In brief

The Online Safety Act 2021 (Cth) (“Act“) passed Parliament on 23 July 2021 and commences on 24 January 2022 (being six months after it received royal assent, unless proclaimed earlier). Please see here and here for our previous alerts on the development of the Act.

A key element of the Act is the proposed “basic online safety expectations” (“Expectations“), which specify the core expectations (to be determined by the Minister) for:

• social media services;
• relevant electronic services (services that allow communication with other end-users e.g., email, IM, chat and certain gaming services); and
• designated internet services (including, with a few exceptions, those that deliver or allow access to material via an internet carriage service).

On 8 August, as required under the Act, the Australian government opened a consultation seeking input on the draft Expectations (Online Safety (Basic Online Safety Expectations) Determination 2021) proposed under section 45 of the Act. Submissions can be made until 15 October 2021.

Key takeaways

Part 4 of the Act permits the Minister to determine the Expectations.  It also includes core expectations that must be included in the Expectations determined by the Minister.

In addition to those core expectations set out in the Act, the draft determination released for public consultation adds eleven additional expectations, including:

• The provider of the service will take reasonable steps to proactively minimise the extent to which material or activity on the service is or may be unlawful or harmful.
• The provider of the service will ensure that there is an employee or agent who is designated as the service’s contact person for the purposes of the Act.
• The provider of the service will keep records of reports and complaints about the material provided on the service for five years after the making of the report or complaint to which the record relates.

Pursuant to the Act, the e-Safety Commissioner may issue a notice or a declaration requiring the service, or class of service, to prepare reports detailing the extent of their compliance with the Expectations. Such reports may be required periodically or in regard to a specified period.

Although the Expectations, once introduced, will not impose a duty that is enforceable by proceedings in court, non-compliance with the Expectations could potentially carry significant reputational consequences. The e-Safety Commissioner has the power to issue a statement (and publish the statement on their website) that the service did not comply with the Expectations, the reporting requirements, or a notice or determination issued by the e-Safety Commissioner in regard to the Expectations. Additionally, the Act provides for civil penalties up to AUD 111,000 for not complying with a notice or a determination relating to the reporting requirements.

Accordingly, businesses involved in the supply of online services should be aware of the Expectations and the potential reputational risk from non-compliance as the draft Expectations complete their consultation and ahead of the commencement of the Act at the start of next year.

Thank you to Liam O’Callaghan for his assistance in preparing this alert.