In response to growing concerns over online harassment and the malicious exposure of personal information, the Australian Government introduced new criminal offences targeting doxxing in the Privacy and Other Legislation Amendment Act 2024 (Cth) in December 2024.
In this article, we explain doxxing and the two new criminal offences, which are now part of the Criminal Code Act 1995 (Cth).
What is doxxing?
Doxxing is the intentional malicious exposure of an individual’s personal data online. The exposure can include publishing, releasing or sharing personal information. The malicious aspect can include a person encouraging others to send violent or threatening messages to the person.
Personal data includes information about an individual that enables the individual to be identified, contacted or located. This this could include a person, or group of people’s:
- names;
- photos;
- telephone numbers;
- email addresses;
- work, business or home addresses; or
- places of education or worship.
Offence 1 ― Doxxing against a person
The first offence of doxxing is when a person publishes personal information about an individual. The criteria for this offence is when a person:
- uses a carriage service (such as over the internet, a phone or social media) to make available, publish or distribute information;
- the information is personal data of one or more individuals; and
- a reasonable person would consider the person’s conduct is considered in all circumstances, menacing or harassing towards those individuals whose data is released.
This offence carries a sentence of six years for offenders.
Offense 2 ― Doxxing against a group or member of a group
The second offence of doxxing is where a person publishes information about a group or a member of a group. The criteria for this offence is the same as the first offence, but also includes that:
- the information is personal data of one or more members of a group, and
- the conduct in whole, or in part is because of a person’s belief that the group is distinguished by race, religion, sex, sexual orientation, gender identity, intersex status, disability, nationality or national or ethnic origin.
Whether the group that is targeted is actually distinguishable by a certain factor is irrelevant.
This offence carries a sentence of seven years imprisonment for offenders.
To protect yourself and your business, personal data should be kept private and protected and you should have systems to avoid information from being misused or released, such as implementing multi-factor authentication for access to your platforms.
Contact us
If you are an Australian business or individual requiring advice on doxxing, please contact a member of our Privacy & Data Protection team.
For general information about the Privacy Act, Australian Privacy Principles (APPs) and the Privacy Amendment Act, please see our previous article.
| Disclaimer: This publication contains comments of a general nature only and is provided as an information service. It is not intended to be relied upon, nor is it a substitute for specific professional advice. No responsibility can be accepted by Rigby Cooke Lawyers or the authors for loss occasioned to any person doing anything as a result of any material in this publication.
Liability limited by a scheme approved under Professional Standards Legislation. © 2025 Rigby Cooke Lawyers |