In September 2023, the Office of the Australian Information Commissioner (OAIC) welcomed the Australian Government’s response to the Attorney-General’s Department’s (AGD) review of the Privacy Act 1988 as a crucial step in ensuring Australia’s privacy framework is strengthened for the future.
“This is a vital set of proposals that will deliver significant gains for the Australian community,” Australian Information Commissioner and Privacy Commissioner Angelene Falk said at the time.
{We previously shared an informative blog article on the proposed Privacy Law reforms back in 2023, which you can check out here.}
In keeping in line with the privacy frameworks of other countries around the world, such as the UK, Canada and the EU, one of these proposed changes – a new statutory tort for serious invasions of privacy – recently came into effect on the 10th June 2025.
If you’re a business that handles sensitive or personal information, this landmark reform significantly expands individual rights which in turn increases legal exposure for businesses. This legal risk is even greater for commercial enterprises that operate in a fast-moving digital, marketing, or data-driven sectors and conduct activities such as processing customer data, tracking user behaviour or operating in public-facing environments.
Employers may also face vicarious liability for privacy breaches committed by staff in the course of their employment.
An Overview on the New Statutory Tort
Previous frameworks relied heavily on the Office of the Australian Information Commissioner (OAIC). With the introduction of a civil right for individuals to sue if their privacy is seriously invaded, the new cause of action only applies to conduct occurring on or after the 10th of June 2025.
It covers two key forms of privacy invasion, namely:
Intrusion upon seclusion (for example: unauthorised surveillance, spying, or physical intrusions) and
Misuse of private information which includes unauthorised collection, disclosure, or exploitation of personal data.
Legal Thresholds for a Successful Claim
In order for a plaintiff to make a successful claim, strict criteria must be met.
However, it’s important to note that the new privacy tort has provided exemptions for certain groups, including but not limited to intelligence agencies and law enforcement bodies. In certain circumstances, it also ensures the tort does not restrict legitimate journalistic or public interest activities with qualified protection.
Crucially, most commercial businesses are not exempt.
What is the Legal Recourse Available?
It’s important to note there are deadlines for legal action.
The statutory tort applies to conduct that occurs after the 10th of June 2025.
Proceedings under the statutory tort must be commenced within certain timeframes. If a plaintiff is under 18 years of age when the alleged invasion of privacy occurred, proceedings must commence before their 21st birthday. In other circumstances, the timeframe is the earlier of:
- 1 year after the day on which the plaintiff became aware of the invasion of privacy; and
- 3 years after the invasion of privacy occurred
As per the OAIC’s website, the court may grant remedies as it considers appropriate. This may include, among other remedies, granting damages, an injunction or an order requiring an apology.
Considerations for Businesses
In light of the new privacy tort coming into effect, there are a number of steps a business can take including conducting a privacy risk audit, reviewing staff training and policies, updating incident response plans, revisiting third party contracts and assessing insurance coverage.
How We Can Help
At Litton Legal we can assist clients in understanding the current Privacy Law reforms, advise how these may impact your services and implement practices to bring your business in line with the upcoming changes. Now is the perfect time to update your privacy policies. We can also assist your business with understanding cyber security risks, your obligations around this and what you should do in the event of a data breach. Send our friendly team an email via the contact form here.
