03 9070 9810

Choosing Between an OAIC Complaint and Court Action

Two routes exist for privacy complaints in Australia. They cover different conduct, different defendants, and produce very different outcomes.

Book a Confidential Assessment

Max file size: 20MB

Two Pathways, Very Different Reach

If your privacy has been invaded, Australian law now provides two distinct avenues of redress. The first is a complaint to the Office of the Australian Information Commissioner (OAIC). The second is a civil claim under the statutory tort for serious invasion of privacy, introduced by Schedule 2 of the Privacy Act 1988 (Cth) and in force since 10 June 2025.

Both pathways have a place. But they differ in who you can bring a claim against, what remedies are available, and how long the process takes. Many people begin by searching for the OAIC complaint process, only to discover it does not cover their situation at all. If the person who invaded your privacy is an individual, a small business, or a non-APP entity, the OAIC cannot help you. The statutory tort can.

The following comparison identifies the reach and limitations of each avenue. If you need guidance on which pathway applies to your circumstances, a confidential initial assessment is available for a fixed fee of $770.

The clock is ticking. You may have as little as 12 months to act.

The statutory tort has a strict one-year limitation period from when you became aware of the invasion. Do not delay.

Comparing the Two Pathways

The OAIC complaint process and the statutory tort serve different purposes and cover different ground.

Person filing OAIC privacy complaint online

The OAIC Complaint: Free, but Limited

<p>A complaint to the OAIC is free to lodge and does not require a lawyer. It is a regulatory process, not a court proceeding. The OAIC can investigate, attempt conciliation, and in some cases make a determination ordering compensation or requiring an entity to change its practices.</p><p>However, the OAIC pathway only covers Australian Privacy Principles (APP) entities. These are Australian Government agencies and private sector organisations with an annual turnover above $3 million (plus some smaller organisations that opt in or are covered by specific rules). If the person who invaded your privacy is your ex-partner, your neighbour, a small business operator, or a private individual, the OAIC has no jurisdiction over them.</p><p>Processing times can be lengthy, and the resolution of a complaint may take a year or more. There is no capacity for urgent interim relief. Compensation outcomes tend to be modest. The OAIC does not award exemplary damages. And the process is administrative, not adversarial: you do not control the pace or strategy of the investigation.</p>

Courtroom representing civil litigation for privacy invasion

The Statutory Tort: Judicial Remedies and Enforcement

<p>The statutory tort for serious invasion of privacy under Schedule 2 of the Privacy Act is a civil cause of action. You bring it in a federal, state, or territory court. You can claim against any person, corporation, or government body, regardless of whether they are an APP entity. There is no turnover threshold. There is no limitation on the type of defendant.</p><p>The tort covers two forms of invasion: <a href="/surveillance-and-recording-claims">intrusion upon seclusion</a> (such as surveillance, tracking, or eavesdropping) and <a href="/misuse-of-private-information">misuse of personal information</a> (such as doxxing, leaking medical records, or publishing intimate images). Damages for non-economic loss are capped at approximately $500,000, with exemplary damages available in exceptional cases. <a href="/urgent-privacy-injunctions">Urgent injunctions</a> can restrain ongoing invasions or prevent imminent publication. No proof of damage is required: the tort is actionable per se.</p><p>Court proceedings move on a timetable you and your lawyers control. You can apply for interlocutory relief within days. The statutory tort is, for serious invasions, a fundamentally more powerful remedy.</p>

Legal consultation for privacy law pathway decision

Choosing the Right Path

<p>The OAIC pathway is appropriate where the respondent is a large organisation or government agency, the invasion is relatively minor, and you do not need urgent relief. It costs nothing and may resolve the matter without litigation.</p><p>The statutory tort is the appropriate pathway where the invasion is serious, the defendant is not an APP entity, you need an injunction to stop ongoing conduct, or the OAIC's remedial powers are insufficient. It is also the only pathway that provides for exemplary damages, which serve to punish deliberate or reckless invasions and deter future conduct.</p><p>In some cases, both pathways may be available. They are not mutually exclusive, but the procedural and strategic implications of pursuing one or both should be considered carefully. A privacy lawyer experienced in court action can assess which approach is likely to produce the best outcome for your circumstances.</p>

What the OAIC Cannot Do

Coverage Gaps

A significant limitation of the OAIC complaint pathway is its restricted coverage. The Australian Privacy Principles in Schedule 1 of the Privacy Act apply only to APP entities. If your former partner installed a tracking device on your car, the OAIC cannot investigate. If your neighbour pointed a CCTV camera at your backyard, the OAIC cannot help. If a private individual published your home address and phone number online, the OAIC has no jurisdiction. These are precisely the kinds of invasions the statutory tort was designed to address.

No Urgent Relief

The OAIC does not grant injunctions. If someone is threatening to publish intimate images of you tomorrow, or if a surveillance device is recording you now, the OAIC complaint process offers no mechanism for urgent intervention. By contrast, a court can grant an urgent privacy injunction restraining the conduct, sometimes within hours of the application being filed. For ongoing or imminent invasions, the difference between the two pathways is the difference between waiting months and acting immediately.

Modest Remedies

The OAIC can order compensation, but in practice, awards have been modest. There is no equivalent of the statutory tort's damages cap of approximately $500,000 for non-economic loss, and no mechanism for exemplary damages. For a serious invasion of privacy, where the defendant acted deliberately or recklessly, the remedial gap between the two pathways is substantial.

The Employee Records Exemption

The Australian Privacy Principles contain a broad exemption for employee records held by employers. This means that if your employer accessed your private emails, monitored your personal device usage, or disclosed your medical information internally, the OAIC may not be able to assist, because the conduct falls within the employee records exemption. The statutory tort contains no such exemption. Employer invasions of privacy are actionable under Schedule 2 if they meet the seriousness threshold, regardless of the employee records exemption in Schedule 1.

Truth Is Not a Defence Under the Statutory Tort

Unlike defamation (where truth is a complete defence), the statutory tort for serious invasion of privacy does not permit a defendant to escape liability by proving the information published was true. If someone published your private medical records, the fact that the records are accurate does not protect them. This is a critical distinction. If your situation involves the publication of true but private information, the statutory tort is likely the only avenue that provides a meaningful remedy. Where the same publication also damages your reputation, a parallel claim in defamation may also arise. We act in both areas and can advise on the interaction between the two: see invasion of privacy vs defamation and our related practice at defamationlawyer.au.

A Practical Note

None of this is to say the OAIC complaint process is without value. For straightforward breaches by large organisations, it can produce a resolution without the cost and stress of litigation. If you are unsure which pathway applies to your situation, that is exactly what our confidential initial assessment is designed to clarify.

Not Sure Which Pathway Applies to You?

A fixed-fee confidential initial assessment ($770) will identify your options, assess the strength of your claim, and set out practical next steps.

Why the Statutory Tort Matters for Serious Invasions

Schedule 2 of the Privacy Act created a civil right of action that fills long-standing gaps in Australian privacy law.

Any Defendant

The statutory tort applies to individuals, corporations, small businesses, and government bodies. There is no APP entity requirement and no turnover threshold.

No Proof of Damage Required

The tort is actionable per se. You do not need to prove financial loss, psychiatric injury, or any other form of damage to bring a claim.

Urgent Injunctive Relief

Courts can grant injunctions to stop ongoing surveillance, prevent publication, or restrain other invasive conduct. The OAIC has no equivalent power.

Substantial Damages

Non-economic loss damages are capped at approximately $500,000. Exemplary damages may be awarded in exceptional cases of deliberate or reckless conduct.

Truth Is Not a Defence

Unlike defamation, the accuracy of published information does not protect the defendant. Publishing true but private information is actionable.

No Employee Records Exemption

The statutory tort covers invasive workplace monitoring and misuse of employee information that falls outside the OAIC's reach.

Frequently Asked Questions: OAIC Complaint vs Court Action

Generally, no. Your neighbour is almost certainly not an APP entity, which means the OAIC has no jurisdiction over them. The statutory tort for serious invasion of privacy under Schedule 2 of the Privacy Act is the appropriate avenue. It allows you to bring a civil claim against any person, including a private individual, for intrusion upon seclusion. See our page on neighbour cameras and the new privacy law.

Yes. Lodging a complaint with the OAIC is free and does not require a lawyer. If the respondent is an APP entity, the OAIC can investigate, attempt conciliation, and in some cases make a binding determination. However, the process can be slow, remedies are often modest, and the OAIC cannot grant urgent injunctions or award exemplary damages.

In principle, the two pathways are not mutually exclusive. However, pursuing both simultaneously raises procedural and strategic questions that should be considered carefully. In some circumstances, an OAIC complaint may complicate or delay court proceedings. This is something to discuss with a privacy lawyer before committing to a particular course of action.

The Australian Privacy Principles contain an exemption for employee records held by employers. This exemption means the OAIC may be unable to assist you. The statutory tort for serious invasion of privacy contains no such exemption. If your employer's conduct was intentional or reckless and meets the seriousness threshold, a court claim under Schedule 2 may be the only viable avenue. See employer invasion of privacy.

Yes. Truth is not a defence to the statutory tort. If someone published your private medical information without your consent, the fact that the information is accurate does not protect them. This is one of the critical distinctions between the statutory tort and defamation law. See leaked medical records and invasion of privacy vs defamation.

The statutory tort has a strict limitation period: one year from the date you became aware (or ought reasonably to have become aware) of the invasion, or three years from the date the invasion occurred, whichever expires first. The court may extend this to a maximum of six years in limited circumstances. Do not assume you have time to wait. See privacy tort time limits.

You are not legally required to have a lawyer, but the statutory tort involves court proceedings with procedural rules, evidence requirements, and a public interest balancing test. For serious claims, particularly those involving urgent injunctions or substantial damages, legal representation is strongly advisable. Our confidential initial assessment is available for a fixed fee of $770 and will clarify your position.

No. Only individuals (natural persons) can bring a claim under the statutory tort for serious invasion of privacy. Corporations, trusts, and other legal entities cannot be plaintiffs. However, corporations can be defendants: an individual can sue a corporation that has invaded their privacy.

If Your Privacy Has Been Seriously Invaded, the Right Pathway Matters

A confidential initial assessment will identify whether the OAIC, the court, or both are appropriate for your situation. Fixed fee: $770.

Disclaimer

The information provided on this website is for general informational purposes only and does not constitute legal advice. No solicitor-client relationship is created by your use of this site. You should seek independent legal advice regarding your specific circumstances before taking any action.

Call