Criminal framework

Online Safety Act 2021 image based abuse scheme plus Criminal Code Act 1995 (Cth) section 474.17A. The statute was enacted Online Safety Act in force 23 January 2022; Criminal Code provision in force 2018. Criminal: up to 7 years imprisonment. Civil: penalties up to AU$156,500 for individuals and AU$782,500 for corporations per contravention.

Civil and data protection framework

Privacy Act 1988 plus eSafety removal notice scheme provides the parallel civil route. Office of the Australian Information Commissioner (OAIC) is the national supervisory authority and accepts complaints against any controller processing intimate imagery without lawful basis. The official site is https://www.oaic.gov.au.

Direct takedown authority

The eSafety Commissioner can issue formal removal notices to providers, end users, and hosting services with civil penalty exposure for non compliance within 24 hours.

Official victim support

eSafety Commissioner image based abuse scheme is the recognised support service. Available at https://www.esafety.gov.au/key-issues/image-based-abuse.

Five step removal process for Australia victims

  1. 1

    Preserve evidence before any contact with the perpetrator

    Capture full page screenshots with URLs visible. Save the original files. Note timestamps. This evidence supports both the Online Safety Act 2021 (Cth) Part 6 plus Criminal Code (Cth) s.474.17A complaint and any Privacy Act 1988 plus eSafety removal notice scheme request.

  2. 2

    File a criminal complaint under Online Safety Act 2021 (Cth) Part 6 plus Criminal Code (Cth) s.474.17A

    Report to local police or the national cybercrime unit. eSafety Commissioner image based abuse scheme can assist with the report.

  3. 3

    Submit an erasure request under Privacy Act 1988 plus eSafety removal notice scheme

    Send a written request to each platform's designated data protection contact citing the legal basis. OAIC can be petitioned if the platform fails to comply within 30 days.

  4. 4

    Send a US TAKE IT DOWN Act notice in parallel for covered platforms

    When the platform is subject to US jurisdiction, the 48 hour federal removal obligation applies in parallel with your domestic rights. ScanErase files these notices automatically.

  5. 5

    Track and escalate non compliant platforms

    Document every notice and every response. Use the regulator's takedown authority for non compliant platforms.

Frequently asked questions

What is the criminal NCII statute in Australia?

Online Safety Act 2021 image based abuse scheme plus Criminal Code Act 1995 (Cth) section 474.17A. Enacted Online Safety Act in force 23 January 2022; Criminal Code provision in force 2018. Criminal: up to 7 years imprisonment. Civil: penalties up to AU$156,500 for individuals and AU$782,500 for corporations per contravention.

Who enforces data protection rights in Australia?

Office of the Australian Information Commissioner (OAIC) is the national authority. Official site: https://www.oaic.gov.au.

Is there an official victim support service in Australia?

Yes. eSafety Commissioner image based abuse scheme provides direct help to victims. Site: https://www.esafety.gov.au/key-issues/image-based-abuse.

Does any regulator in Australia have direct takedown power?

The eSafety Commissioner can issue formal removal notices to providers, end users, and hosting services with civil penalty exposure for non compliance within 24 hours.

Can a Australia resident also use the US TAKE IT DOWN Act?

Yes when the hosting platform is subject to US jurisdiction. The TAKE IT DOWN Act applies to covered platforms regardless of where the victim resides. ScanErase's scan finds every US covered platform hosting your images, so you can file notices there in parallel with Privacy Act 1988 plus eSafety removal notice scheme requests.

Related guides