Written by Law Student, Indigo Bauchop, and Managing Principal, Jennifer Tutty
In the current digital age where personal information is more accessible than ever, stronger regulations are necessary to minimise the risks associated with data misuse.
Recognising this, the Australian government introduced the Privacy and Other Legislation Amendment Bill 2024 (Cth), which is due to come into effect June of this year. A key reform in this legislation is the establishment of a legal right for individuals to sue for serious invasions of privacy.
The Privacy and Other Legislation Amendment Bill 2024 (Cth)
This bill amends the Privacy Act 1988, which protects the use, storage and disclosure of personal information. It implements recommendations from the Privacy review report, which includes two years of consultation to address the need for upgraded privacy protection laws that meet community expectations.
The bill aims to address inadequate privacy protections in the current digital economy, where data breaches, identity fraud and scams regularly expose sensitive personal information. It enhances privacy protections by increasing transparency, imposing stricter safeguards against misuse and providing individuals with legal recourse when their privacy is violated.
The protection of personal information is fundamental to ensuring individuals can freely express themselves and engage in various interests without fear of their privacy being compromised.
The New Statutory Tort
One of the most significant changes introduced by the bill is the statutory tort for serious invasions of privacy under s7(1). This provision grants individuals a legal avenue to seek compensation when their privacy has been intentionally or recklessly violated.
Privacy breaches typically occur upon intrusion on an individual’s seclusion or misuse of personal information – with this legal recourse in place, individuals now have stronger protections against unauthorised access to their private information and a clear mechanism for seeking damages, or other remedies if necessary.
This tort aims to reinforce privacy as a fundamental right and encourage greater control and accountability for responsible data handling across industries.
How to Enforce this Action
To successfully sue for a serious invasion of privacy, the following must be met:
-The invasion must be serious, causing significant harm or distress.
– The defendant invaded the plaintiff’s privacy by doing one or both of the following:
+ Intruding upon the plaintiff’s seclusion, or
+ Misusing personal information relating to the plaintiff.
– A reasonable expectation of privacy must exist in the circumstances.
– The invasion of privacy must be intentional or reckless, rather than accidental.
Who Does this Affect?
The bill applies to a range of individuals and entities, with a focus on the following:
– Commonwealth entities
– Private sector organisations
– Entities involved in data breaches
– Entities subject to civil penalties
– Entities engaging in overseas data flows.
Businesses and organisations will need to reassess their privacy practices to avoid potential legal consequences. Stricter compliance measures may be required to ensure personal data is handled appropriately, preventing costly lawsuits and reputational damage.
Are there any Defences?
Under this tort, exemptions will apply to invasions of privacy carried out in good faith by a state authority, its staff or law enforcement bodies, provided they act within the proper exercise of their powers in performing their functions.
Additionally, there will be a defence where a countervailing public interest, such as the proper administration of government, justifies the invasion of privacy. A defence will also apply where the invasion of privacy is required or authorised by law.
Key Takeaways/Top Tips
1. Know your legal rights: Individuals can now take legal action to sue for a serious invasion of privacy under the new statutory tort.
2. Understand how to take legal action: A claim under this tort requires several factors to be met, including an intentional or reckless invasion of privacy and a reasonable expectation of privacy.
3. Businesses to strengthen compliance: Organisations are encouraged to review and update their data protection policies to align with the enforcement of stricter privacy laws.
4. Protect your personal information: In our current digital age, remain aware of scams and identity fraud that put your sensitive personal information at risk.
5. Consider why these reforms and actions are important: They ensure freedom without compromising your personal data.
Final Thoughts
The Privacy and Other Legislation Amendment Bill 2024 (Cth) marks a significant shift in Australia’s privacy laws, ensuring individuals have stronger protections against serious invasions of privacy. By providing a legal remedy for those affected, the law acknowledges privacy as a fundamental right rather than a privilege.
As digital landscapes continue to evolve, this legislation sets a critical precedent for safeguarding personal information in an increasingly interconnected world. Whether for individuals or businesses, understanding and respecting privacy rights will be more important than ever.
“a significant step forward in advancing privacy protections for the Australian community.” – OAIC
Further Information
For more information on Privacy law, check out our blogs:
– Does Your Business Need a Privacy Policy? A Guide For Small Businesses.
If you have any privacy law related legal questions or would like legal advice on privacy policies, please contact us through our online form or via email at hello@studiolegal.com.au.
Written by Law Student, Indigo Bauchop, and Managing Principal, Jennifer Tutty
Published 19 March 2025.
Photo by Matthew Henry on Unsplash
DISCLAIMER
The information in this article is of a general nature. It does not constitute formal legal advice and should not be relied on as such. Please see the full disclaimer in our website terms. Please contact Studio Legal if you are seeking advice about a specific legal matter.