Australia's Statutory Tort for Serious Invasions of Privacy Explained

Since 10 June 2025, Australia has had a nationwide civil right to sue for a serious invasion of privacy under Schedule 2 of the Privacy Act 1988 (Cth), covering intentional or reckless intrusion or misuse of information, and it binds individuals, not only organisations covered by the Privacy Act.

This article explains Australia's Commonwealth statutory tort for serious invasions of privacy under the Australia data privacy laws hub: where it lives in the Privacy Act 1988 (Cth), the elements a plaintiff must prove, the defences and exemptions that apply, the remedies a court can order, and the time limits for bringing a claim. It also explains how this tort differs from making a complaint to the OAIC about a breach of the Australian Privacy Principles. It does not cover state and territory listening-device and surveillance offences, addressed on Is It Legal to Record a Conversation in Australia?, or the criminal doxxing offences that can overlap with a privacy invasion, covered separately in Doxxing Laws in Australia.

What Is the Serious Invasion of Privacy Tort, and Where Does It Come From?

Australia's serious invasions of privacy tort lives in Schedule 2 of the Privacy Act 1988 (Cth), inserted by the Privacy and Other Legislation Amendment Act 2024 (Cth), which received Royal Assent on 10 December 2024. Schedule 2 commenced six months later, on 10 June 2025. Unlike the rest of the Privacy Act, Schedule 2 is deliberately self-contained: clause 6(3) provides that in determining the meaning of a provision of the Schedule, the rest of the Act is to be disregarded. It is organised in four parts: Part 1 preliminary and interpretation, Part 2 the cause of action, defences, injunctions and damages, Part 3 exemptions, and Part 4 miscellaneous rules including a single publication rule.

The tort creates a genuine civil cause of action that an individual can bring against another person in court. It is not a complaint mechanism, and it applies to conduct by individuals as well as organisations and, subject to the Part 3 exemptions below, government agencies. Clause 1 states the Schedule's objects: establishing the cause of action, providing for defences, remedies and exemptions, recognising a public interest in protecting privacy that must be balanced against other public interests, and implementing Australia's international obligations relating to privacy. Clause 3 binds the Crown in each of its capacities, subject to the Part 3 exemptions for particular agencies and bodies discussed below.

The Five Elements a Plaintiff Must Prove

Clause 7(1) sets out a five-part cause of action, and a plaintiff must establish every element; failing any one defeats the claim. The defendant must have invaded the plaintiff's privacy by intruding upon the plaintiff's seclusion, misusing information relating to the plaintiff, or both. A person in the plaintiff's position must have had a reasonable expectation of privacy in all the circumstances. The invasion must have been intentional or reckless, since clause 7(1)(c) excludes negligent conduct entirely. The invasion must have been serious. And the public interest in the plaintiff's privacy must have outweighed any countervailing public interest under clause 7(1)(e).

Clause 7(2) then adds that the invasion of privacy is actionable without proof of damage, meaning a plaintiff who proves all five elements does not additionally have to show they suffered financial loss.

Reasonable Expectation of Privacy, and When an Invasion Is "Serious"

Clause 7(5) lists non-exhaustive factors a court may weigh in deciding whether a person in the plaintiff's position would have had a reasonable expectation of privacy: the means or technology used to invade the privacy, the purpose of the invasion, the plaintiff's age, occupation or cultural background, the plaintiff's own conduct including whether they invited publicity, and, for an intrusion, the place where it occurred. Where the claim is based on misuse of information, the court may also weigh the nature of the information, including whether it concerned intimate or family matters, health or medical matters or financial matters, how the plaintiff held or communicated it, and whether it was already in the public domain. Clause 7(7) makes clear that if the claim is based on misusing information, it is immaterial whether that information was true.

Seriousness is judged separately under clause 7(6): the degree of offence, distress or harm to dignity the invasion was likely to cause a person of ordinary sensibilities in the plaintiff's position, whether the defendant knew or ought to have known that, and, where the invasion was intentional, whether the defendant was motivated by malice.

The Public Interest Balancing Test

Clause 7(1)(e) requires the plaintiff to show that the public interest in their privacy outweighed any countervailing public interest, and clause 7(3) lists, without limiting what else may qualify, matters that can count as a countervailing public interest: freedom of expression, including political communication and artistic expression; freedom of the media; the proper administration of government; open justice; public health and safety; national security; and the prevention and detection of crime and fraud.

This balancing element means a plaintiff has to affirmatively win an argument about competing public interests, not merely show that an intrusion occurred. Where the invasion involved publishing information, clause 9(2) separately requires a court considering an injunction to give particular regard to the public interest in the publication when deciding whether to grant it.

Defences and Exemptions

Clause 8 sets out defences to the cause of action: the invasion was required or authorised by an Australian law or a court or tribunal order; the plaintiff, or someone with lawful authority to do so on the plaintiff's behalf, expressly or impliedly consented; the defendant reasonably believed the invasion was necessary to prevent or lessen a serious threat to a person's life, health or safety; or the invasion was incidental to a lawful right of defence of persons or property and was proportionate, necessary and reasonable. Where the invasion involved publishing information, clause 8(2) also lets the defendant raise defamation-style defences, being absolute privilege, publication of public documents, and fair report of proceedings of public concern, where an equivalent defence would be available under the applicable defamation law.

Part 3 then removes the cause of action altogether for certain conduct: journalists, and people who employ, engage or assist them, for journalistic material (clause 15); government agencies and state and territory authorities other than intelligence agencies and law enforcement bodies, acting in good faith within their functions or powers (clauses 16 and 16A); intelligence agencies and law enforcement bodies, and related disclosures to or from them (clauses 16B and 17); and, at clause 18, any person who is under 18 years of age. A defendant under 18 is exempt from the tort entirely, not merely given a defence.

Clause 8A lets a court determine, at any stage of the proceedings, whether a Part 3 exemption applies, on application by a party or on the court's own motion. If a party applies before trial, the court must generally decide that question as soon as practicable and before the trial starts, unless satisfied there are special circumstances justifying postponing it, including to during the trial itself. This lets a defendant who says it is a journalist, an agency or a law enforcement body test that question early, rather than defending the whole claim on the merits first.

Remedies: Injunctions, Damages and Other Orders

A court may grant an injunction at any stage of the proceedings restraining the defendant from invading the plaintiff's privacy, and where the invasion involves publishing information, clause 9(2) requires the court to give particular regard to the public interest in that publication. Clause 10 allows summary judgment for the defendant if the plaintiff has no reasonable prospect of succeeding.

On damages, clause 11(2) prohibits the court from awarding aggravated damages, clause 11(3) allows damages for emotional distress, and clause 11(4) allows exemplary or punitive damages only in exceptional circumstances. Clause 11(5) caps the combined total of non-economic-loss damages and any exemplary or punitive damages at the greater of $478,550 or the maximum non-economic-loss damages available in defamation proceedings under an Australian law; proven economic loss sits outside that cap. In setting the amount, clause 11(6) lets the court weigh whether the defendant apologised or published a correction, whether the plaintiff already received or agreed to receive compensation, and whether either side took reasonable steps to settle. Clause 13 makes clear an apology is not itself an admission of fault.

Beyond damages, clause 12 lets a court order an account of profits, a correction order, an order that the defendant apologise, a declaration that the defendant seriously invaded the plaintiff's privacy, or an order that material obtained through the invasion be destroyed, delivered up, or otherwise dealt with.

Time Limits for Bringing a Claim

Clause 14 sets strict time limits. A plaintiff who was under 18 years of age when the invasion of privacy occurred must commence proceedings before their 21st birthday. Any other plaintiff must commence proceedings before the earlier of one year after the day the plaintiff became aware of the invasion, or three years after the day the invasion occurred. A court may extend that period on application if satisfied it was not reasonable in the circumstances for the plaintiff to have commenced proceedings within the ordinary period, but clause 14(4) fixes an absolute outer limit: the extended date can never be later than six years after the invasion occurred.

Clause 19's single publication rule also matters for online material. Where a publisher first publishes information and then republishes substantially the same information in a manner that is not materially different, the invasion is treated as occurring on the day of the first publication for time-limit purposes, so republishing the same material does not restart the clock.

The First Case, and How the Tort Differs from an OAIC Complaint

The tort's first published application came within four months of commencement. In Kurraba Group Pty Ltd & Anor v Williams [2025] NSWDC 396, decided 7 October 2025, the District Court of New South Wales considered a case in which the defendant published the plaintiffs' private wedding photographs online during a dispute involving an extortion campaign. Gibson DCJ found there were serious questions to be tried on intimidation, defamation and the statutory privacy tort, and granted urgent interlocutory injunctions requiring the material's removal and restraining further publication. That ruling is interlocutory: it shows Australian courts will engage with the tort at an early, urgent stage of a proceeding, but it is not a final decision on liability or on the amount of damages, if any, ultimately payable. Because it turned on the interlocutory-injunction test of serious questions to be tried and the balance of convenience, it does not resolve whether the five clause 7(1) elements are ultimately made out at a final hearing, and it says nothing about how a court will apply the clause 11 damages cap in practice.

The tort is a different legal pathway from a Privacy Act complaint to the OAIC, and the two should not be confused. A complaint to the OAIC under the ordinary Privacy Act and the Australian Privacy Principles can only be made about an APP entity, broadly an Australian Government agency or a business with more than $3 million annual turnover, and it is investigated administratively by the Commissioner, not decided by a court. The Schedule 2 tort, by contrast, is a court action a plaintiff brings directly against another person, interpreted separately from the rest of the Act under clause 6(3). It reaches an individual defendant, such as a private person who published someone's photographs or personal details, in a way an OAIC complaint about the same conduct could not, since that individual is very unlikely to be an APP entity. A reader deciding which pathway fits their situation should also see How to Make a Privacy Complaint to the OAIC.

This article provides general legal information about Australia's Commonwealth statutory tort for serious invasions of privacy. It does not constitute legal advice and does not account for your individual circumstances. Statutes and the case referenced were verified against primary sources as at 19 July 2026 and are subject to amendment. Consult a legal practitioner admitted in the relevant Australian state or territory for advice on a specific situation.

Related reading: the Australia data privacy laws hub covers the Privacy Act and the Australian Privacy Principles more broadly, The 13 Australian Privacy Principles (APPs) Explained explains the separate rules that bind covered organisations, and Australia's Notifiable Data Breaches Scheme Explained covers an organisation's duty to report a data breach. For the criminal offences that often accompany a privacy invasion, see Doxxing Laws in Australia. For state and territory recording law, see Is It Legal to Record a Conversation in Australia? and CCTV and Home Security Camera Laws in Australia.