03 9070 9810

Someone Published Your Private Information Online

Australian law now provides a direct civil remedy when personal information is posted without your consent.

Book a Confidential Assessment ($770)

Max file size: 20MB

Private Information Posted Online Without Consent

If someone has posted your personal information online, you may have a cause of action under the statutory tort for serious invasion of privacy (Schedule 2 of the Privacy Act 1988 (Cth)), which commenced on 10 June 2025. This is the first general civil privacy remedy in Australian law. It applies to the misuse of personal information regardless of the platform: social media, messaging apps, websites, online forums, or email.

The tort does not require you to prove financial loss. It does not matter whether the information published about you was true. Truth is not a defence. What matters is that private information was shared intentionally or recklessly, and that the invasion was serious. If you are currently facing an ongoing publication, an urgent privacy injunction may be available to restrain further dissemination.

The clock is ticking. You may have as little as 12 months from when you became aware of the publication to commence proceedings. If you need a privacy lawyer in Australia to assess your position, our confidential initial assessment is available at a fixed fee of $770.

Time Limits Apply to Privacy Claims

The limitation period may be as short as one year from when you first became aware of the publication. Do not delay.

How the Law Protects Your Private Information

The statutory tort covers a broad range of personal information and provides real remedies.

Types of private information protected under privacy law

What Information Is Protected

<p>The statutory tort for serious invasion of privacy covers the misuse of personal information that a reasonable person would expect to remain private. This includes health and medical records, financial details, sexual orientation or intimate relationships, home addresses and phone numbers, family circumstances, and images or recordings made in private settings.</p><p>It is not limited to information that is embarrassing or harmful. The question is whether you had a reasonable expectation of privacy in the information and whether the invasion was serious. Publication of your private health records to a Facebook group, for example, is precisely the kind of conduct this tort was enacted to address.</p>

Urgent legal intervention to stop publication

Urgent Intervention to Stop Ongoing Publication

<p>If private information is being circulated now, the priority is containment. Under clause 9 of Schedule 2, a court may grant an injunction to restrain a serious invasion of privacy, including ordering the removal or suppression of published material. This can be sought on an urgent basis, including outside ordinary court hours in appropriate cases.</p><p>An urgent privacy injunction is often the most important step. Compensation matters, but stopping further dissemination of your personal details is usually the immediate concern. We can advise on whether your circumstances warrant an urgent application.</p>

Legal compensation for privacy breaches

Compensation and Civil Privacy Damages

<p>The statutory tort allows a court to award damages for non-economic loss (distress, humiliation, anxiety) up to a cap of $500,000, without requiring proof of financial loss. In exceptional cases involving deliberate, high-handed, or contumelious conduct, exemplary damages may also be awarded above the cap.</p><p>Privacy breach compensation in Australia is assessed by reference to the seriousness of the invasion, the extent of publication, the nature of the information, and the defendant's conduct. A court may also order an account of profits if the defendant profited from publishing your information. These are real remedies with real consequences for defendants.</p>

Platforms, Defendants, and Parallel Claims

Where the Information Was Published Does Not Limit Your Claim

The statutory tort for serious invasion of privacy is not platform-specific. It applies to the misuse of personal information regardless of where it appears: Facebook, Instagram, X (formerly Twitter), TikTok, LinkedIn, Reddit, WhatsApp groups, Telegram channels, personal websites, blogs, online forums, or mass email. If someone posted your personal information online and the conduct was intentional or reckless, the platform is a factual detail, not a legal barrier.

The tort also applies to publication through offline channels. Printing and distributing flyers containing someone's private medical history, for example, is just as actionable as posting the same information on social media. The medium is relevant to the extent and seriousness of the invasion, but not to whether a cause of action exists.

Who Can Be Sued

The defendant pool under Schedule 2 is broad. Any person, corporation, or government body may be a defendant, regardless of whether they are an APP entity under the Privacy Act. This means you can bring a claim against an individual (an ex-partner, a former friend, a disgruntled associate), a company (an employer, a business that disclosed your customer records), or a public body. The person who published the information need not have obtained it unlawfully. It is the act of publication, not the manner of acquisition, that grounds the claim.

The journalist exemption under clause 15 of Schedule 2 provides significant protection. It applies to professional journalists who are subject to standards of professional conduct or a code of practice. This protection may also extend to their employers, assistants, and photographers. While it is anticipated that social media users, bloggers, and influencers may fall outside this protection, the precise boundaries of the term 'journalist' have not yet been tested in court. If your private details were published by someone who is not a professional journalist working under a recognised code, the exemption may not assist them.

When Privacy and Defamation Overlap

Publication of private information will often also damage your reputation. Where information is both private and defamatory, you may have parallel claims: one under the statutory tort for serious invasion of privacy, and one in defamation. These are distinct causes of action with different elements, defences, and remedies. Significantly, truth defeats a defamation claim but does not defeat a privacy claim. A defendant who publishes true but private information about you cannot rely on truth to defeat the privacy claim.

This distinction is significant. If your private medical records are published online and the information is accurate, a defamation claim would likely fail (because the publication is substantially true), but a privacy claim may succeed (because truth is not a defence to misuse of private information). Conversely, if false private allegations are made, both causes of action may be available, and pursuing both may produce a stronger outcome. We act in both privacy and defamation and can assess whether parallel claims are appropriate. Our defamation practice operates through defamationlawyer.au.

Practical Examples

The following are common scenarios in which clients seek advice about private information published without consent. An ex-partner may post private text messages, photographs, or details about a person's health, finances, or sexual history on social media. A former employee or colleague might share confidential information about another person's medical condition or disciplinary record in a group chat. In other instances, a disgruntled customer or business associate publishes a person's home address, phone number, or financial details online. A person's private photographs or recordings may be shared without consent on messaging platforms or websites. Finally, a company or organisation might disclose customer data, patient records, or financial records to third parties without authorisation.

Each of these may give rise to a claim for civil privacy damages, an urgent privacy injunction, or both. The strength of any claim depends on the specific facts, the nature of the information, and whether the seriousness threshold is met. A confidential initial assessment is the appropriate first step.

Confidential Initial Assessments at Fixed Fee

We provide an honest appraisal of your position, the strength of your claim, and what it will cost to pursue. Fixed fee: $770.

Why Clients Instruct Us

Sutton Laurence King Lawyers acts for plaintiffs and defendants in privacy and defamation matters.

Truth Is Not a Defence

Unlike defamation, the statutory tort does not allow defendants to escape liability by proving the published information was accurate. If the information was private, the truth of it is irrelevant.

No Proof of Financial Loss Required

The tort is actionable per se. You do not need to demonstrate that the publication caused you economic harm. Distress, humiliation, and loss of dignity are recognised heads of damage.

Fixed Fee Entry Points

Initial assessments ($770) and pre-action demand letters ($990) are offered at fixed fees. You know the cost before you commit. Full representation is quoted after the assessment.

Urgent Injunctions for Ongoing Publication

Where private information is still being circulated, an urgent application to the court can restrain further publication. Speed matters. We can advise on urgency and appropriate timing.

Parallel Privacy and Defamation Claims

Where a publication is both private and defamatory, parallel proceedings may strengthen your position. We practise in both fields and can assess whether dual claims are warranted.

Federal Jurisdiction, National Reach

The statutory tort operates under Commonwealth law. We act for clients across Australia, with offices in Melbourne and capacity to appear in all states and territories.

Frequently Asked Questions

You may be able to bring a claim under the statutory tort for serious invasion of privacy (Schedule 2 of the Privacy Act 1988 (Cth)), which commenced on 10 June 2025. The tort covers the misuse of personal information, including publication of private details on social media, websites, messaging platforms, or any other medium. To succeed, you must establish that: (1) the defendant's conduct involved a serious invasion of your privacy; (2) the invasion was intentional or reckless (negligence or carelessness is not sufficient); and (3) a reasonable person in your position would have had an expectation of privacy in the information. You do not need to prove financial loss. The first step is a confidential initial assessment to determine whether your circumstances meet the statutory threshold.

No. Truth is not a defence to a claim under the statutory tort for serious invasion of privacy. This is a fundamental distinction from defamation law, where a defendant can defeat a claim by proving the published matter was substantially true. Under the privacy tort, the question is whether the information was private and whether its publication constituted a serious invasion of your privacy, not whether it was accurate. If someone publishes your private medical records and the records are accurate, the truth of the information does not assist them.

The statutory tort applies to any defendant: individuals, corporations, and government bodies. You are not limited to suing organisations that hold your data under the Australian Privacy Principles. An ex-partner, a neighbour, a former colleague, or any other individual who intentionally or recklessly publishes your private information may be liable. This is one of the key advantages of the statutory tort over the OAIC complaint pathway, which only applies to APP entities. For more on this distinction, see our page on OAIC complaints versus suing for invasion of privacy.

A pre-action demand letter (available at a fixed fee of $990) may secure removal without court proceedings. Many defendants will comply with a formal legal demand, particularly when informed of the statutory tort and its remedies. If the defendant does not comply, or if the matter is urgent and further publication is imminent, an urgent privacy injunction may be sought from the court to compel removal and restrain further dissemination.

Under the statutory tort, a court may award damages for non-economic loss (including distress, humiliation, and anxiety) up to a cap of $500,000. In exceptional cases, exemplary damages may be awarded above the cap. The court may also order an account of profits and issue injunctions. No proof of financial loss is required. The quantum will depend on the nature of the information, the extent of publication, the defendant's conduct, and the impact on you. For more detail, see our page on how much compensation for invasion of privacy.

The limitation period is one year from the date you became aware (or ought reasonably to have become aware) of the invasion, or three years from the date the invasion occurred, whichever is earlier. A court may extend this period in limited circumstances, up to a maximum of six years from the date of the invasion. These time limits are strict. If you suspect your private information has been published without consent, you should seek legal advice promptly. See privacy tort time limits for further detail.

Where private information is published in a way that both invades your privacy and damages your reputation, you may have parallel claims in privacy and defamation. These are separate causes of action with different elements and defences. Significantly, truth defeats a defamation claim but does not defeat a privacy claim. We practise in both areas and can assess whether dual claims are appropriate. Our defamation practice operates through defamationlawyer.au. For a detailed comparison, see invasion of privacy versus defamation.

Yes. The Office of the Australian Information Commissioner (OAIC) accepts complaints about privacy breaches at no cost, and you do not need a lawyer. However, the OAIC pathway has significant limitations: it only covers APP entities (certain organisations and government agencies), it does not apply to individuals or most small businesses, outcomes are generally modest, punitive damages are not available, and the process is slow. If the person who published your information is an individual or a small business operator, the OAIC cannot assist. The statutory tort provides a broader and more effective avenue for serious invasions. See OAIC complaint versus suing for invasion of privacy.

No. The statutory tort operates under Commonwealth law and the Federal Court and Federal Circuit and Family Court have jurisdiction across Australia. Our office is in Melbourne, but we act for clients nationally. Initial assessments can be conducted by phone or video conference.

The Limitation Period May Be as Short as 12 Months

If your private information has been published without your consent, seek legal advice before time limits expire. Confidential initial assessments are available at a fixed fee of $770.

Disclaimer: The content of this website is intended to provide general information only and does not constitute legal advice. You should seek specific legal advice tailored to your circumstances before taking any action.

Call