Welcome to our first article on the specific reforms proposed under the Privacy and Other Legislation Amendment Bill 2024 (Bill) delving into further detail on a statutory tort for invasion of privacy. For an overview of the legislation before parliament and to access our series of articles on the reforms as they are released, please click here.
Australian jurisprudence has long been toying with the idea of introducing civil liability for breaches of privacy. The reluctance has been mainly due to it not being recognised at common law. Other torts such as defamation and injurious falsehood have been used unsuccessfully in a de facto attempt to achieve the same result for what amounts to a loss of privacy but this has always resulted in more than unsatisfactory results.
This reform represents a major legal development, providing individuals with new rights and remedies when their privacy is invaded. There are many similarities in the proposed legislation with Australian defamation law, especially in the defences available for an action under the new regime. The proposed legislation contains a number of radically new and interesting concepts to Australian civil law including the remedy of exemplary or punitive damages – a remedy that was fast fading in civil proceedings but is now back with a bite!
What constitutes a serious invasion of privacy?
The statutory tort encompasses two primary types of privacy invasions:
- Intrusion upon seclusion: This includes acts such as:
- physically intruding into someone’s private space; or
- watching, listening, or recording a person’s private activities.
- Misuse of private information: This refers to the unauthorised collection, use, or disclosure of personal information about an individual. Such information may include intimate details like family matters, health records, or financial data.
For an invasion of privacy to be actionable, several elements must be satisfied, namely:
- A reasonable expectation of privacy: There must be a reasonable expectation of privacy in the circumstances. This is assessed on a case-by-case basis and will take into account:
- the location and method of invasion;
- whether the plaintiff was in a private setting, and the nature of the information misused; and
- attributes of the plaintiff such as age, occupation, or cultural background.
- Intentional or reckless invasion: The defendant’s actions must be either intentional or reckless.
- Seriousness of the invasion: The invasion must be serious in nature. A court will consider the degree of the offence, distress, or harm caused to the plaintiff’s dignity. It may also consider whether the defendant knew or ought to have known that their actions would cause distress, and whether they were motivated by malice.
Who can maintain this cause of action?
An action is exclusively available to an individual (referred to as the plaintiff). They can bring an action against another person for serious invasions of privacy. Key points include:
- Individuals only: Corporations cannot sue under this tort.
- Exclusions for deceased persons: An action cannot be initiated or continued in relation to the invasion of privacy of a deceased person, nor can an action be pursued against a deceased defendant.
This provision is intended to protect living individuals from privacy violations, focusing on personal dignity and autonomy.
Public interest considerations
One of the features of the new statutory tort is the public interest balancing test. If the defendant raises a public interest defence, the court must weigh the public interest in the invasion of privacy against the public interest in protecting the plaintiff’s privacy.
Examples of public interest include:
- Freedom of expression, including political communication.
- Freedom of the media and the proper administration of government.
- Public health and safety, national security, and the prevention of crime.
If the public interest in the invasion outweighs the interest in privacy, the defendant may avoid liability.
Defences to the tort of serious invasion of privacy
Defendants have several statutory defences they may rely on to avoid liability. These include:
- Lawful authority: If the invasion of privacy was required or authorised by Australian law or by a court order, the defendant is protected.
- Consent: Consent can be either express or implied and may be given by the plaintiff or someone authorised to act on their behalf.
- Necessity: If the defendant reasonably believed that the invasion of privacy was necessary to prevent or reduce a serious threat to a person’s life, health, or safety.
- Defamation law defences: If the invasion involved the publication of information, the defendant may invoke traditional defamation defences where they are applicable, such as absolute privilege, fair reporting on a matter of public concern, or the publication of public documents.
Remedies for successful claims
If the plaintiff succeeds in proving a serious invasion of privacy, the regime offers a host of remedies, including:
- Damages: The court can award damages, for both:
- non-economic loss for emotional distress; and
- exemplary or punitive damages in exceptional circumstances.
The total cap on damages for non-economic loss and punitive damages is set at $478,550 or the maximum allowed in defamation law, whichever is greater.
- Injunctions: Courts can issue interim or permanent injunctions preventing further invasions of privacy. In cases involving the publication of information, the Court must carefully consider the public interest when deciding whether to grant an injunction.
- Additional remedies may include:
- account of profits;
- orders for the destruction of materials obtained through the invasion of privacy; and
- apologies or corrections to be issued by the defendant to the plaintiff.
Key exceptions and exemptions
Several groups and situations are exempt from the tort, namely:
- Journalists and media organisations: Privacy invasions committed by journalists, their employers, or those assisting in journalism are exempt when they involve the collection or publication of journalistic material. Journalistic material includes news, current affairs, commentary, and documentaries.
A journalist is defined under as someone working in a professional capacity, bound by standards of professional conduct or a code of practice.
- Law enforcement bodies: are exempt when they reasonably believe that the invasion is necessary for enforcement-related activities, such as the prevention or detection of crime.
- Intelligence agencies: Intelligence agencies like Australian Security Intelligence Organisation (ASIO) or Australian Secret Intelligence Service (ASIS).
- Minors: Individuals under the age of 18 are exempt from liability for serious invasions of privacy.
Time limits for filing claims
Time limits apply for bringing an action:
- If the plaintiff was under 18 when the invasion occurred, they must file the claim before their 21st birthday.
- In other cases, the claim must be filed within one year of the plaintiff becoming aware of the invasion, but no more than three years after the invasion occurred.
- Extensions are possible in exceptional cases, but the overall limit is six years from the date of the invasion.
Single publication rule
Similar to current defamation laws to prevent multiple claims arising from repeated publications of the same material, the single publication rule applies. If information is republished, the invasion of privacy is considered to have occurred on the date of the first publication.
Conclusion
The 2024 amendments to the Privacy Act creates a comprehensive legal framework for addressing serious invasions of privacy in Australia. By providing individuals with a clear cause of action, establishing robust defences, and defining the scope of remedies and exemptions, these changes aim to protect personal privacy while balancing competing public interests, such as freedom of expression, the role of the media and national security.
The reforms mark a significant milestone in privacy protection, reinforcing the growing importance of privacy in the digital age.
This article was written by Nicholas Pullen, Partner and Amani Fatileh, Law Graduate.
