17 September 2014 New ALRC privacy tort and the celebrity photo hacking scandal


In Brief

The Australian Law Reform Commission (ALRC) released its report on its inquiry into the prevention of, and remedies for, serious invasions of privacy in the digital era on 3 September 2014.  The majority of its 16 recommendations relate to proposals for a new statutory tort for serious invasion of privacy.  Coincidentally, the release of the ALRC report came days after news of the apparent hacking of a number of celebrities' cloud storage accounts and the online publication of intimate personal photos from those accounts.  How would such incursions on privacy stand up to the proposed cause of action for serious invasion of privacy?


The ALRC has proposed a statutory civil cause of action for intentional or reckless invasions of privacy that are serious and that cannot be justified in the public interest.  It is proposed that a plaintiff must demonstrate that their privacy was invaded either by intrusion on seclusion or through misuse of private information.  A person in the position of the plaintiff should also have had a reasonable expectation of privacy in all of the circumstances in order to be successful in their claim.

Reasonable expectation of privacy

The ALRC has recommended a number of factors that a court should have regard to in determining whether a person in the position of the plaintiff would have had a reasonable expectation of privacy in all of the circumstances including: the nature of the private information (such as intimate/family, health/medical, or financial matters) and how it was held (e.g. utilising password protection or in a private communication/diary); the means used to obtain the information; and, the purpose of the misuse, disclosure or intrusion.  Other factors that should be considered include the conduct of the plaintiff and the extent to which they invite publicity or desire privacy.

Seriousness of the breach

In determining whether a breach is a serious breach and is therefore actionable under the proposed new cause of action, the ALRC has recommended that a court should have regard to the degree of any offence, distress or harm to dignity that the invasion of privacy was likely to cause to a person of ordinary sensibilities in the position of the plaintiff; and whether the defendant's intention was malicious or  whether the defendant knew the invasion was likely to offend, distress or harm the dignity of the plaintiff.


If we assume that the proposed tort has been enacted, that the perpetrator is identifiable and that the recent hacking and online publication of nude photos of various A-list celebrities would be actionable in Australia, would the other elements of the proposed new tort be established?

  • Intention or recklessness? It would be difficult to establish that hacking numerous personal cloud storage accounts of targeted high-profile individuals, downloading photographs from those accounts and then posting them online, would be anything other than reckless or intentional.
  • Misuse of private information? The ALRC specifically contemplates that collecting and disseminating private information, including through publication online may be an actionable misuse.
  • Reasonable expectation of privacy?  Nude photographs of an individual stored in their personal cloud storage account under password protection which could only be obtained by the defendant through hacking the account or service would, in the normal course, be considered to attract a reasonable expectation of privacy.  It is submitted that even the proactive publicity-seeker should be considered to have a reasonable expectation of privacy in respect of private information they elect to store in a secure medium.  In fact, the ALRC suggests in its report that the very fact of the defendant having to use means such as hacking will indicate that the plaintiff did have a reasonable expectation of privacy regardless of the nature of the private information obtained.
  • Serious invasion?  For most individuals the unauthorised public dissemination of graphic nude photographs of themselves would cause considerable distress or harm to their dignity and so would be considered a serious invasion of privacy. 
  • Public interest?  It is hard to imagine in this case that the legitimate public interest in freedom of expression is served by the hacking and online publication of photographs of nude celebrities.

The hacking of personal cloud storage accounts and publication of nude photographs obtained as a result, is clearly a serious invasion of privacy as contemplated by the ALRC recommendations for the new tort.   At this point however, the proposed new tort is only a proposal and there are questions over the constitutional power of the Commonwealth to legislate for this new tort, as well as the appetite of the current government to enact the recommendations for reform.  It remains to be seen if this or future governments will legislate for the new tort.

If you have any queries on privacy law please contact us.

If you would like to republish this article, it is generally approved, but prior to doing so please contact the Marketing team at

This article is not legal advice and the views and comments are of a general nature only. This article is not to be relied upon in substitution for detailed legal advice.

Back to publications
Association Memberships
Tristan Jepson Memorial Foundation
  • 2018 - Recommended Doyles Guide
  • 2018 - Recommended Doyles Guide
  • 2018 - Recommended Doyles Guide