Misuse of Private Information in the Digital Age
What Remedies are Available?
Private information can now be copied, searched and distributed globally in minutes. The legal response depends on what was obtained, how it was obtained, who published it, the seriousness of the harm and how urgently further distribution must be stopped.
Since 10 June 2025, Schedule 2 to the Privacy Act 1988 (Cth) has provided a statutory tort for serious invasions of privacy. A person may sue for an intrusion upon seclusion or misuse of information where they had a reasonable expectation of privacy. The invasion must be intentional or reckless and serious, and the public interest in privacy must outweigh competing public interests such as freedom of expression, journalism, open justice or public health and safety.
The tort can apply beyond businesses ordinarily covered by the Australian Privacy Principles. Proof of financial loss is not essential. Available remedies include injunctions, damages for emotional distress, an apology, correction, destruction or delivery-up of material, and declarations. Exemplary or punitive damages may be awarded only in exceptional circumstances. Defences and exemptions include consent, lawful authority and protections applying in certain circumstances to journalists and public bodies.
Time limits are short. For an adult, proceedings generally must be commenced by the earlier of one year after becoming aware of the invasion and three years after it occurred. A person should not wait while content continues to spread.
The new tort is not the only pathway. Depending on the facts, remedies may also arise through:
-
breach of confidence, contract or copyright;
-
an OAIC privacy complaint against an entity covered by the Privacy Act;
-
defamation, where publication conveys a damaging false meaning;
-
eSafety processes for image-based abuse or serious online abuse; or
-
criminal law, particularly for threats, stalking, unlawful access or intimate-image offences.
The first hours can matter more than the eventual damages claim. Preserve screenshots, URLs, account details, timestamps and original messages without unnecessarily republishing the material. Request platform preservation and removal, review account security, identify the publisher where possible, and consider an urgent injunction or carefully framed cease-and-desist notice. Police or eSafety should be contacted promptly where safety, threats or intimate material are involved.
Digital privacy disputes require two strategies at once: contain the publication now and build the evidence needed for the appropriate legal remedy later. A perfect damages judgment is cold comfort if preventable distribution was allowed to continue unchecked.
Sources: OAIC — Statutory tort for serious invasions of privacy; Privacy Act 1988, Schedule 2; eSafety Commissioner — Report online harm
Disclaimer: This article provides general information only and is not legal advice. It does not create a solicitor-client relationship.
