New Privacy Laws Could Expose Your Business to Legal Action
This change applies to all sectors, not just legal or health. This means that any business that collects, stores, or uses personal information must take notice. The reform marks a significant shift in Australia’s privacy landscape, with new legal, reputational, and financial risks on the table.
What’s Changed?
The Privacy and Other Legislation Amendment Act 2024 introduces a statutory tort that allows individuals to take legal action for:
- Intrusion into private affairs – This includes unauthorised surveillance or accessing someone’s private space, physical or digital. For example, an employee reviewing personal client files without cause could qualify, even if no harm results. In 2020, a Centrelink employee accessed customer records without authorisation and was later charged under criminal laws. Under this new law, the affected person could also sue for emotional distress.
- Misuse of private information – This could involve sharing, publishing or mismanaging someone’s personal or sensitive information intentionally or recklessly. Common risks include unsecured databases, emailing personal records to the wrong person, or poor access controls. The 2022 Medibank breach saw customer health claims data posted online. Even if your business isn’t that high profile, smaller-scale disclosures (accidental or otherwise) could now result in legal action.
Unlike previous obligations under the Privacy Act, this new law enables individuals to claim damages for emotional harm, even where no financial loss has occurred.
When Can a Claim Be Made?
To bring a case, an individual must show:
-
A reasonable expectation of privacy – This is the type of situation where people assume their information is secure like submitting ID to apply for a service, or having a private consultation. If that information is later shared or accessed without valid purpose, you’re exposed.
-
The breach was serious, intentional or reckless – It’s not about minor admin errors—it must meet a “seriousness” threshold. Still, repeated oversights or careless system setup (e.g. no password protection, leaving files in public folders) could quickly escalate.
-
Privacy harm outweighs any competing public interest – Courts will weigh freedom of expression or public safety where applicable, but for most businesses, this will rarely provide a defence. Ensuring strong internal governance is the best protection.
Key Defences and Exemptions
Businesses may rely on defences including:
-
Legal authority or court orders – If the use or disclosure of data was required by law, it may be protected—but you need to be sure. Misinterpreting a request (e.g. disclosing info without valid authority) could void this defence.
-
Consent from the individual – Businesses must have clear, documented consent—not buried in fine print. If challenged, you’ll need to show the person understood what they agreed to and that it was still valid at the time.
-
Public interest, such as preventing harm – In rare cases, sharing information to prevent serious harm may offer a defence—but this must be justifiable. It won’t apply to convenience or operational decisions.
-
Media and law enforcement exemptions – These generally don’t apply to private businesses, but are worth knowing if you operate in sectors adjacent to journalism or government.
-
Minors under 18 are exempt from liability – This protects young people from being sued, but not from being plaintiffs—so firms working with youth data should be particularly cautious.
Legal Consequences If Found Liable
If a claim is successful, courts may order:
-
Damages for emotional distress – The person doesn’t need to prove financial loss; distress alone can be enough. Claims could arise from internal privacy breaches, like HR accessing employee records without cause.
-
Injunctions to stop further breaches – Courts may order your business to stop a process entirely (e.g. shut down a marketing campaign or system workflow). This could disrupt operations or require urgent system changes.
-
Public apologies or corrections – Beyond compensation, courts may compel your business to issue formal apologies or corrections impacting brand trust and professional reputation.
-
Destruction of unlawfully obtained data – If private information was collected or stored inappropriately, you may be ordered to delete or hand it back complicating compliance and recordkeeping efforts.
-
Surrender of profits made from the invasion – If any benefit was gained (e.g. using private data in marketing or analytics), you may be required to forfeit those gains.
What Businesses Should Do Now
This new tort places a clear responsibility on businesses to take privacy seriously and proactively manage personal information. Steps to prepare include:
- Review privacy policies and ensure they reflect current practices.
- Train staff on appropriate data handling and privacy risks.
- Strengthen data governance frameworks and system access controls.
- Ensure breach response plans are up to date and tested.
- Assess frameworks like ISO 27001 or Essential Eight for best practice alignment.
This is not a future problem — it’s a current planning priority. With the introduction of this new legal right, privacy risk is no longer just a compliance issue — it’s a litigation risk. Organisations that act early will be in a stronger position to protect their customers, their brand, and their bottom line.
Privacy risk is no longer theoretical, it’s here.
With the new statutory right to sue for serious invasions of privacy now in effect, the stakes have shifted. This isn’t just about compliance anymore but legal and financial exposure. Organisations that act now are best positioned to protect their customers, their brand, and their bottom line.
Want Help Reviewing your Data Privacy Posture?
Diamond IT can assess your readiness and help implement practical, standards-aligned improvements. Get in touch today so we can help you secure your operations and ensure a resilient future. Contact us on 1300 307 907 today or fill out the form below.
Contact Us Today
