Privacy Law Reforms

1 April 2026 in Commercial Lawyers | 6 min read | skip to FAQs

Australia’s privacy protection regime has long been committed to regulating the disclosure of personal data while balancing individual privacy with competing public interests. This article examines recent privacy law reforms initially introduced by the Privacy and Other Legislation Amendment Bill 2024 (“Bill”), with a particular focus on key changes that introduced a statutory privacy tort under the Privacy Act 1988 (Cth) and the criminalisation of doxxing under the Criminal Code Act 1995 (Cth). These reforms respond to privacy challenges in the digital era and represent a significant shift in Australia’s legal approach to privacy protection. The statutory tort for serious invasions of privacy commenced on 10th June 2025 as Schedule 2 to the Privacy Act 1988 (Cth). The addition of doxxing under the Criminal Code Act 1995 (Cth) occurred on 10th December 2024.

Statutory Privacy Tort

Previous Absence of Privacy Tort in Australia

Global trend

Prior to the introduction of this tort, Australia lacked a statutory privacy tort under the Privacy Act 1988 (Cth) or any other Commonwealth, state, or territory legislation, in contrast to many other Western common law countries with similar legal traditions. The United Kingdom, through the enactment of the Human Rights Act 1998 and the subsequent introduction of the tort of misuse of private information, has established robust privacy protections. Similarly, Canada and New Zealand have developed strong privacy safeguards through specific statutory privacy torts.

The development of a Privacy Tort in Australia

In 2001, the High Court of Australia in Australian Broadcasting Corporation v Lenah Game Meats Pty Ltd [2001] HCA 63 indicated a willingness to recognise a common law right to privacy. This position was reaffirmed in the 2020 High Court case Smethurst v Commissioner of Police [2020] HCA 14. Despite this, no further steps had been taken by Australian legislation or appellate courts to establish a comprehensive right to privacy, leaving privacy interests protected only indirectly. As a result, the Plaintiff seeking redress for privacy breaches previously relied on related causes of legal actions, such as tort of defamation, tort of trespass, or breach of confidence in equity, rather than a dedicated privacy tort.

Human Rights and Privacy Protection in Australia

Australia’s lack of a bill of rights or a similar federal human rights charter further limited the explicit protection of privacy under the law. While the High Court has held that statutory interpretation should favour constructions aligned with Australia’s international obligations, privacy rights protections under Australian common law remain uncertain and implicit (see Minister for Immigration and Ethnic Affairs v Teoh (1995) 183 CLR 273, 287; Plaintiff M70/2011 v Minister for Immigration and Citizenship (2011) 244 CLR 144, [247]).

In addition, in contrast to Australia’s complaints-based enforcement approach to privacy and data protection, the European Union adopts a rights-based approach, as evidenced by Articles 7 and 8 of the Charter of Fundamental Rights, emphasising the need for a clearer statutory privacy framework in Australia.

In light of the above, Australia’s adherence to this traditional model positions, prior to the introduction of the Privacy Tort, Australia was an outlier among Western common law jurisdictions, due to its lack of a statutory privacy tort.

Introduction of Statutory Tort for Serious Invasions of Privacy

New statutory privacy tort

In response to global developments, Schedule 2 of the new Privacy Act provides a new statutory privacy tort that empowers individuals to exercise privacy rights and take direct legal action if their privacy is seriously breached. These privacy rights apply to situations involving

1. Either physical intrusion on a person’s seclusion by invading their private space or recording their private activities
2. or the misuse of personal information without consent
3. Where individuals had a reasonable expectation of privacy
4. The breach or invasion must be serious
5. and intentional or reckless

No requirement for proof of damages

Under the statutory privacy tort, plaintiffs are no longer required to prove actual damage to establish a cause of action. However, any harm or damages suffered is relevant when the court determines appropriate remedies, including damages and injunctions.

Public interest balancing test

A public interest balancing test is applied, requiring the plaintiff to demonstrate that the public interest in protecting privacy outweighs any competing public interest raised by the defendant.

Defences

The Bill outlines several defences that would exclude liability under the privacy tort, such as actions authorised or required by law, or those necessary to address serious threats to life, safety, or health.

Key exemptions include journalists and publishers and distributors of journalistic material. In addition intelligence agencies and law enforcement are exempt if functioning within their powers.

Stronger privacy protection

By introducing a direct tortious right of action for significant privacy breaches, this Bill contrasts with the current complaints based model, giving courts a greater role in enforcement. Importantly, it provides individuals with a clear legal remedy against entities that seriously invade their privacy thus raising the standard of privacy protection.

Doxxing Criminal Offences

Doxxing and Government Response

The Albanese Government has underscored the importance of protecting Australians’ privacy and personal information, particularly in light of the growing misuse of online platforms to harm individuals through practices such as doxxing. The increasing prevalence of doxxing—where malicious individuals obtain and release personal information online, either to the general public via social media or to a victim’s family and friends through messaging platforms—is both deeply disturbing and concerning.

Doxxing involves the unauthorised release of personal data online, often with malicious intent. This harmful practice can affect all Australians, but it disproportionately targets women, particularly in cases of domestic violence. The consequences of doxxing can be severe and enduring, inflicting psychological harm such as shaming, discrimination, stalking, and public humiliation, as well as financial and safety risks including identity theft and financial threats. In extreme cases, doxxing can result in threats to the victim’s life and safety, as well as endangering their family and friends.

New Criminal Offence on Doxxing

On 10th December 2024, Schedule 3 of the Privacy and Other Legislation Amendment Act amended the Criminal Code Act 1995 (Cth) to introduce a new criminal offence for doxxing. The offence applies where a person:

1. Uses a carriage service to make available, public or otherwise distribute the personal data of one or more individuals; and

2. Does so in a way that reasonable persons would regard as being menacing or harassing towards those individuals.

Definition of Personal Data

The new offence covers the release of personal data in a menacing or harassing manner. “Personal data” is broadly defined to include any information that could enable the identification, contact, or location of an individual. This includes, but is not limited to, email addresses, phone numbers, home addresses, names, and photographs, reflecting the diverse ways in which doxxing may occur.

Penalties

The maximum penalty is six years’ imprisonment for the new criminal offence of doxxing (Section 474.17C of the Criminal Code).

If the doxxing targets a victim based on characteristics such as race, religion, sex, sexual orientation, gender identity, intersex status, disability, nationality, or national or ethnic origin, the penalty increases to a maximum of seven years imprisonment. (Section 474.17D of the Criminal Code).

Standard of Proof

The offence will apply only when a reasonable person, considering all the circumstances, would consider the conduct harassing or menacing. This reasonableness standard ensures that legitimate conduct involving the publication or distribution of personal data is not unintentionally criminalised.

The new doxxing offences aim to enhance online safety and hold perpetrators accountable for their harmful conduct. By criminalising this invasive practice, the Act seeks to ensure that individuals’ privacy is safeguarded and that those who misuse personal information are subject to appropriate legal consequences.

Conclusion

The amendment of the Privacy Act 1988 (Cth) to introduce a Statutory Tort for Serious Invasions of Privacy, marks a pivotal moment in the evolution of Australia’s privacy protection framework. The introduction of a statutory privacy tort and the criminalisation of doxxing, brings Australia in line with international standards while addressing the unique challenges posed by the digital age, reflecting the country’s economic, cultural, and legal values.

How can BSM Sydney Lawyers assist you?

The commercial lawyers at Brander Smith McKnight Sydney Lawyer possess extensive knowledge and experience in handling privacy law matters, as well as matters with privacy law implications. Whether you are a business seeking to comply with privacy obligations or an individual concerned about privacy breaches, our experienced commercial lawyers are here to provide you with the most up-to-date legal guidance on Australian privacy law. Our senior commercial lawyers offer free 20-minute consultations.

FAQs

BSM Lawyer Sydney have offices conveniently located in Sydney CBD, Sutherland, Parramatta, Shellharbour and Wollongong.