New statutory tort for serious invasions of privacy due in June

Introduction

The Federal Government has introduced a new statutory tort for serious invasions of privacy (Privacy Tort) in response to growing concerns for safety and privacy of personal information in the rapidly evolving digital landscape in Australia.

The Privacy Tort, which was introduced as part of the Privacy and Other Legislation Amendment Bill 2024 (Bill), will establish a cause of action for serious invasions of privacy against individuals.

The Bill is due to come into effect in June 2025 and may have serious implications of liability for businesses and individuals.

New statutory tort for serious invasions of privacy 

A plaintiff has grounds for a claim against a defendant if there was an invasion of the plaintiff’s privacy and they can demonstrate that a reasonable person in their position would have expected privacy in the circumstances.

Further, the invasion of privacy must be considered intentional or reckless and it must be serious. There is no requirement to show proof of damage.

A Court will assess whether the public interest of the plaintiff’s privacy outweighs any countering public interest such as freedom of expression, public safety, national security or freedom of the media.

Legal proceedings must be initiated within one year after the plaintiff becomes aware of the invasion or within three years after the invasion occurred, whichever occurs sooner. However, if the plaintiff was under 18 years of age, proceedings must commence before their twenty-first birthday.

Serious invasions of privacy

To establish an invasion of privacy, the plaintiff must demonstrate that the defendant either intruded upon their seclusion, misused their information, or both.

Intrusion upon seclusion may involve physically intruding on the plaintiff’s private space or watching, recording or listening to the plaintiff’s private activities.

Misuse of information may involve collecting, using or disclosing information about the plaintiff. It is immaterial whether the information relating to the plaintiff was true.

The seriousness of the invasion will depend on, among other things, the degree of offence or distress likely to be caused to a person of ordinary sensibilities, whether the defendant knew the invasion was likely to offend or whether it was intentional or motivated by malice.

What does it mean for your business?

Individuals, as well as businesses, can be directly liable for serious invasions of privacy under the Privacy Tort.

Businesses should ensure that any personal or sensitive information about an individual that is collected, used or disclosed is not used in a way that is likely to cause offence, distress or harm to the dignity of that individual.

Additionally, businesses may also be at risk of vicarious liability for serious invasions of privacy committed by their employees. Businesses should ensure that internal policies and procedures are in place in relation to employees accessing and misusing private information to reduce the risk of serious invasions of privacy by employees.

The broad scope of the definition for misusing information under the Privacy Tort means that serious invasions of privacy are not limited to the actual use of information. Accordingly, the Privacy Tort may include the act of accessing information about a person without their consent where it causes offence or distress to that person. In addition, the absence of a requirement to show damage, in conjunction with the immateriality that information is true may lower the bar for claims, increasing liability risk for businesses.

The Privacy Tort excludes certain government agencies, law enforcement and intelligence bodies, individuals disclosing information to such agencies, and those under 18, while journalists and others may be exempt in specific circumstances related to the publication of journalistic materials.

Defences

The Privacy Tort provides several defences to balance protecting privacy against the public interest. Defences include where the invasion was required by law, if there was consent, or if it was necessary to prevent or lessen a serious threat to life, health or safety.

The Privacy Tort also provides for defamation defences in the context of publishing information.

Remedies

The Privacy Tort provides individuals with the right to claim compensation for serious privacy breaches in the form as damages, as well as a range of other remedies including account of profits, an injunction, an order requiring the defendant to apologise, a correction order for the destruction of private materials, or a declaration that the defendant seriously invaded the plaintiff’s privacy.  

Conclusion

The new tort for serious invasions of privacy highlights the importance of maintaining privacy of personal data, and the requirement for businesses to ensure stringent policies are in place to prevent employees from accessing and misusing information relating to an individual.

If you are seeking advice or assistance regarding any of the above, you can reach out to our experienced team.