Background: A Longstanding Gap
For most of Australian legal history, there was no freestanding right to sue for invasion of privacy. Claims had to be framed under breach of confidence, trespass, defamation, or nuisance — each with significant limitations. A person whose true but private information was publicly disclosed, for example, had no defamation claim at all, because truth is a complete defence to defamation.
That changed in two stages. First, in Waller v Barrett [2024] VCC 962, the Victorian County Court recognised a common law tort of invasion of privacy for the first time in a binding Australian judgment. Then, on 10 June 2025, the statutory tort for serious invasions of privacy commenced under Schedule 2 of the Privacy Act 1988 (Cth), introduced by the Privacy and Other Legislation Amendment Act 2024.
The statutory tort represents the most significant expansion of personal rights in this area since the enactment of the uniform defamation legislation in 2005. For defamation practitioners and their clients, it opens new strategic possibilities — and creates new complexities.
The Five Elements of the Statutory Tort
Under clause 7 of Schedule 2, a plaintiff has a cause of action if all five elements are established:
- Invasion of privacy: The defendant invaded the plaintiff's privacy by intruding upon the plaintiff's seclusion (physically or through surveillance) or misusing information that relates to the plaintiff.
- Reasonable expectation of privacy: A person in the plaintiff's position would have had a reasonable expectation of privacy in all the circumstances — considering factors such as the nature and sensitivity of the information, whether the plaintiff invited publicity, and the means used to invade privacy.
- Intentional or reckless conduct: The invasion must have been intentional or reckless. Negligent invasions of privacy are not actionable under the statute.
- Seriousness: The invasion must be serious, having regard to factors including the degree of distress or harm to dignity likely to be caused and whether the defendant was motivated by malice.
- Public interest balancing: The public interest in protecting the plaintiff's privacy must outweigh any countervailing public interest, including interests in freedom of expression, media freedom, and public health and safety.
Critically, the tort is actionable per se: the plaintiff does not need to prove financial loss. Non-economic damages (including for emotional distress) are capped at the greater of approximately $478,550 or the maximum non-economic loss available in a defamation claim. There is no cap on economic loss.
The First Decision: Kurraba Group v Williams
The first published application of the statutory tort came in Kurraba Group Pty Ltd & Anor v Williams [2025] NSWDC 396, decided in the District Court of New South Wales. The facts were closely intertwined with a defamation claim.
Facts
Nicholas Smith, CEO of property developer Kurraba Group, was targeted by Michael Williams, a tenant at a development site. After Smith refused Williams's demand for $50,000 to withdraw planning objections, Williams launched an online campaign against Smith. He created a website making accusations "of the gravest kind" against both Smith and Kurraba Group, and published private wedding photographs of Smith that had been shared only among invited guests and were never intended for public dissemination.
Williams published the photographs in a context designed to portray the events depicted as indicating "moral delinquency and drunkenness as opposed to the sanctity of marriage".
The Proceedings
Smith and Kurraba Group commenced proceedings alleging three causes of action: defamation, intimidation, and the statutory tort for serious invasion of privacy. They sought urgent interlocutory injunctive relief on an ex parte basis.
Decision
Gibson DCJ granted the application. On the privacy tort, her Honour held:
- There was a serious question to be tried regarding the misuse of Smith's private wedding photographs;
- The conduct was intentional or reckless — the photographs were published deliberately in a context designed to cause harm;
- Smith had a reasonable expectation of privacy in the photographs, which had been shared only among wedding guests;
- The public interest in Smith's privacy significantly outweighed any countervailing interest Williams might assert;
- Williams's conduct was "not that of journalistic-style investigation, but of extortion".
The Court granted unusually broad orders, including restraining Williams from publishing any content referring to Smith, compelling the removal of all existing online material within 48 hours, and prohibiting Williams from encouraging others to engage in similar conduct.
Why This Matters for Defamation Practitioners
The interplay between the privacy tort and defamation creates both opportunities and complexities for practitioners. The key distinctions are significant:
Truth Is Not a Defence to Privacy
This is the single most important distinction. In defamation, truth (justification) is a complete defence: if the defamatory imputation is substantially true, the claim fails. The privacy tort operates on a fundamentally different premise. The information misused can be entirely accurate — and often will be — because it is the disclosure of private information, not its falsity, that constitutes the wrong.
This means that a person whose true but private information has been publicly disclosed now has a cause of action that did not previously exist in Australian law. For clients who have been publicly exposed but cannot meet the defamation threshold (because the published material is true), the privacy tort may provide a viable alternative.
No Concerns Notice Requirement
Under the uniform defamation legislation, a plaintiff must serve a concerns notice and allow the publisher a reasonable opportunity to respond before commencing proceedings. The privacy tort has no equivalent procedural prerequisite. A plaintiff may proceed directly to court — and, as Kurraba Group v Williams demonstrates, may obtain urgent injunctive relief on an ex parte basis without prior notice to the defendant.
No Serious Harm Threshold (As Understood in Defamation)
Defamation claims require the plaintiff to establish that the publication has caused or is likely to cause serious harm to reputation. The privacy tort has its own "seriousness" threshold, but it addresses harm to dignity and personal autonomy rather than harm to reputation. A disclosure that causes profound personal distress but does not lower the plaintiff's standing in the community may satisfy the privacy tort threshold but fail the defamation serious harm test.
Injunctive Relief Is More Readily Available
Australian courts have traditionally been reluctant to grant pre-trial injunctions in defamation cases, applying the rule in Bonnard v Perryman [1891] 2 Ch 269 that an injunction should not be granted before trial where the defendant asserts a defence of truth. The privacy tort has no equivalent constraint. Clause 9 of Schedule 2 expressly empowers courts to grant injunctions at any time during proceedings to restrain a defendant from invading the plaintiff's privacy. Kurraba Group v Williams demonstrates the Court's willingness to exercise this power robustly.
Concurrent Claims Are Permissible
The same set of facts can give rise to both a defamation claim and a privacy tort claim. In Kurraba Group v Williams, the plaintiff pleaded all three causes of action (defamation, intimidation, and invasion of privacy) arising from the same course of conduct. This is particularly useful where a defendant's campaign involves both false accusations (actionable in defamation) and the misuse of private information (actionable under the privacy tort).
Limitations and Exemptions
The privacy tort is not without constraints. Several features limit its application:
- Journalism exemption: The statute provides a broad exemption for journalists engaged in news reporting, current affairs, documentary production, and related commentary. Media organisations are largely shielded from the statutory tort. However, the common law tort recognised in Waller v Barrett carries no such exemption — which is why the parallel development of the common law privacy cause of action remains significant.
- Short limitation period: Proceedings must be commenced within one year of the plaintiff becoming aware of the invasion, or three years after the invasion occurred — whichever is earlier. This is shorter than the already tight one-year defamation limitation period, and there is no express power to extend it (unlike the defamation legislation, which permits extension up to three years).
- Fault requirement: The invasion must be intentional or reckless. Careless or negligent disclosures of private information are not actionable. This is a higher fault threshold than some other jurisdictions.
- Public interest balancing: The fifth element requires the court to weigh competing public interests, including freedom of expression. This provides an inherent safeguard against claims that would unduly restrict legitimate speech or reporting.
- Defamation defences cross-apply: If the invasion of privacy was constituted by publishing information (as defined in defamation law), and a defamation defence such as absolute privilege or fair report of proceedings would apply, that defence also operates as a defence to the privacy tort. This prevents the tort from being used to circumvent well-established defamation defences.
Practical Implications
For individuals and businesses facing reputational harm, the privacy tort introduces new strategic options:
- Where the published material is true: The privacy tort provides a cause of action that defamation cannot. If private medical records, financial information, personal photographs, or intimate details have been publicly disclosed, the privacy tort may be the primary or sole remedy.
- Where urgent injunctive relief is needed: The privacy tort is better suited to obtaining pre-trial injunctions than defamation, because the Bonnard v Perryman constraint does not apply and Schedule 2 expressly provides for injunctive relief.
- Where the target is not a media organisation: The journalism exemption limits the tort's application against professional media, but it applies fully to individuals, businesses, competitors, disgruntled former employees, and others engaged in online campaigns.
- Where concurrent claims strengthen the case: Pleading defamation and privacy together allows the plaintiff to address both false accusations and the misuse of private material in a single proceeding, with the privacy claim surviving even if a truth defence defeats the defamation claim.
How Matrix Legal Can Help
The intersection of defamation and privacy law is becoming increasingly important as Australia's privacy jurisprudence develops. The strategic decision of whether to plead defamation alone, privacy alone, or both in combination can materially affect the remedies available, the speed at which injunctive relief can be obtained, and the overall prospects of success.
Mark Stanarevic and the Matrix Legal team advise on all aspects of defamation and reputation claims, including the assessment of privacy tort claims alongside defamation proceedings. If you are dealing with the public disclosure of private information, an online campaign involving both false accusations and private material, or any situation where your reputation and privacy are under attack, request a free assessment or call 1800 950 627.
This article is general information and not legal advice. Defamation risk turns on the precise words used, the publication context, the audience, and available evidence.