Privacy Law
The Tort of Serious Invasion of Privacy
Before we go into the main part of the Privacy Act which facilitates the operation of the APP’s, we need to discuss an important amendment to the Act which, disturbingly, has potential to outlaw any surveillance activity that goes to unnecessary extremes. In 2022, Schedule 2 was enacted to give rise to the tort of serious invasion of privacy. This is an action that plaintiffs must take directly at court, rather than going through the OAIC, and which when successful will result in a standard civil court remedy such as an order for damages, rather than the remedies offered by the OAIC.
The operational provision is section 7 of Schedule 2. It is provided that it is a civil wrong if the following five conditions are fulfilled:
-
Invading a person’s privacy by “intruding upon the plaintiff’s seclusion” AND/OR misusing information that relates to the plaintiff;
-
The plaintiff was reasonable in expecting privacy under the circumstances;
-
The invasion of privacy was intentional or reckless;
-
The invasion of privacy was serious;
-
The public interest in the plaintiff’s privacy outweighed any countervailing public interest.
The misuse of information is irrelevant to any kind of investigative or law enforcement activity, and so need not be addressed in this publication. It does need to be asked, though, what the meaning of and intrusion upon seclusion is. This is explained in the definitions in section 6, where it is said,
intruding upon the seclusion of an individual includes, but is not limited to, the following:
(a) physically intruding into the person’s private space;
(b) watching, listening to or recording the person’s private activities or private affairs.
Seclusion then is a private situation and the invasion of it is different to hacking or to coaxing private information out of another party or paying for it through a data broker.
As a point of legal analysis – purely of academic interest – the act of intrusion upon seclusion, taken alone, includes all surveillance activities, with or without trespass being part of it. Furthermore, permissions granted under state and territory surveillance devices legislation and under the Telecommunications (Interception and Access) Act are also caught as intrusions.
The good news is that the other conditions listed in section 7 need to be fulfilled all together for a surveillance operation to be a tortious wrong. It is good to note, then, that no surveillance operation is in breach of the law if it is conducted in a proportional and reasonable manner. No investigator or firm would undertake these sorts of actions as they are likely to be illegal under existing laws of trespass such as burglary, and to involve great client expense to execute. The following paragraphs explain further.
Firstly, the activities being watched or conversations being recorded must be taking place where the subject has a reasonable expectation of privacy – such as in their own home, a hotel room, or in a private office at work. Sub-section (5) lists a number of factors to consider as to the reasonableness of the expectation of privacy. These are not all obvious and should be considered with care. The location and the need for special surveillance technology is the most pertinent of these. The sensitivity of the information is also a point to consider.
Secondly, the invasion of privacy must be done on purpose, which eliminates actions for accidentally happening upon the private activity as one may do with a radio scanner or while walking by an open window.
Thirdly, the invasion of seclusion must be serious. Sub-section (6) provides a further condition, overlapping the above consideration of the sensitivity of information. This can be judged on whether the invasion of privacy was likely to cause offence, distress, or to harm the dignity of an ordinary person in the plaintiff’s position, or the defendant knew or ought to have known this. Other factors may be brought to bear.
Fourthly, whether the public interest in the plaintiff’s privacy outweighs the countervailing public interest. This is probably not referring to the public’s interest in the personal peace of mind of the individual plaintiff, but rather whether the factors or type of subject matter in play are the sort of thing that needs to be made known. For example, does the information identify the plaintiff as a fraud or confidence trickster? Does the information provide the police with a basis on which to investigate a crime further? Does the information help establish or defend a civil lawsuit of merit? Or for that matter, identifying a persona of interest threatening a client or their property, or ensuring that the insurance industry is able to continue offering products of value at affordable prices by catching fraudulent claimants?
The only court case found at the time of writing that addresses the tort of serious invasion of privacy is Kurraba Group v Williams. In this case the defendant had misused private information including wedding photographs belonging to the managing director of the plaintiff company and publicised them online in an attempt at extorting a change of legal position with respect to a property development. There is no question as to surveillance activities, but only as to misuse of information. While this law was used successfully, it is only an interlocutory hearing heard ex-parte under urgency. Hence it is not highly authoritative.
Defences
Section 8 of Schedule 2 lists various defences that a defendant may use. Of interest to us is sub-paragraph (b), that the invasion of privacy was consented to implicitly. It may be argued that by making some sort of claim at court or for an insurance payout, the subject implicitly consented to An investigation knowing that the party claimed against has a right to know positively whether they really are liable.
Another defence is the right to protect oneself or one’s property as put in sub-paragraph (d):
(i) incidental to the exercise of a lawful right of defence of persons or property; and
(ii) proportionate, necessary and reasonable.
Kurraba Group Pty Ltd & Anor v Williams [2025] NSWDC 396.