Making Tax Digital for Income Tax — Quarterly Update Due
FTC Fake Reviews Rule Check (16 CFR Part 465)
Why this matters.
Since 10 June 2025, individuals in Australia have been able to sue for a serious invasion of privacy under a new statutory tort in Schedule 2 to the Privacy Act 1988, inserted by the Privacy and Other Legislation Amendment Act 2024. Unlike the Australian Privacy Principles, the tort is not limited to businesses with turnover above $3 million. It applies to sole traders, small businesses, organisations and individuals alike. A person can bring a claim where someone intruded on their seclusion (for example by filming, recording or watching them) or misused information about them, where they had a reasonable expectation of privacy, the invasion was serious, it was intentional or reckless, and the public interest in their privacy outweighs any competing public interest.
The court can award damages, including for emotional distress, without the person having to prove financial loss, as well as injunctions and orders to destroy material. Damages for non-economic loss and exemplary damages are capped, but a claim can still be costly, and there is no exemption for small businesses. The risk is highest where you use CCTV or listening devices, monitor staff, take or share images of customers, or handle sensitive personal information. There are defences, including consent, acts required or authorised by law, and necessity, and exemptions for journalism, law enforcement and some government activities. Claims must generally be brought within one year of the person becoming aware of the invasion and no later than three years after it happened.
