Two Pathways Under Schedule 2
The statutory tort for serious invasion of privacy under Schedule 2 of the Privacy Act 1988 (Cth) recognises two distinct forms of actionable conduct.
The first is intrusion upon seclusion: the defendant intruded upon the plaintiff's physical solitude or seclusion, or into the plaintiff's private affairs. This covers surveillance, tracking, hidden cameras, eavesdropping, hacking accounts, and physical intrusion into private spaces. If a former partner has installed tracking software on your phone, if a neighbour has directed a camera into your yard or bedroom, or if a landlord has left a concealed recording device in your rental property, the intrusion pathway is likely engaged.
The second is misuse of personal information: the defendant collected, used, or disclosed private information about the plaintiff in circumstances where the plaintiff had a reasonable expectation of privacy. This covers doxxing, publication of medical or financial records, non-consensual sharing of intimate images, and disclosure of private personal details online or to third parties. Truth is not a defence. It does not matter whether the information published was accurate.
Both pathways require the invasion to have been intentional or reckless. Carelessness or negligence alone is not sufficient. The invasion must also be serious, assessed by reference to a range of factors set out in the legislation. You do not need to prove financial loss. The tort is actionable without proof of damage.
The Gap in NSW State Legislation
New South Wales has the Surveillance Devices Act 2007 (NSW), which creates criminal offences for certain types of surveillance. The NSW Act requires all-party consent for recording private conversations (with a limited lawful interest exception), and it prohibits optical surveillance carried out by means of trespass on, or interference with, another person's property. Penalties are significant, including up to five years' imprisonment for some offences.
However, the NSW Act has important limitations for civil claimants. It creates criminal offences, not civil causes of action. You cannot sue for damages under the Surveillance Devices Act 2007. If a person is conducting external surveillance of your home from their own property, without trespassing or interfering with your property, the NSW Act may not be engaged at all. And the Act does not cover many forms of data surveillance, online privacy invasions, or the publication and misuse of private information.
The Commonwealth statutory tort fills these gaps. It provides a civil remedy, pursued in court by the affected individual, for any serious and intentional or reckless invasion of privacy. It applies across Australia regardless of state boundaries. A breach of the NSW Surveillance Devices Act may strengthen a claim under the Commonwealth tort, but the tort is available even where no state criminal offence has been committed.
The OAIC Pathway: Free, But Limited
Sydney residents can also lodge a complaint with the Office of the Australian Information Commissioner (OAIC). This pathway is free and does not require a solicitor. However, it only applies to APP entities, meaning organisations and agencies bound by the Australian Privacy Principles under Schedule 1 of the Privacy Act. The OAIC cannot investigate complaints against individuals, small businesses with annual turnover under $3 million (unless they are a health service provider or meet other criteria), or most private actors. Outcomes tend to be modest, there is no capacity for exemplary damages, and the process is often slow. For a more detailed comparison, see our page on OAIC complaint vs suing for invasion of privacy.
Damages and Remedies
If you succeed in a claim under the statutory tort, the court may award damages for non-economic loss (subject to the statutory cap), damages for economic loss, and in exceptional cases, exemplary damages. The court may also grant injunctions to restrain ongoing or threatened invasions, order the defendant to deliver up or destroy material, and require the defendant to publish an account of the finding. For more on the available remedies, see compensation and damages claims and how much compensation for invasion of privacy.
Limitation periods are strict: prescribed limitation periods apply based on when you became aware of the invasion. While extensions are sometimes possible, they are subject to statutory outer limits. Do not delay.