There are few infrastructural limitations on internet access or speeds. The country has a high internet penetration rate; 91 percent of Australian adults had a home internet connection as of June 2021, according to the Australian Communications and Media Authority.1 Around three-quarters of Australians are connected to the internet via the National Broadband Network (NBN), which was declared built and operational in late 2020. Upgrades are ongoing, including those expanding fiber-optic connections.2

The NBN has seen some success in delivering faster connections to more residents at lower costs but has been dogged by complaints and delays. Many Australian homes do not have full fiber-optic cable connection to the NBN, instead dealing with partial connections and a patchwork of other infrastructure technologies and their associated connectivity issues.3 By July 2022, approximately 12.1 million premises were ready to connect to the fiber-optic network, while approximately 8.5 million premises already had activated connections.4

The majority of NBN broadband services operated in 2022 (over 75 percent) on wholesale speed-tiers of 50 megabits per second (Mbps).5 As of June 2022, Ookla’s Speedtest Global Index ranked Australia 66th in the world for fixed-line broadband internet speeds and 12th in the world for mobile broadband internet speeds—both lower than the year prior.6

Most Australians are now covered by third-generation (3G) and fourth-generation (4G) mobile networks. Fifth-generation (5G) technology rollout is underway and progressing beyond major cities to inner regional areas.7 As of June 2021, Telstra, the largest 5G network provider, claimed to reach 75 percent of Australians.

Internet access is affordable for most Australians. The gradual shift to NBN services across the country is resulting in greater competition among internet service providers (ISPs), higher-quality connections, and improved speeds.8

According to the Australian Digital Inclusion Index, equity in access to and use of digital technologies generally improved in 2021, as compared to the year prior.9 Australia ranks 8th out of 100 countries surveyed in the Economist Intelligence Unit’s 2022 Inclusive Internet Index in terms of the affordability of prices for internet connections.10 However, cost of services remain a point of concern for many; 14 percent of Australians would have to spend over 10 percent of their household income in order to receive a reliable connection.11

A marked digital divide between urban and nonurban areas persists, though it is narrowing. Socially disadvantaged Australians, including mobile-only users and people who rent from public housing authorities, were among those who saw the least improvement in digital inclusion compared to other groups in 2021.12

First Nations Australians generally have a lower level of digital inclusion, with affordability remaining a key barrier to access, though this has improved over time.13 In September 2021, the government published an Indigenous Digital Inclusion Plan (IDIP) paper and announced its intention to hold multistakeholder consultations throughout the year, with the ultimate objective of developing a plan to promote digital inclusion for First Nations peoples.14

The government does not impose restrictions on internet connectivity or mobile networks. Australia is connected to the international internet through undersea cables that are not controlled by the government.15 Domestically, internet traffic flows through either commercial or nonprofit internet exchange points (IXPs)16 located in most major cities.17

Under the iCode, a set of voluntary cybersecurity guidelines for ISPs, internet connectivity may be temporarily restricted for users whose devices have become part of a botnet—an array of computers that have been hijacked for use in coordinated cyberattacks or spam distribution—or are at high risk of being infected with malicious software. Such users may have their internet service temporarily throttled or find themselves in a “walled garden,” or quarantine, until they have communicated with their ISP and restored security.18

The 1997 Telecommunications Act places obligations on providers to assist authorities in certain circumstances, including restricting the provision of services in emergencies.19

The ISP sector is free of major legal, regulatory, and economic obstacles that might restrict the diversity of service providers. However, telecommunications giant Telstra has consistently held the largest share of the mobile and broadband markets.

Australia hosts a competitive market for internet access, with at least 195 providers of the NBN as of mid-2022.20 Telstra commands over 44 percent of the fixed-line broadband market, with TPG, Optus, and Vocus holding smaller shares.21 All four leading ISPs sell NBN connections. As of 2020, the top three mobile network operators (Telstra, Optus, and TPG, which merged with Vodafone in 2020) accounted for 91 percent of the total retail mobile phone market.22

There are several smaller ISPs that act as “virtual” providers, maintaining only a retail presence and offering end users access through the network facilities of other companies. These “carriage service providers” do not require a license.23 The Australian Communications and Media Authority (ACMA) issues operating licenses that larger ISPs that own telecommunications infrastructure, or “carriers,” are required to obtain (see A5). Carriers must go through the independent Telecommunications Industry Ombudsman (TIO) dispute resolution process to resolve complaints from customers.24

The ACMA is the primary regulator for the broadcasting, internet, and telecommunications sectors.25 Its oversight is generally viewed as fair and independent. ACMA members are formally appointed by the governor general of Australia for five-year terms.26

Australian ISPs are coregulated under the Broadcasting Services Act (BSA) of 1992, which combines regulation by the ACMA with self-regulation by the telecommunications industry.27 The industry’s involvement entails developing industry standards and codes of practice.28 There are more than 30 self-regulatory codes that govern and regulate the country’s ICT sector. ACMA approves self-regulatory codes produced by the Communications Alliance, Australia’s main telecommunications industry body.29

Small businesses and residential customers may file complaints about internet, telephone, and mobile phone services with the TIO,30 which operates a free and independent dispute resolution mechanism.

Political and social content is rarely subject to blocking, and communications applications and social media are freely available. However, popular websites that frequently host copyright-infringing material, including Pirate Bay and Kickass Torrents, were blocked by two Federal Court judgments from 2016 and 2017.31 Owners of copyrighted material periodically obtain orders from the Federal Court blocking copyright-infringing websites. An April 2020 Federal Court decision ordered carriage service providers to block a range of copyright-infringing websites, most of which were pirate torrenting and streaming websites.32

Although the Australian government did not order any website blocks in the wake of the March 2019 terrorist attack in Christchurch, New Zealand—which was perpetrated by an Australian— several major Australian ISPs temporarily restricted access to 43 sites,33 including 4chan, 8chan, LiveLeak, Voat, ZeroHedge, and other smaller websites that were believed to be hosting or sharing recordings of the attacker’s live streamed video.34 The ISPs initially acted independently, but they later coordinated with the ACMA and other government agencies.35 The restrictions reportedly remained in effect until September 2019, when the Office of the eSafety Commissioner permitted ISPs to undo the blocks on all but eight unspecified websites that continued to let viewers watch the video.36

In 2020–21, the eSafety Commissioner called for over 14,000 URLs to be prohibited or potentially prohibited, 99 percent of which hosted content that met the definition of child sexual abuse imagery. The eSafety Commissioner reported that content hosted overseas was referred to vendors of software filters.37

In November 2019, the Australian government introduced a website blocking scheme, permitting the ACMA to request that ISPs block illegal gambling websites under Section 313(3) of the 1997 Telecommunications Act.38 The ACMA had requested that ISPs block at least 206 such websites in 2020–21.39

Online content protected under international human rights standards is generally free from interference by state and nonstate actors. However, the courts at times attempt to inhibit publication of defamatory material on large social media platforms and search engines.

In 2019, Parliament adopted the Sharing of Abhorrent Violent Material Act (see B3), which amended the criminal code to enforce the removal of a new category of online content, namely “abhorrent violent material.” The eSafety Commissioner reported that in 2020 and 2021, it issued five notices under this law to content or hosting services in relation to material provided via their service.40

In its most recent transparency report, covering July to December 2021, Facebook disclosed that it had restricted access to 188 items of content in Australia, an increase from the period prior.41 Of these, 21 items were removed globally in response to a court order from Brazil; 82 items were related to private reports of defamation; 81 items were in response to valid court orders; and 25 items were in response to reports submitted by the Therapeutic Goods Administration. During the same period, Google received 833 content removal requests. The company removed 489 items, including those made on grounds including bullying and harassment (285 requests), defamation (28), nudity or obscenity (20), and copyright (19).42 Twitter received two takedown requests in Australia in the same period and complied with one.43

The June 2021 passage of the Online Safety Act, which sparked civil society concern about its potential disproportionate effect on content from marginalized groups, has led to the removal of online content.44 In February 2022, a sex-work friendly social media platform known as Switter announced that it would shut down due to legal concerns over its ability to protect users and comply effectively and ethically with various online safety bills and defamation laws proposed and passed in Australia, as well as in the United States and the United Kingdom. In Switter’s public statement, the platform explicitly cited its concern “about the powers that have been created and granted to the eSafety Commissioner as a part of the introduction of the Online Safety Act […].”45

Recent court cases involving Google’s search results and autocomplete predictions have sought to clarify how Australia’s defamation laws are applied to online content. In April 2020, the Supreme Court of Victoria ruled in favor of lawyer George Defteros in a defamation case against Google and ordered the company pay Defteros AU$40,000 ($28,500) in damages.46 In January 2022, Google filed an appeal to the case, warning that it would be forced to censor search results if the ruling, which would hold the search engine liable for allegedly defamatory content contained in hyperlinks, is not overturned. 47 Previously, in 2018, the High Court of Australia ruled in favor of Milorad Trkulja in a defamation case against Google.48 Although a lower court had dismissed the case, the High Court agreed with the appellant that autocomplete predictions and image searches related to his name could convey to an ordinary, reasonable person that Trkulja was linked to the criminal underworld.49

In a 2017 case involving a breach of confidential information, Twitter was ordered to prevent an offending user from creating any future accounts or posts, with worldwide effect. The Supreme Court of New South Wales Justice Michael Pembroke issued a global injunction against Twitter in relation to a series of posts published by an anonymous user that revealed confidential information about the plaintiff, an unidentified company. The court compelled the platform to prevent any future publication of the offending material and to remove all content associated with the user and information in question.

Australia is home to a limited but increasing number of restrictions on the internet. The legal and technical mechanisms by which ISPs filter illegal material have raised some concerns. In 2018, amendments to the criminal code in response to the Christchurch attack introduced an expansive new category of online content that social media companies must remove, while an amendment to the 1968 Copyright Act opened more avenues for blocking or removing copyright-infringing material.

The Online Safety Act came into force in January 2022.50 The act, which builds off the Enhancing Online Safety Act 2015, passed both houses of Australian parliament in June 2021 and received royal assent the following month.51 While the act aims to improve online safety by, for example, introducing protections against cyberbullying and child exploitation, it expands the federal government’s ability to block and request the removal of certain online content. Civil society groups, tech companies, and other commentators had raised concerns about the law before its passage, including its speedy takedown requirements and its potential disproportionate effect on marginalized groups, such as sex workers, sex educators, LGBT+ people, and artists (see B2).52

Content targeted under the Online Safety Act includes cyberbullying material directed at an Australian child, nonconsensually shared intimate images, and cyberabuse material targeting any Australian adult.53 Under the law, users can make formal complaints about online content; the eSafety Commissioner would then be empowered to conduct investigations into those complaints and issue removal notices. Providers, which include social media services, “relevant electronic services,” “designated internet services,” hosting services, and any end-user that posted the material, must remove content sanctioned by the commissioner within 24 hours of receiving a takedown notice. Failure to comply can result in a penalty of up to AU$555,000 ($396,000) for companies and AU$111,000 ($79,100) for individuals.54 The law also empowers the commissioner to issue app removal notices, requiring a provider to stop enabling users to download an app that facilitates the posting of certain material over their services.

The eSafety Commissioner is also able to order ISPs to block access to sites hosting “abhorrent violent material” for a period of up to three months, particularly when responding quickly to a crisis. After the three months have expired, the eSafety Commissioner can renew the block indefinitely. The act contains no requirement for the commissioner to give reasons for removal notices and provides no opportunity for users to respond to complaints.55

Protections against “abhorrent violent material” were previously amended to the criminal code in 2019 following the Christchurch attack. The amendments required ISPs, along with “content service providers,” and “hosting service providers,” to “expeditiously” remove any “abhorrent violent material,” defined as content depicting attempted murder, terrorism, torture, rape, or kidnapping, that is accessible in Australia.56 The eSafety Commissioner may alert companies to “abhorrent violent material” on their services; if the companies fail to “expeditiously” remove it, they could be fined AU$10.5 million (US$7.48 million) or 10 percent of their annual revenue. Individuals may be fined AU$2.1 million (US$1.5 million) or imprisoned for up to three years. The law also penalizes companies that fail to notify the Australian Federal Police (AFP) of material depicting “abhorrent violent conduct” occurring in Australia within a reasonable time after they become aware of it. These penalties are subject to appeal. Critics have expressed concern that the legislation could unreasonably place responsibility on executives and employees for content posted by users in an industry already grappling with the challenges of reviewing vast amounts of uploaded content.57

Australia’s copyright laws continue to evolve in response to the proliferation of copyright-infringing material online. In 2018, the Copyright Act was amended to broaden its provisions, for example, by allowing blocking injunctions to be extended from sites hosting the material to search-engine providers, which must take reasonable steps to block search results for copyright-infringing content.58 The amendment also allows existing blocking injunctions to be extended to “new domain names associated with the blocked online location” without a new court order.59

Section 313(3) of the 1997 Telecommunications Act allows government agencies to block illegal online services. Following a formal review of the law, the Department of Communications and the Arts published 2017 “good practice measures” on the use of Section 313(3) for agencies to follow, including obtaining approval from the agency head prior to blocking online services, disrupting online services only in instances of serious offenses or national security threats, informing the public on the law’s uses, and ensuring that the agency possesses appropriate technical expertise.60

Copyright holders may apply to the Federal Court to request that copyright-infringing websites and services located overseas be blocked by Australian ISPs under Section 115A of the Copyright Amendment (Online Infringement) Act of 2015.61 The court must take into consideration whether the overseas site has a primary purpose of facilitating copyright infringement, whether the response is proportionate, and whether a block is in the public interest. Additionally, there is no appointed party to represent the public interest in these cases.62

Australian defamation laws are widely regarded as among the most favorable to plaintiffs in the world, and fear of defamation suits has driven some self-censorship among both the media and ordinary users (see C2).

Legal defenses against defamation that are typically available in other democratic countries, such as the public interest defense, are difficult to claim in practice, effectively inhibiting the publication of public interest journalism when there is a risk of defamation accusations.63 According to a survey of journalists published in 2019 by the Australian Media Entertainment and Arts Alliance, 80 percent of respondents reported that defamation laws made their jobs more difficult, with a quarter saying that stories they had written were not published due to fears of provoking legal proceedings.64 Recent defamation case rulings targeting anonymity have further raised concern around potential self-censorship. In June 2022, after the coverage period, a court handed Twitter orders by consent to provide the personal information (including the name of the account, email address, and associated IP addresses) of a popular, anonymous pro-Labor Party account, “PRGuy17,” as part of a defamation lawsuit from a far-right figure.65

Separately, narrowly written orders to suppress coverage of ongoing legal proceedings are often interpreted by the media in an overly broad fashion, so as to avoid contempt of court charges.66 Some suppression orders are themselves excessively broad; both types can have a chilling effect on reporting. In 2018, a judge in Victoria state imposed a global suppression order on the trial of Cardinal George Pell, who was convicted of sex abuse later that year, to mitigate the risk of a mistrial. Journalists criticized the order, which was lifted in 2019, for impeding reporting on a topic of high public importance. Charges of contempt of court for noncompliance were brought against 19 journalists, 21 publications, and 6 corporations.67 Prosecutors dropped all charges against the individuals in February 2021, and in June,68 12 media outlets were fined a combined AU$1.1 million ($784,000).69

The government does not control or manipulate online sources of information to advance any particular political interest.

The online portal of the publicly funded Australian Broadcasting Corporation (ABC) is a major source of news for Australians. Some members of the governing coalition have periodically called for the privatization of the ABC or cuts to its funding;70 commentators have characterized these proposals as a response to perceived left-leaning bias at the outlet. The persistent political pressure on the ABC has raised concerns about its editorial independence.71 For example, in 2018, Minister of Communications Paul Fletcher questioned whether ABC’s Four Corners program, which claimed that ministers had engaged in inappropriate conduct, “met the standards of fair and impartial journalism.”72 The media conglomerate News Corp Australia, which is controlled by Rupert Murdoch and is one of the leading players in the country’s concentrated news media market, is regarded by some observers as editorially biased in favor of the conservative Liberal Party–National Party former governing coalition.73

Recent elections have featured a proliferation of online disinformation spread by domestic political parties.74 In April 2022, one month before the federal election, the Australian Electoral Commission voiced concern over a trend coming from candidates of minor parties, including the One Nation and United Australia parties, who would post alleged advice to their supporters on Facebook that was infused with suggestions that election fraud was likely. For instance, one candidate advised voters to bring a pen to polls so that their votes would not be changed after the fact. Other prominent pieces of disinformation included claims that First Nations people had been silently wiped from the electoral roll.75 Facebook removed some of the misleading content the AEC requested be taken down.76

Major crises in recent years have led to significant disinformation campaigns online. Misinformation about the cause of bushfires, spread by both real users and bots, was rife on social media in relation to the bushfire emergency that affected Australia in late 2019 and early 2020.77 Manipulated online content also persisted throughout the COVID-19 pandemic: for example a small group of hyperpartisan anonymous accounts with fake profiles drove public discussion on Twitter about Victorian Premier Daniel Andrews’s handling of the state’s second COVID-19 outbreak.78

To address the increasing amount of online misinformation, the Digital Industry Group Inc., a nonprofit industry association that advocates for the interests of the tech industry in Australia, published in February 2021 the voluntary Australian Code of Practice on Misinformation and Disinformation. Developed with the assistance of ACMA, the code outlines practices to label, demote, or remove certain categories of false information; to prioritize credible content including through fact-checking programs; and to enhance transparency reporting. The code also includes practices for platforms to enhance transparency around political advertising. Twitter, Google, Facebook, Microsoft, Redbubble, and TikTok are among the platforms to have adopted the code, and have since started removing offending content, including on topics like the COVID-19 pandemic.79

Users are generally free to publish content online without economic or regulatory constraints.

There are no limits on the amount of bandwidth that ISPs can supply, though ISPs are free to adopt internal market practices of traffic shaping, also known as data shaping. The principle of net neutrality is not enshrined in any law or regulation. Some Australian ISPs and mobile service providers practice traffic shaping under what are known as fair-use policies: if a customer uses peer-to-peer file-sharing software, internet connectivity for those activities will be slowed in order to release bandwidth for other applications.80

In February 2021, the government passed the News Media and Digital Platforms Bargaining Code, which establishes a mandatory arbitration regime for digital platforms, such as Facebook and Google, to negotiate with and ultimately pay news outlets for using their content.81 The term “digital platforms,” however, is not defined in the code, which was written to capture “platforms that deliver a wide variety of services” including social media, search engines, and other content aggregators. The minister of communications has the power to categorize services as digital platforms and, in making such a determination, must ensure there is a “significant bargaining power imbalance” between the news companies and the platforms.82 The country’s Department of the Treasury announced a review of the code in February 2022, with the hopes of assessing its progress and identifying possible improvements and publishing its findings in September.83

Critics have said that the News Media Bargaining Code ensures that major news corporations benefit from the “systematic data collection and exploitation models” that digital platforms promote,84 and the deals negotiated between Google and large corporate outlets in the wake of the law’s passing could negatively impact media diversity.85 The threshold of AU$150,000 ($107,000) in annual revenue that a corporation must generate in order to be registered by the ACMA to participate in the code and qualify as a valid “news business” has also been criticized for being potentially prohibitive to smaller and regional outlets.86 Broad nondisclosure provisions have also led some eligible news outlets to be shut out of negotiations with platforms without being offered a justification.87 Despite these criticisms, some have noted the added revenue could present an opportunity for news media outlets to invest in their newsrooms, potentially improving the quality and diversity of the journalism landscape in Australia.88

Score Change: The score improved from 3 to 4 because Facebook did not block Australian news content, unlike during the previous coverage period, and the online landscape remained fairly diverse, with content available on an array of topics.

The online landscape is fairly diverse, with content available on an array of topics. Australians have access to a broad selection of online news sources that convey uncensored political and social viewpoints.

However, the online news landscape is influenced by ownership concentration in the print media industry. News Corp Australia accounts for more than half of newspaper circulation in Australia, while Nine (Fairfax Media) also holds a sizeable share.89 News Corp’s News.com.au is, according to some studies, the country’s most-viewed news website, and the digital versions of News Corp newspapers such as the Australian are also popular.90 Concerns about ownership concentration have come to prominence in the past; News Corp’s 2019 election coverage was criticized for being excessively one-sided, consistent with the outlet’s historically conservative political orientation.91 News Corp outlets have also been assailed for publishing content that is perceived to be supportive of white nationalism and prejudicial toward ethnic minorities.92

Shortly after the News Media and Bargaining Code passed in February 2021 (see B6), Facebook responded by blocking news content for Australian-based users entirely from its platform for a week. Nonnews content was also restricted, including content from the Australian Bureau of Meteorology, civil society organizations, and public health groups. In May 2022, whistleblower reporting exposed that Facebook intentionally created a broad takedown process that would impact nonnews content as a negotiating tactic.93 The social media platform reversed the block only after the Australian government agreed to make amendments to the new law, including giving platforms more time to negotiate deals with news outlets and a notice period if they were to be formally designated as one.94 Google ultimately responded by partnering with dozens of Australian outlets in a manner that is compliant with the code.95

The June 2021 passage of the Online Safety Act, which sparked civil society concern about its potential disproportionate effect on marginalized groups, may already be impacting the diversity of online content (see B2).96

Nevertheless, traditional and digital-only news outlets collectively ensure a substantial diversity of viewpoints are accessible to the public, and this is enhanced by other digital media such as blogs, Twitter feeds, Wikipedia pages, and Facebook groups.97 The publicly funded television station SBS features high-quality news programs in multiple languages, available offline and online, to reflect the diversity found in the country’s population.98

Misinformation has persisted online throughout the COVID-19 pandemic, undermining the reliability of available information. Various false claims and conspiracy theories have circulated on social media, including claims that the coronavirus is a hoax or has been exaggerated as a threat.99 Online coronavirus disinformation has had real-world effects in Australia. False claims that testing kits were faulty or contaminated reportedly discouraged some people in Melbourne from getting tested.100 Migrant groups in Australia have been found to be particularly influenced by vaccine misinformation and are less likely to get a vaccine as a result.101

Australians use social media to petition the government and to mobilize for public protest without restrictions. For example, campaigns launched by GetUp!, an independent nonprofit advocacy group that campaigns on issues aligned with the political left, garner significant engagement online. GetUp! utilizes online petitions to raise awareness and gather support for causes such as cracking down on corporate tax avoidance and corruption.102

After Minister of Defense Peter Dutton sued refugee activist Shane Bazzi for defamation concerning posts on Twitter that labeled him a rape apologist (see C3), supporters set up a crowdfunding campaign in April 2021 to cover the cost of the legal proceedings.103 A November 2021 court ruling in favor of Dutton sparked concern about retribution among activists; however, Bazzi ultimately won his appeal in May 2022.104

While the ability to organize and assemble online remains unimpeded, the increasingly regular introduction of legislation targeting anonymity is seen by civil society as a potential threat to people’s willingness to mobilize using digital technology (see C4 and C5).105

Freedom of expression is not an explicitly protected constitutional or statutory right; Australia does not have a federal bill of rights.106 The High Court has held that there is an implied freedom of political communication in the constitution, but this extends only to the context of communications around the facilitation of representative democracy and communication with public officials.107 Australians’ rights to access online content and freely engage in online discussions are based less in law than on a shared understanding of the prerequisites for a fair and free society. The public benefits greatly from a culture of freedom of expression and freedom of information that is generally protected by an independent judiciary. The country is also a signatory to the International Covenant on Civil and Political Rights (ICCPR).

Whistleblower laws, laws pertaining to defamation, and suppression orders can inhibit journalists’ ability to report on important public issues (see B4).

Online activities that are protected under international human rights standards are sometimes subject to criminal penalties in Australia, primarily through the country’s defamation laws. The Sharing of Abhorrent Violent Material Act, adopted in April 2019, introduced criminal code provisions that could also be applied to online speech (see B3).

Defamation law has been interpreted to favor plaintiffs and is governed by uniform state-level legislation as well as common law principles.108 However, there are several legal defenses against defamation claims, including those of truth, fair reporting on proceedings of public concern, and honest opinion. Three states, New South Wales, Victoria, and South Australia implemented reformed defamation laws in July 2021,109 which included the addition of a public interest defense, a single publication rule, and a serious harm threshold;110 they seek to standardize defamation laws across the nation while limiting the types of legitimate defamation claims and introducing new defenses.

A person may bring a defamation case to court based on information posted online by someone in another country, provided that the material is accessible in Australia and that the allegedly defamed person enjoys a reputation in Australia. This allows for the possibility of “libel tourism,” in which noncitizens file defamation cases in Australia against others based outside the country to take advantage of its favorable legal environment for plaintiffs. While the United States and the United Kingdom have enacted laws to restrict libel tourism, Australia is not currently considering any such legislation.

In some cases, the courts may grant a permanent injunction to prevent the publication of defamatory material, though this remedy is limited to cases involving a high risk that the defamation will continue.111

Several high-profile lawsuits from recent years involved online defamation, with defendants including members of the professional press as well as ordinary social media users.112 Amendments to defamation laws, which came into effect across three states in Australia in July 2021, may curb the success of defamation suits in the future (see C2), particularly in relation to suits launched against social media users and journalists publishing in the public interest.

In a precedent-setting decision, a New South Wales Supreme Court judge ruled in June 2019 that media companies are liable for defamatory comments posted by third parties on their social media pages. In June 2020, the New South Wales Court of Appeal dismissed an appeal brought by media companies that had been found liable for defamation under the 2019 decision,113 and the High Court upheld the previous two rulings in September 2021.114 This finding was preliminary in nature, but it was still treated as significant by publishers. The relevant case has since been resolved, leaving the legal position of publishers unclear.115

High profile politicians, including senior cabinet members of Australia’s former governing coalition, have been known to sue journalists and activists for publishing unfavorable stories or posting critical commentary online.116 In April 2021, Minister of Defense Peter Dutton launched defamation proceedings against refugee activist Shane Bazzi, after Bazzi called Dutton a rape apologist on Twitter. In his submissions to the Court, Dutton accused Bazzi of “showing malice,” and of further demeaning him by claiming the defamation suit suppressed free speech.117 Bazzi’s legal representatives have said he validly expressed an “honest opinion,” which is a defense available in defamation suits (though the Federal Court confirmed in January 2021 that the honest opinion defense is subject to strict limits).118 Bazzi lost the case in November 2021 and was ordered to pay AU$35,000 ($25,000) in damages. He won an appeal overturning the ruling in May 2022, however, which concluded that Bazzi’s post did not contain a claim that Dutton excused rape.119

A high-profile defamation proceeding brought by decorated soldier Ben Roberts-Smith concluded in July 2022, after the coverage period, though a judgement was not expected for several months afterwards.120 Roberts-Smith sued the news outlets The Age, the Sydney Morning Herald, and The Canberra Times for publishing allegedly false stories in 2018 that claimed Roberts-Smith had committed war crimes while deployed in Afghanistan. His legal team has been funded by chairman of Seven West Media, Kerry Stokes, a major competitor of the news outlets subject to the suit. The case could have significant implications for reporting on matters of public interest, particularly those related to the military, as journalists and media outlets may balk at covering topics that could attract expensive defamation suits.121

In May 2021, New South Wales Deputy Premier John Barilaro launched defamation proceedings in Federal Court against YouTuber Jordan Shanks, who runs the popular YouTube channel Friendlyjordies, in which Shanks often discusses Australian political issues. Shanks has alleged, among other things, that Barilaro is corrupt and has mocked his Italian heritage. In his suit, Barilaro also included a claim against Google for failing to remove the videos.122 The matter escalated in June 2021, when New South Wales police arrested Kristo Langker, a producer of the Friendlyjordies YouTube channel, on charges of stalking Barilaro. Langker had allegedly approached Barilaro while filming on two occasions in attempt to discuss the defamation proceedings. Some commentators have expressed concern about apparent police overreach in arresting Langker.123 The case against Shanks was settled in November 2021, with Shanks agreeing to pay Barilaro AU$100,000 ($71,300) in legal costs.124 In June 2022, after the coverage period, Google was ordered to pay Barilaro AU$515,000 ($367,000) for the two allegedly defamatory videos. 125

Individuals do not need to register to use the internet, and there are no restrictions on anonymous communications. However, verified identification information is required to purchase any prepaid mobile service.126 Additional personal information must be submitted to a mobile service provider before a phone can be activated. All recorded information is stored while the service remains activated, and it may be accessed by law enforcement and emergency agencies with a valid warrant.127

In 2018, Parliament passed the Telecommunications and Other Legislation Amendment (Assistance and Access) Act, which allows intelligence and security agencies to send a mandatory notice or a voluntary request to ”communications providers” to change or break their own encryption technology in order to facilitate access to user data (see C6).128 The law prohibits assistance that would undermine encryption or security for users at large, but critics have noted that, in practice, enabling authorities’ access to one user’s data without creating exploitable vulnerabilities that could affect others is difficult (and in some cases impossible).129 The law also undermines the “journalist information warrant” (see C5), which is the limited protection that requires law enforcement to file a warrant when accessing journalist’s metadata because, under the 2018 law, authorities could feasibly install spyware on a journalist’s phone to access their metadata.

In August 2021, the Australian government passed the Surveillance Legislation Amendment (Identify and Disrupt) Bill, which poses a threat to encryption as it allows authorities to take over an individual’s social media accounts (see C5).130

In February 2022, the government introduced the Social Media (Anti-Trolling) Bill to Parliament.131 The bill sought to restrict anonymity online by requiring platforms to provide the name, email address, and phone number of users that were alleged to have defamed someone using an anonymous account. In the event of noncompliance, platforms would be held liable for the allegedly defamatory comments.132 Lawmakers and civil society organizations criticized the bill as “grossly inadequate” to meet its stated purpose, citing the lack of provisions preventing online abuse or trolling practices and the bill’s focus on empowering individuals to bring defamation lawsuits rather than pushing platforms to address online harms through design changes.133 The bill was not passed before the May 2022 federal election and the newly elected government reportedly has no intention of retabling it.134

The government has expanded its surveillance and data-gathering capabilities in recent years. According to evidence given before the Parliamentary Joint Committee on Intelligence and Security (PJCIS) in August 2020, the AFP had issued eight requests to access encrypted user data and the New South Wales Police force had issued 13.135 In 2020–21, according to the Department of Home Affairs, 25 technical assistance requests were given by interception agencies to designated communications providers.136 The Australian Security Intelligence Organisation (ASIO), the country’s domestic intelligence service, has also employed powers given to it under the Assistance and Access Act. These requests are not subject to judicial oversight in cases where authorities had already seized a device.137

While the Privacy Act 1988 (Cth) grants some privacy protections, it does not provide individuals with a judicial remedy for privacy breaches, regardless of whether state or nonstate actors were responsible.138 However, individuals can file a complaint to the Office of the Australian Information Commissioner (OAIC ), the country’s privacy regulator, who can provide them with compensation in cases where their data was breached.139 The OAIC struggles with a lack of funding and resources, limiting its ability to adequately deal with complaints.140 In 2017, the Federal Court clarified that metadata do not qualify as personal information and are therefore not subject to statutory protections, further narrowing the scope of the Privacy Act.141

A review of the Privacy Act 1988 (Cth) was ongoing at the end of the coverage period, with the government releasing a discussion paper, proposing amendments to the definition of personal information and whether individuals should have a right of action to safeguard their right to privacy under the law in October 2021.142

Law enforcement agencies do not require a warrant to access metadata under the 2015 Telecommunications (Interception and Access) Amendment (Data Retention) Act (see C6), except when accessing the metadata of journalists, for which they must file a journalist information warrant.143

In June 2021, both houses of Parliament passed the Telecommunications Legislation Amendment (International Production Orders) Bill 2020,144 which establishes a new legal framework to access overseas communication data for law enforcement and national security purposes, facilitating access to encrypted communications provided by non-Australian companies.145

The Surveillance Legislation Amendment (Identify and Disrupt) Bill, passed in August 2021, grants the AFP and Australian Criminal Intelligence Commission (ACIC) the ability to request new types of warrants to investigate and disrupt “serious” crime (see C4). Warrants would be issued by an eligible judge or nominated Administrative Appeal Tribunal (AAT) member. The law contains three types of warrants. First, data disruption warrants would enable the AFP and ACIC to modify, add, copy, or delete data for the purpose of impeding the execution of serious offenses online. Second, network activity warrants would give the AFP and ACIC access to the devices and networks of the warrant’s subject. Third, the AFP and ACIC would have the power to take control of and lock the warrant’s subject out of an online account for the purpose of gathering evidence. The takeover warrants would also be permitted to be issued internally in an emergency, and subsequently authorized by a magistrate.

To take over an account, defined as a “an account that an electronic service has for an end user,” law enforcement agencies have the right to use an individual’s account credentials, including passwords, personal identification numbers (PINs), and biometric forms of identification; alter account credentials; and remove two-factor authentication requirements. The law also permits law enforcement to object to the public disclosure of the information gathered if “the information…could reasonably be expected to reveal details of account takeover technologies or methods,” raising concerns about authorities’ ability to access accounts on encrypted messaging services.146

The OAIC had raised concerns about the law, noting that it lacks important safeguards and grants agencies wide-ranging and coercive powers that may affect individuals not suspected of involvement with criminal activity.147

In April 2022, the Data Availability and Transparency Bill came into effect, which significantly broadened the government’s powers to share individuals’ personal data among its agencies and accredited parties to support three limited purposes: the delivery of government services, informing government policy and programs, and research and development.148 It was first introduced in December 2020 and passed both houses of Parliament in March 2022; while negotiating the bill, the government made some privacy-enhancing amendments, including restricting private access to public data.149 The law’s stated objective is to improve service delivery to citizens while enabling more evidence-based policy development. Though it does contain some privacy safeguards, including requiring that consent be obtained before sharing an individual’s personal information unless it is “impractical” or “unreasonable,” the OAIC has warned that the legislation could reduce Australians’ privacy protections and lead to the mishandling of personal information. Specifically, the OAIC has called for the data bill to compel agencies to anonymize data when possible and to include a robust data minimization approach, whereby data must not be shared when the purpose could be achieved without sharing personal information.150

The Australian Signals Directorate (ASD), Australia’s cyberintelligence agency, confirmed in March 2020 that it had spied on Australian citizens in the past year. While the ASD typically conducts surveillance of targets outside of Australia, the agency confirmed that it had, in an unspecified number of cases involving “rare circumstances,” obtained ministerial approval to conduct domestic surveillance.151

In 2014, Parliament enacted amendments to national security legislation that increased penalties for whistleblowers and potentially allows intelligence agents to monitor an entire network of people with a single warrant. In particular, a new section (35P) added to the 1979 ASIO Act included provisions that threaten journalists and whistleblowers with a 10-year prison term if they publish classified information related to special intelligence operations.152 Section 35P was subsequently amended to offer some protections to journalists.153 Other worrying amendments to the ASIO Act included changes to the scope of warrants—notably, the definition of “computer” was broadened to allow authorities to access data on multiple networked computers with a single warrant.

Technology companies have become more involved in state surveillance in recent years, thanks largely to the Assistance and Access law adopted in 2018 that gives Australia’s intelligence and security agencies the power to compel “communications providers” to undermine their own encryption technology to obtain user data (see C4).154

The Assistance and Access law allows these agencies to issue requests for encrypted data under a broad set of circumstances, including for the purpose of safeguarding the country’s national security, foreign relations, or economic well-being. Requests may also be issued for the purpose of enforcing criminal law. “Technical Assistance Requests” are voluntary requests for companies to use existing capabilities to assist agencies with access to user information. The law allows relevant agencies to compel tech companies to comply, including with requests to build capabilities into products to facilitate access.155

Rights groups have criticized the Assistance and Access law’s broad reach, relative lack of oversight, and harsh penalties. Opponents have also raised concerns about its potentially stifling effect on the country’s technology sector, as local companies could be forced to create products that are less secure than those of their foreign competitors.156 Companies that fail to cooperate could face fines of up to AU$10 million ($7.1 million), while individuals could face prison time. All requests for assistance are overseen by various Commonwealth bodies, depending on the requesting agency. Organizations subject to a request for assistance have the right to complain or appeal to the relevant oversight body for the requesting agency, and technical capability notices—which require the recipient to change or break their own encryption technology—must be issued by the attorney general and approved by the minister for communications.157

Law enforcement agencies with a lawful warrant may search and seize computers. They may also compel ISPs to intercept and store data from individuals suspected of committing a crime, as governed by the Telecommunications (Interception and Access) Act 1979 (TIAA). ISPs and similar entities are prohibited from, on their own imperative, monitoring and disclosing the content of communications without the customer’s consent.158 Unlawful collection of a communication and disclosure of its content can draw both civil and criminal sanctions.159 The TIAA and the Telecommunications Act explicitly authorize a range of disclosures, including to specified law enforcement and tax agencies. ISPs are currently able to monitor their networks without a warrant for “network protection duties,” such as curtailing malicious software and spam.160

Under the Online Safety Act 2021 (see B3), the e-Safety Commissioner has powers “to obtain information about the identity of an end-user and the contact details of an end-user from a social media service, relevant electronic service or designated internet service.” The commissioner can exercise these powers under broad and vaguely defined conditions, where the information sought is “relevant to the operation of the Act.”161

The Telecommunications (Interception and Access) Amendment (Data Retention) Act 2015 requires telecommunications companies to store two years of customer metadata.162 Telecommunications companies were required to update their technology to be compliant with the law in 2017, receiving a substantial grant from the government to assist with the process.163 That month, the government confirmed that metadata would not be available for use in civil cases.164

The Department of Home Affairs reported that in 2020–21, 223,413 authorizations were issued to access retained subscriber data. In the same reporting period, the Department disclosed that 998 warrants had been issued to law enforcement agencies for stored communications under the TIAA. Law enforcement agencies also made 39,289 authorizations for the disclosure of prospective telecommunications data.165

The Commonwealth Ombudsman reported in April 2021 that, since 2007, the Australian Capital Territory’s police force had systematically gained access to location-based services under the TIAA, in a manner that was not compliant with the law. For example, compliance issues included accessing locations of the wrong individuals, accessing locations after an authorization expired, and authorizations not being signed by the appropriate individual.166

The TIAA’s 2015 amendment added extra privacy protections for journalists, requiring security agencies to obtain a warrant before accessing journalists’ metadata. However, incidents of unauthorized access and loopholes in the Assistance and Access law have undermined faith in these safeguards (see C4).167

The data collection practices of technology firms have also come under scrutiny.168 The Federal Court of Australia ruled in April 2021 that Google breached Australian consumer laws by misleading Android users about how they can limit the company’s ability to obtain, retain, and use personal location data.169 In August 2022, after the coverage period, the Court fined Google AU$60 million ($42.8 million).170

The Data Availability and Transparency Bill 2020 also provides a mechanism by which the government can share citizens’ data with “accredited” third parties, such as academics and scientists. To become accredited, entities must satisfy certain security, privacy, and governance requirements.171

In April 2022, the government launched a discussion paper on a National Data Security Action Plan to develop clearer guidance and expectations around data security, following the recent passage of data sharing and cybersecurity laws (see C5).172 The Department of Home Affairs included the possible introduction of an explicit approach to data localization in the paper; global tech giants and industry associations spoke out against data localization requirements in September 2022, after the coverage period, claiming they would be ineffective for cybersecurity and have an overall negative impact on the availability of digital services.173

Violence against online commentators is rare in Australia. Controversial figures are occasionally subject to intimidation and death threats. In 2019, the AFP obtained warrants and raided the homes of two journalists.174

The eSafety Commissioner recorded an increase in reports of cyberabuse during the coverage period. In 2020–21, the commissioner received requests for assistance from 1,599 adults, an increase of 52 percent from the year prior.175 The majority of victims were women. In the same period, the eSafety commissioner recorded receiving 2,687 reports of image-based abuse, which includes the nonconsensual sharing of intimate images, about the same number as the previous reporting period.176

Cyberattacks and hacking incidents remain a common concern, though they generally target larger institutions and have not been widely used to censor online speech or punish government critics.

Media platforms in Australia occasionally fall victim to cyberattacks. In December 2021, the Chinese government reportedly launched a major cyberattack against an Australian media company. Hackers allegedly accessed passwords and stole data from the company after exploiting vulnerabilities in company software.177 In June 2022, after the coverage period, Chinese-language platform Media Today experienced a cyberattack against its registration system with the presumed objective of obtaining user information and stealing accounts. Media Today reported that no user information was leaked and that the attack, which occurred on the anniversary of the Tiananmen Square massacre, came from internet protocol (IP) addresses located in the United States, Canada, and Hong Kong.178

Australian public institutions and businesses are sometimes targeted with cyberattacks. The Australian Cyber Security Center (ACSC) responded to 1,630 cyber security incidents in 2020–21, noting that such attacks have increasingly targeted critical infrastructure.179 A significant cyberattack in March 2021 targeted Parliament, causing employees to lose access to their emails for a limited period of time. The government reported that no information had been compromised.