In late 2024, the Australian Government enacted a series of reforms to the Privacy Act 1988 (Cth). The new statutory tort for serious invasion of privacy was introduced and passed under the Privacy and Other Legislation Amendment Act 2024 (the Act). On June 10, 2025, the statutory tort for serious invasion of privacy took effect.
The Act, as introduced, outlined a range of measures to protect the privacy of individuals with respect to their personal information, including expanding the Information Commissioner’s powers, facilitating information sharing in emergency situations or following eligible data breaches, requiring the development of a Children’s Online Privacy Code, providing protections for overseas disclosures of personal information, introducing new civil penalties, and increasing transparency about automated decisions that use personal information.
Under the Act, individuals can now sue for intentional or reckless invasions of privacy that are "serious" and breach a reasonable expectation of privacy, where the public interest in the individual's privacy outweighs any countervailing public interest. Individuals are not required to show damages. The Act includes a broad exemption for news publications, current affairs or documentaries, as well as commentary or opinion on those topics. Furthermore, the statutory tort does not apply where public interest in freedom of expression outweighs the interest in privacy.
The catalyst for the Act was in response to increasing public concern over the misuse of personal information in an increasingly digital era, and it is the most significant development in protecting the personal information of Australians.
Organizations will need to assess current and future data processing activities and assess litigation risk associated with business activities that may give rise to serious invasions of privacy.
