The new privacy tort and the customer record

Clause 7(1)The five elements

The Act gives an individual (the plaintiff) a cause of action in tort against another person (the defendant) if all five of these are made out. The words are the Act’s.

1. (a) An invasion“the defendant invaded the plaintiff’s privacy by doing one or both of the following: (i) intruding upon the plaintiff’s seclusion; (ii) misusing information that relates to the plaintiff”
2. (b) An expectation“a person in the position of the plaintiff would have had a reasonable expectation of privacy in all of the circumstances”
3. (c) A state of mind“the invasion of privacy was intentional or reckless”
4. (d) Seriousness“the invasion of privacy was serious”
5. (e) The balance“the public interest in the plaintiff’s privacy outweighed any countervailing public interest”

Two further rules sharpen it. The invasion “is actionable without proof of damage”, and where information was misused, “it is immaterial whether the information was true”.

Clause 6Where a record comes in

Of the two kinds of invasion, misuse is the one that runs through a customer file. The Act says misusing information that relates to a person “includes, but is not limited to, collecting, using or disclosing information about the individual”. Intruding upon seclusion includes physically intruding into a person’s private space and “watching, listening to or recording the person’s private activities or private affairs”.

On whether there was a reasonable expectation of privacy, a court may consider, among other things, the means used, the purpose, and the person’s attributes and conduct. Where information was misused, it may also look at the information’s nature, “including whether the information related to intimate or family matters, health or medical matters or financial matters”, how the person held or communicated it, and how far it was already in the public domain.

On seriousness, the court may consider the degree of offence, distress or harm to dignity likely to be caused to a person of ordinary sensibilities, whether the defendant knew or ought to have known that was likely, and, for an intentional invasion, whether the defendant was motivated by malice.

Clause 8Defences

Clause 8 makes it a defence if:

• the invasion “was required or authorised by or under an Australian law or court/tribunal order”;
• the plaintiff, or a person with lawful authority to act for them, “expressly or impliedly consented to the invasion of privacy”;
• the defendant reasonably believed the invasion was needed to prevent, or reduce, a serious threat to someone’s life, health or safety;
• it was incidental to a lawful right of defence of persons or property, and “proportionate, necessary and reasonable”.

Where the invasion involved publishing information, certain defences that would ordinarily arise in defamation proceedings may also be available.

Part 3Who is exempt

Exemptions apply to intelligence agencies and law enforcement bodies, people disclosing information to them or using information they disclosed, and invasions of privacy by people under 18. Journalists are exempt to the extent an invasion involves collecting, preparing or publishing journalistic material. Government agencies and their staff are exempt for invasions made in good faith in performing their functions or exercising their powers.

Clauses 11 to 13Remedies

A court may award damages, including for emotional distress, and exemplary or punitive damages in exceptional circumstances, but not aggravated damages. In the Act as compiled on 4 June 2026, damages for non-economic loss plus any exemplary or punitive damages must not exceed the greater of $478,550 and the maximum non-economic damages available in defamation proceedings under an Australian law.

Other remedies a court may grant include an account of profits, an injunction, an order to apologise, a correction order, an order that material obtained or misused be destroyed or delivered up, and a declaration that the defendant seriously invaded the plaintiff’s privacy. An apology made in connection with the invasion is not an admission of fault or liability, though a court may consider it when setting damages.

Clause 14Time limits

Beside the APPsHow it sits with the rest of the Act

The Act says Schedule 2 “is intended to be read and construed separately from the rest of this Act”. The Information Commissioner may, with the court’s leave, intervene in proceedings or assist the court as amicus curiae.