Privacy, breach of confidence and the new statutory tort: when the problem is true but private

Defamation law has a gap that many people discover only when they seek advice. It protects reputation against false statements, and truth is a complete defence. If the complaint is that something true but private has been exposed, such as medical information, sexual history, a recording made in a bedroom or photographs never meant for publication, defamation usually offers nothing. Australian law has dealt with these cases, if at all, through the equitable doctrine of breach of confidence. Since 10 June 2025 there has also been a statutory tort of serious invasion of privacy in Schedule 2 to the Privacy Act 1988 (Cth). This article explains the two routes, how they differ from defamation, and how they fit together.

Why defamation does not fit

A defamation claim requires a publication carrying imputations that lower the plaintiff’s reputation, and outside Western Australia the plaintiff must prove serious harm to reputation.¹ A defendant who proves that the imputations were substantially true has a complete defence under s 25.² Three consequences follow. First, true private information cannot found a successful defamation claim. Second, information that is embarrassing but not reputationally damaging, such as a diagnosis or a home address, is not defamatory at all. Third, a plaintiff who sues in defamation invites the defendant to plead truth and prove the private matter in open court. Privacy and confidence claims avoid these difficulties because they do not depend on falsity or reputational harm.

The statutory tort of serious invasion of privacy

The Privacy and Other Legislation Amendment Act 2024 (Cth) inserted Schedule 2 into the Privacy Act. The Schedule commenced on 10 June 2025 and creates a cause of action in tort.³ Unlike the rest of the Privacy Act, it is not confined to government agencies and large organisations: any person who invades an individual’s privacy, including a private individual or a small business, can be sued.

Elements. Under cl 7(1), an individual has a cause of action against another person if the defendant invaded the plaintiff’s privacy by intruding upon the plaintiff’s seclusion or misusing information that relates to the plaintiff; a person in the plaintiff’s position would have had a reasonable expectation of privacy in all the circumstances; the invasion was intentional or reckless; the invasion was serious; and the public interest in the plaintiff’s privacy outweighed any countervailing public interest.⁴ The tort is actionable without proof of damage, and where the invasion consists of misusing information it is immaterial whether the information was true.⁵ Only an individual can sue, which continues the position the High Court foreshadowed in Australian Broadcasting Corporation v Lenah Game Meats Pty Ltd, where Gummow and Hayne JJ said that any development of a privacy tort would be for the benefit of natural, not artificial, persons.⁶

Two limbs. Intrusion upon seclusion covers surveillance, recording, tracking and physical intrusion even where nothing is published. Misuse of information covers disclosure and other use of information about the plaintiff. Many cases involve both.

Reasonable expectation of privacy. The court may consider the means used, including any device or technology; the purpose of the invasion; the plaintiff’s attributes such as age, occupation or cultural background; the plaintiff’s own conduct, including whether they invited publicity or manifested a desire for privacy; for intrusion, the place where it occurred; and for misuse of information, the nature of the information, including whether it concerned intimate or family matters, health or finances, how the plaintiff held or communicated it, and whether and to what extent it was already in the public domain.⁷

Fault. Negligent disclosure is not enough. The invasion must have been intentional or reckless, which excludes accidental data breaches and careless oversharing from the tort.

Public interest. Clause 7(3) lists matters that may constitute a countervailing public interest: freedom of expression including political communication and artistic expression, freedom of the media, the proper administration of government, open justice, public health and safety, national security, and the prevention and detection of crime and fraud.⁸ The plaintiff bears the burden of showing that privacy outweighs these interests, which puts public interest at the centre of every case involving publication.

Defences. Clause 8 provides defences where the invasion was required or authorised by law or court order; where the plaintiff consented expressly or impliedly; where the defendant reasonably believed the invasion was necessary to prevent or lessen a serious threat to a person’s life, health or safety; and where it was incidental to the lawful defence of persons or property and proportionate. Where the invasion involved publication, the defamation defences of absolute privilege, publication of public documents and fair report of proceedings of public concern are also available.⁹ Truth is notably absent, as is any equivalent of honest opinion or qualified privilege.

Exemptions. The Schedule does not apply to journalists, their employers and those assisting them, to the extent the invasion involves collecting, preparing or publishing journalistic material. Nor does it apply to the publication or distribution of journalistic material prepared by a journalist. A journalist is a person who works in a professional capacity as a journalist and is subject to professional standards or a code of practice, and journalistic material means news, current affairs, documentary and related commentary, opinion, analysis and editorial content.¹⁰ It also does not apply to agencies and state or territory authorities acting in good faith, to law enforcement bodies or intelligence agencies, or to a defendant under 18 years of age.¹¹ For mainstream media publications, the plaintiff is left with defamation and breach of confidence.

Remedies. The court may award damages, including damages for emotional distress, but must not award aggravated damages and may award exemplary or punitive damages only in exceptional circumstances. The sum of damages for non economic loss and any exemplary damages must not exceed whichever is higher: $478,550, or the maximum amount that may be awarded for non economic loss in defamation proceedings under an Australian law.¹² In assessing damages the court may consider any apology or correction, settlement efforts and unreasonable conduct by the defendant after the invasion. Other remedies include an account of profits, injunctions, an order to apologise, a correction order, orders for destruction or delivery up of material, and a declaration.¹³ An injunction may be granted at any stage, but where the invasion involves publishing information the court must have particular regard to the public interest in publication.¹⁴ An apology is not an admission of liability.¹⁵

Time limits. Proceedings must be commenced before the earlier of one year after the plaintiff became aware of the invasion and three years after it occurred, with a longer period for plaintiffs who were under 18 and a discretion to extend to no more than six years where it was not reasonable to have commenced earlier.¹⁶ The Schedule confers jurisdiction on the Federal Circuit and Family Court (Division 2), and state courts and the Federal Court also have jurisdiction.¹⁷

The first application. In Kurraba Group Pty Ltd v Williams, decided in October 2025, a property developer and its chief executive sought urgent orders against the director of a former tenant company who, after his demand for $50,000 was refused, had published a website attacking them and, among other things, used private wedding photographs to portray the executive unfavourably. Hearing the application without the defendant present, Gibson DCJ noted that it was the first application under cl 7, found a serious question to be tried on the privacy claim for the individual plaintiff, alongside defamation and intimidation, and granted interlocutory injunctions requiring removal of the material and restraining further publication.¹⁸ The decision illustrates how the tort will often be pleaded with defamation rather than instead of it.

Breach of confidence

Before the statutory tort, and still today, the main protection for private information was the equitable action for breach of confidence. The plaintiff must show that the information had the necessary quality of confidence, that it was imparted or obtained in circumstances importing an obligation of confidence, and that there was an unauthorised use or disclosure. In Lenah Game Meats, Gleeson CJ said that images and sounds of private activities recorded surreptitiously would be confidential, that an obligation of confidence would bind those who obtained them and anyone into whose hands they came who knew or ought to have known how they were obtained, and that the requirement that disclosure or observation “would be highly offensive to a reasonable person of ordinary sensibilities” is in many circumstances a useful practical test of what is private.¹⁹

The doctrine has been applied to intimate images and recordings. In Giller v Procopets, a former partner filmed sexual activity and then showed or threatened to show the tapes to the plaintiff’s family, friends and employer. The Victorian Court of Appeal held that equitable compensation is available for the distress and embarrassment caused by a breach of confidence, even without psychiatric injury, and awarded $40,000 including $10,000 for the aggravating manner of the breach.²⁰ The court observed that a generalised tort of invasion of privacy had not been recognised by any superior court in Australia and that it was unnecessary to decide whether it should be, because breach of confidence met the case.²¹ In Wilson v Ferguson, a man posted sixteen explicit photographs and two videos of his former partner to his Facebook page, where they were accessible to about 300 friends including workmates at their mining site. Mitchell J held that posting the images breached an equitable obligation of confidence, granted a permanent injunction and awarded $48,404, comprising $35,000 for humiliation, anxiety and distress and $13,404 for lost wages.²²

Breach of confidence has features that remain useful alongside the statutory tort. It is available to corporations as well as individuals. It has no requirement of intention or recklessness, no seriousness threshold and no statutory cap. It is not subject to the journalism exemption, although a public interest in disclosure can defeat a claim. Its limits are also real: the information must be confidential rather than merely private, the circumstances must give rise to an obligation, and it is doubtful whether the doctrine extends to mere intrusion where no information is used.

Other protections for intimate images

Where the material is an intimate image, two further regimes apply. The Online Safety Act 2021 (Cth) prohibits a person from posting, or threatening to post, an intimate image of another person on a social media service or similar service without consent, with a civil penalty of 500 penalty units, and the eSafety Commissioner can issue a removal notice requiring a service provider to remove the image within 24 hours.²³ That scheme is often the fastest way to get material taken down. In Queensland, distributing an intimate image without consent in a way that would cause distress is a misdemeanour punishable by up to three years imprisonment under s 223 of the Criminal Code, and the other states and territories have equivalent offences.²⁴ Criminal complaints and eSafety reports can run alongside civil claims.

Choosing between defamation, privacy and confidence

The choice depends on what the complaint really is.

If the material is false and damages reputation, defamation is the natural claim, with its presumption of falsity and its established damages framework.

If the material is true, or its truth is not the point, and it is private, the statutory tort or breach of confidence is the claim.

If the material is both false and an exposure of private life, for example doctored or decontextualised private photographs, both defamation and privacy may be pleaded, as in Kurraba. The defamation claim has a serious harm element, a concerns notice requirement and a one year limitation period from publication. The privacy claim instead requires intention or recklessness and seriousness, and its one year period runs from awareness.

If the defendant is a journalist or media organisation, the statutory tort is unavailable and the realistic claims are defamation and breach of confidence.

If the defendant is under 18, the statutory tort is unavailable, but breach of confidence, the Online Safety Act scheme and the criminal law remain.

Injunctions are treated differently across the three claims. Courts are very reluctant to restrain allegedly defamatory publications before trial, but equity has long restrained threatened breaches of confidence, and the Schedule expressly authorises injunctions subject to particular regard for the public interest in publication. For urgent removal of private material, confidence and the statutory tort are usually the firmer footing.

Practical points

• Identify whether the grievance is falsity, exposure or both before choosing the cause of action.
• For the statutory tort, assemble evidence of intention or recklessness and of seriousness; both are elements the plaintiff must prove.
• Check the defendant’s status. Journalists and defendants under 18 are outside the tort, and state agencies and law enforcement are largely exempt.
• Note the time limits: one year from awareness under the Schedule, which may expire before the three year outer limit.
• Consider an eSafety report under the Online Safety Act for intimate images in parallel with any civil claim.
• For defendants, consent, public interest and the absence of intention or recklessness are the principal answers, and for publishers, whether the material is journalistic material prepared by a journalist.

Differences between jurisdictions

The statutory tort is a Commonwealth law and applies in the same terms throughout Australia, including Western Australia. Breach of confidence is general law and does not vary between jurisdictions, although the main appellate and trial authority on compensation for distress comes from Victoria and Western Australia. Criminal offences for intimate image abuse exist in every state and territory but differ in their elements and penalties. The defamation points made above use New South Wales section numbers, which are shared by Queensland, Victoria, South Australia and Tasmania, while the territories number their provisions differently. Western Australia also differs in substance: it has no serious harm element.

Getting advice

Disputes about private material move quickly, and the choice between defamation, the statutory tort and breach of confidence shapes everything that follows: what must be proved, which defences are available, whether an injunction is realistic and how long the plaintiff has to act. The statutory tort is new, so advice should draw on both the legislation and the established equitable principles.