behalf for a fixed fee of $990, which puts the matter on a formal footing without commencing proceedings.

You may be able to lodge a complaint with the OAIC under the Australian Privacy Principles, but the employee records exemption significantly limits the OAIC's jurisdiction over workplace monitoring complaints. Where the OAIC can act, the process is free and does not require a lawyer, but outcomes are typically modest and resolution is slow. There is no capacity for punitive damages. For serious invasions, the statutory tort is generally the stronger avenue. The two pathways are not mutually exclusive. See OAIC complaint vs suing for invasion of privacy.

Seek legal advice promptly. We represent employers defending claims under the statutory tort. Available defences include consent (particularly where monitoring was disclosed and acknowledged), lawful authority, necessity, and defence of property. If you have been served with an urgent injunction application, response timeframes are short. For more on the defence side of workplace privacy claims, see employer invasion of privacy.

The limitation period may be as short as 12 months.

If you have discovered covert workplace monitoring, do not delay. Contact us for a confidential fixed fee assessment.

Call