Filmed or Leaked? How to Sue Under Australia's Privacy Tort

Written by Yazdhan Sameer, Senior Solicitor

8 September 2026 · 12 min read

For a long time, Australia had an awkward gap in its privacy law. If someone shared your intimate photos, published your medical history, secretly filmed you, or leaked your personal data, you often had no direct way to sue for the harm. Victims were forced to shoehorn their complaint into older, ill-fitting causes of action such as breach of confidence, defamation and trespass, none of which were built for the problem.

That changed on 10 June 2025, when a statutory tort for serious invasions of privacy came into force under Schedule 2 of the Privacy Act 1988(Cth) (introduced by the Privacy and Other Legislation Amendment Act 2024 (Cth)).

Individuals can now sue directly for a serious invasion of privacy and recover damages for emotional distress and loss of dignity, even where they have suffered no financial loss at all. It is one of the most significant expansions of privacy rights in Australia in decades, and it carries consequences for individuals, businesses, and anyone who collects or handles personal information.

What is the new privacy tort?

The new cause of action lets a person bring a claim when their privacy has been seriously invaded in one of two ways:

Intrusion upon seclusion, for example covertly recording a person (including with a hidden camera or drone).
Misuse of private information, for example, collecting, storing, using, or disclosing someone's private information without consent. Sharing intimate images or leaking sensitive data are classic examples.

The invasion can occur at the moment the information is gathered, not just when it is published. Taking the photograph, hacking the device, or accessing the file can itself constitute the invasion.

The five things a claimant must prove

To succeed, a person must satisfy five cumulative elements. All five must be present:

There must be an invasion of privacy. Either intrusion upon seclusion or misuse of private information.
There must be a reasonable expectation of privacy. Assessed objectively, taking into account the setting (a private home versus a public event), the nature of the information (health, financial, sexual), and how the person conducted themselves (did they invite publicity, or take steps to keep the matter private?).
The conduct must be intentional or reckless. Negligence is not enough. This is a fault-based tort. Recklessness means being aware of a substantial and unjustifiable risk, and taking it anyway.
The invasion of privacy must be serious. Trivial or accidental breaches will not clear the bar. Courts will weigh the sensitivity of the information, the scale of the disclosure, the impact on the person, and the defendant's motives.
Public interest will be considered. Even if the first four elements are met, the person's interest in privacy must outweigh any competing public interest, such as freedom of expression, freedom of the media, or the prevention of crime.

Two features that make this tort powerful

You do not need to prove financial loss
The tort is actionable without proof of damage. It exists to protect intangible interests such as dignity, autonomy, peace of mind. That is a major departure from personal injury law, where you generally need a recognised psychiatric illness to recover for mental harm. Here, ordinary emotional distress can be enough.
Truth is not a defence
Unlike defamation, the fact that the information is true does not save the defendant. Publishing someone's medical diagnosis or sexual orientation without consent may not be defamatory if it is true, but it can still be a serious invasion of privacy.

What can a court order?

The remedies are broad and flexible:

Damages (capped at around $478,550)
Exemplary damages for egregious conduct
Injunctions to stop publication or further sharing
Account of profits where someone has made money out of the invasion
Destruction or delivery-up of private material (for example, deletion of images)
Apology or correction orders
Declarations that a breach has occurred

How this could have changed some famous cases

The best way to understand the new tort is to examine cases that were decided before it existed where the law forced victims through legal gymnastics to get justice.

Ettingshausen v Australian Consolidated Press (1991) 23 NSWLR 443

In 1991, a magazine published a full-page nude photograph of rugby league star Andrew Ettingshausen, taken without his consent in a private dressing room. With no privacy tort available, he had to rely on breach of confidence (and, in related proceedings, defamation) and was awarded $100,000. Under the new tort, the path would be far simpler: a shower is about as clear a case of a reasonable expectation of privacy as you can find.

Giller v Procopets (2008) VSCA 236

After a relationship ended, a man showed intimate videos of his former partner to others. She won compensation for her distress but only by stretching breach of confidence to its limits, because there was no proper cause of action for what we would now call image-based abuse. Today, this would be a straightforward claim for misuse of private information, with remedies including takedown and deletion orders.

Doe v Australian Broadcasting Corporation (2007) VCC 281

A sexual assault survivor, whose identity was protected by a suppression order, was effectively identified in a broadcast through her age, suburb and other details. She recovered damages, but again had to rely on statutory breach and breach of confidence. The new tort would give a much clearer route to redress.

The bottom line is that people like these would no longer have to "borrow" a cause of action that was never designed for a privacy harm.

Smart glasses and wearable cameras

A wave of claims might come from smart glasses now sold at low prices. Kmart's $89 Anko "camera glasses" that is a budget alternative to the Meta Ray-Ban glasses and reportedly sold out across Australia within days. It appears that the built-in cameras are difficult for bystanders to detect or easy for users to conceal covert recording. Dubbed "pervert glasses" by some critics, they look like ordinary eyewear but record high-definition video at the tap of a frame.

The point most buyers will miss is that the recording itself can be the invasion of privacy. The new tort captures intrusion upon seclusion at the moment of capture. What this means is that you do not need to publish or share anything. Covertly filming someone in a change room, a private home, a medical setting, or any circumstance where they have a reasonable expectation of privacy could satisfy every element of the tort. Recording is an intrusion, intentional, and the concealed nature of the device goes directly to seriousness. If the footage is then shared (and arguably even possessed), the misuse of private information limb is engaged as well.

The technology may be new, but the legal analysis is not. Courts have long treated covert capture, i.e. the hidden camera or the concealed lens, as an aggravating feature of a privacy breach. Wearable cameras simply put that capability in everyone's pocket, or on everyone's face. An $89 impulse purchase could carry expensive consequences. Recording without consent may also carry criminal law consequences which are not considered in this article.

The commercial applicability of this tort concerns data breaches, cyberattacks and your business

This is where the new tort matters most for businesses, and it is the part that has flown under the radar.

We hear about major cyberattacks on a large Australian companies regularly. Optus. Qantas. AustralianSuper. Even law firms are not immune. When these attacks lead to customers' personal information being exposed, there is an argument to be made that the disclosure was reckless. An example is where cybersecurity was inadequate, or where a staff member clicked a phishing link despite widespread awareness of the risk.

Since the new tort covers collecting and storing data (not just disclosing it), a company that holds personal information could find itself exposed.

The same logic applies to facial recognition and biometric surveillance. Regulators have already found that businesses collected customers' facial images ("faceprints") without proper, informed consent. Conduct of that kind could now support privacy claims for emotional harm, alongside orders to delete the data.

If your business collects, stores or handles personal or sensitive information customer records, employee data, health or financial details the new tort should be on your risk radar. Practical steps matter: robust cybersecurity, clear and specific consents in your engagement and privacy documents, deleting data you no longer need, staff training, and a tested breach-response plan.

The journalist exemption

The legislation carves out a significant exemption for journalists and journalistic material. The collection, preparation and publication of material that has "the character of news, current affairs or a documentary," as well as related commentary and opinion2.

The exemption is deliberately generous. It can apply even where a journalist has breached their own professional standards. Since terms like "news" and "journalist" are not tightly defined, there is genuine uncertainty about how far it stretches, particularly in an era of tabloid websites, influencers, and online "publishers" of varying credibility. Whether salacious celebrity gossip truly has "the character of news" is exactly the kind of question the courts will have to work through in the coming years.

Defences and other exemptions

Even outside the media, several defences are available3, including where the invasion was:

required or authorised by law (for example, discovery, subpoenas, or a court order);
consented to (including implied consent), which I note is likely to generate its own grey areas;
reasonably believed necessary to prevent a serious threat to life, health or safety; or
incidental to a proportionate defence of a person or property.

Certain defamation defences (such as absolute privilege and fair reports of court proceedings) can also apply. Beyond journalists, the tort does not apply to enforcement bodies, intelligence agencies, or government agencies acting in good faith within their functions and people under 18 are exempt.

How long do you have to bring a claim?

Time limits are tight, and mirror defamation. Proceedings must be commenced4

One year from the day you become aware of the invasion; or
Three years from the date the invasion occurred

whichever comes first. If the person was under 18 when the invasion occurred, they generally have until their 21st birthday. Because these periods are short, acting quickly is essential. Waiting can extinguish an otherwise strong claim.

Frequently asked questions

Yes. Since 10 June 2025, individuals can bring a direct claim for a serious invasion of privacy, provided the five elements are met.
No. The tort is actionable without proof of damage. Emotional distress and loss of dignity can be enough.
Yes, the non-consensual sharing of intimate images is a central example of misuse of private information.
It depends on the circumstances. Recording someone where they have a reasonable expectation of privacy, even without sharing the footage, may now amount to a serious invasion of privacy.
Truth is not a defence. A true statement can still be a serious invasion of privacy.
Potentially. Where personal data is exposed, and the handling of it was reckless, the tort may apply, including through class actions. Sound data-governance and cybersecurity practices are the best protection.

Where to from here?

The new tort is both a legal milestone and a signal. Privacy is now a right worth enforcing, and breaches carry financial, reputational, and emotional consequences. As the courts begin to map its boundaries, both claimants and organisations will be navigating unfamiliar terrain.

If you believe your privacy has been seriously invaded or if you run a business that handles personal or sensitive information and want to understand your exposure, it is worth getting advice early, especially given the short limitation periods.

If you would like to discuss how the new privacy tort applies to your situation, please get in touch. This article is general information only and is not legal advice.

Filmed, leaked or exposed? Australia's new privacy tort finally gives you a way to sue