New statutory tort for serious invasions of privacy

Landmark reforms to the Privacy Act 1988 (Cth) come into effect from 10 June 2025, creating a new statutory tort for serious invasions of privacy. Businesses should review their privacy and data handling practices to minimise exposure to claims under this new cause of action.

What are the tort’s elements?

To succeed in a claim under the new statutory tort for serious invasions of privacy, a plaintiff will need to demonstrate that:

1. their privacy was invaded through:

• intrusion upon seclusion (such as being watched, recorded, or physically intruded upon in a private space); and/or
• misuse of private information (such as unauthorised collection, use, or disclosure of personal data);

2. a reasonable expectation of privacy existed in the circumstances;
3. the invasion was intentional or reckless;
4. the invasion was serious; and
5. the public interest in privacy outweighs any competing public interest.

‍

Importantly, plaintiffs will not be required to prove actual financial loss or harm to succeed.

What constitutes a ‘serious’ invasion?

The seriousness of a privacy invasion will be assessed based on several factors, including the likely distress for a person in the plaintiff’s position, whether the defendant knew or should have known the invasion would cause such harm, and whether the defendant acted with intention or malice.

Other contextual factors, such as how the information was obtained, the plaintiff’s background, and whether they sought publicity, may also be relevant to the court’s assessment.

What remedies are available?

Courts will have broad discretion to grant a range of remedies for this tort, including damages, exemplary or punitive damages (in exceptional cases), injunctions, and declarations of wrongdoing.

Except in relation to people under the age of 18, plaintiffs must commence proceedings within the earlier of (a) one year after they became aware of the invasion or(b) three years after the invasion actually occurred.

‍

What does this mean for businesses?

This new tort provides privacy protections for individuals but also introduces new legal risks for businesses who collect data. In particular, it appears that the tort’s ‘misuse of private information’ limb provides an avenue for individuals to sue businesses for serious data breaches.

Practical steps for businesses

To prepare for this shift and reduce exposure to legal claims, businesses who collect data should take proactive steps to reduce their legal exposure under this new tort:

• Review your data handling and privacy practices – identify any areas where data is being collected, stored, or shared in ways that could be vulnerable.
• Train staff on privacy obligations – ensure all employees understand the importance of handling personal information lawfully, particularly in high-risk areas like client communication, marketing, and HR.
• Implement a robust data breach response plan – ensure there are clear and effective response plans to data breaches or suspected misuse in place.

‍

As the legal landscape around privacy continues to evolve, understanding this new tort will be essential for businesses seeking to handle data lawfully and ethically.

How we can help

At Groom Kennedy, we can assist businesses in navigating the evolving landscape of privacy law.  Whether you're conducting a compliance review, responding to a breach, or developing internal policies, our team provides strategic advice tailored to your industry and risk profile.

This article includes general information only and is not specific to your situation. If you require assistance in relation to anything contained within this article, please contact us.

‍