How Austaralia’s new privacy tort affects marketers, advertisers and photographers

How Austaralia’s new privacy tort affects marketers, advertisers and photographers

In today’s hyper-connected world, telling real stories is often the key to marketing magic. But where do you draw the line between a powerful narrative and a legal landmine? Australia’s new statutory tort of serious invasion of privacy — set to take effect in 2025 — adds a whole new layer to that question.

While data breaches and cookie policies have dominated headlines for years, this new law is different. It’s about people — their images, their stories, their quiet moments — and whether they’ve been used in ways that cross the line from creative to invasive.

What is the new privacy tort?

Under amendments to the Privacy Act 1988 (Cth), the tort allows people to sue for serious invasions of privacy. It’s not a broad “right to privacy” in every sense, but it is Australia’s most concrete move toward protecting individuals where the law has traditionally lagged. Until now, cases had to be framed under breach of confidence, trespass, defamation or nuisance. That’s changing.

Under Australia’s updated privacy laws, serious invasions now include intrusion into seclusion — such as filming or recording someone without consent in a private space — and misuse of private information, like leveraging sensitive stories or images in ways that cause distress. Critically, plaintiffs no longer need to prove financial loss: if a court deems the act intentional, reckless, serious, and against the public interest, that’s sufficient grounds for action (Privacy and Other Legislation Amendment Act 2024, Schedule 2).

Under Australia’s new statutory tort for serious invasions of privacy, misuse of private information applies even if the information is true — a critical departure from defamation law, which requires false statements. To read more about defamation law and its requirements go here: https://sharongivoni.com.au/services/defamation-law/

This principle, rooted in ALRC Report 123 (2014), focuses on protecting individuals’ control over their personal data, regardless of its accuracy.

Here’s what this means in practice:

Key Elements

1. Truth Is Not a Defence: Unlike defamation, privacy breaches can occur when factually accurate information is collected, used, or disclosed without consent. For example, sharing someone’s medical history, financial records, or intimate photos may constitute a breach if done without lawful authority.
2. Reasonable Expectation of Privacy: The law around privacy isn’t clear-cut, as it’s not fully in effect yet. It seems courts will look at whether someone in the plaintiff’s position could reasonably expect their privacy to be protected. They’ll likely consider things like how sensitive the information is—stuff like health, family, or money matters is usually seen as private. They’ll also think about how the information was collected, like whether it was hacked, spied on, or obtained through trickery. Another factor is the context—whether the information was kept private, like in personal messages, or shared publicly, such as on social media. If the information was already public, that might lower the expectation of privacy. Courts will weigh these factors to decide if someone’s privacy should be protected.

Implications for Businesses and Individuals

Consent and public interest have always been important considerations when it comes to protecting privacy.

For consent to be valid, it would need to be clear and specific.

Vague permissions, like agreeing to let your information be used “for marketing purposes,” may not be enough.

People need to know exactly how their data will be used and agree to each specific purpose.

On the other hand, even if someone’s privacy is breached, the person or organisation responsible might argue that it was in the public interest, such as exposing criminal activity.

However, using this defence for commercial gain may not always be accepted.

Another key point is that people don’t need to prove they’ve suffered financial loss to take legal action for a privacy breach.

If the invasion of privacy is serious and intentional, that alone could be enough to make a claim.

This approach puts a strong focus on giving individuals control over their personal information, especially in a time when digital tools make it easy for data to be misused.

For organisations, this means they need to take privacy seriously by improving how they get consent and regularly checking their data practices to ensure they’re doing the right thing.

Real-world scenarios

1. You’re producing a brand video telling real mental health recovery stories. Everyone signs a consent form. But what if someone didn’t fully understand their story would appear in national ads, on social media, and in print? Could they say their privacy was invaded? Would their consent hold up?
2. You shoot a street portrait for an ad campaign showing “authentic Aussies.” The image goes viral. But what if the subject didn’t know you were taking the photo — or didn’t agree to its use? Could you be liable?
3. You’re a filmmaker creating a fictionalised drama based on real people. One recognisable character claims it’s about them and that their private life is being broadcast. Is it art or an invasion of privacy?
4. A marketing team repurposes unused clips from a corporate video shoot in a completely different context two years later. The original speaker is shown joking about a personal issue that now feels deeply inappropriate. Is it a breach under the new law?
5. A short documentary on homelessness features close-up footage of an individual sleeping rough. Although no names are used, the person’s face is clearly visible. They later claim they were not aware they were being filmed and that it caused emotional harm. Could they sue for a serious invasion of privacy?

The answer to all these? We don’t know — yet. The law hasn’t taken effect, and no cases have tested its boundaries. But if you wait for the first test case to hit, it may be too late.

The Legal Landscape

Australia has long lacked a clear, enforceable express right to privacy.

The High Court’s decision in ABC v Lenah Game Meats left the door open for such a tort, but the courts never stepped through it.

The High Court case Australian Broadcasting Corporation v Lenah Game Meats Pty Ltd ([2001] HCA 63) involved footage of possum slaughter at Lenah Game Meats’ processing plant in Tasmania, secretly filmed by trespassers who installed hidden cameras. In that case, the footage was passed to Animal Liberation Ltd and then to the ABC, which planned to broadcast it.

Lenah sought an injunction, arguing the broadcast would breach confidentiality, was unconscionable due to the illegal trespass, and invaded its privacy. The High Court ruled against Lenah, holding that the activities filmed were not inherently private, there was no recognised tort of invasion of privacy for corporations in Australian law, and the public interest in exposing potential animal cruelty outweighed Lenah’s commercial concerns.

This decision highlighted the balance between freedom of expression and privacy rights in Australia while leaving open the possibility of future legal developments regarding privacy protections. To read the case go here: https://jade.io/j/?a=outline&id=68299

In response, the ALRC and other bodies pushed for reform.

The new law fills this gap by confining the tort to the two well-established categories above.

Plaintiffs won’t need to prove financial harm, only that the invasion was intentional or reckless, serious, and that they had a reasonable expectation of privacy.

When courts consider privacy cases, they must carefully balance the public interest against an individual’s right to privacy. Factors such as freedom of expression, artistic merit, public health, and democratic importance can sometimes outweigh privacy concerns.

For instance, exposing corruption or addressing urgent public health issues might justify a breach of privacy. However, this balancing act is highly contextual and depends on the specifics of each case. Courts must weigh whether the public benefit of disclosure genuinely overrides the harm caused by the privacy invasion. It is not black and white.

If a privacy breach is established, courts can impose various remedies to address the harm. These include awarding damages for emotional distress, ordering profits made from the breach to be handed over (account of profits), issuing injunctions to stop further misuse, or requiring the destruction of improperly obtained materials. Other remedies might involve public apologies, corrections, or formal declarations acknowledging the breach.

At the same time, defendants can rely on statutory defences, such as proving consent was given, acting under lawful authority, engaging in public interest journalism, or acting out of necessity to prevent harm.

This framework aims to protect privacy while recognising that some situations demand exceptions for broader societal benefits.

How can your business prepare?

At Sharon Givoni Consulting, we’ve worked with production houses, media agencies, and creative teams to help them reduce legal risk.

That includes everything from drafting tailored consent forms to reviewing scripts and campaigns for potential red flags.

Here are a few questions to ask now:

• Are your release forms up-to-date, specific, and legally robust?
• Is your team trained to recognise privacy risks in real-time?
• Do you know how to balance storytelling with legal obligations?

We Speak Legal Ease, Not Legalese®

Our approach is simple: we make the law easy to understand. If you work in advertising, production, photography, or marketing, we can help you:

• Understand how this tort might impact your work
• Develop plain-English documents like release forms and consents
• Train your team in identifying privacy issues before they go to air
• We also offer tailored training sessions — in person or online — for your creative team or agency.

Need Help?

Let’s Talk.

We’re here to help you navigate the legal maze of marketing, advertising, and creative production — before issues arise.

---

Please note the above article is general in nature and does not constitute legal advice.

Please email us info@iplegal.com.au if you need legal advice about your brand or another legal matter in this area generally.