By Simone Basso and Daniel Kiley
While the public is becoming increasingly aware of privacy issues, and concerned about the way in which personal information is handled, Australian laws have not traditionally provided strong mechanisms for individuals to take action for breach of privacy.
The Privacy Act 1988 (Cth) (Act) contains a number of obligations for regulated entities to follow when handling personal information, but has not traditionally included a direct cause of action for breach of those obligations or other interferences with privacy.
Australian Courts have been long toying with recognising civil claims for breach of privacy, via extensions to other torts, but have generally been hesitant to make what would be a significant leap beyond the existing common law.
In late 2024, the Federal Government introduced major amendments to the Act, including one which seeks to fill this gap, being the introduction of a statutory tort for serious invasions of privacy. This provision, which was introduced via the Privacy and Other Legislation Amendment Bill 2024 (Bill) and commenced on 10 June 2025.
The explanatory memorandum to the Bill confirmed that the purpose behind the amendment was to “provide a flexible framework to address current and emerging privacy risks and provide individuals with the ability to better protect themselves and seek compensation for a broader range of serious invasions of privacy, including physical privacy, as well as misuse of information.”
The tort responds to invasions of privacy where:
- there is an intrusion upon an individual’s seclusion (for example, by physically intruding into the person’s private space, or by watching, listening to or recording the person’s private activities or private affairs); or
- there is a misuse of information that relates to the individual.
In addition to at least one of the above elements being satisfied, a further four elements must also be established in order for a claim in this cause of action to be successful:
- The plaintiff has a reasonable expectation of privacy in all of the circumstances;
- The invasion of privacy was intentional or reckless (as opposed to just negligent);
- The invasion of privacy was serious; and
- The public interest in the plaintiff’s privacy outweighs any countervailing public interest.
In assessing the seriousness of conduct, the Court can take into account factors such as the degree of offence, distress or harm to dignity, the extent to which the defendant knew (or ought to have known) of such consequences, and whether any malice was involved.
Notably, the legislation states that the plaintiff is not required to prove that they have suffered any damage.
There are several defences to the tort listed at Clause 8 of Schedule 2 to the Act. Of particular relevance to many complaints is cl 8(2) which provides that it is a defence to the tort if:
- the defendant invaded the plaintiff’s privacy by publishing, within the meaning of an Australian defamation law, information that relates to the plaintiff; and
- that law provides for a related defence (which includes absolute privilege, publication of public documents, and fair report of proceedings of public concern); and
- the defendant would be able to establish the related defence if a reference in the Australian law to the publication of defamatory matter were to include a reference to the invasion of privacy.
How will the tort operate in practice?
As for how the tort is intended to operate in a practical sense, and noting that it is based in statute, the explanatory memorandum clarifies that “[t]he statutory tort … is intended to operate similarly to other torts, in that it would be developed through jurisprudence. It is distinct from the regulatory regime established in the Privacy Act, which requires compliance with the APPs and is overseen by a regulator. As such, it is intended that courts would draw on key concepts from other torts, including privacy torts in other jurisdictions“.
A further, and rather interesting, point raised by the introduction of the tort is how it will operate in conjunction with causes of action in defamation. The explanatory memorandum makes clear that the tort is intended to align with related defences in defamation law. As discussed further below, both the statutory tort for serious invasions of privacy and defamation have been relied upon in the same proceedings brought by plaintiffs.
However, given the short period of time at which the statutory tort for serious invasion has been at play, there has been little opportunity for jurisprudence to develop as to the application and interpretation of the tort. As a result, there is very limited guidance on the operation of the tort in a practical setting.
Notwithstanding this, there have been a handful of cases in which plaintiffs have relied on the statutory tort as a cause of action, with one of those cases resulting in a decision (although interlocutory) handed down by the courts.
Kurraba Group Pty Ltd & Anor v Williams
The first and only decision to date which considers the application of the statutory tort is Kurraba Group Pty Ltd v Williams. This decision was handed down by Justice Gibson in the District Court of New South Wales. The plaintiffs, Kurraba Group Pty Ltd (Kurraba) and its chief executive officer, Mr Nicholas Smith, sought a suite of interlocutory orders for the torts of defamation and serious invasion of privacy and (in the case of the second plaintiff) intimidation, designed to bring to an end what they called a “campaign of extortion” by the defendant, Mr Michael Williams.
The plaintiffs asserted that this campaign begun after Kurraba, a Sydney-based real estate development firm, had lodged a development application to redevelop a property in New South Wales. They asserted that Mr Williams had:
- maintained a publicity campaign against both plaintiffs while secretly approaching the plaintiffs for the purpose of demanding $50,000 in exchange for desisting in this conduct;
- published a one-star Google review of the first plaintiff (and, by inference, the second plaintiff) in furtherance of this proposal;
- made allegations about the plaintiffs in a public meeting in furtherance of this proposal; and
- created a public website (“Kurraba Group Exposed”) on which a series of publications were made for the same purpose.
The plaintiffs asserted that the campaign was brought by Mr Williams for the purpose of obtaining financial benefit sought in exchange for ceasing to publish.
In her Honour’s decision handed down on 2 October 2025, Gibson DCJ found that the conduct of Mr Williams was such that there was a serious question to be tried in relation to the tort of privacy concerning the CEO of Kurraba, Mr Smith.
Her Honour further stated, in relation to Mr Williams’ misuse of Mr Smith’s and his wife’s private wedding photographs, that “[Mr Smith] and his wife were not public figures and had no intention of publishing their wedding photographs to any media or other mass publication organisation. The photographs in question were, further, misused by the defendant in that he sought to portray what they depicted as indicating moral delinquency and drunkenness as opposed to the sanctity of marriage and the ceremonial proceedings attendant thereupon.”
Her Honour noted that “[s]imilarly the misuse of private photographs has long been recognised in Australia as being capable of amounting to defamation where they appear out of context…‘, citing Geyer v Ghosn (No 2) [2020] NSWDC 782.
Her Honour granted injunctive relief in favour of the plaintiffs against the defendant.
Groth & Anor v The Herald and Weekly Times & Anor
Proceedings recently brought by Sam and Brittany Groth in the Federal Court of Australia have provided some helpful insight on how the tort may be relied upon by plaintiffs, as well as how defences made available via the Privacy Act may be deployed by defendants.
Sam Groth, former professional tennis player and former Victorian Deputy Liberal Leader, and wife Brittany Groth, brought proceedings against the Herald and Weekly Times (parent company of the Herald Sun) (HWT), as well as two journalists as co-defendants, in relation to a series of articles published by the Herald Sun about their relationship (Sam Groth bringing a defamation action and Brittany Groth for serious invasions of privacy).
The case pleads two further causes of actions in the alternative, being a breach of a common law tort of privacy and/or a breach of confidence.
Although the matter has now settled out of court, application of the statutory tort may be derived from the positions taken by the parties. During a case management hearing on 30 October 2025, it was reported that counsel for HWT relied on the “journalism” exemption and argued that, given Mr Groth’s political career, articles of this nature were in the public interest.
Pursuant to reports, counsel for the plaintiffs argued that the articles were “not news” and were “at best malicious gossip”, and “anything that has the character of news in something that is a factual presentation of information.”
Based on positions taken by the defendant in these proceedings, as well as defences often deployed by publishers in defamation proceedings, it seems plausible that publishers (or rather any journalists or journalism entity) may rely heavily on the journalism exemption in proceedings brought against them for serious invasions of privacy.
Counsel also raised a question as to the cohesiveness between the common law tort of privacy and the statutory tort, again, causes of action which are yet to be tested together.
What’s next?
As foreshadowed by the explanatory memorandum, it is intended that jurisprudence will shape the application and interpretation of the statutory tort of serious invasions of privacy. It will therefore take some time for that jurisprudence to develop.
However, there is no doubt that the courts will see an increase in actions in defamation and actions for serious invasions of privacy brought in tandem. While publications seem an obvious avenue for claims, the Kurraba example above illustrates the potential for a wide range of scenarios to enliven the tort, and we expect to see attempted claims for other controversies involving personal information, particularly data breaches.
Ultimately, it will be a matter of statutory interpretation as to how actions for serious invasions of privacy will be determined.
