The statutory privacy tort (Privacy Act Schedule 2): what security and incident teams need to know

What it is. The Privacy and Other Legislation Amendment Act 2024 inserted Schedule 2, 'Statutory Tort for Serious Invasions of Privacy', into the Privacy Act 1988. The Federal Register of Legislation records that Schedule 2 of the amending Act commenced on 10 June 2025. Unlike the Australian Privacy Principles, which the OAIC enforces against APP entities, the tort gives an individual a cause of action they can take to court themselves. It binds the Crown, and the Schedule says it is to be read separately from the rest of the Act, so its terms are defined within the Schedule and not by the APPs.

The five elements (clause 7)

The plaintiff must show all five. (a) The defendant invaded their privacy by intruding upon their seclusion, misusing information that relates to them, or both. (b) A person in the plaintiff's position would have had a reasonable expectation of privacy in all the circumstances. (c) The invasion was intentional or reckless. (d) The invasion was serious. (e) The public interest in the plaintiff's privacy outweighed any countervailing public interest. The invasion is actionable without proof of damage, and where information was misused it does not matter whether the information was true.

The definitions are wide. 'Intruding upon seclusion' includes physically intruding into someone's private space and watching, listening to or recording their private activities or affairs. 'Misusing information' includes collecting, using or disclosing information about the person. 'Reckless' takes its meaning from the Criminal Code.

Why security teams should care

Element (c) does the sorting: the invasion must be intentional or reckless, and carelessness is not on that list. Whether a particular control failure was reckless is a question for a court. The clearer fit is deliberate conduct, and three patterns come up often in security work. Insiders browse or take customer, patient or colleague records with no business reason. Cameras, microphones, screen recording or tracking are pointed at people's private activities. Personal information is published or passed on to embarrass or harm someone. Your access logging and monitoring are what show whether this happened, who did it and when.

Clause 7(5) lists factors the court may weigh on reasonable expectation. These include the means used, 'including the use of any device or technology', the purpose, and for information the nature of the data (intimate or family, health or medical, financial), how it was held and whether it was already public. Clause 7(6) on seriousness looks at the likely offence, distress or harm to dignity to a person of ordinary sensibilities, whether the defendant knew or ought to have known that, and malice if the invasion was intentional. Clause 7(3) lists countervailing public interests the court may balance, including public health and safety, national security, and the prevention and detection of crime and fraud.

Defences and exemptions that touch security work

Clause 8 defences: the invasion was required or authorised by an Australian law or a court or tribunal order; the plaintiff, or someone with lawful authority for them, consented expressly or impliedly; the defendant reasonably believed it was necessary to prevent or lessen a serious threat to someone's life, health or safety; or it was incidental to a lawful right of defence of persons or property and was proportionate, necessary and reasonable. Some defamation defences carry over where the invasion was a publication.

Part 3 exemptions. The Schedule does not apply to invasions by intelligence agencies or law enforcement bodies and their staff in their roles. It also does not apply to the extent the invasion involves disclosing information to, or information disclosed by, a law enforcement body or an intelligence agency. The Schedule's list of intelligence agencies includes the Australian Signals Directorate, and its list of law enforcement bodies includes the AFP and state and territory police. Journalists and those assisting them are exempt for journalistic material, as are agencies and their staff acting in good faith in their functions or powers, and people under 18. Under clause 8A a court may decide whether an exemption applies at any stage, and must generally decide before trial if a party asks before the trial starts.

Time limits, remedies and the damages cap

Clause 14: proceedings must start before the earlier of one year after the plaintiff became aware of the invasion and three years after it occurred. A plaintiff who was under 18 at the time has until their 21st birthday. A court can extend the time if starting on time was not reasonable, but never beyond six years after the invasion. Clause 19 treats a later publication of substantially the same information by the same publisher or an associate, in a manner not materially different, as occurring on the day of the first publication.

Clause 11: no aggravated damages; damages for emotional distress are available; exemplary or punitive damages only in exceptional circumstances. Non-economic loss plus exemplary or punitive damages together cannot exceed the greater of $478,550 and the defamation cap for non-economic loss. In setting damages the court may look at whether the defendant apologised, published a correction, or behaved unreasonably after the invasion, including during the proceedings. Under clause 12 the court can also order an account of profits, an injunction, an apology, a correction, destruction or delivery up of material obtained or misused, or a declaration of serious invasion. Clause 13 says an apology is not an admission of fault or liability. That matters when you draft notification and customer messages. Under clause 22 the Information Commissioner may intervene or act as amicus curiae with the court's leave.

Practitioner checklist

1. Make record-access logging on customer, patient and HR systems detailed enough to show who viewed what and when, and keep it long enough to cover the three-year outer limit and any extension a court allows. 2. Treat unexplained internal browsing of records as a privacy incident, not just a policy breach, and escalate it through the incident process. 3. Review cameras, call recording, screen and endpoint monitoring, and location tracking against the 'private activities' wording. Document the purpose, the notice given and the legal authority or consent you rely on. 4. When you share incident data with police or ASD, record what was disclosed, to which body and why, because the Part 3 exemptions turn on those disclosures. 5. Give legal and communications teams the clause 11 and 13 points: an apology does not admit liability but can reduce damages, and unreasonable conduct after the event can increase them. 6. Keep this alongside, not instead of, your APP 11 security, notifiable data breach and OAIC obligations, because the tort adds to them and does not replace them.

Desk note: this page summarises Schedule 2 as compiled on the Federal Register of Legislation (compilation of 4 June 2026, fetched 25 October 2026). It is not legal advice. The Act is the authority.