The privacy tort and employers: workplace exposure

Last checked 25 September 2026 against the Privacy Act 1988 compilation C2026C00227 (compilation date 4 June 2026)

Sch 2 cl 7 the law, read in the authorised textOAIC guidance the regulator's published guidance, which is not law

Why employers should look at the tort

The statutory tort for serious invasions of privacy is in Schedule 2 of the Privacy Act 1988. It commenced on 10 June 2025.¹ Any individual can bring a claim: an employee, a former employee, a job applicant, a contractor, a client or a visitor to your office.²

Two features matter most to a small employer:

• Turnover is irrelevant. Schedule 2 has no $3 million threshold. The OAIC says the tort "is broader in application than the Privacy Act, extending to individuals and other entities that may not necessarily be an Australian Privacy Principle entity".³
• It is decided by the courts. The OAIC "does not have a direct role in administering the tort".³ A claim is a civil action for damages or other orders, not a complaint to a regulator.

The general guide to the statutory tort covers the defences, remedies, damages cap and time limits in full.

What an employee would have to prove

A claim succeeds only if the plaintiff proves all five elements in clause 7(1):⁴

1. the employer intruded upon their seclusion or misused information that relates to them, or both;
2. a person in their position would have had a reasonable expectation of privacy in all of the circumstances;
3. the invasion was intentional or reckless;
4. the invasion was serious; and
5. the public interest in their privacy outweighed any countervailing public interest.

The plaintiff does not have to prove that they suffered damage.⁵ Intruding upon seclusion includes "watching, listening to or recording the person's private activities or private affairs". Misusing information includes "collecting, using or disclosing information about the individual".⁶

The bar is high. A careless mistake is not enough on its own, because the invasion must be intentional or reckless, and it must also be serious. But ordinary workplace practices can meet the first element, so they are worth reviewing.

Where workplace exposure can arise

The table maps common practices to the element of the tort they can touch, and to the matters Schedule 2 lets a court consider. Whether any particular practice invades privacy depends on all the circumstances.

If you provide AML/CTF designated services, your AML/CTF policies must deal with personnel due diligence (AML/CTF Act s 26F(4)(d)).⁷ That means collecting information about staff. Collect what the program needs, record why, and keep it secure. The OAIC lists "excessive collection and retention of personal information" among its regulatory action priorities for 2025–26.⁸

The employee records exemption does not answer the tort

Many employers rely on the employee records exemption. Under s 7B(3) of the Privacy Act, an act or practice of an organisation that is or was an individual's employer is exempt for the purposes of s 7(1)(ee) if it is directly related to the employment relationship and to an employee record the organisation holds about that individual.⁹ That exemption concerns the Australian Privacy Principles.

Schedule 2 works differently:

• it is "intended to be read and construed separately from the rest of this Act", and in working out what a clause of Schedule 2 means, the rest of the Act is disregarded;¹⁰
• its defences and exemptions are listed in the Schedule itself (clauses 8 and 15 to 18), and an exemption for employee records is not among them.¹¹

The employee records exemption also reaches only an employer's own employees and former employees. It says nothing about job applicants who were never employed, contractors, clients or visitors.⁹

Defences that matter at work

Of the defences in clause 8(1), three are most relevant to employers:¹²

• Consent. The plaintiff, or a person with lawful authority to act for them, expressly or impliedly consented to the invasion. A written, communicated monitoring policy is evidence of what staff were told. Whether it amounts to consent to a particular act is for a court to decide.
• Lawful authority. The invasion was required or authorised by or under an Australian law or a court or tribunal order.
• Defence of persons or property. The invasion was incidental to the exercise of a lawful right of defence of persons or property, and was proportionate, necessary and reasonable. Whether a camera meets that test depends on what it covers and why.

Schedule 2 does not say when a business is liable for an invasion of privacy committed by one of its employees. If that question arises, get legal advice. State and Territory laws continue to operate alongside Schedule 2, including any surveillance or listening-device laws where you operate.¹³

Practical steps for employers

1. Write a monitoring policy

   Say what you monitor (cameras, email, devices, location), why, where, who can see the results and how long you keep them. Review it when you add a new tool.

2. Tell staff before you start

   Give the policy to staff, and to new starters before their first day. Record that you did. Avoid covert monitoring unless a lawyer has advised that it is lawful where you operate.

3. Collect the minimum

   Collect only what the role, the law or your AML/CTF program requires, and delete it when it is no longer needed.

4. Restrict access to staff files

   Keep health, leave and disciplinary information in a restricted file. Share it only with people who need it, and never in a group email or chat.

5. Plan for a breach

   Decide in advance who does what if staff information is lost or wrongly disclosed. Whether the Notifiable Data Breaches scheme applies depends on whether you are an APP entity and on the information involved; our data breach response plan explains the test.

6. Deal with complaints early

   An apology is not an admission of liability for the purposes of Schedule 2, and a court may take an apology into account in setting damages. Sch 2 cl 13 Sch 2 cl 11(6)

Where to go next

• The tort in full: the statutory tort for serious invasions of privacy.
• The rest of the Privacy Act: the Privacy Act section covers the small business test, privacy policies, data breaches and the dates coming up.
• Every source we use is listed on our sources page.

AMLCompliant is published by Wani Meridian Pty Ltd, an independent private business. We are not affiliated with, or endorsed by, the Office of the Australian Information Commissioner, the Attorney-General's Department or any other government body. This guide is general information, not legal or employment advice.

Independent. Not affiliated with, or endorsed by, AUSTRAC or the Australian Government.