Amendment of Privacy Act

6 April 2025 in Civil and Commercial Litigation | 12 min read | skip to FAQs

The recent passing of the Privacy and Other Legislation Amendment Bill 2024 (Cth) by the Federal Parliament of Australia may cause a significant change in privacy law, particularly to the Privacy Act 1988 (Cth). This article focuses on the Bill’s amendment of the Privacy Act. That is, the introduction of a cause of action in tort for serious invasions of privacy. A tort is a legal action available to anyone against another person or business who has a duty of care to them and that duty of care has been breached. In this case, the duty of care relates to any invasion of privacy.

Privacy law is an evolving and increasingly important area of law. BSM Lawyers Sydney have special expertise in this area, providing ongoing advice to long standing clients including international corporations and local companies and individuals. Our privacy lawyers have decades of experience in this area and are able to provide concise and accurate advice relevant to your needs.

Privacy Laws in Australia

The present privacy laws in Australia vary between the Commonwealth, State and Territory levels and focus on ensuring corporations and other entities protect the personal information of individuals. The introduction of this new tort for serious invasions of privacy creates an entirely new tort with the purpose of protecting any person’s privacy and will allow individuals to seek compensation for breaches of physical privacy or the misuse of information.

Australia currently has legislation, common law or other legal mechanisms to protect personal information (legislation, Privacy Act 1988 (Cth)), misuse of surveillance devices (legislation, Surveillance Devices Act 2007 (NSW)) and confidential information (common law, Coco v A.N. Clark Engineers 1969, and contract). However, Australia does not currently have any tort or other legal mechanism, to protect a person’s privacy or private acts. This Bill seeks to address this issue.

Overview of the Amendment Bill

The Bill introduces a new Schedule to the Privacy Act 1988 (Cth), Schedule 2, which establishes the new tort for Serious Invasions of Privacy. The intention of the Parliament being that the Schedule will be read and construed separately from the rest of the Privacy Act.

Under section 7 of the new Schedule 2, a plaintiff, the individual/s who started the legal proceedings for a privacy breach, will have a cause of action in tort against a defendant, the individual or business who is accused of the privacy breach, where they can establish that:

The defendant invaded the plaintiff’s privacy by doing one or both of the following:

1. By intruding upon the plaintiff’s seclusion;
2. By misusing information that relates to the plaintiff; and

The plaintiff would have had a reasonable expectation of privacy in all of the circumstances; and

1. The invasion of privacy was intentional or reckless; and
2. The invasion of privacy was serious; and
3. The public interest in the plaintiff’s privacy outweighed any countervailing public interest.

An Invasion of Privacy

The plaintiff is required to prove that the defendant invaded their privacy, and that the invasion was either by intrusion upon seclusion or misuse of information, or both. The term intruding upon the seclusion of an individual is defined in section 6(1) of the new Schedule 2 (“intruding upon the seclusion of an individual includes, but is not limited to, the following:

1. physically intruding into the person’s private space;
2. watching, listening to or recording the person’s private activities or private affairs”).

This intrusion concerns the physical privacy of a person and can involve physically intruding into the person’s private space (such as their property or home) and watching, listening to or recording a person’s private activities or affairs.  Whereas the term misuse of information that relates to an individual, concerns the security of information (which is distinct from intrusion upon a person’s seclusion) and involves the collection, use and/or disclosure of information that is relevant to an individual. An example of conduct by a defendant which could amount to a misuse of information, is a person hacks into or accesses an electronic device and distributes photographs, or other private information, obtained from that device.

The Bill does not provide guidance regarding how closely the information must ‘relate to the plaintiff’. However, section 7(7) of the new Schedule 2 provides that where the defendant invades the privacy of the plaintiff by misusing information relating to the plaintiff ‘it is immaterial whether the information was true’ or not. It must also be noted that information relating to an individual, where there is a reasonable expectation of privacy, does not hold the same meaning as personal information under the Privacy Act for the purposes of the Australian Privacy Principles in Schedule 1 of the Act. Privacy, for the purposes of section 7(1)(a) of the new Schedule 2, is determined on a case-by-case basis applying the test of section 7(1)(b) of the new Schedule 2, (“a person in the position of the plaintiff would have had a reasonable expectation of privacy in all of the circumstances”).

Reasonable Expectation of Privacy

The plaintiff must also prove that a person in their position would have had the reasonable expectation of privacy when considering all of the circumstances. This is a flexible test, as it reflects the fact that community expectations of privacy can change over time and in different circumstances. Section 7(5) of the new Schedule 2 provides a non-exhaustive list of factors that a court may consider when determining whether a reasonable expectation of privacy exists. These factors include the methods used to invade the plaintiff’s privacy, the purpose of the invasion, the plaintiff’s attributes (such as age, gender or disability) and whether the plaintiff invited publicity or expressed a desire for publicity.

In the event of an intrusion upon the plaintiff’s seclusion, a relevant consideration is the location of the invasion (for example, privacy is generally greater within a person’s home and property than in public). While for the case of a misuse of information relating to the plaintiff, relevant considerations include the nature of the information involved (such as intimate, financial, family or health-related details), how the information was initially held or communicated by the plaintiff and whether, and to what extent, the information was already in the public domain.

According to the Explanatory Memorandum of the Bill, the “nature of the types of information listed” under the definition of sensitive information in section 6 (of division 1 part 2) of the Privacy Act 1988 (Cth) may be of relevance to considering whether there is a reasonable expectation of privacy. However, sensitive information alone does not guarantee an expectation of privacy, the context is important, such as whether the information is already publicly available.

Intentional or Reckless Invasion

This is a fault requirement, therefore, the plaintiff must establish that the defendant intentionally or recklessly invaded their privacy.  However, proof of negligence alone is insufficient to satisfy this fault element. Recklessness is defined in the same way as in the Criminal Code, ensuring consistency in its application, and refers to situations where a person is aware of a substantial risk and unjustifiably takes that risk. Intention, on the other hand, has its ordinary meaning and the defendant’s intention may be subjective or imputed and must relate to the privacy invasion by way of intrusion upon seclusion or misuse of information.

When determining this fault element, it is not sufficient that the defendant merely performed an act that resulted in the invasion of privacy. For example, a person taking a video of a public event who inadvertently records a private activity, would not be intentionally or recklessly invading privacy. Similarly, the creator of an online platform, which is utilised by third parties to invade privacy, would not be liable if the creator had no knowledge of the invasion. It must be noted though, that the plaintiff does not need to prove that the defendant intended to commit a legal wrong or intended to fulfil the other elements of this new cause of action.

Serious Invasion of Privacy

The plaintiff must also prove that the invasion of privacy was serious. According to the Explanatory Memorandum of the Bill, this requirement aims to deter trivial claims, as the determination of whether a privacy invasion is ‘serious’ is an objective test, where the analysis is based on a “person of ordinary sensibilities” who is in the plaintiff’s position, rather than considering the particular subjective views of the plaintiff.

To assist with determining what amounts to a serious invasion, section 7(6) of the new Schedule 2 includes a non-exhaustive list of factors that the court may consider when determining this. These factors include the degree of offence, distress, or harm to dignity the invasion is likely to cause.

Another point of consideration is the likely harm to dignity, which reflects that the privacy invasion may be serious even if no material harm or offence is caused. For example, a person who is a young child may not suffer offence and still be harmed. The knowledge and motive of the defendant are also relevant factors to be considered. For instance, an invasion motivated by malice, or with knowledge that the plaintiff will likely be offended, harmed or distressed, is more likely to be serious.

Proof of Damage is Not Required

As the tort is intended to protect the plaintiff’s intangible interests and dignity, the plaintiff does not need to prove that they incurred a loss resulting in damage, such as a financial loss. A plaintiff is able to bring a claim against the defendant without this proof or element.

Countervailing Public Interest

The plaintiff must also show that their privacy interest outweighs any countervailing interest of the public. This is particularly the case where the defendant presents evidence of a public interest, or interests, relating to their conduct.

In light of this, section 7(3) of the new Schedule 2 provides a list of what constitutes a countervailing public interest that a defendant may present for a court to consider when an invasion of privacy is in the public interest. This, however, is not exhaustive and other possible public interests may be raised.

This results in a balancing exercise, which recognises that a person’s privacy interests are important but not unconditional. No interest automatically takes priority over other interests, however some interests, such as the freedom of political communication due to its importance to Australia’s democratic system of government, may carry more weight. If it is found that the plaintiff’s privacy interest and a public interest are evenly balanced, then the plaintiff will be unable to meet this public interest requirement of the cause of action.

Exemptions

Part 3 sets out exceptions which apply, with some qualifications, to:

1. Journalists;
2. Agencies and State and Territory authorities (other than intelligence agencies and law enforcement bodies);
3. Staff members of agencies or State and Territory authorities (other than intelligence agencies and law enforcement bodies);
4. Law enforcement bodies;
5. Intelligence agencies; and
6. Persons under 18.

Limitation Periods

The Bill establishes a limited timeframe for initiating proceedings based on the statutory tort. If the plaintiff was under 18 years of age at the time of the invasion of privacy, proceedings must begin before the plaintiff reaches the age of 21 years. In all other cases, proceedings must be filed within one year of the plaintiff becoming aware of the invasion, or within three years of the invasion itself, whichever is earlier.

Defences

Section 8 of the Bill sets out various defences that a defendant can claim against the cause of action. These defences are extensively set out in section 8 of Schedule 2.  A number of these defences are outlined below.

Authorised or Required by the Law

The Bill protects the powers authorised by an Australian law or court or tribunal. It is crucial to incorporate a defence of this manner, to ensure that current statutory legislation and court orders are complied with. A body, organisation or an individual may rely on this defence.

Consent

Express or implied consent provided by the plaintiff will be a defence that the defendant may rely on. The consent must be made by someone who has legal capacity, which is a matter that the Court may determine. An entity who has lawful authority under Australian legislation may also provide a person with consent.

Necessity

The Bill recognises that an invasion of privacy may take place when an individual reasonably believed that it was necessary to prevent or lessen a threat to someone’s life, health or safety. This defence is included in the case of emergencies or imminent threats that are serious.

Exercising Right of Defence of Persons or Property

A serious invasion of privacy when defending the lawful right of persons or property must be incidental. When utilising this defence, the court will consider if the defendant’s conduct was proportionate, necessary and reasonable. The Court will consider the context of the invasion and if the defendant had a right to exercise their defence of person or property.

Defamation

Section 8(2) provides that defences to defamation may apply to an invasion of privacy. In New South Wales, such defences are set out in the Defamation Act 2005 (NSW). The relevant defences include the following:

1. A defence of absolute privilege;
2. A defence for publication of public documents;
3. A defence of fair report of proceedings of public concern.

Remedies

Once a serious invasion of privacy has been established, the Court may enforce damages or other remedies to compensate the plaintiff for the loss. Section 11 of the new Schedule 2 sets out the powers of the Court when awarding damages to the plaintiff. Depending on the case, the Court may award damages for emotional distress and economic loss, and exemplary or punitive damages in special circumstances.

The maximum sum for an award of damages to the plaintiff must not exceed $478,550, which is consistent with any damages in defamation proceedings in Australia. When ordering damages, the Court will consider.

1. Any apology made by the defendant to the plaintiff;
2. Any correction published by the defendant;
3. Any other compensation received by the plaintiff for the invasion;
4. If the parties took reasonable steps to settle the dispute;
5. If the defendant acted unreasonably during or after the proceedings that may have caused further embarrassment, harm, distress or humiliation to the plaintiff.

Other remedies that are available are set out in Section 12.

Corporate Responsibility and Extension of Liability

In accordance with section 5(3) of the new Schedule 2, a corporation may be liable for any serious invasion of privacy. A corporation may be liable for an invasion of privacy where the corporation has used private information in a manner that is beyond the intended purpose of the private information. Corporations can also be vicariously liable for any intentional or reckless act of any employee who commits an invasion of privacy.

Corporations should inform employees, agents and contractors to exercise caution during their employment or engagement to avoid any breach of the new tort of privacy. Any breach may result in serious legal penalties.

Key Takeaways

1. New Tort for Serious Invasions of Privacy: The Bill establishes a new tort for serious invasions of privacy, including intrusion upon seclusion and misuse of personal information.
2. Key Requirements for the Plaintiff: To succeed, the plaintiff must prove a reasonable expectation of privacy, intentional or reckless invasion, and that the invasion is serious and outweighs public interest.
3. Defences and Remedies: Defendants can claim defences such as consent, necessity, or legal authorisation.
4. Penalties: Courts may award damages of up to $478,550 and consider factors like emotional distress and apologies.
5. Corporate Liability: Corporations can be directly or vicariously liable for privacy breaches committed by their employees, agents or contractors and are encouraged to implement measures to limit liability and protect against potential legal risks.

How can BSM Sydney Lawyers assist you?

The civil litigation and commercial lawyers at Brander Smith McKnight have special expertise in privacy law. Our Sydney law firm has acted for both international and local businesses, providing detailed, pertinent, written advice regarding privacy law. We currently act for multiple Australian companies. The civil litigation legal team at BSM Sydney Lawyers has several decades of experience in privacy law and always remain up to date with new legislation. Our lawyers pride themselves on providing accurate, competitively priced advice with a rapid turn around. The privacy lawyers at BSM Sydney Lawyer offer a free 20-minute, obligation free consultation.

FAQs

BSM Lawyer Sydney has conveniently located offices in Sydney CBD, Sutherland, Parramatta, Shellharbour and Wollongong.