What is a serious invasion of privacy? UK case law has answers

Australia’s new privacy tort is in force from 10 June 2025. It is contained within Schedule 2 of the Privacy and Other Legislation Amendment Act 2024. Lawyers will be accustomed to all sorts of clients complaining about breaches of their privacy. These may include poisonous posts on social media (often anonymous); malicious emails or messages; websites created to attack and humiliate; old-school leaflet drops; and approaches to journalists. Culprits might commonly be former partners in life or business: embittered relatives, neighbours, colleagues and friends. The material might be in video, photographic or written form; sexual or salacious; or concern a person’s health or finances. It might just incorporate private accounts of love, loss, joy or despair. Until now, in terms of avenues provided by the civil law, an old-school equitable breach of confidence action was the best option for such complaints. That action is often not well equipped to accommodate these sorts of disputes, not least because of the requirements to prove information is ‘confidential’ as well an actual or threatened use of the information without consent (as opposed to the actual gathering of the information), and the limited ability to recover damages for distress. The new tort covers intentional or reckless breaches of privacy that meet a threshold of seriousness. It is actionable without proof of damage. It will now be easier for individuals to apply for injunctive relief to stop publication of private information or photographs online. That is perhaps the most obvious application of the new tort, although there will be other developments, including for actions against the mass media and class actions (most obviously concerning data releases and data harvesting).

This article will look at some of the practical issues for solicitors in assessing privacy complaints (or responses to those complaints), and readying any claim or defence for action. This article will focus on intentional invasions although the legislation, at clause 7(1)(c), also permits actions for reckless invasions (reckless conduct must be proven to the criminal standard). Actions under this head will presumably often involve the release of personal data by corporations. Next month, a second article will deal with the exemption that protects the traditional news media. That exemption protects journalistic material that has ‘the character of news’.

Intrusion into seclusion and misuse of information

Clause 7(1)(a) of Schedule 2 extends the scope of an invasion of privacy to two instances, namely when there is an intrusion upon seclusion or a misuse of information. The definition of an intrusion into seclusion in clause 6 explicitly includes not just physical intrusion into a private space but watching, listening to or recording a person’s private activities or affairs. The concepts are broad and a breach may occur not just at the point the information is posted online or provided to a journalist, but earlier at the point where the information was gathered. For instance, the act of taking a photograph, of hacking a device or accessing and looking at someone’s private information could satisfy the intrusion into seclusion test.

Reasonable expectation of privacy

Clause 7(1)(c) requires a plaintiff to establish a reasonable expectation of privacy in the circumstances. Clause 7(5) provides a list of factors to be taken into account on this issue. These include the individual plaintiff’s age and cultural background, and whether a plaintiff has invited publicity or manifested a desire for privacy. The UK law has an identical limb and it is likely Australian courts will take guidance from that body of law. In the UK, a series of decisions have gradually extended the reach of a reasonable expectation of privacy. The concept includes the more obvious private sexual, health and financial information (whether in written, visual or other form). It may also extend to family photographs taken in public places, to the fact of various sexual relationships and even to the existence of law enforcement investigations, searches and an arrest, prior to a person being charged with a criminal offence. A reasonable expectation of privacy will more easily arise in respect of photographic or audiovisual information which is particularly intrusive and enables the viewer to act as spectator or voyeur (Douglas v Hello! Ltd (No 3) [2005] EWCA Civ 595). In Campbell v MGN [2004] UKHL 22, the supermodel, Naomi Campbell, was photographed by concealed lens on a street outside a Narcotics Anonymous meeting. Ms Campbell had publicly denied any addiction. The House of Lords found a reasonable expectation of privacy and took the view the photographs greatly added to the harm (at [122]-[124] and [154]-[155]).

Depictions of children are also a special case. In Murray v Express Newspapers [2008] EWCA Civ 446 (‘Murray’), the Court of Appeal held a reasonable expectation of privacy existed in respect of images taken by concealed lens of JK Rowling and her partner walking in an Edinburgh street towards a café with their child in a stroller (at [17]-[18], [46] and [55]-[57]). In similar circumstances, a reasonable expectation of privacy was also held to arise in Weller v Associated Newspapers Ltd [2015] EWCA Civ 1176 (‘Weller’) in relation to photographs taken by concealed lens of a former singer with his ten-month-old twins and teenage daughter at a Los Angeles cafe (at [61]). In contrast, in John v Associated Newspapers Ltd [2006] EWHC 1611 (QB), there was no reasonable expectation of privacy for photographs taken of Elton John in a tracksuit standing outside his home (at [15]). The critical difference was the photo included no private information, in contrast with the context of family recreational activities in Murray and Weller. In Stoute v News Group Newspapers [2023] EWCA Civ 523, the plaintiffs, a married couple who made their fortune selling personal protective equipment, also failed to establish a reasonable expectation of privacy in respect of photographs taken by concealed lens of them arriving at a restaurant at a public beach. The Court held there was no factor pointing to a reasonable expectation of privacy and, in particular, their ostentatious arrival on a jet-ski counted against them (at [58]-[65]).

A serious breach

Clause 7(1)(d) establishes a requirement the invasion of privacy be serious. Clause 7(6) provides some criteria for a court to consider and, importantly, it includes both the degree of distress and harm to dignity likely to be caused to a person of ordinary sensibilities in the position of the plaintiff, as well as the defendant’s state of mind and conduct. A similar threshold exists in the UK: see, for instance, Prismall v Google UK Limited [2024] EWCA Civ 1516 at [42]. It has not discouraged the frequent litigation of the tort in that jurisdiction. Certainly, the explicit provision in clause 7(6) of a factor which, to at least some extent, permits a subjective analysis of the plaintiff’s probable feelings as to the invasion, suggests there will be cases where the ‘serious’ threshold may be passed even when the private information is not particularly scintillating – just hurtful in the circumstances.

Balancing of competing interests

Clause 7(1)(e) requires a plaintiff to establish the public interest in their privacy outweighed any countervailing public interest. Clause 7(3) provides a list of countervailing interests notably including freedom of expression, freedom of the media, open justice and the prevention of crime and fraud. The UK has a similar public interest balancing test as an element of its tort. At this point of the inquiry, some defendants have relied on their own right to tell a shared story including, for instance, the details of a previous sexual relationship or friendship. Generally, this has not been enough to sway the balance against a plaintiff or prevent the granting of an injunction. In Ash v McKennitt [2006] EWCA Civ 1714, McKennitt was a folk singer and Ash had been her friend. Ash wrote a tell-all book about their times together and argued she was entitled to tell her own story. The Court of Appeal (upholding the trial judge’s decision to injunct parts of the book) rejected the argument on the basis the two had a long-term close friendship (as opposed to a brief sexual encounter, for instance) and that the book itself was really about McKennitt, containing revelations about her rather than telling Ash’s own story (at [16], [28]-[32] and [50]-[52]). Similarly, in BVC v EWF [2019] EWHC 2506 (QB), a former partner of the plaintiff created a website which, amongst other attacks, revealed his sexuality which was illegal and culturally difficult in his home country. The defendant argued for the right to tell his own story. The Court, whilst alive to the possibility the defendant was in fact seeking revenge for perceived mistreatment, instead rejected the argument on the basis that even if he had a right to tell his own story he had no entitlement to ‘intrude so uncompromisingly into the Claimant’s private space’ (at [147]-[149]).

Defences

Clause 8 provides defences for invasions of privacy that are:

• required by law;
• reasonably believed to be necessary to prevent a serious threat to the life, health or safety of a person; or
• incidental to the proportionate exercise of a lawful right of defence to a person or property.

An additional defence of consent extends to plaintiffs who have ‘impliedly consented to the invasion of privacy’. It may be argued this defence might embrace persons who have recently and/or regularly publicised or shared aspects of their private life in the same sphere of the invasion about which they now complain.

Injunctions

In the UK, litigation has been very much focused on injunctive relief and damages claims are comparatively rare. My survey on injunction applications suggests UK courts typically expect frank evidence from plaintiffs explaining the origin and importance of the private information, or the nature of the intrusion into seclusion, as well as the potential harm likely to be caused by publication. If harm to family members is to be advanced as a matter in support of injunctive relief, this should also be the subject of evidence. Careful attention will need to be paid to the appropriate suppression orders once an action is commenced, lest the privacy at the heart of the action be lost by publicity or disclosure about the litigation. The effect of clause 23 is to permit privacy actions to be litigated in state and federal courts. While the facts in each case will obviously affect the appropriate jurisdiction, the well-established preference of the Federal Court for greater open justice including the early release of pleadings (see rule 2.32(2) of the Federal Court Rules 2011 (Cth) and clause 4.8 of the Access to Documents and Transcripts Practice Note) may present additional challenges for plaintiffs taking action to prevent or ameliorate a serious invasion of privacy in that jurisdiction. If publication or further dissemination is threatened or ongoing, speed will obviously be essential. Defendants (who often will not have much time) may wish to submit evidence of the plaintiff’s own public conduct or the extent to which the material is already in the public domain. In Mosley v News Group Newspapers [2008] EWHC 687 (QB), Max Mosley, the President of the International Automobile Federation (which runs Formula One racing), established a complete absence of public interest in respect of intrusive footage and still images of him attending an orgy with five sex workers. Nevertheless, the Court declined to injunct on the basis the material had already been viewed by millions and ‘the dam had effectively burst’ (at [7] and [34]-[36]). However, in other circumstances, the fact of some prior publication has not been enough to persuade courts in the UK to withhold injunctive relief. In PJS v News Group Newspapers [2016] UKSC 26, the spouse of a famous pop star succeeded in injuncting a story of an extra-marital threesome in respect of which a reasonable expectation of privacy had been established. This was despite the fact that, while there had not been mass media publication in the UK, there had been extensive publication on the internet and also in overseas media. The UK Supreme Court took the view there was no public interest in the story and the mere fact that persons interested in a prurient story could deduce the details by internet searches was not enough to tell against injunctive relief (at [44]). Similarly, in Edward Rocknroll v News Group Newspapers [2013] EWHC 24 (Ch), the private information consisted of older partly nude photographs taken at a party of Kate Winslet’s new husband. The photographs were briefly available to the public on a Facebook account but there was no evidence of widespread public inspection and the newspaper was injuncted from publishing the photographs (at [20]-25]).

Damages

Most significantly, clause 7(2) provides that an invasion of privacy is actionable without proof of damage. There is accordingly no need to prove even the existence of distress and this may be particularly significant for class actions. In the UK, courts have characterised damages awarded in the absence of any evidence of distress (and to, for instance, very young children) as damages for the loss of the right to control the private information (Lloyd v Google LLC [2021] UKSC 50 at [103]-[104]). The other damages provisions are located within clause 11. The same cap for non-economic loss damages existing in the defamation jurisdiction is imposed (currently $478,550). While aggravated damages are prohibited by clause 11(2), clause 11(6)(e) curiously permits a court to award damages for unreasonable conduct of the defendant occurring after the invasion of privacy that subjects the plaintiff to additional embarrassment or distress. This is a lower threshold than would be required to establish aggravated damages. Exemplary damages are permitted but at a level remaining inside the cap. Finally, clause 12 permits a court to grant other remedies (either in addition to damages or as an alternative) including an account of profits, an order requiring a defendant to apologise, a correction order or a declaration.

Conclusion

Australia’s privacy tort is arriving much later than in other comparable jurisdictions. While there is a significant, if imprecise, protective carve out for journalists and media (which is the subject of my second article), the new legislation should provide a significant additional right to individuals suffering from privacy breaches in the internet age.

Matthew Richardson SC is a barrister at 153 Phillip with expertise is media and defamation law. Since 2022, Matthew has been the Co-Chair of the NSW Bar Association Media and Information Law and Technology Committee which, amongst other matters, assists the NSW Bar in advising on law reform in the defamation, privacy and AI space.