Who must comply with doxxing criminal offence (Criminal Code s 474.17C)?

From 11 December 2024, using a carriage service to dox personal data with menace is criminal.

Sections 474.17C-474.17D of the Criminal Code (added by the Privacy and Other Legislation Amendment Act 2024) create criminal offences for using a carriage service to menace, harass or cause offence by publishing personal data about an individual or group. Aggravated form (motivated by prejudice based on race, religion, sex, etc.) carries higher penalty.

A criminal offence for individuals using a carriage service — not a business compliance obligation. The Rules Mate questionnaire does not treat this as an obligation for an ordinary business.

How the regulator frames it: All users of carriage services in Australia.

What triggers it: Publishing personal data via internet/phone/messaging to menace or harass.

Jurisdiction: Commonwealth law, so the test is the same in every state and territory.

Outcome across the 35 industries Rules Mate maps (35 of 35: no).

The answer is the same in every industry: no. Industry does not change who must comply.

Structure does not change the answer across all industries: for every structure the answer is "no".

Size does not change the answer across all industries: at every size band the answer is "no".

Each line is one run of the Rules Mate applicability engine for a single business profile, with the reason the engine gives:

• Pty Ltd company in real estate agents with 6–19 employees, turnover $1M–$3M: does not apply. A criminal offence for individuals using a carriage service — not a business compliance obligation.

When due

Continuous from 11 December 2024.

Frequency

Ongoing

Evidence to keep

n/a — criminal offence; AFP prosecutes.

Status

Current

Priority

High

Maximum penalty: Up to 6 years imprisonment for basic offence; up to 7 years for aggravated (prejudice-based).

Rules Mate has not yet classified the audit or assurance level for this obligation. Any audit, review or certification requirement is set by the regulator source listed below.

• APP 3 collection of sensitive information: APP 3 bars collecting sensitive information — health, race, religion, sexual orientation and more — without consent. What counts as sensitive, the exceptions and penalties.
• Automated decision-making transparency in your privacy policy (APP 1.7–1.9): From 10 December 2026, APP entities that use computer programs to make or substantially assist decisions that significantly affect individuals must say so in their APP privacy policy.
• Notifiable Data Breach (NDB) scheme: Under the NDB scheme, APP entities must notify the OAIC and affected individuals of an eligible data breach likely to cause serious harm — assessed within 30 days.
• APP 12 & APP 13 access and correction requests: Individuals can ask to access (APP 12) and correct (APP 13) the personal information you hold — the strict response times, allowable refusals and how to comply.
• APP 7 direct marketing: consent, opt-out & when you can't message (2026): APP 7 restricts using or disclosing personal information for direct marketing and requires a simple opt-out — when it applies, the exceptions and penalties.

Rules Mate tracks 20 published obligations tagged "privacy", 3 of them rated critical. For a professional services Pty Ltd company with 6–19 employees operating in every state, 4 of those apply outright. This obligation is rated high priority and carries criminal liability, and is an ongoing duty.

Criminal Code Act 1995: Schedule 1 = Criminal Code.

• Criminal Code Act 1995

Free tools that help with this obligation:

• Privacy Act 2026 readiness
• NDB notification timer
• Marketing compliance check (Spam Act)