New Statutory Tort – Serious Invasions of Privacy
We provide a brief overview of the new cause of action for serious invasions of privacy introduced in Schedule 2 of the Privacy Act 1988 (Cth) (the Schedule). The statutory tort commenced in June 2025 and creates a right for individuals to seek relief where their privacy has been invaded, either through an intrusion upon their seclusion or through the misuse of information about them.[1]
Although the new statutory tort is still in its early days, it has now received its first judicial consideration in Kurraba Group Pty Ltd & Anor v Williams [2025] NSWDC 396, where the New South Wales District Court granted urgent interlocutory relief restraining what was described as a “campaign of extortion” involving, among other things, the misuse of private wedding photographs. That decision, discussed further below, provides early guidance on how Australian courts are likely to approach applications under the new tort.
Background
The Schedule is intended to be treated as a suite of independent provisions, with the intended objective of recognising that individuals should be given the opportunity to take action for serious invasions of privacy and provided with remedies where the cause of action is established.[2]
Clause 7(1) of the Schedule outlines the elements of the cause of action which the plaintiff, being a natural person, must prove, including:
(a) an invasion of privacy, by either the defendant’s intrusion upon the plaintiff’s seclusion or misuse of information, or both;
(b) a reasonable expectation of privacy in all the circumstances;
(c) the defendant’s fault (either intention or recklessness);
(d) seriousness of the invasion; and,
(e) that the public interest in protecting the plaintiff’s privacy outweighs countervailing public interests that are raised by the defendant.
Clause 7(2) makes clear that the plaintiff does not need to prove they suffered damage in order to establish the tort. However, any harm or loss they did experience will be relevant to determining whether the invasion of privacy was serious.[3]
For the purposes of subclause 7(1)(a) of the Schedule, the plaintiff’s ‘privacy’ is to be determined on the facts of each case by applying the test in subclause 7(1)(b), that is, whether the plaintiff had a reasonable expectation of privacy in all the circumstances. Subclause 7(5) sets out a non‑exhaustive list of factors the Court may take into account when assessing that expectation. The reasonable‑expectation test is intended to remain flexible so it can adapt to changing community views about privacy.[4]
The plaintiff must show that the defendant invaded their privacy either intentionally or recklessly. Under subclause 6(1) of the Schedule, ‘recklessness’ adopts the definition used in the Criminal Code Act 1995 (Cth), ensuring consistency across jurisdictions and distinguishing it from the lower standard of negligence. A reckless invasion of privacy may be established where the defendant was aware of a substantial risk and, given the circumstances known to them, it was unjustifiable for them to take that risk[5]
The Explanatory Memorandum to the Privacy and Other Legislation Amendment Bill 2024 (Cth) provides examples of conduct that would not amount to recklessness, for instance a photographer at a public event who unknowingly captures a private activity. Similarly, a person who creates a digital platform is not liable if a third party uses that platform to invade someone’s privacy without the creator’s knowledge.[6]
The plaintiff must also show that the invasion of privacy was objectively serious; an element designed to prevent trivial claims. This assessment is made from the perspective of a person of ordinary sensibilities in the plaintiff’s position, rather than based on the plaintiff’s own subjective feelings.[7]
A defendant may present evidence of a relevant public interest to justify an invasion of the plaintiff’s privacy. Subclause 7(3) of the Schedule sets out a non‑exhaustive list of countervailing public interests that may outweigh the protection of the plaintiff’s privacy. The United Kingdom has developed an extensive body of case law on the tort of misuse of private information, and it is expected that Australian courts will draw on that jurisprudence when assessing a plaintiff’s reasonable expectation of privacy and when balancing competing public interests.
A likely UK authority includes the judgment of the United Kingdom House of Lords in the case of Campbell v Mirror Group Newspapers [2002] EWHC 499. Many will recall this case in which the UK Daily Mirror published photographs of Naomi Campbell leaving a rehabilitation clinic. The House of Lords held that even individuals who seek public attention retain a degree of privacy in their personal lives. Although there was a legitimate public interest in revealing that Campbell had misled the public about her drug use, the publication exceeded what was justified by publishing detailed information about her treatment, which was confidential and not necessary to satisfy the public interest.
Defences
Defendants bear the onus of proving that their conduct is subject to a defence provided under clause 8 of the Schedule, including:
(a) a required or authorised invasion of privacy under an Australian Law, including circumstances in which WH&S laws or mandatory reporting schemes require or authorise the invasion of privacy (subclause 8(1)(a));
(b) where consent is given for the invasion of privacy (subclause 8(1)(b));
(c) a defence of necessity, where the defendant reasonably believes the invasion of privacy was necessary to prevent or lessen a serious threat to the life, health or safety of a person (subclause 8(1)(c)); or,
(d) a defence for invasions of privacy that are incidental to the exercise of a lawful right of defence of persons or property where the conduct is proportionate, necessary and reasonable (subclause 8(1)(d)).
Subclause 8(2) sets out defences that are intended to match the similar defences available in defamation law, including absolute privilege (subclause 8(3)(a)), publication of public documents (subclause 8(3)(b)), and fair reporting of proceedings of public concern (subclause 8(3)(c)). The defamation defence of truth is not available to a defendant of the new tort, because subclause 7(7) of the Schedule provides that it does not matter if the information misused by the defendant is true or not.
Summary Judgment
Subclause 10(1) of the Schedule provides that a court may give judgment if it is satisfied that the plaintiff has no reasonable prospect of successfully prosecuting the proceedings.[8]
Pursuant to subclause 8A(1) of the Schedule, the court may be asked, at any stage of the proceedings, to determine whether an exemption under Part 3 of the Schedule applies to the relevant invasion of privacy, including exemptions for publication of journalistic material, invasion of an individual’s privacy by an intelligence agency or a State or Territory authority, or an invasion of an individual’s privacy by a person who is under 18 years of age.
Interim Injunction
Subclauses 9(1) and 12(2)(b) of the Schedule provides that courts may grant interim injunctions restraining an invasion of privacy at any stage of proceedings.
Damages
Clause 11 of the Schedule governs the types of damages a court may award to a plaintiff for an invasion of privacy. Under subclause 11(4), a court may award exemplary or punitive damages in exceptional circumstances, for example where the defendant intentionally invaded an individual’s privacy in order to obtain a financial benefit.
Subclause 11(5) of the Schedule sets out the maximum sum of damages, being the cap for damages available under Defamation Law, which is $500,000.[9]
Clause 12 of the Schedule provides a non-exhaustive list of remedies that a court may grant in addition to, or instead of, damages, including an account of profits, an injunction, an apology order, a correction order, or a declaration that the defendant has seriously invaded the plaintiff’s privacy.
Limitation Period
Clause 14 of the Schedule provides that the plaintiff must commence their action before the earlier of the day that is one year after the day on which they became aware of the invasion of privacy and the day that is three years after the invasion of privacy occurred.
However, if the plaintiff was under 18 years of age when the invasion of privacy occurred, the plaintiff may commence their action before their 21st birthday.
Kurraba Group Pty Ltd & Anor v Williams [2025] NSWDC 396
Kurraba Group Pty Ltd & Anor v Williams [2025] NSWDC 396 is the first reported decision in which a court has considered an application for relief under clause 7 of Part 2 of Schedule 2 of the Privacy Act 1988 (Cth). The decision, handed down by Gibson DCJ in the District Court of New South Wales on 7 October 2025, granted urgent interlocutory injunctive relief to the plaintiffs pending final hearing.
Background
The first plaintiff, Kurraba Group Pty Ltd (Kurraba), had lodged a development application with the City of Sydney to establish a life science hub at 100 Botany Road, Alexandria, a project worth approximately $220 million. The second plaintiff, Mr Nicholas Smith, was Kurraba’s chief executive officer and the sole director and shareholder of the entity that owned the development site.
The defendant, Mr Michael Williams, was the sole director and secretary of Glexia Pty Ltd, a company that had taken a six‑month lease over premises adjacent to the proposed development site shortly after Kurraba publicly announced its plans. After purporting to engage with the plaintiffs as a concerned neighbour, the defendant met with Mr Smith on 11 November 2024 and demanded $50,000 in exchange for withdrawing his objections to the development. He boasted of having extracted similar payments from John Holland, Australia Post and Google.
When the demand was refused, the defendant launched a sustained campaign against the plaintiffs and the development. He lodged 64 pages of submissions opposing the development, posted a one‑star Google review of Kurraba, made allegations at a public meeting of the Central Sydney Planning Committee, and established a website titled “Kurraba Group Exposed” on which he published a series of allegations of the gravest kind against both plaintiffs, including the misuse of private wedding photographs of Mr Smith and his wife.
The plaintiffs commenced proceedings on 2 October 2025 seeking damages and other relief (including permanent injunctive relief) for defamation, the new statutory tort of serious invasion of privacy (in the case of Mr Smith) and the tort of intimidation. They also applied, on an urgent ex parte basis, for interlocutory injunctions to bring the campaign to an end pending final hearing.
Application of the new statutory tort
Her Honour expressly recognised that this was the first occasion on which an application for relief had been brought under the recently enacted provisions in clause 7 of Part 2 of Schedule 2 of the Privacy Act 1988 (Cth), observing that the legislation “was intended to provide a flexible framework to address current and emerging privacy complaints and to provide individuals with the ability to protect themselves and seek compensation for a broader range of invasions of privacy than is the case under existing law”.
On the merits, her Honour found there was a serious question to be tried in respect of the privacy claim. The affidavit evidence comprehensively established the misuse of private wedding photographs that were never intended to be made public. Drawing on the English decision in Douglas v Hello! Ltd [2005] EWHC 786, her Honour observed that wedding functions of that kind were intended to be “as private as was possible”, and noted that this was particularly so where the second plaintiff and his wife were not public figures and had no intention of publishing the photographs. The defendant had compounded the invasion by misusing the photographs to portray what they depicted as indicating moral delinquency and drunkenness rather than the sanctity of marriage.
The balance of convenience clearly favoured the plaintiffs. Her Honour found that the defendant’s conduct was “not that of journalistic-style investigation, but of extortion” and that there was no evidence of any other legitimate reason for it.
Outcome
Her Honour granted the suite of interlocutory orders sought, including injunctions restraining the defendant, until the final determination of the proceedings, from publishing any document referring to or identifying Mr Smith, Kurraba or the Botany Road development; requiring the defendant to take all steps within two days to remove from the internet and any social media platform any website, article, advertisement or document referring to the plaintiffs or the development; restraining the defendant from repeating or continuing to publish such material; and restraining the defendant from inciting or encouraging any other person to engage in the restrained conduct. Suppression orders were also made under section 8(1)(a) and (e) of the Court Suppression and Non‑publication Orders Act 2010 (NSW) in respect of certain confidential material, and orders for substituted electronic service were made given the defendant’s history of avoiding contact.
Key takeaways
Kurraba is an important first marker of how Australian courts are likely to apply the new statutory tort.
Several practical points emerge:
(a) Interlocutory relief is available. The decision confirms that the courts may grant urgent interlocutory injunctions under subclauses 9(1) and 12(2)(b) of the Schedule, and will do so where the conduct complained of is properly characterised as extortionate rather than journalistic.
(b) State courts have jurisdiction. Notwithstanding that the tort is created by Commonwealth legislation, State courts (including the District Court of New South Wales) are invested with federal jurisdiction to grant interlocutory relief under clause 23 of Part 2 of Schedule 2, read with the Judiciary Act 1903 (Cth). The scope of any power to grant final injunctive relief at District Court level remains to be determined.
(c) UK authorities will inform the analysis. As anticipated by the Explanatory Memorandum, the court drew on UK jurisprudence (in particular Douglas v Hello! Ltd) when assessing the plaintiff’s reasonable expectation of privacy in respect of private photographs.
(d) Misuse of private images is a paradigm case. The decision confirms that the misuse of private photographs taken in circumstances where the subject had a reasonable expectation of privacy – such as a private wedding, is the kind of conduct that the new tort is well suited to address, particularly where the images are repurposed in a misleading or denigratory way.
(e) The tort sits alongside other causes of action. The plaintiffs successfully combined the new privacy tort with claims in defamation and intimidation. Practitioners should consider the new tort as part of a wider toolkit when advising clients confronted with online campaigns of this kind.
Concluding note
Kurraba provides the first judicial guidance on the new statutory tort, but many questions remain to be worked out. Until a more developed body of Australian case law emerges, the application of the tort will continue to be shaped by:
(a) government materials issued prior to its enactment, including the Australian Law Reform Commission’s Serious Invasions of Privacy in the Digital Era (2014) report and the Explanatory Memorandum to the Privacy and Other Legislation Amendment Bill 2024 (Cth); and
(b) relevant case law from other jurisdictions, particularly the United Kingdom.
This information is provided as general guidance only. It is not comprehensive and does not constitute legal advice. It reflects the law as at the date of publication. You should obtain legal advice tailored to your specific circumstances before taking any action.
[1] Privacy Act 1988, schedule 2 clause 2.
[2] The Explanatory Memorandum to the Privacy and Other Legislation Amendment Bill 2024 (Cth) at 360.
[3] Ibid, at 385.
[4] Ibid, at 391.
[5] Ibid, at 402.
[6] Ibid, at 404.
[7] Ibid, at 408.
[8] Ibid, at 445.
[9] Defamation Act 2005 (Qld), s 35(3).