Australia Privacy Laws: A Fresh Era Begins

Privacy used to be a box ticking exercise. Not anymore. As of 10 June 2025, Australia Privacy Laws are entering an entirely new chapter and this one brings the power back to the people. If you think this is just a headache for big tech companies or overworked compliance officers, think again. Whether you’re running a small business, sharing content online, or handling data at work, these changes matter.

What Changed in 2025?

Gone are the days when the Privacy Act was the only player in town. Now, there’s a brand new statutory tort for serious invasion of privacy, meaning Australians can take legal action without needing the regulator to step in first. 

So, what is a tort, anyway?

In simple terms, it’s a civil wrong that allows someone to bring legal action against another person or organisation. In this case, it applies if someone’s privacy is seriously invaded either through intrusion into personal space or misuse of personal information.

Who Does This Affect?

The short answer? Everyone. But let’s break it down:

• Small business owners collecting customer emails or phone numbers
• Content creators and media professionals sharing videos or posts
• HR and employers handling staff data or using surveillance tools
• Everyday Aussies using apps, smart devices, or social media

What Counts as a Serious Invasion of Privacy?

There are two main categories:

1. Intrusion into seclusion such as spying, tracking, or recording someone where they reasonably expect privacy
2. Misuse of personal information using someone’s data intentionally or recklessly beyond what was consented to

Both require a reasonable expectation of privacy, the act to be intentional or reckless, and the invasion to be serious.

Intentional or Reckless? Not Just a Simple Mistake

To meet the legal threshold, the action must be more than just negligent. Recklessness or intent is key. So, an admin error might not count but sharing sensitive data without consent? That could absolutely be grounds for action.

Australia Privacy Laws: No More Blanket Exemptions

The old Privacy Act included carve outs like the employee records exemption. But this new tort isn’t bound by the same rules. Employee data breaches, workplace surveillance, and misuse of internal staff information may now be open to challenge.

Beyond Just the OAIC: Multi-Regulator Environment

Agencies like ASIC and APRA can also step in. It’s not just the Office of the Australian Information Commissioner (OAIC) anymore. This means privacy is now part of a broader governance, cybersecurity, and financial compliance framework.

“Misuse” Has a Whole New Meaning

The scope of “misuse” has expanded. It could include:

• Metadata, anonymised, or pseudonymised information
• Surveillance footage
• Internal chats, emails, or stored employee data
• Using personal information beyond what someone has consented to

Got Consent? Prove It.

Consent is one of the few defences available but it needs to be clear, informed, and documented. Generic or implied consent won’t cut it. Especially when dealing with sensitive data, consent should be recorded and regularly reviewed.

6 Signs You Might Be at Risk

1. Your privacy policy hasn’t been updated since 2022
2. You’re using CCTV in the workplace without proper notice or consent
3. You store employee data with unrestricted access
4. You share customer data with third party
5. You use implied consent for marketing
6. You collect or keep more data than you need

Australia Privacy Laws and Employee Monitoring

Employers must now be especially cautious. Under the new tort, employee monitoring activities can be challenged where there’s a reasonable expectation of privacy. Examples include:

• Covert surveillance
• Tracking employee location without disclosure
• Monitoring emails or keystrokes without consent

Employers must ensure transparency, necessity, and proper data handling practices.

How Are Courts Likely to Decide What’s “Serious”?

To determine seriousness, courts may consider:

• Whether the conduct caused offence, distress or harmed dignity
• If the defendant acted maliciously
• If the information was particularly sensitive (e.g., health, family, financial matters)
• If a device or technology was used
• Whether the individual’s privacy expectations were reasonable in the circumstances

Australia Privacy Laws in Context

These changes are part of a broader push to modernise privacy protections. The statutory tort gives Australians a direct legal remedy, while the Privacy Act continues to evolve.

Other reforms include:

• Higher penalties (up to $50M for corporates)
• Technical and organisational measures for data security
• Children’s Online Privacy Code (coming soon)
• Criminal offences like doxxing
• Future transparency rules around AI decision making

Conclusion: Ready or Not, Change Is Here

The new Australia Privacy Laws signal a big cultural shift. One where privacy matters more, where trust is key, and where organisations need to walk the talk.

Whether you’re a small business owner, a content creator, or someone who values their personal space these laws affect you. Don’t wait for a complaint to take privacy seriously.

Review privacy processes, get legal advice if needed, and document all consent and data handling practices.

Disclaimer
The material contained in this publication is of a general nature only and it is not, nor is intended to be, legal advice.

🖤💛❤️

AMK Law acknowledges the Traditional Custodians of the land on which we are fortunate to live and work. We pay our respects to Elders, both past and present and further acknowledge the important role that First Nations peoples continue to play within our communities.