Criminal Offences Relating to Doxxing in Australia are Broader than Required

On the last sitting day of parliament in 2024, the Albanese government enacted two new federal criminal offences to outlaw doxxing, which, while they had already been under contemplation, were brought forward by Australian attorney general Mark Dreyfus at the behest of the prime minister in February 2023

PM Anthony Albanese was prompted to make the call on these laws, following a number of public figures having revealed the names of over 600 Jewish academics and creatives listed on a private WhatsApp chat, as some of these people were Zionists involved in the targeting and exposing of pro-Palestinian supporters online, although some of them weren’t a party to the harassment.

Doxxing involves the publishing of personal identifiable details of an individual, such as an address or phone number, that are not already in the public domain.

Such conduct involves posting such details online without the person’s permission, usually with nefarious intent such as to encourage harassment or stalking. The practice commenced in the 1990s with the advent of the internet, and doxxing is an abbreviation of the term “dropping documents”.

Passed on 28 November 2024, the Privacy and Other Legislation Amendment Bill 2024 inserted a range of new privacy laws into eight pieces of federal legislation, in response to the 2022 Privacy Act Review report, which included two new doxxing offences inserted into the Criminal Code Act 1995 (Cth), despite the earlier review not having recommended these laws. And being federal laws, they apply across Australia.

The new offences that passed with bipartisan support apply to the new category of “personal data”, which is much more pervasive than the “personal information” defined in the Privacy Act 1988 (Cth), and civil society groups have condemned these crimes for the broad scope of behaviour they cover, as well as the fact that preexisting laws already serve to criminalise doxxing.

Criminalising legitimate practices

“Doxxing exposes victims to significant and enduring harm, including public embarrassment, humiliation, shaming, discrimination, stalking and identify theft and financial fraud,” said attorney general Mark Dreyfus. “It can lead to threats to a victim’s life and safety, and the lives and safety of their families and friends. It can inflict significant and lasting psychological harm.”

“Doxxing is a form of abuse that can affect all Australians but is often used against women in the context of domestic and family violence,” the federal AG added during his 12 September second reading speech on the bill. “The creation of this offence also responds to a recent, shocking incident of a group who were targeted with doxxing on the basis of their religion.”

In terms of the type of information that might be exposed in an act of doxxing, prior to the passing of the new law, the Privacy Act defined ‘personal information’ as “information or an opinion about an identified individual, or an individual who is reasonably identifiable” and this holds regardless of whether the information is true or not and whether it’s recorded in a material form or not.

The new antidoxxing laws capture ‘personal data’, which the new offences define as “information about the individual that enables the individual to be identified, contacted or located”, and this can include their name, photo, telephone number, email address, online account, residence, work or business address, and place of education or worship.

Commentators have warned that the broad definition of personal data that’s been applied to the new doxxing offences appears to capture information that isn’t necessarily private, and it could potentially apply to the publication of a photo of an individual accompanied by their name, if it is considered to have been done in a “menacing or harassing” manner.

These laws neither provide any safeguards or exemptions in terms of people revealing personal details when it is involved in legitimate journalistic practice or in the act of whistleblowing, and this in turn could breach various rights, including the right to political communication.

The new laws on the books

The Privacy Amendment inserted the new criminal offence of using a carriage service to make available the personal data of one or more individuals, under new section 474.17C of the Criminal Code, which is a crime that can see individuals sent away for up to 6 years.

The elements of this offence involve an individual using a “carriage service to make available, publish or otherwise distribute” the personal data of one or more persons, and the perpetrator has done this “in a way that reasonable persons would regard as being, in all circumstances, “menacing or harassing towards those individuals”.

The second doxxing law inserted into new section 474.17D of the Criminal Code is the crime of using a carriage service to make available personal data of one or more members of certain groups, and this offence carries a maximum penalty of 7 years imprisonment.

This more serious offence is similar to the first, but it applies when the act of doxxing has been perpetrated in a discriminatory manner that targets a person due to their involvement with a group that is “distinguished by race, religion, sex, sexual orientation, gender identity, intersex status, disability, nationality or national or ethnic origin”.

In respect of the second offence, the doxxed individual does not have to be part of the group that is being discriminated against.

A number of critical responses to the March 2024 public consultation on whether doxxing crimes should be added to the privacy legislation that was being drafted as a response to the review of the Privacy Act, pointed out that a number of federal offences already serve to criminalise doxxing, especially the crime of use carriage service to menace, harass or cause offence.

Section 474.17 of the Criminal Code contains the offence of menacing, harassing or causing offence via a carriage service. It carries up to 5 years inside, and a person is liable to this penalty if they’re found guilty of using a carriage service in a manner that “reasonable persons would regard as being, in all the circumstances, menacing, harassing or offensive”.

The Telecommunications Act 1997 (Cth) defines a carriage service as “a service for carrying communications by means of guided and/or unguided electromagnetic energy”.

The limitations of offences

The Australian Human Rights Commission’s response to the government consultation regarding the offences outlined that doxxing “can be serious” and it can include “humiliation, discrimination, stalking, threats of violence… actual violence, identity theft, reputational damage leading to social and financial disadvantage, as well as impacts on an individual’s mental health and wellbeing”.

Key issues that the AHRC highlights in regard to the now enacted laws are that doxxing online is often carried out in an anonymous manner so tracking down a perpetrator is almost impossible, and it also warns about the scope of the laws in terms of what is captured under personal data, as it’s likely that revealing that a specific person lives in a particular city could be captured under them.

Antifascist researchers the White Rose Society asserted in its response to government that doxxing is not always negative behaviour and in certain circumstances, it is a “much-needed and valuable service”.

The group goes onto list a number of ways in which it can be positively applied, especially in calling out the far-right, and they cite numerous instances in which their exposure of Nazis has produced beneficial outcomes.

Another key example of a behaviour that appears to have a positive effect that could now be outlawed is in cases where women being subjected to online harassment by a man go on to repost this individual’s derogatory messaging on social media, as well as exposing their online identity, as this could now be used to criminalise these women for outing their harassers.

The White Rose Society also underscores that while the doxxing of the Jewish WhatsApp group may have been warranted in terms of exposing Zionists individuals who had been targeting pro-Palestinians online, the act also exposed the names of many Jewish individuals not involved in the doxxing. So, the rushed manner in which this occurred proved harmful to some innocent people.

“Existing and sufficient laws are in place in all jurisdictions to effectively address intentionally harmful doxxing,” the antifascist research group said in concluding. “In our view, there is no need for new legislation”.

“In terms of enforcement, however, it is our experience over many years and varying circumstances, that enforcement has been generally inadequate and frequently useless,” the White Rose Society ended.