On 29 November 2024 the Privacy and Other Legislation Amendment Bill 2024 (Bill) was passed by Commonwealth Parliament. The Bill covers several privacy reforms which will soon be implemented. This includes expanded enforcement powers and reforms concerning automated decision making, as well as serious invasions of privacy.

Additionally, the Bill includes further privacy reforms concerning the criminalisation of types of conduct that could impact an individual’s privacy.

What is Doxxing?

Doxxing is the intentional malicious exposure of an individual's personal data online. It involves conduct that may expose an individual whose personal data is released to harassment, threats to life or physical safety, public embarrassment, humiliation or shaming, discrimination, stalking, identity theft and/or financial fraud.

Doxxing can also cause psychological harms, both directly and as a result of the occurrence, or the fear of the occurrence, of the above-mentioned harms.

This offence is not intended to criminalise legitimate conduct such as media reporting, political commentary, or public debate on matters of public interest because such conduct is not typically done so in a manner that a reasonable person would regard as being menacing or harassing.

Doxxing Offences

1. The person uses a carriage service to make available, publish or otherwise distribute information; and
2. The information is personal data of one or more individuals; and
3. The person engages in the conduct in a way that reasonable persons would regard as being, in all the circumstances, menacing or harassing towards those individuals.

The second offence is comprised of an additional aggravating component. An aggravated offence is committed if the person engages in the conduct in whole or in part because of the person’s belief that the ‘group’ is distinguished by race, religion, sex, sexual orientation, gender identity, intersex status, disability, nationality or national or ethnic origin. ’Group’ is a term that is already adopted in the Criminal Code.

Personal Data

Personal data includes a name, photograph, telephone number, email address, online account, residential or business address.

Menacing or Harassing

To menace or harass involves conduct that is threatening or repeatedly vexatious to such an extent as to cause a person to fear for their safety, or limit their ability to go about their daily life. These terms have been used in criminal law since 2004, including in section 474.17 of the Criminal Code.

An offence could include the publishing of an individual’s contact details on social media, on a website, or during online multiplayer games, and encouraging others to menace or harass the individual.

However, a person who makes personal data, such as the name of an individual and their contact information, available to an Australian business for a legitimate purpose would not constitute menacing or harassing behaviour.

Penalties

The penalty for a non-aggravated offence is imprisonment for up to 6 years. The penalty for the aggravated offence is imprisonment for up to 7 years.

Application/ Implications

The term ‘doxxing’ is very broad and therefore has the potential to criminalise many forms of conduct in situations that lead to a person being menaced or harassed following their personal data being made available/ published/ distributed. For example:

• Data breaches: if personal information is published as a result of a data breach
• Employment: an employer or employee who made available / distributed contact details or photos of other employees or former employees
• Domestic relationships: intimate images and videos, including deepfakes, being distributed, for example involving former partners
• Social media: embarrassing videos, pranks, and other content without consent, incorporating the image or contact details of an individual on a social media platform.
• Websites & Platforms: platforms that allow individuals to publish or otherwise distribute content and do not remove personal data despite being requested to do so. This could not only include social media platforms, but also review sites and other sites that allow users to post comments and content

Liability could also extend to those involved in or knowingly concerned in making available, publishing, or distributing personal data. That is, a party could be held liable as an accessory for further distributing and publishing personal data (for example, re-posting information, or not adequately securing personal data).

Comment

There has been no clear differentiation between penalties for certain types of ‘personal data’ being published, made available or distributed. For instance, there is no guidance as to whether leaking sensitive information may warrant a harsher punishment under doxxing laws, compared to publishing an individual’s name and social media handle.

Conclusion

In an era in which digital technologies are advancing at a rapid rate, the introduction of anti-doxxing measures that protect the privacy of individuals couldn’t come at a better time.

Doxxing laws should assist in protecting against privacy breaches and invasions of privacy, both by criminalising the release of personal data, and by deterring doxxing. The Bill, once implemented, should also assist in protecting individuals against the consequential harms associated with doxxing.

As doxxing can be used to silence or humiliate an individual, doxxing laws will give a voice to victims and may be used as a mechanism to hold those perpetrators accountable for their actions.

Should you wish to discuss the Bill, privacy rights and obligations, please do not hesitate to contact us. We also deliver presentations and training to our clients on privacy laws, data breaches and the implications of privacy law reforms.

Further information / assistance regarding the issues raised in this article is available from the author, Bill Fragos, Special Counsel or your usual contact at Moray & Agnew.