03 9070 9810

The New Invasion of Privacy Law in Australia

Schedule 2 of the Privacy Act 1988 creates a statutory tort for serious invasion of privacy. It commenced on 10 June 2025.

Book a Confidential Assessment

Max file size: 20MB

Australia Now Has a Civil Right of Action for Invasion of Privacy

For decades, Australian law had no general civil remedy for invasion of privacy. If someone recorded you, tracked your movements, or published your private information, your options were limited to complaints to the Office of the Australian Information Commissioner (OAIC), police reports under state surveillance legislation, or attempts to stretch existing causes of action such as breach of confidence or defamation. None of these was fit for purpose.

That changed on 10 June 2025. The Privacy and Other Legislation Amendment Act 2024 inserted Schedule 2 into the Privacy Act 1988 (Cth), creating a statutory tort for serious invasion of privacy. For the first time, any individual in Australia can bring a civil claim in court against any person, corporation, or government body that has intentionally or recklessly invaded their privacy in a serious way.

The tort covers two distinct pathways: intrusion upon seclusion (surveillance, tracking, recording, physical intrusion) and misuse of personal information (publishing private health, financial, or intimate details without consent). It does not require proof of financial loss. Truth is not a defence. And it applies to defendants who fall entirely outside the existing Privacy Act regime, including individuals, small businesses, and non-APP entities.

The Clock Is Ticking

You may have as little as 12 months from the date you became aware of the invasion to commence proceedings. Do not delay.

The Two Pathways and What You Can Recover

The statutory tort recognises two forms of privacy invasion, each with its own factual elements.

Illustration representing intrusion upon seclusion privacy violations

Pathway 1: Intrusion Upon Seclusion

This pathway covers physical or technological intrusion into a person's private space or affairs. It applies to conduct such as covert surveillance by a neighbour's camera, GPS tracking of a vehicle or phone, hidden cameras in a rental property or workplace, eavesdropping on private conversations, and unauthorised access to private accounts or devices. The focus is on the act of intrusion itself. Publication is not required. The invasion occurs when the defendant penetrates the plaintiff's zone of privacy, whether by watching, listening, entering, or accessing.

Illustration representing misuse of personal information

Pathway 2: Misuse of Personal Information

This pathway covers the collection, use, or disclosure of private information in circumstances where the plaintiff had a reasonable expectation of privacy. It applies to conduct such as publishing someone's medical records, sharing intimate images without consent, disclosing financial information, doxxing (publishing a person's home address, phone number, or other identifying details), and circulating private correspondence. The focus is on what was done with the information. It does not matter whether the information was true. Truth is not a defence to this tort, unlike defamation. Where private information has also been published in a way that damages reputation, the claim may overlap with defamation, and we can advise on both causes of action through our related practice at <a href="https://defamationlawyer.au">defamationlawyer.au</a>.

Illustration representing legal remedies and damages for privacy breaches

Available Remedies: Injunctions, Damages, and Other Orders

A court may award several remedies under the statutory tort. These include damages for non-economic loss and exemplary damages (the total capped at the greater of approximately $478,550, indexed annually, or the maximum amount for non-economic loss in defamation), injunctions to restrain an ongoing or threatened invasion (including on an urgent or after-hours basis), orders requiring the defendant to deliver up or destroy material, and orders for an account of profits the defendant derived from the invasion. Importantly, the tort is actionable per se. This means the court can award damages even if the plaintiff suffered no financial loss. The fact that privacy was seriously invaded is itself sufficient.

The Five Elements of the Statutory Tort: Privacy Act Schedule 2 Explained

To succeed in a claim for serious invasion of privacy in Australia, the plaintiff must establish five elements. These are set out in clauses 5 to 7 of Schedule 2 of the Privacy Act 1988 (Cth).

1. The plaintiff is an individual

Only natural persons can bring a claim. Corporations, trusts, and government bodies cannot be plaintiffs. There is no minimum age requirement for plaintiffs, though defendants under 18 are exempt from the tort (clause 18).

2. The defendant invaded the plaintiff's privacy

The invasion must fall within one of the two pathways: intrusion upon seclusion, or misuse of personal information. The conduct must go beyond what is trivial or incidental. A single glance over a fence is unlikely to be actionable. Sustained surveillance, systematic tracking, or deliberate publication of private material is a different matter.

3. The invasion was intentional or reckless

This is a critical threshold. Negligence is not sufficient. The defendant must have intended to invade the plaintiff's privacy, or been reckless as to whether the conduct would do so. Recklessness in this context means the defendant was aware of a substantial risk that the conduct would invade the plaintiff's privacy and proceeded regardless. A careless data breach by a corporation, while potentially actionable through the OAIC complaint process, does not meet this threshold. The distinction between these two avenues is addressed in our comparison of OAIC procedures and the statutory tort.

4. A reasonable person would have had a reasonable expectation of privacy

The court applies an objective test. Would a reasonable person in the plaintiff's position have expected privacy in the relevant circumstances? Relevant factors include the nature of the information or activity, the means by which the invasion occurred, the degree to which the plaintiff had exposed the information to others, and whether the plaintiff was in a public or private place. A person sunbathing in an enclosed backyard has a stronger expectation of privacy than a person walking down a public street. Context matters.

5. The invasion was serious

Not every invasion of privacy is actionable. The tort imposes a seriousness threshold. The court considers the nature and consequences of the invasion, whether the defendant knew or ought to have known the conduct was likely to offend, humiliate, or distress the plaintiff, the purpose of the invasion, and whether the plaintiff suffered harm (though proof of harm is not required). The court must then weigh the plaintiff's interest in privacy against any countervailing public interest, including freedom of expression, media freedom, the proper administration of government, and the prevention of crime or fraud.

Defences

A defendant who is found to have committed a serious invasion of privacy may raise one of several statutory defences at trial. These include lawful authority (the conduct was required or authorised by law or a court order), consent (express or implied), necessity (the defendant reasonably believed the conduct was necessary to prevent a serious threat to life, health, or safety), defence of persons or property (the invasion was incidental to a lawful right of defence and was proportionate, necessary, and reasonable), and defamation-related defences where the invasion involved publication (absolute privilege, publication of public documents, or fair report of proceedings of public concern).

Exemptions

Exemptions under Part 3 of Schedule 2 operate differently from defences. A defendant who is exempt may apply for a pre-trial determination that the tort does not apply to them. If successful, the matter is resolved without a trial. This is a significant procedural advantage for defendants. Exempt categories include professional journalists subject to a code of practice (and their employers), government agencies and state authorities acting in good faith, law enforcement and intelligence agencies, and persons under 18. The journalist exemption is narrow. Social media users, bloggers, influencers, and citizen journalists are not covered.

Time Limits

The limitation period is strict: proceedings must be commenced within one year of the date the plaintiff became aware of the invasion, or three years from the date the invasion occurred, whichever expires first. A court may extend this period to a maximum of six years from the date of the invasion in exceptional circumstances. Limitation periods are discussed further in our guide to time limits.

This page provides general information about Australian privacy law. It is not legal advice. The statutory tort commenced on 10 June 2025 and, as at the date of publication, there is no Australian case law interpreting Schedule 2. Courts are likely to consider persuasive authority from the United Kingdom, New Zealand, and Canada, where privacy torts have been developed through case law and statute.

Find Out Where You Stand

Our confidential initial assessment is a fixed-fee consultation ($770) to evaluate your matter and advise on your options under the statutory tort.

Key Features of the Statutory Tort

The new invasion of privacy law in Australia differs from existing remedies in several important respects.

No Proof of Damage Required

The tort is actionable per se. A plaintiff does not need to prove financial loss or quantifiable harm. The serious invasion of privacy is itself sufficient to found a claim.

Truth Is Not a Defence

Unlike defamation, it does not matter whether the published information was accurate. The wrong lies in the invasion of privacy, not in falsity.

Broad Defendant Pool

Any person, corporation, or government body can be sued. The defendant does not need to be an APP entity. This covers individuals, small businesses, employers, landlords, and others outside the existing Privacy Act regime.

Fills Gaps in State Law

State surveillance legislation creates criminal offences with limited scope. The Commonwealth statutory tort provides a civil remedy across all Australian states and territories, including for outdoor CCTV surveillance and GPS tracking that state laws do not cover.

Injunctions Available Urgently

Courts can grant injunctions to restrain an ongoing or threatened invasion of privacy. This includes interim orders made on an urgent basis before the matter is heard in full. The procedure for obtaining these orders is outlined in our guide to urgent privacy injunctions.

Apology Without Admission

Under clause 13, an apology by the defendant does not constitute an admission of fault or liability. This facilitates early resolution and settlement, particularly for defendants seeking to limit damages exposure.

Frequently Asked Questions About the New Privacy Law

Yes. Since 10 June 2025, any individual in Australia can bring a civil claim for serious invasion of privacy under Schedule 2 of the Privacy Act 1988 (Cth). The claim may be brought in a court with jurisdiction to hear the matter. You do not need to prove financial loss, and the defendant can be any person, company, or government body.

The OAIC complaint pathway is free and does not require a lawyer. However, it only applies to APP entities (generally organisations with annual turnover above $3 million, health service providers, and Commonwealth agencies). It does not cover individuals, most small businesses, or employee records. Outcomes are typically modest and the process can be slow. The statutory tort under Schedule 2 applies to any defendant, is heard by a court, and can result in damages, injunctions, and exemplary damages. For serious invasions, the statutory tort is the stronger avenue. These differences are addressed in our comparison of the two pathways.

The statutory tort applies to conduct that occurred on or after 10 June 2025. It does not apply retrospectively. If the invasion occurred before that date, other causes of action may be available depending on the circumstances, including breach of confidence, defamation, or state-based criminal complaints. We can assess this during an initial consultation.

In many Australian states, outdoor surveillance from a neighbour's own property is not a criminal offence. In Victoria, the Surveillance Devices Act 1999 excludes activities carried on outside a building from the optical surveillance offence. In NSW, the optical surveillance offence under the Surveillance Devices Act 2007 requires trespass or interference with property. In Queensland, there is no legislation covering optical surveillance at all. The Commonwealth statutory tort now provides a civil remedy in these situations. If the surveillance is intentional or reckless, you had a reasonable expectation of privacy, and the invasion is serious, a claim may lie. See our dedicated page on neighbour surveillance.

Publication of private health, financial, or personal information without consent falls squarely within the misuse of personal information pathway. If the publication was intentional or reckless and the information was of a kind in which you had a reasonable expectation of privacy, the statutory tort is likely to apply. Truth is not a defence. If the publication also damaged your reputation, you may have overlapping claims in defamation and privacy. We can assess both.

We act for defendants as well as plaintiffs. Depending on the circumstances, you may be entitled to an exemption (which can be determined before trial on application), or you may have a statutory defence such as lawful authority, consent, necessity, or defence of persons or property. If you have been served with an urgent injunction application, you should obtain legal advice immediately. The court must consider the public interest in publication when deciding whether to grant an injunction. Early legal advice is important, particularly given the strict time limits that apply to responding to court applications.

As at the date of this publication, there is no Australian case law interpreting Schedule 2. The legislation commenced on 10 June 2025. Australian courts are likely to consider persuasive authority from comparable jurisdictions, particularly the United Kingdom (where the tort of misuse of private information has been developed since Campbell v MGN Ltd [2004] UKHL 22), New Zealand (where the tort of intrusion upon seclusion was recognised in C v Holland [2012] NZHC 2155), and Canada (where the tort was recognised in Jones v Tsige [2012] ONCA 32). These decisions are persuasive, not binding, and Australian courts will interpret the statutory provisions on their own terms.

We offer fixed-fee entry points to reduce uncertainty. A confidential initial assessment is $770 and a pre-action demand letter is $990. Full court representation is quoted after the initial assessment, once the scope and complexity of the matter are understood. Costs will depend on whether the matter resolves early (for example, following a pre-action letter or settlement negotiation) or proceeds to a contested hearing. We discuss costs transparently at the outset.

You May Have as Little as 12 Months to Act

Limitation periods under the statutory tort are strict. If you believe your privacy has been seriously invaded, or if you are facing a claim, obtain legal advice promptly.

Call