03 9070 9810

Misuse of Private Information

Legal claims for unauthorised disclosure of your health records, financial details, and private correspondence.

Book a Confidential Assessment

Max file size: 20MB

When Your Private Information Is Disclosed Without Consent

Since 10 June 2025, individuals in Australia have had a direct civil right of action where someone intentionally or recklessly misuses their private information. The statutory tort for serious invasion of privacy under Schedule 2 of the Privacy Act 1988 (Cth) covers the unauthorised collection, use, or disclosure of personal information, including health records, financial details, intimate material, and private correspondence.

This is a significant development. Before Schedule 2, there was no general civil remedy for misuse of private information in Australian law. You could complain to the OAIC about certain organisations, but you could not sue the individual, the small business, or the unregulated entity that leaked your information. That has changed.

Critically, truth is not a defence. It does not matter whether the information disclosed about you was accurate. If someone published your private medical diagnosis, your financial records, or your personal correspondence without your consent, the accuracy of that information is irrelevant to your claim. The wrong is the disclosure itself.

The clock is ticking. You may have as little as 12 months from the date you became aware of the disclosure to commence proceedings. If your private information has been published without your consent, early legal assessment is important.

Confidential Initial Assessment: $770 Fixed Fee

A thorough review of your circumstances, the strength of your privacy breach claim, and a clear recommendation on your options.

Categories of Private Information We Act On

The statutory tort covers any information in which you have a reasonable expectation of privacy. Common categories include the following.

Medical records representing health information privacy

Health and Medical Records

<p>Your medical history, diagnoses, prescriptions, mental health records, and treatment details are among the most sensitive categories of personal information. Unauthorised disclosure of health records can cause serious harm to personal relationships, employment, and reputation.</p><p>Common scenarios include a former partner revealing a mental health diagnosis, an employer disclosing a positive drug test, a medical practice sharing records with a third party without consent, or a family member publicising health conditions during a dispute. The statutory tort provides a civil remedy regardless of who disclosed the information and regardless of whether they are regulated under the Australian Privacy Principles.</p><p>For dedicated guidance, see our page on <a href='/leaked-medical-records'>leaked medical records</a>.</p>

Financial documents representing financial privacy protection

Financial and Commercial Information

<p>Bank balances, tax returns, salary details, debt levels, business accounts, and credit information are private. Disclosure of this information can affect your commercial relationships, creditworthiness, and personal standing.</p><p>Financial information is frequently misused in property disputes, family law proceedings, and business separations. An estranged spouse who publishes your financial records on social media, a former business partner who discloses your personal tax affairs to clients, or an employee who leaks salary data internally may all be liable under the statutory tort.</p><p>Where the disclosure also damages your reputation, you may have a concurrent defamation claim. We act in both areas and can assess which cause of action (or combination) best serves your interests. See <a href='https://defamationlawyer.au'>defamationlawyer.au</a> for further information on defamation claims.</p>

Private correspondence representing communication privacy

Private Correspondence and Communications

<p>Emails, text messages, voicemails, private social media messages, and personal letters are private communications. Publishing or sharing them without consent can ground a claim under the statutory tort, regardless of their content.</p><p>This category commonly arises in relationship breakdowns, workplace disputes, and neighbourhood conflicts. An ex-partner who screenshots and publishes private messages, a colleague who forwards confidential emails to damage your standing, or a person who reads out private correspondence in a public forum may all face liability.</p><p>The tort does not require proof of financial loss. The invasion itself is actionable. The court may award damages for emotional distress, loss of dignity, and anxiety caused by the disclosure, up to the statutory cap of approximately $478,550 for non-economic loss.</p>

How a Misuse of Private Information Claim Works

Elements of the Claim

To succeed in a privacy breach claim for misuse of private information under Schedule 2, a plaintiff must establish that the defendant collected, used, or disclosed information in which the plaintiff had a reasonable expectation of privacy, that the defendant acted intentionally or recklessly, and that the invasion was serious. The court applies a balancing test, weighing the plaintiff's privacy interest against any countervailing public interest, including freedom of expression and the proper administration of government.

No proof of damage is required. The tort is actionable per se. This means you do not need to show financial loss, psychiatric injury, or any specific consequence. The wrongful disclosure itself is sufficient.

Truth Is Not a Defence

This is one of the most significant features of the statutory tort, and one that distinguishes it sharply from defamation law. In defamation, truth (or "substantial truth") is a complete defence. Under Schedule 2, it is not. A person who publishes your genuine medical records, your actual bank statements, or your real correspondence is just as liable as someone who fabricates information. The harm recognised by the tort is the loss of control over your private information, not the falsity of what was said.

This makes the statutory tort particularly important for individuals whose private but accurate information has been weaponised against them, often in family disputes, workplace conflicts, or by former associates.

Parallel Claims: Privacy, Defamation, and Breach of Confidence

Where private information has been published, the same conduct may give rise to claims under more than one cause of action. If the publication is also defamatory (that is, it damages your reputation in the eyes of ordinary members of the community), you may have a concurrent defamation claim. If the information was shared in confidence, an equitable claim for breach of confidence may also be available.

Our firm practises in both privacy and defamation litigation. This allows us to assess the full range of causes of action available to you and to select the strongest path, or to run claims concurrently where that is in your interest. For further information on how the two regimes interact, see our page on invasion of privacy vs defamation.

Who Can Be Sued

The defendant pool under Schedule 2 is broad. Any person (including an individual, a corporation, a government body, or an unincorporated association) can be a defendant. Unlike the OAIC complaint pathway, which is limited to APP entities (generally organisations with annual turnover exceeding $3 million), the statutory tort applies to individuals, small businesses, employers, landlords, family members, and anyone else who misuses your private information. This is a substantial expansion of the remedies available.

The OAIC Pathway: An Alternative, Not a Substitute

The Office of the Australian Information Commissioner operates a free complaint mechanism for breaches of the Australian Privacy Principles. This pathway does not require a lawyer and involves no court proceedings. However, it only covers APP entities. It does not cover individuals, most small businesses, or entities not bound by the APPs. Outcomes tend to be modest, the process is slow, and there is no capacity for punitive or exemplary damages. For a detailed comparison, see our page on OAIC complaints vs suing for invasion of privacy.

For serious invasions of privacy, particularly those involving intentional or reckless conduct, the statutory tort under Schedule 2 is the stronger avenue. It provides access to injunctive relief, compensatory damages, exemplary damages in exceptional cases, and orders requiring the defendant to account for profits derived from the invasion.

Urgent Injunctions to Prevent Further Disclosure

If private information is about to be published, or if disclosure is ongoing, you may be able to obtain an urgent privacy injunction restraining further publication. We act promptly on injunction applications. For more detail on this process, see our page on urgent privacy injunctions.

This page provides general information only and does not constitute legal advice. The statutory tort commenced on 10 June 2025 and there is no Australian case law as at the date of publication. Courts are likely to consider persuasive authority from the United Kingdom, New Zealand, and Canada, where similar causes of action are established.

Time Limits Apply to Privacy Breach Claims

You may have as little as 12 months from the date you became aware of the misuse. Do not delay seeking legal advice.

Key Features of a Misuse of Private Information Claim

What distinguishes the statutory tort from other privacy remedies under Australian law.

No Proof of Damage Required

The tort is actionable per se. You do not need to prove financial loss, psychiatric injury, or any other specific harm. The wrongful misuse of your private information is itself sufficient.

Truth Is Irrelevant

Unlike defamation, the accuracy of the disclosed information does not matter. The wrong is the unauthorised disclosure, not the content. True information is protected equally.

Broad Defendant Pool

You can bring a claim against any person, corporation, or government body. The statutory tort is not limited to APP entities. Individuals, small businesses, employers, and family members can all be defendants.

Damages Up to Approximately $478,550

Non-economic loss damages are capped at the same level as defamation. Exemplary damages may be awarded in exceptional cases. The court may also order an account of profits.

Injunctive Relief Available

Courts can order defendants to stop disclosing your private information. Urgent injunctions may be sought before trial and, in appropriate cases, outside ordinary court hours.

Concurrent Claims Possible

A single disclosure may support claims in privacy, defamation, and breach of confidence. Running claims concurrently can strengthen your position and broaden the available remedies.

Common Questions About Misuse of Private Information Claims

There is no closed list. The question is whether you had a reasonable expectation of privacy in the information. Health records, financial details, intimate images, private correspondence, sexual orientation, family circumstances, and home addresses are all likely to qualify. The court will consider the nature of the information, the context in which it was obtained, and the means by which it was disclosed. Information that is already genuinely in the public domain may not attract a reasonable expectation of privacy, but limited disclosure to a small group does not necessarily make information public.

If someone intentionally or recklessly disclosed your medical records without your consent, and the disclosure was serious, you are likely to have a claim under the statutory tort for serious invasion of privacy. It does not matter whether the person who leaked the records is a health provider, a family member, an employer, or anyone else. The statutory tort is not limited to regulated entities. You do not need to prove that the disclosure caused you financial loss. For further detail, see our page on leaked medical records.

No. Truth is not a defence to a claim for misuse of private information under Schedule 2. This is one of the most important distinctions between privacy claims and defamation claims. In defamation, truth is a complete defence. Under the statutory tort, the wrong is the unauthorised disclosure, not the falsity of the information. A defendant who publishes your genuine financial records or your actual medical diagnosis is just as liable as one who fabricates information.

Potentially, yes. If the publication of your private information also damages your reputation, you may have a concurrent defamation claim. The two causes of action protect different interests (privacy and reputation, respectively) and have different elements, defences, and remedies. In some cases, a defamation claim will be stronger. In others, the privacy tort is more advantageous, particularly where the information is true. Our firm practises in both areas and can assess which combination of claims best serves your position. See invasion of privacy vs defamation for a detailed comparison.

The statutory tort applies to any defendant: individuals, small businesses, employers, landlords, family members, former partners, and corporations of any size. This is a key difference from the OAIC complaint pathway, which only covers APP entities (generally organisations with annual turnover above $3 million). Under Schedule 2, you can bring a claim against anyone who intentionally or recklessly misused your private information, regardless of their size or regulatory status.

The court may award compensatory damages (including for emotional distress, with non-economic loss capped at approximately $478,550), exemplary damages in exceptional cases, an injunction restraining further disclosure, an order requiring delivery up or destruction of material, an account of profits, and a declaration that an invasion of privacy occurred. An apology, if made, does not constitute an admission of fault or liability, but the court may take it into account when assessing damages.

You must commence proceedings within one year of the date you became aware (or ought reasonably to have become aware) of the invasion, or within three years of the date of the invasion, whichever is earlier. The court has a discretion to extend time up to a maximum of six years. These time limits are strict. Early legal advice is important. See our page on privacy tort time limits.

Not yet. The statutory tort commenced on 10 June 2025 and, as at the date of this page, no Australian court has delivered a judgment on Schedule 2. Courts are likely to consider persuasive authority from the United Kingdom (where the tort of misuse of private information is well developed), New Zealand (which recognised a common law tort of invasion of privacy in Hosking v Runting [2005] 1 NZLR 1), and Canada (which recognised intrusion upon seclusion in Jones v Tsige [2012] ONCA 32). These decisions are persuasive, not binding, but they provide guidance on how Australian courts may approach key concepts including reasonable expectation of privacy, the seriousness threshold, and the public interest balancing test.

We offer a confidential initial assessment for a fixed fee of $770 (inclusive of GST). This covers a review of your circumstances, an assessment of whether you have a viable claim (or claims), and a recommendation on next steps. If a pre-action demand letter is appropriate, we offer that service for a fixed fee of $990 (inclusive of GST). For full court proceedings, costs depend on complexity and are discussed at the assessment stage. See our page on confidential initial assessments.

Your Private Information Has Been Disclosed. What Now?

Contact us for a confidential assessment of your claim. Fixed fee entry points. Urgent matters receive priority attention.

Call