The statutory tort for serious invasions of privacy formed a pillar of the government's first tranche of substantial reforms to the Privacy Act 1988 (Cth) passed in November last year, which we discussed in our previous article.

The new tort, now sitting as Schedule 2 to the Privacy Act, will create a cause of action for individuals who consider that another person has invaded their privacy by intruding upon their seclusion or misusing information relating to them.

Elements

The statutory tort requires a plaintiff to prove the following elements:

1. there has been an invasion of privacy by either intrusion upon the plaintiff’s seclusion (for example, physical intrusion into their private space or recording their private activities) or the misuse of information that relates to the plaintiff;
2. the plaintiff has a reasonable expectation of privacy in all of the circumstances;
3. the invasion of privacy was intentional or reckless (rather than just negligent);
4. the invasion of privacy was serious; and
5. the public interest in the plaintiff’s privacy outweighs any countervailing public interest (such as freedom of expression, the proper administration of government, or freedom of the media).

It is not necessary for a plaintiff to prove that they have suffered damage.

Importantly, only individuals can sue for serious invasions of privacy; corporations cannot. The pool of possible defendants is large, as an individual can sue any individual or organisation (including government) under this cause of action – that is, even though the new tort sits under the Privacy Act, the defendant does not need to be an 'APP entity'.

Indeed, the new tort is expressly separated from the broader regulatory regime in the Privacy Act, with courts directed to disregard the meaning of expressions used elsewhere in the Privacy Act when interpreting the tort provisions. Accordingly, the courts will be left to develop the boundaries of the new tort independently of the Privacy Act’s regulatory regime.

Remedies

Courts may order any remedy they think most appropriate in the circumstances. Schedule 2 lists several remedies that a court may order, including injunctions, declarations, and damages. Courts will also have powers to require a defendant to apologise to the plaintiff, to correct misinformation, and to require the defendant to destroy or deliver up copies of material (such as documents, pictures or recordings).
Damages for non-economic loss (plus any exemplary and punitive damages a court decides to award in exceptional circumstances) are capped at $478,550 (or the maximum amount available in defamation law). As with defamation claims, however, a plaintiff will also be entitled to economic loss above the cap, if there is proof of actual financial loss.

Exemptions

There are a number of notable exemptions to the new cause of action. In a significant win for press freedom, journalists and those who publish or distribute journalistic material are exempt from being sued under the new tort, as are employers of journalists and persons assisting journalists in certain circumstances.

Broad exemptions also apply for law enforcement bodies, intelligence agencies, persons under the age of 18, and State and Territory authorities to the extent that the invasion of privacy occurs in the good faith performance or purported performance of a function, or exercise or purported exercise of a power, of the agency or authority.

Where a defendant applies for a determination that an exemption is applicable, the court will generally be expected to make that determination prior to trial (unless special circumstances apply). This is a significant benefit for defendants with an applicable exemption, because unlike the defences (discussed below), it will provide an opportunity to have a claim dismissed without consideration of the plaintiff's claim and evidence at a full trial.

Defences

Several defences are available to defendants, including that the defendant’s conduct was required or authorised by law; the defendant reasonably believed the invasion of privacy was necessary to prevent or lessen a serious threat to the life, health or safety of a person; or the plaintiff consented to the invasion of privacy.

There are also defences familiar in defamation law, such as absolute privilege, publication of public documents, and fair reporting of public proceedings.

What to expect moving forward

Predicting how courts will interpret the elements of this new cause of action is challenging, given that several of those elements turn on fact-sensitive and inherently imprecise concepts – including a reasonable expectation of privacy, the seriousness of the invasion, and considerations of the public interest.
Schedule 2 provides non-exhaustive lists of matters that courts may consider in assessing these broad elements. However, significant uncertainty remains as to how courts will ultimately define the tort’s precise scope.

Guidance from overseas

Australian courts are therefore likely to draw on jurisprudence from other common law jurisdictions where privacy torts have been established – in some cases for decades.

Primarily, this will include New Zealand, Canada, the UK, and the US. Case law from New Zealand will likely be particularly relevant, as the framework of Australia's new statutory tort closely aligns with the New Zealand torts of intrusion upon seclusion and wrongful publication of private facts, which have developed as common law causes of action.

As an example of the relevance of overseas case law, the privacy torts in New Zealand and the UK both require a plaintiff to prove a reasonable expectation of privacy in all the circumstances. Decisions from those jurisdictions will therefore inform the reasoning of Australian courts when considering that element of the tort.

Several UK cases have considered how to balance public interest factors as part of the tort of misuse of private information – one of the two pathways available for establishing the new Australian tort.

Similarly, privacy torts in Canada, the US, and New Zealand all require a finding that a reasonable person would have found the relevant invasion of privacy 'highly offensive'. Although Australia requires the invasion to be 'serious' (rather than 'highly offensive'), these thresholds appear conceptually similar, with both aiming to limit the tort to significant breaches and to avoid frivolous or insignificant claims.

However, in a notable departure from New Zealand's cause of action, Australia's new cause of action is actionable for both intentional as well as reckless invasions of privacy, whereas New Zealand's torts require intentional conduct.

This expansion of the fault element may broaden the scope of Australia's tort, and should be a particular focus point for entities handling personal information. The new tort will hold entities accountable if they disregard obvious privacy risks, even if no breach was ever intended.

In the coming year, we expect to see a number of cases seeking to test the boundaries of this new cause of action. These cases will give a more definite shape to the tort, and will provide entities with more certainty around its scope. However, while the scope of this tort is uncertain, entities that collect, manage, and otherwise deal with personal data should take appropriate mitigation measures sooner rather than later, to avoid costly lessons learnt through the litigation process.

Please get in touch if you would like to discuss the implications of this tort of privacy.