In the closing Parliamentary days of 2024, the Australian Federal Parliament created a new statutory privacy tort action, which may have a significant impact on churches and other religious groups. In the context of a possible disciplinary action against someone who has behaved contrary to the principles of a religious group to which they belong, it may be necessary to inform other members of the group about the person’s behaviour. In doing so the group will be in danger of breaching a right of privacy set up by the new law. The tort action (which will probably come into operation on 11 June 2025) seems to cut across important rights of religious freedom, and the exemptions under the law do not take this into account.

In this post I aim to outline some aspects of the operation of the new law, and recommend that before it commences Parliament provide specific recognition of religious freedom as an exemption to the availability of the action. In this discussion I will specifically refer to the impact on Christian churches, but my comments will in most cases be also applicable to other religious traditions and to other organisations operating with a religious ethos.

The new tort action was created by the Privacy and Other Legislation Amendment Act 2024 (Cth; No. 128, 2024), and in particular by the insertion of a new Schedule 2 into the Privacy Act 1988 (Cth). However, while the action will be contained in a Schedule to the 1988 Act, the amendments make it clear that it is actually not meant to be read in light of other provisions of the 1988 legislation, and is meant to be essentially found completely within Schedule 2. (See the final note at the end of s 2 of Schedule 2: “This Schedule is intended to be read and construed separately from the rest of this Act”.) My comments here then will not relate to other amendments made by the 2024 Amendment Act, but simply to the terms of new Schedule 2. (I have found it helpful to download a pdf of the whole 2024 Act but then to “bookmark” the start of the Schedule 2 amendments). The commencement provisions in the 2024 Act (see s 2(1), item 8) specify that the addition of new Schedule 2 will take place either by separate proclamation, or automatically the day after the expiry of 6 months after Royal Assent, which was given on 10 December 2024.

After that technical information, let’s consider what Schedule 2 does. The main effective provision is clause 7, which creates a “cause of action” for breach of privacy:

7 Cause of action

(1) An individual (the plaintiff) has a cause of action in tort against another person (the defendant) if:
(a) the defendant invaded the plaintiff’s privacy by doing one or both of the following:
(i) intruding upon the plaintiff’s seclusion;
(ii) misusing information that relates to the plaintiff; and
(b) a person in the position of the plaintiff would have had a reasonable expectation of privacy in all of the circumstances; and
(c) the invasion of privacy was intentional or reckless; and
(d) the invasion of privacy was serious; and
(e) the public interest in the plaintiff’s privacy outweighed any countervailing public interest.

(2) The invasion of privacy is actionable without proof of damage.

A couple of things worth noting. This clause creates a private “cause of action”, a “tort”. This is not the same thing as creating a criminal offence, which would be prosecuted by the government. Instead, this civil action (which is another way of describing a “tort”) can be brought by an individual person who claims to have had their privacy breached. Most tort actions have been created at common law by a history of court decisions, and tort actions deal with a range of important civil rights that we can choose to seek a remedy for if breached: rights of personal bodily integrity, freedom of movement, enjoyment of possession of land and goods, our rights to a good reputation among others not sullied by lies. But torts can also be created by Parliament, and this is an example of an explicit “statutory” tort.

Something else important hangs on the use of the word “individual” in cl 7 to describe the person who can take an action. The use of this word for the plaintiff means that actions under cl 7 can only be taken by individual human beings, and not by corporations or collective bodies. However, the use of the word “person” to refer to the defendant means that corporations are included in those who can be sued for breach of privacy. (See the Acts Interpretation Act 1901 s 2B definition of “individual” as a “natural person”, and s 2C, including companies when the word “person” is used.)

Before going into other aspects of Schedule 2, let’s set up a couple of scenarios in church life. In Scenario 1, the governing body of the church discovers that a member of the team that teaches children on Sunday morning, “A”, has had a history of grooming and child abuse (which he did not previously disclose). We may assume that this has occurred despite the church requiring “Working with Children” checks to be done appropriately; somehow this man has slipped through the various procedures. The leaders, as well as immediately standing A down from the children’s team, think that they ought to alert all the parents of children whom A was in contact with of the reason for their decision, in case it emerges that he was behaving inappropriately towards their children. In doing so, will they be subject to an action for breach of privacy by A, under cl 7?

We will also consider Scenario 2: a female member of the staff team,”B”, with responsibility for ministry amongst the women of the church, is found to have been having an affair with a man who is not her husband. This is contrary to the church’s commitment to Biblical principles of sexual behaviour, which of course forbid adultery (sleeping with someone who is not your spouse). B is stood down and will be asked to leave the church unless she repents. While the leaders do not propose to announce the reasons for her dismissal to the whole congregation, they believe that they should communicate these facts to the bible study groups of women who were being led by B. They believe these women will be hurt and upset if B simply leaves with no explanation, and want to be clear about why the decision has been made so that they are seen to be applying Biblical principles. If they do so, are they in danger of being sued for breach of privacy under cl 7?

Of course these are not the only situations where privacy issues might arise, but hopefully our discussion will illustrate how the new law might apply, and why some amendments are needed.

Scenario 1: child abuse

To anticipate, I have chosen this scenario because I am pretty sure that what is proposed would not give rise to a privacy action. But let’s see how that would work out.

The first step would be to see if what was proposed to be communicated would “invade the defendant’s privacy” in terms of cl 7(1)(a). There are two alternatives here: either it would amount to an “intrusion on seclusion” under sub-para 7(1)(a)(i), or would be “misusing information that relates to the plaintiff”, under sub-para 7(1)(a)(ii).

In general, cases of the sort we are discussing here will not fall under the “seclusion” limb, which seems to be designed to deal with situations where someone is physically annoyed when they want to be left alone, or secretly observed. The definition of the term in cl 6(1) is:

intruding upon the seclusion of an individual includes, but is not limited to, the following:
(a) physically intruding into the person’s private space;
(b) watching, listening to or recording the person’s private activities or private affairs.

However, there is a definition of the second form of invasion of privacy,”misusing information,” in cl 6(1), which is quite broad:

misusing information that relates to an individual includes, but is not limited to, collecting, using or disclosing information about the individual.

Hence it seems that disclosing any information about someone, to anyone else, would fall into the category of “misusing” information about the person. Here, telling parents about prior misbehaviour of A clearly falls within this definition. (It must be stressed that simply doing something that satisfies this definition, despite its unfortunate framing as “misuse”, does not mean that what has been done is unlawful, or even morally wrong. All other “elements” of the tort action in cl 7 need to be satisfied before it can be concluded that what was done was even a prima facie legal wrong, and even where that is true various defences may apply. But for this stage of the analysis, we can say that “misuse” within the statutory definition has occurred.)

The second question is whether the disclosure has occurred where, under cl 7(1)(b), “a person in the position of the plaintiff would have had a reasonable expectation of privacy in all of the circumstances”. Here is probably where, for this scenario, any purported tort action under cl 7 would fail. It seems clear that under general community standards, even outside a church context, no-one who has abused children can have a “reasonable” expectation of privacy. They may subjectively justify this to themselves in various ways, but the “reasonable” standard is an objective one judged by community expectations overall. It is true that under cl 7(5)(f)(i) one of the issues to be considered in determining “reasonable expectation of privacy” is whether the information being disclosed “related to intimate or family matters”, but cl 7(5) makes it clear that the matters listed there do not limit the matters which may be considered, and in my view someone who abuses children can have no such expectation of privacy.

We could stop our analysis here, and move on to Scenario 2. However, as I stress to my law students, it is always best to explore all possibilities, so in case I am wrong about this point, I will consider the other issues that might be raised.

The third question, under cl 7(1)(c), is whether the disclosure was (or would be, if done) “intentional or reckless”. This element seems to be satisfied. If parents were told, the church would intend to do so and to convey the relevant information about A.

The fourth question, under cl 7(1)(d), is whether “the invasion of privacy was serious.” Yes, labelling someone as a child abuser is indeed one of the most serious of accusations that can be made. This is clear even without needing to consider the issues spelled out on this topic in cl 7(6).

The fifth question, under cl 7(1)(e), is whether “the public interest in the plaintiff’s privacy outweighed any countervailing public interest”. Here it is worth noting that the “onus of proof” on this point lies with the plaintiff- the plaintiff has to make the case that their interest in privacy outweighs any relevant “public interest” from other perspectives. Here we are given some assistance by sub-cl 7(3), which provides some guidance on the question of what might be the relevant “countervailing” public interests:

(3) Without limiting what constitutes a countervailing public interest, any of the following matters of public interest may constitute a countervailing public interest:
(a) freedom of expression, including political communication and artistic expression;
(b) freedom of the media;
(c) the proper administration of government;
(d) open justice;
(e) public health and safety;
(f) national security;
(g) the prevention and detection of crime and fraud.

However, there is no specific reference here to the safety of children. Nor, as we will pick up more below, is there a reference to “freedom of religion”. Still, there are a couple of points where we could argue that disclosure of A’s activities would be clearly in the public interest. For example, without knowing all the details, it seems likely that acts of child abuse represent criminal activities, and so disclosure of his action would perhaps assist in the “detection” of crime (if they led, for example, to other parents whose children had previously not been known to be abused, discovering and reporting such abuse.)

But the more persuasive point would be that cl 7(3) provides what lawyers call an “inclusive”, not an “exclusive”, definition, so that anything that satisfies the general description of a “countervailing public interest” can be relied on, even if not specifically listed here. In this context I was interested to see the following comment which was added in the course of Parliamentary debate to the “Explanatory Memorandum” designed to explain the Government’s view of how the legislation should operate:

‘The list is not intended to be exhaustive; other important countervailing public interests not included in the list may be engaged in the circumstances of a particular case. For example: the public interest in the protection of vulnerable persons, including children.’ (emphasis added)
(This comment added by the “Addendum” to the Explanatory Memorandum, para 44, and deemed to replace para 419 of the original Explanatory Memorandum.)

So it seems clear that the interests of children would be a public interest which would over-ride any “public interest” in the privacy of A in not having his behaviour exposed. This would mean that even if he could satisfy para 7(1)(b) (which in my view he could not), he would not be able to satisfy para 7(1)(e). As all paragraphs (elements of the tort) need to be satisfied, any action he took would be likely to fail.

In addition to the above, we should note that even if the plaintiff had somehow been able to make out a prima facie case (that is, an apparently good case by satisfying the elements of the tort action), there are a number of defences available. Under cl 8 these defences include:

(c) the defendant reasonably believed that the invasion of privacy was necessary to prevent or lessen a serious threat to the life, health or safety of a person; or
(d) the invasion of privacy was:
(i) incidental to the exercise of a lawful right of defence of persons or property; and
(ii) proportionate, necessary and reasonable.

Without going into this in too much depth, it seems arguable that disclosure of the information about A’s wrongdoing to parents was necessary to prevent or lessen a serious threat to the “safety” of children (so that no more children would be exposed unwittingly to A’s overtures), and also that in a similar way the action was one which was taken in “defence” of the children’s bodily safety and was proportionate (it was only to certain parents, not to the whole congregation), necessary and reasonable. So these defences would further support the failure of any tort action brought under cl 7 by A.

Scenario 2: sexual misconduct of staff

We turn then to consider a decision to notify women in small groups led by B that she has been stood down as a staff member and is guilty of adultery. Assuming this has been done, does B have a tort action under cl 7 against the church?

First, in terms of the definition in the Schedule, there has been a “misuse” of information about B because the information was disclosed to the women. (Again I note how inappropriate this terminology is! The definition uses the term “misuse” to describe what may be a perfectly correct collection or sharing of information. But that is the way the legislation is worded.)

Second, did B have a “reasonable expectation of privacy in all of the circumstances”? This is a slightly tricky question. In the general community, it would probably be said that a person has a reasonable expectation that a clandestine love affair would not be made public without their permission. However, it could be argued that someone who is a leader in a church should be well aware of the church’s commitment to Biblical sexual standards, and it could be further argued that they should be aware that if they breach such standards, one consequence might be that this would be disclosed to others. Resolution of this issue is not clear, and may depend on whether a court hearing an action was prepared to apply only general community norms, or would hold that accepting a leadership role in a group with specific moral standards on sexual behaviour means accepting the possibility of discipline when those standards are breached.

In light of this uncertainty, it might be wise for a church to spell out in any contractual arrangements with staff the standards that they are expected to adhere to, and also to note that should those standards be breached, church disciplinary processes may require disclosure of such breach to other affected congregation members. One could then argue that the “circumstances” would need to take into account this acceptance of what would otherwise be an invasion of privacy. It would be relevant that cl 7(5)(c), in setting out matters relevant to a “reasonable expectation of privacy”, refers to the plaintiff’s “occupation” as one matter to be taken into account. Under cl 7(5)(d), it is also said to be relevant to consider “the conduct of the plaintiff, including whether the plaintiff invited publicity,” and it could be strongly argued that someone who had agreed to the terms of such an arrangement had impliedly “invited” publicity in the relevant circumstances.

Third, the invasion of privacy would be intentional (as there was a clear intention to convey the information.)

Fourth, it would arguably be a “serious” invasion of privacy. Again there is some uncertainty here. Disclosure of an extramarital affair may not be regarded as a major issue in some parts of the community. But in a church with a commitment to Biblical morality, it would be a serious thing for a person to be identified as guilty of adultery.

Finally in considering the elements of the tort, is there a “countervailing public interest” in the disclosure? I noted above the specific such interests listed in cl 7(3), none of which would seem to apply to an issue of church discipline. However, as I noted in relation to protection of children, the definition of the term by listing the specific matters in cl 7(3) is said to be “without limiting what constitutes a countervailing public interest”.

I would argue that the important human right to free exercise of religion by religious groups is indeed a countervailing public interest which would justify this disclosure. It is, however, a significant omission from the matters noted in cl 7(3). Para 7(3)(a) refers to “freedom of expression, including political communication”. This could be justified by the recognition of freedom of speech as a significant value in our community, and in particular in international human rights law under art 19(2) of the International Covenant on Civil and Political Rights, to which Australia is a party. However, right next to art 19 we find art 18, which refers to religious freedom rights:

18.1. Everyone shall have the right to freedom of thought, conscience and religion. This right shall include freedom to have or to adopt a religion or belief of his choice, and freedom, either individually or in community with others and in public or private, to manifest his religion or belief in worship, observance, practice and teaching.

The reference to exercise of this right “in community with others” recognises the key role that religious communities play in protecting and furthering religious freedom. And international jurisprudence on this and related rights clearly recognises that there are circumstances where an individual can be removed from a religious group on account of their behaviour contrary to the ethos of the group: see for example Sindicatul “Pastorul Cel Bun” v Romania (2014) 58 EHHR 10, approved in Australia in Iliafi v The Church of Jesus Christ of Latter-Day Saints Australia [2014] FCAFC 26 at [78].

On this basis a countervailing public interest here would be the interest of the church (and the members of the church) in operating in accordance with its faith commitments as to the standards to be required of leaders, and in caring for its members who have been affected by a breach of those standards. However, whether a court would recognise such an interest is not clear, and it would be far more preferable if Parliament added to cl 7(3) “freedom of thought, conscience and religion” in accordance with art 18 of the ICCPR. The argument in favour of this is particularly strong given that the main constitutional justification for Schedule 2, under cl 4, is said to be Australia’s obligations under the ICCPR!

A quick review of the “defences” and “exemptions” in the rest of Schedule 2 does not reveal any of these that would be relevant as a defence to a civil action brought in the circumstances of scenario 2.

Other matters

There are a number of other uncertainties about the operation of new Schedule 2 and the statutory privacy tort which I will leave for the moment. One is whether “vicarious liability” applies, so that a church can be held strictly liable for an invasion of privacy committed by an employee. Schedule 2 does not address this issue; since the action is specifically said to be a cause of action “in tort” it seems that Parliament is relying on the common law for the answer to the question. (Much more could be said here but it is worth noting, as I have recently mentioned, that the High Court of Australia has rejected the expansion of vicarious liability beyond the classic areas where it operates, which for most purposes will be employment arrangements. Clergy are not usually employees, though there are some exceptions. However, actions taken by resolution of a management committee, or by senior leaders, would probably be regarded as actions of the church as a whole, which might then be liable for the tort created by cl 7.)

Another significant legal question is whether Schedule 2 can actually be constitutionally supported as a valid law of the Federal Parliament. Within the schedule, as noted above, the main constitutional justification provided (in cl 4) is reliance on the ICCPR. But that Convention, while it mentions “arbitrary or unlawful interference with … privacy” in art 17.1, provides very little else to support the detailed regime established here. Other supporting justifications are provided in cl 5, with a mixed bag of possible heads of power including communications, corporations, Territories, trade and commerce, banking and insurance, and the “incidental” power. Whether these will all withstand scrutiny is unclear, and for present purposes it is worth noting that most of these other grounds would clearly not apply to a disciplinary action in a church.

Still, final resolution of these matters must await further consideration by the courts. For the moment it would be wise for churches and other religious groups to clearly communicate standards of behaviour expected from their leaders or members, and to only collect and convey information about serious matters in ways that can be clearly justified in the interests of the faith commitments of the group and its members.