Canva account at centre of legal fight over employee privacy

Australia’s new privacy laws have been used to prevent a business destroying a former employee’s personal information, including family medical records, that were stored on a Canva account, in an unusual early application of the new rules.

While the outcome of the case, which is being heard before the NSW District Court, is yet to be finalised, the temporary ruling to secure the account confirms courts can make powerful orders under the new laws for alleged serious invasions of privacy.

In July, Judge Matthew Charles Leckie Dicker, SC, said he was satisfied – at face value – that there had been a misuse of information by The Art Scene, a supplier of arts materials, and that its former sales and marketing manager Adriana Nehme had a reasonable expectation of privacy.

Dicker granted an interim injunction temporarily stopping The Art Scene from destroying any personal files belonging to Nehme before the case is heard.

Nehme said she had created a “Canva pro” computer account using her personal email sometime in 2020 and personally paid the subscription fees until July 2023. From July 2023 to July 2025, she used a work credit card. On March 19, this year, Nehme’s employment with The Art Scene was terminated.

While employed at the company, Nehme used the Canva account to store design work she produced for the company, but also to store personal documents and files including medical records for herself and her family; legal documentation and advice concerning a dispute with her employer; personal financial records, personal identification documents; and confidential client documents relating to her husband’s business.

In May 2023, Nehme granted access to a “single shared team folder within the Canva account” to another employee at The Art Scene.

Nehme said she did not grant administrator or owner rights to the Canva account to anyone associated with The Art Scene, except to the single shared team folder.

After leaving her job at The Art Scene, Nehme said she did not terminate the other employee’s access, or access through a company email address, to the single shared team folder, and that she continued paying the subscription costs herself.

In July 2026, Nehme received several emails from Canva noting changes in the account, after which she lost access to her personal folder.

“This seems to have been at the instigation of [The Arts Scene],” Dicker said. “The fact that the access was changed, apparently by the defendant, suggests to me for the purposes of this application that the invasion of privacy was intentional.”

Nehme said she tried to raise the seriousness of the access to information with Canva, contacted The Arts Scene, which indicated they were seeking legal advice, and eventually took the matter to police.

Canva did not respond to a request for comment from this masthead.

Dicker said the aim of an interim injunction was to “preserve the status quo until the rights of the parties can be determined at a final hearing, including to prevent the practical destruction of the right”.

A further hearing was scheduled for July 22 and legal representatives for The Arts Scene and Adriana Nehme declined to comment on the case on the basis that it was an ongoing legal matter.

University of Sydney law professor David Rolph said the case demonstrated that privacy concerns could go beyond media-related invasions of privacy.

“This case demonstrates privacy concerns can manifest in other areas such as employment disputes,” he said.

Get workplace news, advice and perspectives to help make your job work for you. Sign up for our weekly Thank God it’s Monday newsletter.