03 9070 9810

Ex Partner Accessing Your Accounts? The Law Gives You a Civil Remedy

Unauthorised access to email, social media, banking, or cloud storage is actionable under Australia's new statutory tort for serious invasion of privacy.

Book a Confidential Assessment

Max file size: 20MB

Unauthorised Account Access by a Former Partner

If your ex partner has accessed your email, social media accounts, banking portals, or cloud storage without your permission, you may have both a civil claim and grounds for criminal complaint. Since 10 June 2025, Australia's statutory tort for serious invasion of privacy (Schedule 2, Privacy Act 1988 (Cth)) provides individuals with a direct right of action in court for intrusion upon seclusion. Logging into another person's accounts without consent is a clear example of this tort in action.

This is not a minor matter. A former partner who reads your emails, monitors your messages, accesses your financial records, or downloads your private photographs is engaging in conduct that is, by its nature, intentional. The statutory tort does not require you to prove financial loss. The invasion itself is enough. What the court requires is that the invasion was serious and that the defendant acted intentionally or recklessly.

You may have as little as 12 months from the date you became aware of the access to commence proceedings. If the access is ongoing, urgent relief may be available to restrain further intrusion. We offer a fixed-fee initial assessment ($770) to determine your position and the strength of your claim.

The clock is ticking. You may have as little as 12 months to act.

If your ex is still accessing your accounts, urgent injunctive relief may be available to stop them. Contact us for a confidential assessment.

How We Act on Unauthorised Account Access

Civil remedies, evidence preservation, and urgent court orders.

Legal documents and technology representing urgent privacy legal remedies

Urgent Privacy Injunctions to Stop Ongoing Access

<p>If your former partner is still accessing your accounts, the most pressing concern is stopping them. Under clause 9 of Schedule 2, the Federal Court or Federal Circuit and Family Court can grant injunctions restraining a defendant from continuing to intrude upon your seclusion.</p><p>An urgent privacy injunction can compel the respondent to cease accessing your accounts and to delete or return any information obtained through unauthorised access. We are available to prepare and file injunction applications at short notice. The court has power to hear applications on an interim basis, including before the defendant has been served.</p><p><a href="/urgent-privacy-injunctions">Learn more about urgent privacy injunctions</a>.</p>

Digital forensics and evidence preservation tools and documents

Preserving Digital Evidence Before It Disappears

<p>Unauthorised account access leaves traces, but those traces can be lost if not captured promptly. Login records, IP addresses, session data, device identifiers, and access timestamps are all available from service providers, but most platforms retain this data for limited periods. Google, Apple, Microsoft, Meta, and major banking platforms each have their own data retention policies and disclosure processes.</p><p>We work with clients to identify and preserve digital evidence at the earliest possible stage. This includes requesting account activity logs, securing authentication records, and where necessary, engaging forensic analysts to document the scope of the intrusion. Proper evidence preservation is critical to both the civil claim and any parallel criminal complaint.</p>

Legal scales and financial documents representing privacy damages compensation

Compensation and Damages for Privacy Breach

<p>The statutory tort provides for damages up to $500,000 for non-economic loss (indexed annually to the defamation damages cap). In exceptional cases involving deliberate, sustained, or malicious conduct, exemplary damages may also be awarded. Unauthorised access to a former partner's accounts, particularly where the access is repeated or used to obtain leverage in family law proceedings, is the kind of conduct the tort was designed to address.</p><p>The tort is actionable without proof of financial loss. The invasion itself grounds the claim. Where the information obtained through unauthorised access has been disclosed to third parties or used to harass or control the plaintiff, the seriousness of the invasion and the quantum of damages both increase.</p><p><a href="/compensation-damages-claims">Read more about privacy breach compensation</a>.</p>

The Legal Framework: Civil Claims and Criminal Offences

The Statutory Tort: Intrusion Upon Seclusion

Under Schedule 2 of the Privacy Act 1988 (Cth), a person commits a serious invasion of privacy by intruding upon the seclusion of another individual. The tort requires the plaintiff to establish that the invasion was intentional or reckless, that the plaintiff had a reasonable expectation of privacy in the circumstances, and that the invasion was serious. The court considers all relevant factors, including the nature and consequences of the invasion, the relationship between the parties, and the purpose of the defendant's conduct.

Accessing another person's email, social media, banking, or cloud storage account without their consent is a classic example of intrusion upon seclusion. The plaintiff's password-protected accounts are, by definition, spaces in which a reasonable expectation of privacy exists. The act of logging in using retained, guessed, or improperly obtained credentials is intentional. And where the access reveals private correspondence, financial records, photographs, or health information, the seriousness threshold is readily met.

Criminal Offences: Commonwealth and State Laws

Unauthorised access to a computer system is also a criminal offence. Under section 478.1 of the Criminal Code Act 1995 (Cth), a person who causes unauthorised access to data held in a computer is guilty of an offence carrying a maximum penalty of 2 years imprisonment. The offence requires that the access was unauthorised and that the defendant knew that fact. Where the access involves a restricted-access system (such as an email or banking platform secured by a password), the prosecution need only prove that the defendant was not entitled to access the data.

State offences may also apply. In Victoria, section 247G of the Crimes Act 1958 prohibits unauthorised access to or modification of restricted data (maximum 2 years). In NSW, section 308H of the Crimes Act 1900 creates an offence of unauthorised access to restricted data held in a computer (maximum 2 years). In Queensland, section 408E of the Criminal Code creates an offence of computer hacking and misuse (maximum 3 years, or 5 years if the access is for the purpose of gaining a benefit or causing a detriment).

A criminal complaint and a civil claim under the statutory tort are not mutually exclusive. You can pursue both. However, the criminal process is controlled by police and prosecutors, not by the complainant. It does not yield compensation. The civil claim is within your control and is directed at obtaining injunctive relief, damages, or both.

What Happens if the Access Occurred During the Relationship

Former partners sometimes argue that they had implied consent to access shared accounts or devices during the relationship. Consent is a defence under the statutory tort, but it is limited. Consent to share a password during a relationship does not extend to accessing the account after the relationship has ended, or after the other party has changed passwords or revoked access. The court will assess consent in context. Where the relationship has ended and the plaintiff has taken steps to restrict access, continued logging in will ordinarily be treated as unauthorised.

What if the Information Has Been Disclosed to Others

If your former partner has disclosed information obtained through unauthorised access, such as sharing your private emails with friends, family, or lawyers, or publishing your financial records, that conduct may give rise to a second limb of the tort: misuse of personal information. It may also amount to doxxing if it involves publication of identifying personal details. Where the disclosure has damaged your reputation, a defamation claim may also be available.

The statutory tort of serious invasion of privacy and the tort of defamation operate independently. Truth is a complete defence to defamation, but it is not a defence to the privacy tort. Information that is true, private, and published without consent is actionable under Schedule 2 regardless of its accuracy.

Fixed-Fee Initial Assessment: $770

A confidential, structured review of your situation. We assess the strength of your claim, identify available evidence, and advise on the most effective course of action.

Why Clients Come to Us for Account Access Claims

Practical, direct, and confidential.

Urgency Capability

We prepare and file urgent privacy injunction applications to restrain ongoing access. Available outside standard business hours for genuine emergencies.

Digital Evidence Focus

We understand how platform login records, IP logs, device identifiers, and session data work. Early preservation of this evidence is often decisive.

Fixed-Fee Entry Points

Initial assessments ($770) and pre-action demand letters ($990) are fixed fee. You know the cost before you commit.

Federal Jurisdiction, National Reach

The statutory tort is Commonwealth law. We act for clients across Australia. Our principal office is in Melbourne, with capacity to appear in all federal courts.

Privacy and Defamation Overlap

Where account access leads to disclosure of private information that also damages reputation, we assess both privacy and defamation claims concurrently.

Confidential Process

The statutory tort includes provisions for suppression and non-publication orders. Your private information does not need to become public to pursue a claim.

Frequently Asked Questions: Ex Partner Accessing Accounts

Yes. Unauthorised access to a computer system is a criminal offence under section 478.1 of the Criminal Code Act 1995 (Cth), carrying a maximum penalty of 2 years imprisonment. Equivalent offences exist in Victoria (Crimes Act 1958, s 247G), NSW (Crimes Act 1900, s 308H), and Queensland (Criminal Code, s 408E). Since 10 June 2025, it is also actionable as a civil wrong under the statutory tort for serious invasion of privacy (Schedule 2, Privacy Act 1988), which allows you to seek damages and injunctive relief in court. The criminal and civil avenues are independent. You can pursue both.

Sharing a password during a relationship may constitute implied consent to access at that time. It does not constitute ongoing consent after the relationship has ended or after you have changed your passwords or otherwise indicated that access is no longer permitted. Consent under the statutory tort is assessed in context. If you have revoked access, whether by changing passwords, telling your former partner to stop, or simply ending the relationship, their continued access is likely to be treated as unauthorised.

No. The statutory tort for serious invasion of privacy is actionable per se, meaning it does not require proof of financial loss or other damage. The invasion itself grounds the claim. If you have suffered financial loss, emotional distress, or other harm, those matters are relevant to the quantum of damages but are not a precondition to bringing the claim.

The most direct evidence is platform activity logs showing login times, IP addresses, device identifiers, and geographic locations that are inconsistent with your own usage. Most major platforms (Google, Apple, Microsoft, Meta, banking institutions) maintain this data and provide access to it through account security settings or formal disclosure requests. Screenshots, unusual account activity (such as emails being marked as read before you opened them), and changes to account settings are also relevant. Preserving this evidence early is critical, as platform data retention periods vary.

Yes. The Federal Court and the Federal Circuit and Family Court have power to grant injunctions under the statutory tort. If the access is ongoing, you can apply for an interim injunction restraining the respondent from further access. The court can also order deletion of any information obtained through the unauthorised access. We prepare and file urgent injunction applications at short notice. For more information, see Urgent Privacy Injunctions.

If your former partner has disclosed private information obtained through unauthorised access, that conduct may give rise to a separate claim for misuse of personal information under the second limb of the statutory tort. Where the information was published online or shared widely, it may also constitute doxxing. If the disclosure has damaged your reputation, a defamation claim may be available in parallel. Truth is a defence to defamation but not to the privacy tort.

The limitation period under the statutory tort is 1 year from the date you became aware (or ought reasonably to have become aware) of the invasion, or 3 years from the date the invasion occurred, whichever expires first. The court has discretion to extend this period up to a maximum of 6 years from the date of the invasion. If you have recently discovered that your ex has been accessing your accounts, it is important to obtain legal advice promptly. See Privacy Tort Time Limits for a detailed explanation.

Non-economic loss damages are capped at $500,000 (indexed annually in line with the defamation damages cap). The court may also award exemplary damages in exceptional cases, such as where the defendant acted with deliberate malice or for the purpose of gaining advantage in family law proceedings. See How Much Compensation for Invasion of Privacy.

You may wish to. Unauthorised computer access is a criminal offence, and a police report creates an independent record of the conduct. However, the criminal process is controlled by police and prosecutors. It does not provide compensation, and outcomes are not within the complainant's control. The civil claim under the statutory tort is brought and controlled by you, and is directed at obtaining damages, injunctions, or both. A criminal complaint and a civil claim can proceed in parallel.

The Office of the Australian Information Commissioner (OAIC) handles complaints about breaches of the Australian Privacy Principles (APPs) by APP entities, which are organisations and government agencies above the small business threshold. The OAIC complaint pathway does not cover conduct by individuals, including former partners. If your ex partner accessed your accounts, the OAIC cannot assist. The statutory tort under Schedule 2 allows you to bring a civil claim in court against any person, including individuals. See OAIC Complaint vs Suing for Invasion of Privacy for a full comparison.

Your Ex Accessed Your Accounts. You Have a Right of Action.

Contact us for a confidential initial assessment. Fixed fee: $770. We act for clients across Australia.

Disclaimer: The content of this page provides general information only and does not constitute specific legal advice. You should seek independent legal advice regarding your particular circumstances.

Call