The Privacy Act 1988 (Cth) (Act) is one of the longest-standing pieces of national data protection legislation in the world, but – despite its name – it has been more concerned with regulating use of individuals’ personal data than granting them an actionable, stand-alone right to privacy.

However, as of June 2025, this has changed. Australians now have access to a new statutory cause of action (or tort), built into the Act, for serious invasions of their privacy. The elements of the tort have been much discussed already, but in short, the cause of action arises in the following circumstances:

• An individual suffers an invasion of their privacy either by an intrusion into their seclusion and/or misuse of information. The Act contemplates an individual may be able to claim for both elements, e.g. where any material produced from an intrusion into seclusion is published by the defendant.
• A person in the individual’s position would have had a reasonable expectation of privacy.
• The invasion of privacy was intentional or reckless.
• The invasion of privacy was serious.
• The public interest in the plaintiff’s privacy outweighed any countervailing public interest.

Read the full article on our website for our answers to some of the questions we have heard our clients ask.

Disclaimer: While every effort has been made to ensure that the information contained in this article is accurate, neither its authors nor Squire Patton Boggs accepts responsibility for any errors or omissions. The content of this article is for general information only and is not intended to constitute or be relied upon as legal advice.