Route V · eSafety

Online abuse of a person: where eSafety’s scheme begins

eSafety’s adult cyber abuse scheme protects people, not businesses: it can act when seriously harmful content targets one specific adult who ordinarily lives in Australia, such as an owner or a member of staff, but it cannot act on behalf of an organisation. The content must meet a two-part legal test, and eSafety says the scheme is not intended to regulate purely reputational damage or bad online reviews.

General information, not legal advice. The eSafety Commissioner is the official place to check.

A person, never a brand

First, safety: if anyone in Australia is in immediate danger or at risk of harm, eSafety’s advice is to call emergency services on Triple Zero (000).

eSafety is plain about where its scheme starts. In its words, “the harmful content must target one specific person, not a broad range or group of people”, and eSafety gives the example that it cannot act for an organisation facing racist or misogynist abuse online, because that abuse is aimed at a group. The person targeted must be 18 or older and ordinarily live in Australia.

That draws the line through a business. A post aimed at the business as an organisation is outside the scheme, while a post aimed at the owner, or at one identifiable member of staff, may be inside it if it meets the test below. eSafety does not search for abuse itself: it can seek removal only when the targeted adult complains, or authorises another person to complain on their behalf.

The two-part test

“For eSafety to investigate, the harmful content must meet the legal definition of ‘adult cyber abuse’. This means it must target a specific Australian adult and be both: intended to cause serious harm, and menacing, harassing or offensive in all the circumstances.”

eSafety Commissioner, Adult cyber abuse

eSafety defines the first part closely: “‘Serious harm’ means that the content is likely to have a severe negative impact on the physical or mental health of the person targeted. The impact can be temporary, long lasting or permanent. It includes serious distress that goes beyond ordinary emotional reactions such as anger, fear or grief.”

It says the threshold is set deliberately high, to balance freedom of speech and legitimate expressions of opinion against everyone’s ability to take part online. eSafety says adult cyber abuse “can include content that makes realistic threats, places a person in physical danger, is excessively hurtful, or repeatedly targets the same person.”

The same words in two laws

‘Serious harm’ also appears in defamation law, where it means something else. Set side by side:

eSafety’s scheme, from its own pages, beside defamation as Queensland’s Act sets it out.
Question	eSafety’s adult cyber abuse scheme	Defamation (Queensland)
What serious harm is to	The physical or mental health of the person targeted.	Reputation; for an excluded corporation, harm that causes or is likely to cause serious financial loss.
Who it can protect	One specific adult who ordinarily lives in Australia, never an organisation.	A person, or a corporation that was an excluded corporation when the matter was published.
The first step	A report to the service or platform used, before any report to eSafety.	A concerns notice to the publisher, before any proceedings.
Who decides	eSafety assesses whether the material qualifies for removal under the Online Safety Act’s criteria.	The judicial officer, not the jury, decides whether the serious harm element is established.

One post can raise both questions, and the two are separate. The defamation side is in the guide to defamation and businesses, with its notice and time limits in concerns notices and time limits.

What eSafety can do, and when it can’t

For eSafety to investigate, the content must first have been reported to the service or platform used. What eSafety can then require is set out on its page on reporting adult cyber abuse. eSafety also sets out its limits: it does not have to seek removal for every complaint, it cannot take further action once the content has been deleted or removed, and it cannot reveal who is behind an anonymous or fake account.

A decision can be looked at again. Where eSafety chose not to issue a removal notice for content meeting the definition, a review can be requested, and eSafety says it is handled first internally, by another member of its staff.