1. Background, Purpose and Legislative Structure
The Online Safety Act 2021 (Cth) is the principal Commonwealth statute establishing Australia’s regulatory framework for specified categories of online harm. It received Royal Assent on 23 July 2021. The bulk of its operative provisions commenced on 23 January 2022, replacing and expanding the framework previously contained in the Enhancing Online Safety Act 2015.
The Act is administered by the eSafety Commissioner, an independent statutory office holder established under Part 2. The Commissioner’s functions are set out in s 27 and the general powers in s 28.
Objects — s 3
The objects of the Act are:
(a) to improve online safety for Australians; and
(b) to promote online safety for Australians.
The Act does not create a single general power to remove “harmful” or “offensive” online material. It establishes a series of distinct statutory schemes, each with its own definitions, thresholds, regulated entities, notice provisions and enforcement consequences.
Any exercise of power must therefore be assessed against the specific scheme and the specific statutory conditions that attach to that power.
Implied freedom of political communication — s 233
Section 233 expressly provides that the Act does not apply to the extent (if any) that its operation would infringe the implied freedom of political communication.
This is part of the Act’s internal architecture and must be taken into account when the material in question concerns political communication.
2. Key Definitions
2.1 Serious harm — s 5
Section 5 provides:
“serious harm” means serious physical harm or serious harm to a person’s mental health, whether temporary or permanent.
The Act further provides that:
“serious harm to a person’s mental health” includes:
(a) serious psychological harm; and
(b) serious distress;
but does not include mere ordinary emotional reactions such as those of only distress, grief, fear or anger.
This statutory definition is critical.
Ordinary emotional responses do not meet the statutory threshold of serious harm.
2.2 Cyber-abuse material targeted at an Australian adult — s 7
Section 7 provides the statutory definition of cyber-abuse material targeted at an Australian adult.
Section 7(1)
For material to constitute cyber-abuse material targeted at an Australian adult, the statutory conditions include:
(a) The material is provided on:
- a social media service; or
- a relevant electronic service; or
- a designated internet service;
(b) an ordinary reasonable person would conclude that it is likely that the material was intended to have an effect of causing serious harm to a particular Australian adult;
(c) an ordinary reasonable person in the position of the Australian adult would regard the material as being, in all the circumstances, menacing, harassing or offensive; and
(d) such other conditions (if any) as are set out in the legislative rules.
Where these conditions are satisfied:
(e) the material is cyber-abuse material targeted at the Australian adult; and
(f) the Australian adult is the target of the material.
Section 7(2) further provides that the relevant effect may be:
(a) a direct result of the material being accessed by, or delivered to, the Australian adult; or
(b) an indirect result of the material being accessed by, or delivered to, one or more other persons.
Cumulative nature of the test
The test is cumulative.
Both of the principal substantive limbs must be satisfied:
- the serious-harm limb, assessed through the lens of an ordinary reasonable person as to the likely intended effect of the material; and
- the menacing, harassing or offensive limb, assessed by reference to an ordinary reasonable person in the position of the Australian adult and the circumstances as a whole.
The existence of offence, distress, disagreement, embarrassment or reputational damage does not, by itself, establish cyber abuse under s 7.
2.3 Determining whether material is offensive — s 8
Section 8 provides guidance for determining whether material is offensive for the purposes of the Act.
It requires consideration of a non-exhaustive range of matters, including:
- generally accepted standards of morality, decency and propriety;
- the literary, artistic or educational merit, if any, of the material; and
- the general character of the material, including whether it is of a medical, legal or scientific character.
The assessment is objective and contextual.
It is not determined solely by the subjective reaction of the person who is the target of the material.
Accordingly, the statutory concept of “offensive” should not be treated as synonymous with material that merely causes personal offence.
3. Principal Regulatory Schemes
The Act contains several distinct statutory schemes.
The principal schemes relevant to this analysis are:
| Part | Scheme |
|---|---|
| Part 4 | Basic Online Safety Expectations |
| Part 4A | Social media minimum age |
| Part 5 | Cyber-bullying material targeted at an Australian child |
| Part 6 | Non-consensual sharing of intimate images |
| Part 7 | Cyber-abuse material targeted at an Australian adult |
| Part 8 | Material that depicts abhorrent violent conduct |
| Part 9 | Online content scheme — Class 1 and Class 2 material |
These schemes must not be conflated.
A power available under one Part does not automatically authorise action under another Part. Each scheme has its own statutory definitions, thresholds, procedures and enforcement mechanisms.
4. Adult Cyber-Abuse Scheme — Part 7
Part 7 establishes the statutory scheme dealing with cyber-abuse material targeted at an Australian adult.
The central provisions are:
| Provision | Subject |
|---|---|
| s 88 | Removal notice to the provider of a social media service, relevant electronic service or designated internet service |
| s 89 | Removal notice to an end-user |
| s 90 | Removal notice to a hosting service provider |
| s 91 | Compliance with removal notice |
| s 92 | Formal warning |
| s 93 | Service provider notifications |
Section 88 — Removal notice
A formal removal notice under s 88 can only be issued where the statutory requirements for the notice are satisfied, including the requirement that the relevant material constitute, or have constituted, cyber-abuse material within the meaning of s 7.
Satisfaction of the statutory definition is therefore a critical precondition to the exercise of the removal power.
The existence of a complaint, or the fact that material has caused distress or offence, does not itself establish that s 7 is satisfied.
5. Formal Notices versus Informal Communications
A distinction must be maintained between formal statutory notices and informal communications by eSafety.
Formal statutory removal notice
A formal removal notice derives its legal force from the Act.
It is subject to:
- the statutory conditions governing the relevant notice;
- the procedural requirements of the Act;
- the obligations imposed upon the recipient; and
- the applicable review and enforcement provisions.
Informal communications
eSafety may also communicate with online platforms by drawing material to their attention for consideration under the platform’s own terms of service.
Such communications operate on a different legal foundation.
An informal communication does not itself constitute a formal statutory removal notice and does not, merely by being sent, impose the same statutory obligation to remove material.
The distinction between formal statutory notices and informal communications has been the subject of litigation and remains legally significant.
6. Complaints and Investigation — Part 3
Complaints about adult cyber-abuse material are made under s 36.
The Commissioner’s investigation power is contained in s 37.
Receipt of a complaint does not itself establish that material meets the statutory definition of cyber abuse.
The Commissioner must still consider whether the material satisfies s 7 and whether the statutory conditions for exercising the relevant power have been met before issuing a formal removal notice.
Three concepts should therefore be distinguished:
Complaint
An allegation that particular material falls within the Act.
Investigation
The Commissioner’s examination of whether the relevant statutory criteria are satisfied.
Regulatory action
The exercise of a specific statutory power following the relevant assessment.
These are legally distinct stages.
7. Enforcement — Part 10
Part 10 establishes the principal enforcement framework.
It provides for mechanisms including:
- civil penalty provisions;
- infringement notices;
- enforceable undertakings; and
- injunctions.
Civil penalties
Non-compliance with a formal removal notice is a civil penalty matter where the relevant statutory provision specifies it as such.
Maximum penalties are expressed in penalty units.
The monetary value of a penalty therefore depends upon:
- the specific civil penalty provision;
- the applicable number of penalty units; and
- the penalty-unit amount applicable at the relevant time.
The applicable maximum may also differ depending upon whether the person or entity concerned is an individual or a body corporate.
Accordingly, reported dollar figures should always be checked against the specific statutory provision and the applicable penalty-unit value rather than treated as universally applicable.
8. Review Mechanisms and Accountability
The Act contains specific administrative review mechanisms.
Specified decisions, including certain decisions concerning removal notices, may be subject to:
- internal review; and
- merits review by the Administrative Review Tribunal (ART) under s 220.
Section 220A provides for internal review of specified decisions.
The availability and scope of review depend upon the particular decision involved and the statutory provisions governing it.
9. Judicial review
Judicial review may also be available in appropriate circumstances, including under:
- the Administrative Decisions (Judicial Review) Act 1977 (Cth); and
- s 39B of the Judiciary Act 1903 (Cth).
Judicial review and merits review are legally distinct.
Merits review involves reconsideration of the merits of a reviewable decision within the jurisdiction of the review body.
Judicial review principally concerns the legality of the exercise of statutory power, including whether the decision-maker acted within jurisdiction and according to law.
The existence of these review mechanisms forms an important part of the accountability structure established by the Act.
10. Scope and Disclaimer
This analysis examines selected provisions of the Online Safety Act 2021 (Cth), with particular emphasis on the adult cyber-abuse scheme in Part 7, the statutory definition of cyber-abuse material in s 7, the meaning of serious harm in s 5, the consideration of offensive material under s 8, relevant removal powers, enforcement provisions, review mechanisms and judicial review.
It is not an exhaustive analysis of the Online Safety Act 2021 (Cth) or of all powers, schemes, definitions, regulatory mechanisms, amendments, legislative rules, industry codes or related Commonwealth legislation.
The analysis is intended as a research and analytical document to assist in understanding the statutory framework. It is not legal advice and should not be relied upon as a substitute for advice from a qualified Australian legal practitioner.
The application of the Act to any particular facts will depend upon the precise material, circumstances, evidence, statutory provision relied upon and procedural steps taken. Conclusions concerning a particular case should therefore be drawn only after examining the relevant notices, correspondence, evidence and applicable case law.
Reference:
Online Safety Act 2021. Australia Legislation. – https://www.legislation.gov.au/C2021A00076/latest/text