Privacy Tort Exemptions: Who Can Be Sued and Who Cannot

The statutory tort for serious invasion of privacy commenced on 10 June 2025. It gives individuals a direct right of action against anyone who seriously invades their privacy, whether by intrusion upon seclusion or by misuse of personal information. Only individuals can bring a claim, but the defendant pool is wide: claims can be brought against a person, a corporation, or a government body, regardless of whether they are an APP entity under the Privacy Act. This fills gaps left by the state surveillance statutes.

But the tort is not unlimited. Schedule 2 of the Privacy Act 1988 (Cth) contains both exemptions and defences, and they operate in different ways. The privacy tort exemptions determine who can be sued at all. The defences determine whether conduct that would otherwise be actionable can be excused. For anyone considering a claim, or defending one, the distinction matters from the first day.

Exemptions and Defences Are Not the Same Thing

The practical difference between an exemption and a defence is procedural, and it is significant.

Exemptions are set out in Part 3 of Schedule 2. A defendant who falls within an exemption can apply to the court for a pre-trial determination that the exemption applies. If the application succeeds, the matter can be resolved before trial, avoiding the cost and delay of full proceedings. This is a powerful early exit for defendants who qualify.

Defences are set out in Part 2 of Schedule 2. They are raised and determined at trial. A defendant cannot ordinarily dispose of a claim pre-trial simply by asserting a defence; the court will hear evidence and weigh the defence against the circumstances. For a plaintiff, this means a defence does not necessarily end the claim at the door.

Understanding which category applies to a given defendant is the first step in assessing whether a claim has prospects.

Who Is Exempt Under Part 3

The exemptions cover several categories of defendant.

Journalists and journalistic material. Clause 15 exempts journalists, their employers, and persons assisting them for the collection, preparation, or publication of journalistic material. The exemption is drawn narrowly. It applies to professional journalists who are subject to a code of practice. Social media users, bloggers, influencers, and citizen journalists do not qualify. A person who publishes private information online without the protections of a professional code remains within reach of the tort.

Government agencies and State or Territory authorities. Clauses 16 and 16A exempt government agencies and State or Territory authorities acting in good faith in the performance of their functions. The exemption was clarified and extended during the passage of the Privacy and Other Legislation Amendment Bill 2024, which passed both Houses on 29 November 2024. The exemption applies where the invasion of privacy occurs in the performance or exercise of the agency or authority's function or power.

Law enforcement and intelligence bodies. Clauses 16B and 17 exempt law enforcement bodies and intelligence agencies. Related provisions cover disclosures of information to a law enforcement body or intelligence agency.

Persons under 18. Clause 18 exempts individuals under 18 years of age.

These exemptions are not a blanket immunity for institutional conduct. They are confined to the categories and functions described in the legislation, and a defendant who steps outside them loses the protection.

The Defences Available Under Part 2

For defendants who are not exempt, Part 2 provides a defined set of defences. These are raised at trial.

• Lawful authority. The invasion was required or authorised by or under an Australian law or a court or tribunal order.
• Consent. The plaintiff expressly or impliedly consented to the invasion.
• Necessity. The defendant reasonably believed the invasion was necessary to prevent or lessen a serious threat to life, health, or safety. This includes domestic and family violence emergencies.
• Defence of persons or property. The invasion was incidental to the exercise of a lawful right of defence and was proportionate, necessary, and reasonable.
• Defamation-related defences. Where the invasion involved publication, the defences of absolute privilege, publication of public documents, and fair report of proceedings of public concern may apply.

An apology by a defendant does not constitute an admission of fault or liability under clause 13. The court may, however, consider an apology when determining damages. That provision shapes how settlement negotiations are conducted on both sides.

The Seriousness Threshold and Public Interest

Two elements of the cause of action itself operate as filters, and defendants frequently challenge them.

The seriousness threshold in clause 7(1)(d) means not every invasion of privacy is actionable. Only serious invasions meet the threshold. The court may consider whether the invasion was intentional, whether the defendant knew or ought to have known the invasion was likely to offend or distress the plaintiff, and whether the plaintiff suffered damage. A defendant facing a claim based on minor, incidental, or proportionate conduct will test this element.

The public interest balancing test in clause 7(1)(e) requires the court to weigh the plaintiff's privacy interest against any countervailing public interest. The factors include freedom of expression, freedom of the media, the proper administration of government, and the prevention and detection of crime and fraud. Where a defendant can lead evidence of a countervailing public interest, that evidence goes to the heart of the claim.

In urgent injunction proceedings, clause 9 requires the court to have particular regard to the public interest in the publication of information when deciding whether to restrain publication. A defendant resisting an injunction will point to that provision.

Workplace Monitoring and the Employee Records Question

The statutory tort applies to the handling of employee records, unlike the Australian Privacy Principles, which contain an employee records exemption. This is a change in exposure for employers. Monitoring that is disclosed, proportionate, and conducted for a legitimate business purpose may still be defended on grounds of implied consent, lawful authority, or because the plaintiff did not have a reasonable expectation of privacy in the circumstances. The assessment turns on the facts of the monitoring, not on the existence of a policy alone.

Why the Exemptions Matter for Plaintiffs

For a person whose privacy has been seriously invaded, the exemptions determine whether the person responsible can be pursued in court at all. A blogger who publishes a home address is not exempt. A neighbour who trains a camera on a private area of a property is not exempt. An ex-partner who tracks a phone or threatens to publish intimate images is not exempt. A media organisation publishing private information may or may not be exempt, depending on whether the publication falls within journalistic material prepared by a journalist subject to a code of practice.

The statutory tort is separate from the OAIC complaint pathway. The OAIC pathway is free, does not require a lawyer, and covers APP entities, but it does not reach individuals or small businesses, does not produce punitive damages, and moves slowly. The statutory tort provides a court remedy against a wider pool of defendants. The NSW Parliamentary Research Service has published analysis of how the tort interacts with state law, and the operation of the tort will be clarified as the first claims approach the courts.

Where a publication of private information also damages reputation, the claim may overlap with defamation. The two causes of action have different elements, defences, and damages frameworks, and they can be run together in appropriate cases. See defamationlawyer.au for more on that overlap.

There is Australian case law on the statutory tort. Kurraba Group Pty Ltd & Anor v Williams [2025] NSWDC 396 was decided on 7 October 2025, and addresses the statutory tort. Courts will also look to UK, NZ, and Canadian privacy jurisprudence as persuasive authority, but those decisions do not bind Australian courts. The first Australian decisions will provide guidance on how the exemptions and defences are applied in practice.

Next Steps

The clock is ticking. You may have as little as 12 months to act. Limitation periods under the tort are strict: one year from awareness or three years from occurrence, whichever is earlier, with a maximum extension to six years.

If you are considering a claim, or if you have been served with an urgent injunction application, the exemptions and defences will frame everything that follows. A confidential initial assessment is available to discuss the exemptions and defences that may apply, and urgent injunction applications can be made where necessary to restrain ongoing invasions or prevent publication. Enquire now or call our office to discuss your matter.

This article provides general information only. It is not legal advice and should not be relied upon as such. Every matter turns on its own facts.