From Click to Conviction: The Law on Posting Personal Information Without Consent
By Mathai Joshi
Understanding implications of Section 474.17C of the Criminal Code Act 1995 (Cth)
It is no surprise that we are well and truly living in the digital age of technology. We live in a time where the internet and social media play a significant role in the way we live our lives as well as improve how we do our jobs.
Whether it is from posting, sharing, or tagging each other, one misguided click or ill thought social media post can now put you in position where you can face serious legal consequences.
Recent changes to the Federal Criminal Law in Australia, sharing a person’s personal information online without their consent, despite whether or not the content is truthful, can constitute a Commonwealth Criminal Offence.
Section 474.17C of the Criminal Code Act 1995 (Cth) criminalises the use of a carriage service (such as the internet, phone, or social media) to make available or publish the personal data of a person in a way that is either menacing, harassing, or offensive.
This new criminal offence is the Australian Government’s response to the modern practice of ‘doxing’ which is when a person publicly shares someone’s personal details to shame, intimidate or endanger them.
When and Why was this passed?
Section 474.17C was included in the Privacy and Other Legislation Amendment Bill 2024, which was a Bill designed by Parliament to introduce a range of measures to protect the privacy of individuals with respect to private and personal information. The Bill expands the Information Commissioner’s powers and, in the context of Criminal Law, to create offences targeting the release of personal data using a carriage service in a manner which would be menacing or harassing.
The Minister responsible for the bill in his second reading speech, outlined the growing risks posed by people misusing digital platforms to expose or endanger others, often in a context of domestic disputes.
The law is said to fill in the gap where there is no existing offence which deals with the public disclosure of personal information with an intent to harm.
What does the offence Criminalise?
Under the new provision, a person commits an offence if they:-
- Use a carriage service (e.g., phone, text, email, social media),
- To make available, publish, or transmit personal information of one or more individuals,
- Without the consent of those individuals,
- In a way that a reasonable person would regard as menacing, harassing, or offensive.
Key points are as follows:-
- Personal information can include names, addresses, phone numbers, workplace details, and more.There is no constraint of the type of the information.
- The law does not require the information to be true or false, meaning that there is no requirement as to the veracity of the post rather the intention behind it.
- The offence primarily focuses on the intent and impact of the post and whether the act could cause fear, distress, or reputational harm.
- The key mental element is that of recklessness and whether you had an awareness that there was a substantial risk that what you post could be regarded as menacing, or harassing despite being aware of the risk.
Who can be affected?
It is important to note that because it involves a ‘reasonable person’ test there will be a wide disagreement between people as to what will be expected when it comes to privacy and publication of personal information.
The rationale behind this offence creates problematic scenarios of what may or may not be criminal conduct because it has a broad application across both personal and professional settings.
Conduct may include:-
- An ex-partner posting someone’s private address online.
- A former employee leaking client or staff details on social media.
- A social media user naming and shaming someone in a viral post with identifying details.
- Even if there is no financial motive, the emotional or reputational fallout—and the reckless disregard for safety—can be enough to trigger a charge.
The conduct could even include that of posting information in relevant local Facebook pages identifying someone for an alleged act or conduct.
Summary
These new provisions show that regardless of what we may intend to post, ignorance will not suffice as a defence to reckless behaviour online. What might feel like a quick post in the heat of the moment could result in serious criminal charges. This new provision is a significant step in addressing inappropriate online conduct and the need to regulate it like any other form of abuse of intimidation.
So before you click “post” consider whether it is worth risking a potential criminal conviction.