A new way Australians can sue you directly for privacy invasions

Source legislation

The statutory tort was introduced through the Privacy and Other Legislation Amendment Act 2024 (Cth), commencing 10 June 2025. The cause of action sits within the Privacy Act 1988 (Cth).

Plain-English summary from OAIC

The OAIC publishes plain-English guidance on the statutory tort, explaining what it covers, who it applies to, and how it relates to other privacy rights under Australian law.

Why it matters

Until 10 June 2025, an Australian individual whose privacy was invaded had limited direct remedies. They could complain to the OAIC, which could investigate and potentially issue a determination. The new tort gives them a direct cause of action in court, including the ability to seek damages, injunctions, and other relief.

First claims are already being filed

Law firms commenting publicly through 2025 and 2026 confirm that early claims are being brought under the new tort. Boards and insurers are paying attention because the tort creates a litigation pathway separate from OAIC enforcement.

Element 1 : Invasion of privacy

The defendant must have invaded the plaintiff's privacy either by (a) intruding upon the plaintiff's seclusion, or (b) misusing information that relates to the plaintiff.

Element 2 : Reasonable expectation of privacy

The plaintiff must have had a reasonable expectation of privacy in all the circumstances. This is an objective test informed by the context, the nature of the information or intrusion, and how the matter came to be invaded.

Element 3 : Seriousness

The invasion must be serious. Trivial breaches, minor administrative errors, and routine handling missteps are unlikely to meet the threshold. Cases involving health information, intimate images, sustained intrusion, or significant harm are the likely test cases.

Element 4 : Intentional or reckless

The invasion must have been intentional or reckless. Pure negligence is not enough. This narrows the tort significantly compared to the underlying Privacy Act obligations, where the OAIC can still enforce against negligent handling.

Defences : public interest

Public interest weighed against the privacy interest is a defence. This protects legitimate journalism, public interest reporting, and matters of public concern. Courts will assess the public interest test objectively.

Defences : consent and lawful authority

Consent of the plaintiff is a defence. So is conduct authorised or required by Australian law (including law enforcement and intelligence functions). Standard contractual data handling done with consent is unlikely to be tortious.

Small businesses currently exempt from APPs

The Privacy Act's small business exemption does not exempt a business from the statutory tort. A previously exempt business that seriously invades an individual's privacy is exposed to the tort regardless of turnover.

Employees and former employees

Employee records have historically benefitted from a partial Privacy Act exemption. The tort is not bound by that exemption. Employee health information, surveillance footage, and personal communications all sit within the potential scope of the tort.

Suppliers, contractors and vendors

Any third party handling personal information on behalf of an Australian business is in scope. Boards are now asking whether vendor due diligence covers the tort exposure. Most contracts written before June 2025 do not.

Customers, suppliers and members of the public

Any individual whose privacy is seriously invaded has standing. This includes customers, suppliers, prospective customers, members of the public photographed or recorded without authority, and former staff.

Personal information inventory

Know what personal information you hold, where it lives, who can access it, and why. A current inventory is the starting point for everything else.

Access controls and least privilege

Reduce who can access sensitive personal information. Enforce role-based access in Microsoft 365 and your line-of-business systems. Audit access quarterly. Most tort risk lives in over-broad access, not in malice.

Surveillance and recording policies

Document CCTV, call recording, screen monitoring, location tracking, and any other surveillance activity. Notify staff and visitors clearly. Most intentional intrusion claims will turn on whether the activity was reasonable and properly disclosed.

Email and messaging governance

Tighten distribution lists, sensitivity labels in Microsoft 365, and the use of personal devices for company communications. Most data leakage is preventable with sensitivity labels, conditional access, and DLP.

Vendor due diligence

Update vendor contracts to address the statutory tort. Confirm vendors have current cyber insurance, breach response procedures, and access controls that meet your standard.

Incident response with the tort in mind

When a privacy incident occurs, your response needs to address three audiences: the affected individuals (potential plaintiffs), the OAIC (potential investigator), and your insurer. Incident response documentation should reflect this.

Cyber insurance renewal questions to expect

Have you reviewed your privacy policies in light of the statutory tort? Do your vendor contracts address the tort? What is your incident response process for a serious invasion of privacy claim? Do you have a privacy officer or equivalent function?

Management liability is in scope

Directors and officers liability and management liability policies are being reviewed in light of the tort. Boards should ask their broker whether existing cover responds to a tort claim and whether sub-limits apply.

Class actions are plausible

Legal commentators expect the tort to give rise to class actions where a single intrusive practice has affected many individuals. Examples being discussed publicly include intrusive workplace surveillance, mass leakage of customer personal information, and inappropriate handling of intimate images.

Board reporting should include the tort

Quarterly board reporting should now include a brief privacy section that covers tort awareness, vendor due diligence status, and any incidents that could be tortious. Real Bytes covers this in our board reporting template.