Have you been A Victim of A Serious Invasion of Privacy?

With effect from 10 June 2025 a new basis for bringing a claim has emerged focusing on serious invasions of privacy which allows individuals to seek recourse against entities that have breached their duty of care regarding privacy. The introduction of this cause of action is aimed at safeguarding individuals’ privacy rights and enabling them to seek compensation for violations of their physical privacy or misuse of personal information.

A Schedule has been added to the Privacy Act 1988 (Cth) to establish the tort for Serious Invasions of Privacy. The intention of the Parliament being that the Schedule will be read and construed separately from the rest of the Privacy Act.

Claim

Under section 7 of the new Schedule 2, a plaintiff, the individual/s who started the legal proceedings for a privacy breach, will have a cause of action against an individual or business accused of the privacy breach, where they can establish that:
A. The defendant invaded the plaintiff’s privacy by doing one or both of the following:
1. By intruding upon the plaintiff’s seclusion;
2. By misusing information that relates to the plaintiff; and

B. The plaintiff would have had a reasonable expectation of privacy in all of the circumstances; and
1. The invasion of privacy was intentional or reckless; and
2. The invasion of privacy was serious; and
3. The public interest in the plaintiff’s privacy outweighed any countervailing public

To establish a case under this new tort, the plaintiff must prove that the defendant intentionally or recklessly invaded their privacy, that the invasion was serious, and that the public interest in the plaintiff’s privacy outweighed any competing interests. Factors such as the nature of the invasion, the plaintiff’s reasonable expectation of privacy, and the harm caused by the invasion are considered in determining the seriousness of the privacy breach.

Exemptions

Part 3 sets out exceptions which apply, with some qualifications, to:

• Journalists
• Agencies and State and Territory authorities (other than intelligence agencies and law enforcement bodies)
• Staff members of agencies or State and Territory authorities (other than intelligence agencies and law enforcement bodies)
• Law enforcement bodies
• Intelligence agencies
• Persons under 18 years of age

Limitation Periods

The legislation establishes a limitation period for initiating proceedings based on this statutory tort.
If the plaintiff was under 18 years of age at the time of the invasion of privacy, then the proceedings must be commenced before the plaintiff reaches the age of 21 years.
In all other cases, proceedings must be commenced within one (1) year of the plaintiff becoming aware of the invasion, or within three (3) years of the invasion itself, whichever is earlier.

Defences

Section 8 provides defences a defendant may raise, including:

1. Authorised or Required by Law
   Powers authorised by Australian law or court orders may justify the act.
2. Consent
   Express or implied consent by the plaintiff, provided legally, may be a valid defence.
3. Necessity
   Invasions made to prevent or lessen threats to life, health or safety in emergencies may be justified.
4. Defence of Persons or Property
   Actions taken in self-defence must be proportionate and reasonable in context.
5. Defamation Defences
   Section 8(2) provides that defences to defamation may apply to an invasion of privacy. The relevant defences include the following:
   1. A defence of absolute privilege;
   2. A defence for publication of public documents;
   3. A defence of fair report of proceedings of public concern.

Remedies

Once a serious invasion of privacy has been established, the Court may order damages or other remedies to compensate the plaintiff for the loss.
Section 11 of the new Schedule 2 sets out the powers of the Court when awarding damages to the plaintiff. Importantly, the Court may award damages for emotional distress and economic loss, and exemplary or punitive damages in special circumstances.
The maximum sum for an award of damages to the plaintiff must not exceed $478,550.
When ordering damages, the Court will consider.

1.  Any apology made by the defendant to the plaintiff;
2.  Any correction published by the defendant;
3.  Any other compensation received by the plaintiff for the invasion;
4.  If the parties took reasonable steps to settle the dispute;
5.  If the defendant acted unreasonably during or after the proceedings that may have caused further embarrassment, harm, distress or humiliation to the plaintiff.

Other remedies that are available are set out in Section 12.

Corporate Responsibility and Liability

In accordance with section 5(3) of the new Schedule 2, a corporation may be liable for any serious invasion of privacy.
A corporation may be liable for an invasion of privacy where the corporation has used private information in a manner that is beyond the intended purpose of the private information. Corporations can also be vicariously liable for any intentional or reckless act of any employee who commits an invasion of privacy.
It is therefore prudent for Corporations to instruct employees, agents and contractors to exercise caution during their employment or engagement to minimize if not avoid any breach of this new tort of privacy. Any breach may result in serious legal penalties.
The information provided in this article is for general informational purposes only. Bowen Buchbinder Vilensky accepts no responsibility for any actions taken based on this information, and users do so at their own risk.
For further information contact Leslie Buchbinder at Bowen Buchbinder Vilensky (BBV Legal) on 93259644 or by email at enquiries@bbvlegal.com.au.