From 10 June 2025, individuals in Australia can sue a person or organisation for a serious invasion of their privacy. The statutory tort was created by Schedule 2 of the Privacy and Other Legislation Amendment Act 2024 and now sits in Schedule 2 of the Privacy Act 1988. The OAIC confirmed that the changes commenced on 10 June 2025.
For practices, this adds a new kind of risk. Until now, a patient unhappy about how their information or image was used would usually complain to the practice, to the OAIC or to Ahpra. Now, if the invasion is serious and the other conditions are met, the patient can take the practice, or an individual staff member, to court directly. Marketing that uses patient photos, stories or details is the obvious place to look first.
Where this sits: the tort was part of the first tranche of Privacy Act reforms (see our article on the Privacy and Other Legislation Amendment Act 2024). In August 2026 the Government released an exposure draft of further Privacy Act reforms, which is not law and does not replace the tort (see our article on the tranche 2 exposure draft).
What changed
Before 10 June 2025 there was no general, legislated right to sue for invasion of privacy in Australia. The Act created a cause of action in tort that applies where someone has invaded another person’s privacy by:
- intruding upon their seclusion, which the Act says includes physically intruding into their private space, and watching, listening to or recording their private activities or private affairs; or
- misusing information that relates to them, which the Act says includes collecting, using or disclosing information about them.
The Act set commencement by proclamation, with a fallback of six months after assent if no proclamation was made. Assent was 10 December 2024, and the OAIC states the tort commenced on 10 June 2025.
The OAIC does not have a direct role in administering the tort. Claims are brought in the courts. The Act confers jurisdiction on the Federal Circuit and Family Court of Australia (Division 2), and notes that state courts and the Federal Court also have jurisdiction. The Information Commissioner may, with the court’s leave, intervene in proceedings or assist the court as amicus curiae.
Who it applies to
The tort is broader than the rest of the Privacy Act. The OAIC explains that it extends to individuals and other entities that may not be APP entities. That means it is not limited by the small business exemption or by whether you are a health service provider. A sole practitioner, a practice company, a practice manager or a contractor could all, in principle, be a defendant.
There are exemptions, including for intelligence agencies and law enforcement bodies, for journalists in relation to journalistic material, for some government agencies acting in good faith, and for invasions of privacy by people under 18. None of these exemptions is designed for private healthcare marketing.
Only living people can bring a claim. The Act says an action cannot be brought for an invasion of a deceased person’s privacy, or against a person who has died.
What the rules require
A plaintiff has to establish all of the following elements.
1. An invasion of privacy
Either intrusion upon seclusion or misuse of information that relates to them, as described above. If information was misused, it does not matter whether the information was true.
2. A reasonable expectation of privacy
A person in the plaintiff’s position must have had a reasonable expectation of privacy in all the circumstances. The court may consider the means used (including any device or technology), the purpose, the person’s attributes such as age, occupation or cultural background, their conduct, and, for misuse of information, the nature of the information. The Act specifically lists information relating to “health or medical matters” as relevant to the nature of the information, along with intimate, family and financial matters. It also looks at how the information was held or communicated and whether it was already public.
3. Intentional or reckless
The invasion must have been intentional or reckless, with “reckless” having the same meaning as in the Criminal Code. Pure accidents are not covered by the tort, although they may still breach the Privacy Act.
4. Serious
The court may consider the degree of offence, distress or harm to dignity likely to be caused to a person of ordinary sensibilities, whether the defendant knew or ought to have known that was likely, and, if the invasion was intentional, whether it was motivated by malice.
5. Public interest balancing
The public interest in the plaintiff’s privacy must outweigh any countervailing public interest. The Act gives examples such as freedom of expression, freedom of the media, open justice, public health and safety, and the prevention and detection of crime and fraud. Promoting a practice is not on that list.
No need to prove damage
The invasion is actionable without proof of damage. A patient does not have to show financial loss to bring a claim.
Defences
The Act provides defences where the invasion was required or authorised by law or a court or tribunal order; where the plaintiff, or someone with lawful authority for them, expressly or impliedly consented; where the defendant reasonably believed it was necessary to prevent or lessen a serious threat to life, health or safety; and where it was incidental to lawful defence of persons or property and proportionate, necessary and reasonable. Some defamation-style defences (absolute privilege, publication of public documents and fair report of proceedings of public concern) are available where the invasion involved publication.
For marketing, consent is the defence that matters. It is far easier to rely on if it was specific, informed and recorded.
Remedies
The court may award damages, including for emotional distress. Aggravated damages are not available. Exemplary or punitive damages are available only in exceptional circumstances. The combined total of damages for non-economic loss and any exemplary or punitive damages cannot exceed the greater of $478,550 and the maximum damages for non-economic loss in defamation proceedings under an Australian law.
The court can also grant other remedies, including an account of profits, an injunction, an order to apologise, a correction order, an order that material be destroyed or delivered up, and a declaration that the defendant seriously invaded the plaintiff’s privacy. An apology is not an admission of liability, but the court may take it into account when assessing damages.
Time limits
Proceedings must start before the earlier of one year after the plaintiff became aware of the invasion and three years after it occurred. If the plaintiff was under 18 at the time, they have until their 21st birthday. A court can extend time in some circumstances, but not beyond six years after the invasion. A single publication rule means that later republication of substantially the same material, in a manner that is not materially different, is treated as occurring on the date of first publication.
What it means for your marketing
Most practices will never face a tort claim. The threshold is high: intentional or reckless, and serious. But the conduct that would meet it is easier to stumble into in healthcare marketing than in most industries, because so much of what you might want to show is about patients’ bodies and health.
Before-and-after photos and case studies
Using a patient’s images or story is a use or disclosure of information that relates to them, and health and medical matters are expressly relevant to the reasonable expectation of privacy. If consent was vague, out of date, or did not cover the channel you are using, consent is harder to rely on. Ahpra’s advertising rules also apply to these images, and for cosmetic procedures there are additional requirements, so privacy consent is only one part of the picture.
Social media
Watch for patients appearing in the background of clinic photos or videos, waiting room shots, screens showing patient lists, and staff filming in treatment areas. Recording a person’s private activities is listed in the Act as an example of intruding upon seclusion. A post that is removed quickly may still have been seen and shared, and the single publication rule does not undo the original publication.
Google Business Profile and review replies
A defensive reply that reveals a reviewer’s treatment, appointment history or personal circumstances is a disclosure of information about them. Keep replies general, do not confirm someone is a patient, and take the conversation offline.
Influencers and patient content
If a patient films their own procedure or results and you repost it, you are using information that relates to them. Get specific written permission for each use, and check that the content also complies with Ahpra’s rules on testimonials.
Email and SMS
Sending a marketing message that reveals a condition or treatment to a shared email address or phone could expose information to others in the household. Keep marketing content general and avoid naming treatments in subject lines and previews.
In-clinic material
Treatment room cameras, call recording and patient photos on display boards all deserve a second look. Make sure patients know about any recording and that images on display are there with consent.
Common mistakes we see
- Relying on a general consent clause in new patient paperwork to cover future marketing use of photos.
- Consent forms that do not name the channels (website, social media, paid ads) or say how long images will be used.
- No easy way for a patient to withdraw consent, and no process to remove images everywhere they appear once they do.
- Staff posting from the clinic on personal accounts without guidance.
- Cropping a face out of a photo and assuming the person can no longer be identified, when tattoos, jewellery, setting or the caption still point to them.
- Responding to negative reviews with details about the patient’s care.
A practical checklist
- Use a dedicated, specific marketing consent form for any patient image or story, separate from clinical consent.
- Name each channel and use, and record the date, the version of the form and who obtained it.
- Explain how a patient can withdraw consent, and keep a register of where each image is used so you can remove it.
- Review all existing website galleries and social posts against your consent records.
- Set a social media policy for staff covering filming and posting in the clinic.
- Check photos and videos for patients, screens and documents in the background before posting.
- Write a short review response template that does not confirm or discuss any patient’s care.
- Review any cameras or call recording and the notices patients see about them.
- Know who to call for legal advice if a patient raises a privacy complaint.
How this fits with other rules
The tort runs alongside the Privacy Act’s existing complaint and enforcement system, not instead of it. A practice could face an OAIC complaint under the Australian Privacy Principles, a tort claim, or both. The Act states the tort is not intended to limit state or territory laws.
It also sits alongside Ahpra’s advertising rules, which control whether you can use certain content at all, such as testimonials, and how cosmetic procedures can be advertised. Something that satisfies Ahpra can still raise privacy issues, and the reverse is also true.
Data security failures are mostly dealt with under the Privacy Act itself. In October 2025, the Federal Court ordered Australian Clinical Labs to pay $5.8 million in civil penalties over the Medlab Pathology data breach, the first civil penalties under the Privacy Act. That case was brought by the Information Commissioner, not under the tort, but it shows the courts are now actively involved in privacy outcomes for healthcare organisations.
Frequently asked questions
Can a patient sue my practice even if we are a small business?
Yes, in principle. The OAIC explains that the tort extends to individuals and entities that are not APP entities, so business size does not exclude you. The patient would still need to prove every element, including seriousness and intent or recklessness.
Does the patient need to show they lost money?
No. The Act says the invasion is actionable without proof of damage. Damages can include an amount for emotional distress.
Is consent a complete defence?
Express or implied consent by the plaintiff, or by someone with lawful authority for them, is a defence. Whether consent covered what you actually did will depend on the facts, which is why specific, recorded consent matters.
How long does a patient have to bring a claim?
Generally the earlier of one year after becoming aware of the invasion and three years after it happened. For people under 18 at the time, until their 21st birthday. A court can extend this, but not beyond six years after the invasion.
Can staff be personally sued?
The tort applies to “another person”, and the OAIC says it reaches individuals as well as organisations. A staff member who personally invades a patient’s privacy could be a defendant. Seek legal advice on questions of liability.
Does the OAIC handle these claims?
No. The OAIC says it has no direct role in administering the tort and recommends individuals seek independent legal advice.
Related articles
- Using AI in your practice marketing: Ahpra and OAIC guidance
- Privacy Act amendments 2024: what changed for practices
- Tracking pixels on a health website: what practices need to know about patient privacy
- How to reply to Google reviews without breaching patient privacy
Need a hand?
If your website or social channels feature patient images or stories, it is worth checking them against your consent records now. Our compliance audit reviews galleries, case studies and social content, and our social media for clinics service works from documented consent. For practices that want staff to understand where the lines are, our compliance training covers filming, posting and review replies.
This article is general guidance based on the published rules, not legal advice. Final responsibility for how your marketing handles patient information and images sits with your practice, and complex situations may need independent legal or privacy advice.