Australia's new tort of privacy, which came into effect in June 2025, will impact 90% of Australian businesses previously exempt from privacy regulation. The tort introduces new requirements around the "serious invasion" test, journalism defences, and a challenging one-year limitation period.
We spoke to Matthew Hodgkinson, Managing Partner of Papillon Technology and Privacy Lawyers, who breaks down the five core elements lawyers must prove under the new tort. He also explains how the "serious invasion" test functions in practice, and shares essential compliance strategies for businesses of all sizes navigating this significant shift in Australia's privacy framework.
The "Serious Invasion" Test: What Lawyers Must Prove Under the New Privacy Framework
As Hodgkinson explained, the new tort requires claimants to prove five core elements. These may be found under the new Schedule 2, section 7(1) of the Privacy Act 1988 (Cth) (the Act).
Claimants must prove:
- invasion of privacy through intrusion upon physical seclusion or misuse of information relating to the person;
- the person had a “reasonable expectation of privacy in the circumstances;”
- the invasion was intentional or reckless conduct (not mere negligence);
- the public interest in the person’s privacy outweighed any other public interest; and
- the invasion was "serious."
“The ‘serious invasion’ test may be determined by various factors under Schedule 2, section 7(6),” explains Hodgkinson. “These factors include: the actual harm suffered by the person, whether the invasion was intentional, whether the defendant knew or ought to have known that it was likely to offend, distress, or harm the person and whether the person acted with intention and malice.”
What’s notable for lawyers is the inclusion of ‘eligible data breach’ as ‘serious.’
"'Serious' is already well utilised under the Act, including in the definition of an 'eligible data breach,' which requires that the breach is 'likely to cause serious harm,’” Hodgkinson says. “The courts have considered this to go beyond mere inconvenience or annoyance. It's likely that the interpretation of this section will follow a similar route in practice."
"There are exceptions to these tests, including authorisation by law, express or implied consent, reasonable belief in a threat to the life, health, or safety of a person, or circumstances that are proportionate and incidental to a right of defense of persons or property.”
A person will also not be liable if the information was published and there is a related defense to defamation Hodgkinson explains.
“The legislation also provides exemptions in some circumstances for journalists, disclosure to and by agencies, state and territory law enforcement bodies, and intelligence organisations, as well as people under 18.”
How do exemptions apply to journalists and government?
As you might expect, the new tort of privacy seeks to balance an individual’s right to privacy against press freedom.
“The journalism exemption applies where invasion involves collection, preparation for publication or publication of 'journalistic material' by professional journalists subject to professional standards or codes of practice, extending to their employers and assistants,” Hodgkinson says. “This distinction seems tailored to avoid a 'citizen journalist' scenario where anyone with a TikTok account could attempt to utilise the exemption.”
"Interestingly, the focus on 'standards' and 'codes,' which is defined widely, provides a blanket exemption even if this code is breached by the disclosure,” Hodgkinson says. “This indicates that the government is wary of journalists being targeted by administrators of the code. 'Journalistic material' includes editorial content relating to news, current affairs or documentaries, plus commentary, opinion or analysis on topics."
From a pragmatic perspective, government authorities are also exempt under the new tort.
"Other important exemptions include government agencies, state and territory authorities acting in good faith, law enforcement and intelligence bodies, and persons under 18,” Hodgkinson says. “Defenses include lawful authority, consent, necessity to prevent serious threats, proportionate defense of persons or property, and traditional defamation defenses like absolute privilege and fair reporting of public proceedings."
"The public interest balancing test is also a potential defense, and requires courts to weigh privacy against competing interests including freedom of expression and media freedom. This is available to non-journalists and allows the millions of 'citizen journalists' to seek the benefits of press freedom."
New Privacy Compliance Requirements for Australian Businesses
Perhaps the biggest impact of the change is its application to small businesses Hodgkinson observes.
“Previously, small businesses with less than $3m revenue (which, according to the Australian Small Business and Family Enterprise Ombudsman, includes more than 90% of businesses in Australia) were exempt from compliance with the Act. With the application of this new tort, these small businesses may suddenly be subject to regulation in this area.”
Hodgkinson suggests several ways to prepare.
“In light of this new tort, smaller businesses should both ensure they secure and have adequate control of their personal information, as well as review relevant contracts to place similar requirements on their suppliers,” Hodgkinson advises. “Naturally, speaking with a technology and privacy lawyer is a good way to mitigate risks of significant claims against their business.”
These small businesses (and bigger businesses who have not already done so) should ensure that they are adequately securing and deleting personal information, review privacy governance frameworks, and ensure management understands the implications.
“Organisations should thoroughly review and update privacy policies. This includes specifying, and enforcing data retention periods,” Hodgkinson says.
“Breach of confidence, meeting confidentiality requirements in contracts, and privacy may be similar for compliance at a high level, but the details around privacy regulation may require additional, privacy-specific policies and processes beyond those used for confidential information. Specific factors include consent, movement of information overseas, and deletion of the information when no longer required.”
From Data Breaches to Doxxing: Predicting the First Wave of Privacy Litigation
Due to the scale of the new tort of privacy, we can expect numerous cases testing the tort’s boundaries in the coming year. This will provide more definite shape and certainty around scope.
“Given Australians' increasing privacy consciousness and ongoing large data breaches, the new tort may generate significant cases against big Australian brands. These cases could be similar to those hit by data breaches recently, such as QANTAS and Medibank. Security will be an issue in those cases, so this new tort of privacy will likely test the limit of what can constitute “intentional” or “reckless” conduct under the third limb of the test.”
Hodgkinson predicts a second set of cases, potentially triggered by unauthorised surveillance or malicious data disclosure (“doxxing”).
“Here, while the moral case may be more striking and the application more clear, courts will need to resolve the precise meaning of ‘reasonable expectation of privacy' and the limits of ‘seriousness, ’” Hodgkinson says.
“The one-year limitation period from awareness of invasion (or three years from occurrence) will likely be tested, including the extension for those under the age of 18, particularly where malicious release of information is concerned,” he says. “These short turnaround times will likely limit the amount of litigation in the area, as people fail to exercise their rights in time due to uncertainty about the application of the laws.
The reach and impact of the new tort of privacy are likely to be significant. Specialist insight will be invaluable, both in compliance and potential litigation.
“Privacy and technology law specialists can provide crucial guidance as businesses navigate a rapidly evolving data governance and privacy regulatory landscape,” Hodgkinson says.
Privacy and technology lawyers typically review data-heavy agreements, such as business-critical SaaS agreements and services agreements. Additionally, they can assist clients in negotiating favourable terms given their privacy obligations, and work with businesses on their global privacy compliance obligations.
“This would include updating privacy policies, data breach response plans, and privacy management plans, as well as training staff on privacy-conscious practices. For businesses operating across jurisdictions, navigating the complex relationship between Privacy Act compliance and international privacy obligations will also be important.”
![How to handle Direct Speech after Gan v Xie [2023] NSWCA 163](https://images4.cmp.optimizely.com/assets/Lawyer+Up+direct+speech+in+drafting+NSW+legislation+OCT232.jpg/Zz1hNDU4YzQyMjQzNzkxMWVmYjFlNGY2ODk3ZWMxNzE0Mw==)
