The Statutory Tort of Serious Invasion of Privacy: Engineering to Reduce Exposure

Australia has quietly done something most of the privacy debate missed: it has given individuals the right to sue you directly for a serious invasion of their privacy, with no need to prove they lost anything. That moves privacy out of the regulator’s inbox and into a courtroom, and it changes what your engineering choices are worth as evidence.

Since 10 June 2025, the Privacy Act 1988 (Cth) carries a new statutory tort for serious invasions of privacy, inserted by the Privacy and Other Legislation Amendment Act 2024 as a new schedule to the Act. For years, an aggrieved individual in Australia had no clean cause of action for privacy as such; they complained to the regulator, or reached for defamation, breach of confidence or trespass. That gap is now closed. The mechanism most people are still underestimating is who gets to enforce it, and how little they have to show.

What actually changed

The legal shape is worth stating precisely, because the engineering consequences follow from it. The tort covers two kinds of conduct: intrusion upon seclusion — watching, listening to or physically intruding on someone’s private space — and misuse of information relating to the person. To succeed, an individual has to show a reasonable expectation of privacy in the circumstances, that the invasion was serious, and that it was intentional or reckless. Negligence is not enough. A court then weighs the public interest in privacy against any countervailing public interest, such as freedom of expression or public safety.

Two features change the risk calculus for a technology function. First, the plaintiff does not have to prove damage; the tort is actionable in itself, and damages for non-economic loss are capped at the same figure as defamation — an amount indexed annually, currently in the order of A$480,000 — with economic loss recoverable on top. Second, only individuals can bring the claim, and they bring it themselves. This is not a regulator deciding whether your remediation was adequate. It is a person, a lawyer and a filing.

There are exemptions — for journalism, for law enforcement and intelligence agencies acting in good faith, and for certain state and territory bodies — and limitation periods that run from awareness of the invasion. None of that helps an ordinary firm holding customer or employee data. If you are a regulated business processing personal information at scale in or into Australia, you are squarely inside the frame. This sits alongside the broader reform programme the same Act set in train, which I have written about in the context of automated decision-making transparency.

Why this is an engineering problem, not a legal one

The instinct in most firms is to route this to the general counsel, update a policy, and move on. That misreads where the exposure actually lives. A serious invasion of privacy is not usually created by a policy. It is created by a system that collected more than it needed, retained it longer than it should have, let the wrong people see it, or watched someone in a way nobody sanctioned. Every one of those is an engineering decision, taken months or years earlier, that now sits in a data store waiting to be produced in discovery.

The reason this matters is that the tort turns your architecture into evidence. When a claim is filed, the question is not what your privacy statement said. It is what your systems did — who had access, what was logged, how long it was kept, whether the monitoring was necessary and proportionate. Weak data-handling that was previously an abstract compliance concern becomes a concrete exhibit. The controls that reduce your exposure are the same ones a competent security engineer would already recognise: least privilege, minimisation, retention discipline and governed monitoring. What has changed is that they now carry a price tag denominated in litigation.

Access control stops being hygiene

The misuse limb rewards firms that can show personal information was seen only by people who needed it, and punishes firms that cannot. Broad standing access — the shared service account, the analyst with read rights to the whole customer table, the support tool that surfaces more than the ticket requires — is exactly the pattern that turns a single curious or malicious employee into a serious invasion the firm has to answer for. Reckless conduct is enough, and a court will read “we granted everyone access and hoped” as recklessness with little difficulty.

The practical work is unglamorous and familiar: enforce least privilege on the data stores that hold personal information, make access role-scoped and time-bound rather than standing, and produce an access log you could hand to a court that shows who read what and why. The point is not perfect security. It is being able to demonstrate that access was deliberately constrained, so that any misuse was a breach of your controls rather than an absence of them.

Minimisation is the cheapest defence you have

You cannot lose, misuse or be forced to disclose data you never held. Every field you collect “in case it is useful”, every log that quietly retains full payloads, every backup that outlives its purpose is a future exhibit with no offsetting value. Minimisation and retention are the controls with the best return here precisely because they shrink the surface a claimant can point at. A firm that collected narrowly and deleted on schedule has less to defend, full stop.

This is engineering work with a clear specification: map where personal information enters and rests, cut collection to what the process genuinely needs, and make deletion automatic and evidenced rather than a manual promise. Designing systems so that data access is scoped and expiry is built in from the start — the same access-by-design discipline that connected-product regulation demands — is the pattern that pays off here too.

Monitoring: govern it or it becomes the exhibit

The intrusion limb is the one most firms have not priced in. Employee monitoring, session recording, device tracking, location capture, call recording — all of it is now potential intrusion upon seclusion if it is disproportionate or ungoverned, and the employment relationship does not automatically make it reasonable. A monitoring capability that was switched on by a vendor default, or expanded without a decision anyone can point to, is the archetype of the reckless intrusion this tort was built for.

The defensible position is a documented one: every form of monitoring tied to a stated purpose, scoped to what that purpose needs, with a decision on the record about why it is proportionate and who approved it. If you cannot say why a given surveillance capability exists and who signed it off, you are not in a position to argue it was reasonable — and reasonableness is the whole contest.

What “reasonable” will be measured against

The tort is young and untested, so the temptation is to wait and see how courts read “serious” and “reasonable expectation”. That is the wrong posture for the technology function, because the systems that will be judged are being built and populated now. Whatever standard emerges, it will be applied to the access logs, retention settings and monitoring configurations you already have in production on the day a claim lands. The engineering choices that reduce exposure are the ones you make before anyone has a reason to look. Once they are looking, the architecture has already given its evidence.