FEDERAL COURT OF AUSTRALIA

eSafety Commissioner v Rotondo (No 4) [2025] FCA 1191

ORDERS

THE COURT DECLARES THAT:

1.    On 15 November 2022, the respondent contravened s 75 of the Online Safety Act 2021 (Cth) by posting on the [named website] a moving visual image, that appeared to be Depicted Person 1, without Depicted Person 1’s consent, depicting the person’s genital area and breasts and engaged in a sexual act of a kind not ordinarily done in public in circumstances in which an ordinary reasonable person would reasonably expect to be afforded privacy.

2.    On 24 November 2022, the respondent contravened s 75 of the Act by posting on the [named website] a moving visual image, that appeared to be Depicted Person 2, without Depicted Person 2’s consent, depicting the person’s genital area and breasts and engaged in a sexual act of a kind not ordinarily done in public in circumstances in which an ordinary reasonable person would reasonably expect to be afforded privacy.

3.    On 5 December 2022, the respondent contravened s 75 of the Act by posting on the [named website] a moving visual image, that appeared to be Depicted Person 3, without Depicted Person 3’s consent, depicting the person’s genital area and breasts and in a state of undress in circumstances in which an ordinary reasonable person would reasonably expect to be afforded privacy.

4.    On 26 December 2022, the respondent contravened s 75 of the Act by posting on the [named website] a moving visual image, that appeared to be Depicted Person 5, without Depicted Person 5’s consent, depicting the person’s genital area and breasts and in a state of undress in circumstances in which an ordinary reasonable person would reasonably expect to be afforded privacy.

5.    On 27 December 2022, the respondent contravened s 75 of the Act by posting on the [named website] a moving visual image, that appeared to be Depicted Person 3, without Depicted Person 3’s consent, depicting the person’s genital area and breasts and in a state of undress in circumstances in which an ordinary reasonable person would reasonably expect to be afforded privacy.

6.    On 7 March 2023, the respondent contravened s 75 of the Act by posting on the [named website] a moving visual image, that appeared to be Depicted Person 3, without Depicted Person 3’s consent, depicting the person’s genital area and breasts and in a state of undress in circumstances in which an ordinary reasonable person would reasonably expect to be afforded privacy.

7.    On 7 May 2023, the respondent contravened s 75 of the Act by posting on the [named website] a moving visual image, that appeared to be Depicted Person 4, without Depicted Person 4’s consent, depicting the person’s genital area and breasts and in a state of undress in circumstances in which an ordinary reasonable person would reasonably expect to be afforded privacy.

8.    On 9 May 2023, the respondent contravened s 75 of the Act by posting on the [named website] a moving visual image, that appeared to be Depicted Person 4, without Depicted Person 4’s consent, depicting the person’s genital area and breasts and in a state of undress in circumstances in which an ordinary reasonable person would reasonably expect to be afforded privacy.

9.    On 16 May 2023, the respondent contravened s 75 of the Act by posting on the [named website] a moving visual image, that appeared to be Depicted Person 6, without Depicted Person 6’s consent, depicting the person’s genital area and breasts and in a state of undress in circumstances in which an ordinary reasonable person would reasonably expect to be afforded privacy.

10.    On 19 May 2023, the respondent contravened s 75 of the Act by posting on the [named website] a moving visual image, that appeared to be Depicted Person 6, without Depicted Person 6’s consent, depicting the person’s genital area and breasts and in a state of undress in circumstances in which an ordinary reasonable person would reasonably expect to be afforded privacy.

11.    On 19 May 2023, the respondent contravened s 75 of the Act by posting on the [named website] a moving visual image, that appeared to be Depicted Person 6, without Depicted Person 6’s consent, depicting the person’s genital area and breasts and in a state of undress in circumstances in which an ordinary reasonable person would reasonably expect to be afforded privacy.

12.    On 27 May 2023, the respondent contravened s 75 of the Act by posting on the [named website] a moving visual image, that appeared to be Depicted Person 6, without Depicted Person 6’s consent, depicting the person’s genital area and breasts and in a state of undress in circumstances in which an ordinary reasonable person would reasonably expect to be afforded privacy.

13.    Between 6 May 2023 and 27 October 2023, the respondent contravened s 80 of the Act by failing to comply with a requirement under a removal notice given under s 78 of the Act to the extent that he was capable of doing so.

14.    Between 6 May 2023 and 27 October 2023, the respondent contravened s 83(3) of the Act by contravening a direction given under s 83(2) of the Act.

THE COURT ORDERS THAT:

15.    The respondent pay to the Commonwealth of Australia pursuant to s 162 of the Act, the following pecuniary penalties:

(a)    in respect of the contravention of s 75 of the Act the subject of Declaration 1 above, $15,000;

(b)    in respect of the contravention of s 75 of the Act the subject of Declaration 2 above, $15,000;

(c)    in respect of the contravention of s 75 of the Act the subject of Declaration 3 above, $15,000;

(d)    in respect of the contravention of s 75 of the Act the subject of Declaration 4 above, $15,000;

(e)    in respect of the contravention of s 75 of the Act the subject of Declaration 5 above, $15,000;

(f)    in respect of the contravention of s 75 of the Act the subject of Declaration 6 above, $18,500;

(g)    in respect of the contravention of s 75 of the Act the subject of Declaration 7 above, $35,000;

(h)    in respect of the contravention of s 75 of the Act the subject of Declaration 8 above, $35,000;

(i)    in respect of the contravention of s 75 of the Act the subject of Declaration 9 above, $35,000;

(j)    in respect of the contravention of s 75 of the Act the subject of Declaration 10 above, $35,000;

(k)    in respect of the contravention of s 75 of the Act the subject of Declaration 11 above, $35,000; and

(l)    in respect of the contravention of s 75 of the Act the subject of Declaration 12 above, $35,000.

16.    The respondent pay to the Commonwealth of Australia pursuant to s 162 of the Act, a pecuniary penalty of $20,000 in respect of the contraventions of s 80 of the Act the subject of Declaration 13 above.

17.    The respondent pay to the Commonwealth of Australia pursuant to s 162 of the Act, a pecuniary penalty of $20,000 in respect of the contraventions of s 83(3) of the Act the subject of Declaration 14 above.

18.    The respondent pay the applicant’s costs of and incidental to the proceeding to be assessed on a party and party basis.

Note:    Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.

REASONS FOR JUDGMENT

LONGBOTTOM J:

INTRODUCTION

1    The Online Safety Act 2021 (Cth) was enacted with the object of improving and promoting online safety for Australians: Act, s 3. To that end, the Act established an eSafety Commissioner whose functions relevantly include administering a complaints system for the non-consensual sharing of intimate images: Act, ss 25, 26 and 27. The powers of the Commissioner extend to requiring a person who has posted such images online to take all reasonable steps to ensure their removal and commence proceedings to enforce civil penalty provisions: Act, ss 28, 78 and 162.

2    Between 15 November 2022 and 19 May 2023, the respondent posted 12 non-consensual deepfake intimate images of six persons ordinarily resident in Australia online. The respondent was given a notice and a direct under the Act requiring him to take all reasonable steps to ensure removal of a number of those images: Act, s 78 and s 83(2). The respondent failed to comply. It was not until November 2023, that the respondent provided the cooperation necessary to enable the images to be removed.

3    On 19 October 2023, the Commissioner commenced these proceedings. She seeks declarations and civil penalties against the respondent in respect of the conduct described above. The Commissioner also seeks an order for costs. The Commissioner says that this is the first proceeding involving the imposition of a civil penalty under the Act.

4    The respondent is not legally represented, although attempts were made to secure him pro-bono legal assistance. He has admitted liability in a statement of agreed facts and admissions made pursuant to s 191 of the Evidence Act 1995 (Cth) filed 28 January 2025. Against that background, and the novelty of the proceeding, on 11 April 2025, orders were made for the appointment of an amicus curiae: cf, Roadshow Films Pty Ltd v iiNet Ltd [2011] HCA 54; (2011) 248 CLR 37 at [3] to [4] (French CJ, Gummow, Hayne, Crennan and Kiefel JJ); and Wilson v Manna Hill Mining Co Pty Ltd [2004] FCA 1663; (2004) 51 ACSR 404 at [87] (Lander J). The amicus curiae filed an outline of submissions but was not able to appear at the hearing.

5    For the reasons set out below, I will grant declaratory relief as sought by the Commissioner and make civil penalty orders that the respondent pay the Commonwealth of Australia pecuniary penalties totalling $343,500.

FACTUAL OVERVIEW

6    The agreed facts and admissions were filed following a mediation on 19 September 2024. The agreed facts are supported by the following affidavits upon which the Commissioner relied at the hearing:

(1)    The Affidavit of Luke Boon filed 20 October 2023. Mr Boon is the acting Executive Manager of the Investigations Branch of the Office of the Commissioner. He is a delegate of the Commissioner for the purposes of conducting investigations and exercising regulatory powers under the Act. Mr Boon had oversight of the investigation into complaints of non-consensual sharing of intimate images by members of the public that led to the commencement of these proceedings.

(2)    The Affidavit of Plainclothes Senior Constable Michael McLaughlin filed 17 November 2023. Senior Constable McLaughlin works in the Brisbane City Child Protection and Investigation Unit of the Queensland Police Service. He is the investigating officer in respect of charges against the respondent under the Criminal Code 1899 (Qld).

7    Having regard to the affidavit material, I am satisfied that the agreed facts are to be accepted as true: Evidence Act, s 191 and Australian Securities and Investments Commission v BHF Solutions Pty Ltd [2022] FCAFC 108; (2022) 293 FCR 330 at [34] (O’Bryan J, with whom Besanko and Lee JJ agreed).

8    The Commissioner also relied on the expert report of Report of Professor Clare McGlynn KC filed 28 January 2025 (McGlynn Report). Professor McGlynn is a Professor of Law at Durham University in the United Kingdom. She has over 30 years’ experience of research and policy work regarding violence against women and girls. Professor McGlynn was an international collaborator on the largest study to date of legal and policy responses to image-based abuse involving interviews and survey respondents across the United Kingdom, Australia and New Zealand and funded by the Australian Research Council. At the hearing, I ruled parts of the McGlynn Report dealing with individual psychosocial harm inadmissible having regard to the Commissioner’s concession that Professor McGlynn did not have specialised knowledge in that field: Evidence Act, s 79.

9    The respondent did not file evidence but made submissions at the hearing, including with respect to his financial position.

Posting of non-consensual deepfake intimate images

10    The first part of the agreed facts and admissions deals with the respondent posting non-consensual deepfake intimate images of six individuals (Depicted Persons) on a website. It relevantly provides as follows:

4.    A deepfake is a form of visual media in which one person’s likeness is digitally manipulated so as to convincingly depict the individual in circumstances that never existed.

5.    The website [the named website] … aggregates, hosts and displays deepfake videos and images and is accessible worldwide, including by people in Australia.

6.    [The respondent] created each of the deepfake images described below by following the same process:

a.    locating an image of the depicted person online;

b.    uploading the image to a webpage that allowed him to create semi-naked or naked images of the person;

c.    saving the generated image.

7.    On 15 November 2022, [the respondent] uploaded to [the named website] a moving visual image, that appeared to be Depicted Person 1, depicting the person’s genital area and breasts and engaged in a sexual act of a kind not ordinarily done in public in circumstances in which an ordinary reasonable person would reasonably expect to be afforded privacy (DP1 Image).

8.    On 24 November 2022, [the respondent] uploaded to [the named website] a moving visual image, that appeared to be Depicted Person 2, depicting the person’s genital area and breasts and engaged in a sexual act of a kind not ordinarily done in public in circumstances in which an ordinary reasonable person would reasonably expect to be afforded privacy (DP2 Image).

9.    On 5 December 2022, [the respondent] uploaded to [the named website] a moving visual image, that appeared to be Depicted Person 3, depicting the person’s genital area and breasts and in a state of undress in circumstances in which an ordinary reasonable person would reasonably expect to be afforded privacy (DP3 Image 1).

10.    On 26 December 2022, [the respondent] uploaded to [the named website] a moving visual image, that appeared to be Depicted Person 5, depicting the person’s genital area and breasts and in a state of undress in circumstances in which an ordinary reasonable person would reasonably expect to be afforded privacy (DP5 Image 1 [sic]).

11.    On 27 December 2022, [the respondent] uploaded to [the named website] a moving visual image, that appeared to be Depicted Person 3, depicting the person’s genital area and breasts and in a state of undress in circumstances in which an ordinary reasonable person would reasonably expect to be afforded privacy (DP3 Image 2).

12.    On 7 March 2023, [the respondent] uploaded to [the named website] a moving visual image, that appeared to be Depicted Person 3, depicting the person’s genital area and breasts and in a state of undress in circumstances in which an ordinary reasonable person would reasonably expect to be afforded privacy (DP3 Image 3).

13.    On 7 May 2023, [the respondent] uploaded to [the named website] a moving visual image, that appeared to be Depicted Person 4, depicting the person’s genital area and breasts and in a state of undress in circumstances in which an ordinary reasonable person would reasonably expect to be afforded privacy (DP4 Image 1).

14.    On 9 May 2023, [the respondent] uploaded to [the named website] a moving visual image, that appeared to be Depicted Person 4, depicting the person’s genital area and breasts and in a state of undress in circumstances in which an ordinary reasonable person would reasonably expect to be afforded privacy (DP4 Image 2).

15.    On 16 May 2023, [the respondent] uploaded to [the named website] a moving visual image, that appeared to be Depicted Person 6, depicting the person’s genital area and breasts and in a state of undress in circumstances in which an ordinary reasonable person would reasonably expect to be afforded privacy (DP6 Image 1).

16.    On 19 May 2023, [the respondent] uploaded to [the named website] two moving visual images, that appeared to be Depicted Person 6, depicting the person’s genital area and breasts and in a state of undress in circumstances in which an ordinary reasonable person would reasonably expect to be afforded privacy (DP6 Image 2 and DP6 Image 3).

17.    On 27 May 2023, [the respondent] uploaded to [the named website] a moving visual image, that appeared to be Depicted Person 6, depicting the person’s genital area and breasts and in a state of undress in circumstances in which an ordinary reasonable person would reasonably expect to be afforded privacy (DP6 Image 4).

18.    [The respondent] did not receive (and was aware that he had not received) consent from any of Depicted Persons 1, 2, 3, 4, 5 or 6 to him posting any of the images described in paragraphs 7 to 17 above to [the named website].    

11    Mr Boon gives evidence that each of the Depicted Persons ordinarily resides in Australia and made a complaint about the images (either on their own behalf or through an authorised person).

Removal Notices and Remedial Directions

12    The second part of the agreed facts and admissions addresses the notices issued to the respondent under the Act regarding the removal of the non-consensual deepfake intimate images. It provides as follows:

19.    On 5 May 2023 (after uploading six of the twelve total images referred to above) [the respondent] received an email from eSafety at his email address … (5 May eSafety email). Attached to the 5 May eSafety email was:

19.1    a removal notice under s 78 of the OS Act (Removal Notice); and

19.2    a remedial direction under s 83 of the OS Act (Remedial Direction).

20.    On 5 May 2023, at around 9:15pm AEST, [the respondent] sent an email, replying to the 5 May eSafety email, which said:

I am not a resident of Australia.

The removal notice means nothing to me.

Get an arrest warrant if you think you are right.

21.    The Removal Notice required [the respondent] to, amongst other things, take all reasonable steps to ensure the removal from [the named website] of DP1 Image and DP2 Image.

22.    From 5 May 2023 to 27 October 2023 (being the date of his arrest) [the respondent] was capable of taking steps to remove DP1 Image and DP2 Image from [the named website] but he refused to take any steps to comply with the Removal Notice.

23.    The Remedial Direction required [the respondent] to take the following actions, amongst others:

23.1.    Delete all intimate images of Depicted Person 1 and Depicted Person 2 in [the respondent’s] possession or control within 24 hours of receiving the Remedial Direction;

23.2.    Refrain from posting any further intimate images of Depicted Person 1 and Depicted Person 2; and

23.3.    Write a statement to eSafety to be sent by 6 May 2023, containing the following:

23.3.1.    confirmation that [the respondent] had read and understood the Remedial Direction,

a)    the steps [the respondent] had taken to comply with the Remedial Direction, and

b)    any other actions [the respondent] had taken to ensure that there will be no further contravention of s 75 of the OS Act.

24.    [The respondent] did not comply with the Remedial Direction.

25.    On 23 May 2023, [the respondent] received an email from eSafety which attached two s 80 infringement notices (23 May Notices). The first infringement notice was for the amount $3,300, for [the respondent’s] noncompliance with the Removal Notice. The second infringement notice was for the amount $3,300, for [the respondent’s] noncompliance with the Remedial Direction.

26.    On 29 May 2023, [the respondent] replied to eSafety’s email of 23 May 2023 stating:

Are you sure you have got the right person? Have you got the right name? Do you have a residential address for Antonio Rotondo in Australia?

27.    On 29 May 2023, eSafety replied to [the respondent] by email stating that eSafety was satisfied that [the respondent] was the correct recipient of the infringement notices (29 May eSafety email).

28.    On 29 May 2023, [the respondent] replied to the 29 May eSafety email providing a link to DP6 Images 1, 2, 3 and 4 and stating:

Are you referring to [Depicted Person 6’s] profile on [the named website]?

29.    [The respondent] failed to comply with the 23 May Notices.

30.    On 10 October 2023, [the respondent] arrived in Australia on holiday.

31.    On 27 October 2023, [the respondent] was arrested by the Queensland Police Service and remanded into custody in relation to matters beyond the scope of this proceeding.

32.    When [the respondent] was arrested, he acknowledged that his posting of deepfake images could cause upset and distress to the depicted individuals and that the images were obscene. However, he did not express remorse and described his deepfake activities as a hobby. He stated that producing deepfake images was fun and likened it to “like having x-ray vision glasses.” He also stated:

I’m just that type of person. I’m at that stage in my life where I really don’t care. I think it’s funny.

…

from a practical point of view you cannot stop deepfakes. Everyone should live in fear of deepfakes. Every woman on Earth should live in fear of a camera, live in fear of Facebook. There will be nude pictures of everyone on the internet.

33.    From 27 October 2023, [the respondent] was not capable of complying with the requirements of the Removal Notice or the Remedial Direction because he was in custody.

13    The agreed facts and admissions go on to provide:

37.    Some of the images [the respondent] posted online were retaliatory against individuals who were involved in the issuing of the Removal Notice.

38.    From around 3 November 2023, [the respondent] cooperated with eSafety in relation to removing the images from [the named website] by providing his consent and account log in details to enable eSafety investigators to remove the images referred to at paragraphs 7 to 17 above.

39.    [The respondent] has not previously been found to have contravened the OS Act.

STATUTORY FRAMEWORK

Non-consensual sharing of intimate images

14    Part 6 of the Act prohibits a person who is the end-user of a social media service, relevant electronic service or designated internet service from posting non-consensual intimate images of a person ordinarily resident in Australia.

15    Section 75 of the Act relevantly provides:

75    Posting an intimate image

(1)    A person (the first person) who is an end-user of:

(a)    a social media service; or

(b)    a relevant electronic service; or

(c)    a designated internet service;

must not post, or make a threat to post, an intimate image of another person (the second person) on the service if:

(d)    the first person is ordinarily resident in Australia; or

(e)    the second person is ordinarily resident in Australia.

Civil penalty: 500 penalty units.

Consent

(2)    Subsection (1) does not apply if the second person consented to the posting of the intimate image by the first person.

Note:    In proceedings for a civil penalty order against a person for a contravention of subsection (1), the person bears an evidential burden in relation to the matter in this subsection (see section 96 of the Regulatory Powers (Standard Provisions) Act 2014).

    Depiction of second person without attire of religious or cultural significance

…

(4)    Subsection (1) does not apply if:

(a)    in the case of a post of the intimate image—the resulting provision of the intimate image on the service is an exempt provision of the intimate image; or

(b)    in the case of a threat to post the intimate image—assuming that the threat had been carried out, the resulting provision of the intimate image on the service would be an exempt provision of the intimate image.

Note:    In proceedings for a civil penalty order against a person for a contravention of subsection (1), the person bears an evidential burden in relation to the matter in this subsection (see section 96 of the Regulatory Powers (Standard Provisions) Act 2014).

16    An “intimate image” is defined to include a still or moving visual image that depicts, or appears to depict, a person in a state of undress or engaged in a sexual act of a kind not ordinarily done in public, or the person’s genital area (whether bare or covered by underwear) in circumstances where an ordinary reasonable person would reasonably be expected to be afforded privacy: Act, ss 15(2), 15(3)(b)(i) and (v). An intimate image is a “non-consensual intimate image” of a person if, relevantly, the intimate image of the person is provided on a designated internet service; the person did not consent to the provision of the intimate image on that service; and the provision of the intimate image on the service is not an exempt provision of the intimae image: Act, s 16.

17    For the purposes of the Act, a “designated internet service” means a service that allows end-users to access material using an internet carriage but does not include a social media service, a relevant electronic service, an on-demand program service, a service specified in a legislative instrument or an exempt service: Act, s 14(1) and (2). A service is an “exempt service” if none of the material on the service is accessible to, or delivered to, one or more end-users in Australia: Act, s 14(3).

Removal notice and remedial direction

18    A person may make a complaint to the Commissioner if they have reason to believe that s 75 has been contravened: Act, s 32(1) and s 33(3). The complaint must be made by either the person depicted in the intimate image or another person with the authority of the person depicted: Act, s 35(1) and s 35(3)(a). If the complainant is not able to identify the person who allegedly contravened s 75, then the complainant must make a statement to the Commissioner to that effect: Act, s 35(2).

19    Upon complaint, provided that the Commissioner is satisfied that the person did not consent to the provision of the intimate image on the service, she may give the end-user a written notice (removal notice) requiring the end-user to take all reasonable steps to ensure the removal of the intimate image from the service within 24 hours after the removal notice is given, or such longer period as the Commissioner allows: Act, ss 78(1)(c)(i), (f) and (g). It is also a pre-condition to issuing a removal notice that the intimate image of the person is, or has been, provided on a designated internet service and posted on that service by a particular end-user of it: Act, s 78(1)(a) and (b).

20    Section 80 provides:

80    Compliance with removal notice

    A person must comply with a requirement under a removal notice given under section 77, 78 or 79 to the extent that the person is capable of doing so.

    Civil penalty: 500 penalty units.

21    If a person has contravened, or is contravening, s 75 of the Act, then the Commissioner may give the person a written direction requiring the person to take specified action directed towards ensuring that the person does not contravene s 75 in the future (remedial direction): Act, s 83(1) and (2). The civil penalty for contravening a remedial direction is 500 penalty units: Act, s 83(3).

Civil penalties

22    A person who contravenes a civil penalty provision that requires an act or thing to be done within a particular period or before a particular time, commits a separate contravention of the provision in respect of each day during which the contravention occurs (including the day the relevant civil penalty order is made or any later day): Regulatory Powers (Standard Provisions) Act 2014 (Cth).

23    The Commissioner bears the onus of proof and must establish the allegations against the respondent on the balance of probabilities, taking into account the nature of the cause of action, the subject matter of the proceeding and the gravity of the matters alleged: Evidence Act, s 140; see also, Regulatory Powers Act, s 87; Secretary, Department of Health v Evolution Supplements Australia Pty Ltd (No 2) [2021] FCA 872 at [4] (Burley J); and Australian Competition and Consumer Commission v We Buy Houses Pty Ltd [2017] FCA 915 at [44] (Gleeson J).

24    The Court may not make a civil penalty order against a person for contravention of a civil penalty provision if the person has been convicted of an offence constituted by conduct that is the same, or substantially the same, as the conduct constituting the contravention: Regulatory Powers Act, s 88. The pecuniary penalty must not be more than that specified for the civil penalty provision: Regulatory Powers Act, s 82(5)(b). A civil penalty under the Act is enforceable under Pt 4 of the Regulatory Powers Act: Act, s 162.

DECLARATIONS

25    The Commissioner seeks declarations that the respondent has contravened ss 75, 80 and 83 of the Act. The respondent has made the following admissions with respect to those contraventions:

34.    [The respondent] admits that between 15 November 2022 and 27 May 2023, by engaging in the conduct set out in paragraphs 7 to 17 above, he contravened s 75 of the OS Act on 12 occasions by posting intimate images on [the named website] on:

34.1.    15 November 2022 in relation to DP1 Image;

34.2.    24 November 2022 in relation to DP2 Image;

34.3.    5 December 2022 in relation to DP3 Image 1;

34.4.    26 December 2022 in relation to DP5 Image;

34.5.    27 December 2022 in relation to DP3 Image 2;

34.6.    7 March 2023 in relation to DP3 Image 3;

34.7.    7 May 2023 in relation to DP4 Image 1;

34.8.    9 May 2023 in relation to DP4 Image 2;

34.9.    16 May 2023 in relation to DP6 Image 1;

34.10.    19 May 2023 in relation to DP6 Image 2;

34.11.    19 May 2023 in relation to DP6 Image 3;

34.12.    27 May 2023 in relation to DP6 Image 4.

35.    [The respondent] admits that between 6 May 2023 and 27 October 2023, he contravened s 83 of the OS Act (sic) by not complying with a requirement under a removal notice given under s 78 of the Act to the extent that he was capable of doing so.

36.    [The respondent] admits that between 6 May 2023 and 27 October 2023 he contravened s 83(3) of the OS Act by not complying with a direction given under s 83(2) of the OS Act.

Power and discretion

26    The Court has a wide discretionary power to make declarations under s 21 of the Federal Court of Australia Act 1976 (Cth): Forster v Jododex Australia Pty Ltd [1972] HCA 61; (1972) 127 CLR 421 at 437 to 438 (Gibbs J). Declarations relating to contraventions of legislative provisions are likely to be appropriate where they serve to record the Court’s disapproval of the contravening conduct, vindicate the regulator’s claim that the respondent contravened the provisions, assist the regulator to carry out its duties and deter other persons from contravening the provisions: Australian Building and Construction Commissioner v Construction, Forestry, Mining and Energy Union [2017] FCAFC 113; (2017) 254 FCR 68 at [93] (Dowsett, Greenwood and Wigney JJ).

27    Before granting declaratory relief, the Court should be satisfied that the question is real, not hypothetical or theoretical, that the applicant has a sufficient real interest in raising the issue and that there is a proper contradictor: Forster at 437 to 438; see also, Hobart International Airport Pty Ltd v Clarence City Council [2022] HCA 5; (2022) 276 CLR 519 at [32] to [34] (Kiefel CJ, Keane and Gordon JJ).

28    The facts necessary to support a declaration may be established by agreed facts: Australian Competition and Consumer Commission v Fisher & Paykel Customer Services Pty Ltd [2014] FCA 1393 at [52] (Wigney J). But “close attention” should be given to the form of proposed declarations, particularly those “by consent”: Rural Press Ltd v Australian Competition and Consumer Commission [2003] HCA 75; (2003) 216 CLR 53 at [90] (Gummow, Hayne and Heydon JJ).

29    Moreover, the declaration should “disclose the basis on which” a contravention has occurred and “sufficient indication of how and why the relevant conduct is a contravention” of the Act: BMW Australia Ltd v Australian Competition and Consumer Commission [2004] FCAFC 167; (2004) 207 ALR 452 at [35] (Gray, Goldberg and Weinberg JJ); and Australian Competition and Consumer Commission v Coles Supermarkets Australia Pty Ltd [2014] FCA 1405 at [77] (Gordon J), as cited in Comcare v Linfox Australia Pty Ltd [2015] FCA 61; (2015) 144 ALD 593 at [12] (Flick J).

Disposition

30    For the following reasons, I am satisfied that this is an appropriate case to grant declaratory relief.

31    Even though the respondent has admitted he contravened ss 75, 80 and 83 of the Act, I am independently satisfied that the agreed facts amount to contraventions of each of those provisions. That includes satisfaction that insofar as the agreed facts refer to terms defined by the Act (such as “intimate image” which is defined by s 15) that the facts, as agreed, satisfy the statutory definition.

32    That is to say, I am satisfied that the respondent has:

(a)    on twelve occasions contravened s 75 of the Act in the manner described in the agreed facts and admissions by uploading to the named website non-consensual intimate images of six persons ordinarily resident in Australia;

(b)    contravened s 80 of the Act in the manner described in the agreed facts and admissions by failing to comply with the requirement under the removal notice given to him on 5 May 2023; and

(c)    contravened s 83(3) of the Act in the manner described in the agreed facts and admissions by failing to comply with the remedial direction given to him on 5 May 2023.

33    There is an important public service to be served by granting declarations as sought by the Commissioner. So much is clear from the statutory objects in s 3 of the Act, reinforced by the Explanatory Memorandum to the Online Safety Bill 2021 (Cth) which relevantly provides as follows:

The eSafety Commissioner reports that image-based abuse or the sharing of intimate images without consent, affects 11 per cent of adult Australians. This is an extremely destructive form of online abuse which can have devastating impacts for victims. Reports of image-based abuse have increased as more Australians have adopted new digital habits during the COVID-19 isolation period, with reports of image-base abuse up 200 per cent in the first few months of the pandemic.

The sharing of intimate images without consent is, at times, linked to intimate partner and family violence, with 1 in 4 female victims reporting that perpetrators of image-based abuse had engaged in threatening behaviour after an image was shared. According to 2017 research by the eSafety Commissioner, image-based abuse is more prevalent amongst certain population groups including Aboriginal or Torres Strait Islander persons (25%), young women (24%), and those who identify as LGBTQI (19%). (Footnotes omitted)

34    The particular risk that is posed by the respondent’s conduct as identified in the agreed facts and admissions is addressed in the McGlynn Report. Professor McGlynn gave evidence that the harms associated with sexually explicit deepfake images stems from those images being shared and viewed and not solely from misleading people about their authenticity. She outlined that the prevalence of deepfake image-based abuse has risen exponentially in recent years. This is due to the development of an entire financial and technical eco-system dedicated to their creation, solicitation, use and distribution. Professor McGlynn characterised deepfake intimate images as causing a “highly gendered harm” because the vast majority of people depicted are women or girls. She expressed the opinion that increasing awareness that such behaviours are unlawful can lead to sanctions and that punishment is likely may prevent and deter sexually explicit deepfake image-based abuse.

35    Given the matters outlined above, I am satisfied that the question is real and not hypothetical and that the Commissioner, given her statutory function, has a real interest to raise it: cf, Forster at 437 to 438. The respondent is a proper contradictor because he has a “true interest to oppose” the declaration sought: ibid; see also, Australian Competition and Consumer Commission v MSY Technology Pty Ltd [2012] FCAFC 56; (2012) 201 FCR 378 at [14] to [18] (Greenwood, Logan and Yates JJ). Moreover, I have had the benefit of written submissions from the amicus curiae, which addressed the discretionary powers of the Court to make the declarations sought.

36    The declaratory relief not only vindicates the decision taken by the Commissioner to prosecute the contraventions but also serves as a public warning to others that posting non-consensual intimate images of individuals is a serious matter. For these reasons, save in the one respect outlined below, I make the declarations sought by the Commissioner.

37    The declarations sought included the name of the website onto which the respondent posted the deepfake non-consensual intimate images. Shortly before delivering judgment, I sought the views of the parties as to whether the name of the website should be redacted in either these reasons or the declarations. The Commissioner indicated that she did not consider that needed to occur and did not seek to make any submissions on the matter. The amicus curiae concurred with the position taken by the Commissioner. The respondent did not seek to make submissions on the matter.

38    While noting the position taken by the Commissioner, I have determined to anonymise the name of the website in both these reasons and the declarations. That is for two reasons. First, anonymising the website does not undermine the purpose served by the declaratory relief, including relevantly, to record the Court’s disproval of the contravening conduct. Second, anonymising the name of the website is consistent with the objects of the Act because it ensures that the website on which non-consensual deepfake intimate images can be posted is not publicised to the community at large: Act, s 3.

PECUNIARY PENALTY

39    Whereas criminal penalties import notions of retribution and rehabilitation, the purpose of a civil penalty is primarily, if not wholly, protective in promoting the public interest in compliance: Commonwealth of Australia v Director, Fair Work Building Industry Inspectorate [2015] HCA 46; (2015) 258 CLR 482 at [55] (French CJ, Kiefel, Bell, Nettle and Gordon JJ), citing Trade Practices Commission v CSR Ltd [1990] FCA 762; (1991) 13 ATPR 41-076 at 51,152 (French J).

40    That purpose is to be achieved through both specific and general deterrence. As Beach J explained in Australian Securities and Investments Commission v Westpac Banking Corporation (No 3) [2018] FCA 1701; (2018) 131 ACSR 585 at [48]:

… A pecuniary penalty to the extent that the statute permits must put a price on contravention that is sufficiently high to deter repetition by the contravener and by others who might be tempted to contravene. Its level must be fixed to ensure that the penalty is not to be regarded as an acceptable cost of doing business. As I have said, both specific and general deterrence are important. The need for specific deterrence is informed by the attitude of the contravener to the contraventions, both during the course of the contravening conduct and in the course of enforcement proceedings.

And the need for general deterrence is particularly important when imposing a penalty for a contravention which is difficult to detect.

(Emphasis added)

Relevant considerations

41    Section 82(6) of the Regulatory Powers Act prescribes the matters that the Court must consider in determining the pecuniary penalty:

(6)    In determining the pecuniary penalty, the court must take into account all relevant matters, including:

(a)    the nature and extent of the contravention; and

(b)    the nature and extent of any loss or damage suffered because of the contravention; and

(c)    the circumstances in which the contravention took place; and

(d)    whether the person has previously been found by a court (including a court in a foreign country) to have engaged in any similar conduct.

42    Section 82(6) does not purport to list “all relevant matters” in determining a pecuniary penalty. A series of cases, notably including that of French J in CSR Ltd, have distilled a number of factors emerging from the authorities as relevant to the assessment of a penalty of appropriate deterrent value. In Westpac Banking, Beach J summarised the relevant factors as including the following (at [49]):

(a)     the extent to which the contravention was the result of deliberate or reckless conduct by the corporation, as opposed to negligence or carelessness;

(b)    the number of contraventions, the length of the period over which the contraventions occurred, and whether the contraventions comprised isolated conduct or were systematic;

(c)    the seniority of officers responsible for the contravention;

(d)    the capacity of the defendant to pay, but only in the sense that whilst the size of a corporation does not of itself justify a higher penalty than might otherwise be imposed, it may be relevant in determining the size of the pecuniary penalty that would operate as an effective specific deterrent;

(e)    the existence within the corporation of compliance systems, including provisions for and evidence of education and internal enforcement of such systems;

(f)    remedial and disciplinary steps taken after the contravention and directed to putting in place a compliance system or improving existing systems and disciplining officers responsible for the contravention;

(g)    whether the directors of the corporation were aware of the relevant facts and, if not, what processes were in place at the time or put in place after the contravention to ensure their awareness of such facts in the future;

(h)    any change in the composition of the board or senior managers since the contravention;

(i)    the degree of the corporation’s cooperation with the regulator, including any admission of an actual or attempted contravention;

(j)    the impact or consequences of the contravention on the market or innocent third parties;

(k)    the extent of any profit or benefit derived as a result of the contravention; and

(l)    whether the corporation has been found to have engaged in similar conduct in the past.

43    That list of factors includes matters pertaining to both the character of the contravening conduct (such as factors (a), (b) and (j)) and to the character of the contravener (such as factors (d), (e) and (i)). While it relates to a corporation, the list has been described as “useful” even when the contravener is an individual: Director of Biosecurity v Chi [2024] FCA 388; (2024) 303 FCR 76 at [43] (McElwaine J). But as the majority cautioned in Australian Building and Construction Commissioner v Pattinson [2022] HCA 13; (2022) 274 CLR 450 at [19] (Kiefel CJ, Gageler, Keane, Gordon, Steward and Gleeson JJ):

It is important, however, not to regard the list of possible relevant considerations as a “rigid catalogue of matters for attention” as if it were a legal checklist. The court's task remains to determine what is an “appropriate” penalty in the circumstances of the particular case.

(Footnotes omitted)

Maximum penalty

44    Attention must also be given to the maximum penalty for contravention. If the contravening conduct is not so grave as to warrant the imposition of the maximum penalty, the Court is bound to consider where the facts of the particular conduct lie in the spectrum that extends from the least serious category of the offence to the worst category: Westpac Banking at [50]. What is required is that there be “some reasonable relationship between the theoretical maximum and the final penalty imposed”: Pattinson at [10], citing Australian Competition and Consumer Commission v Reckitt Benckiser (Australia) Pty Ltd [2016] FCAFC 181; (2016) 340 ALR 25 at [156] (Jagot, Yates and Bromwich JJ).

45    The relationship of “reasonableness” may be established by reference to the circumstances of the contravener, as well as by the circumstances of the conduct involved in the contravention: Pattinson at [55] and [60]. Insistence on the deterrent quality of a penalty should also be balanced by insistence that it “not be so high as to be oppressive”: NW Frozen Foods Pty Ltd v Australian Competition and Consumer Commission (1996) 71 FCR 285 at 293 (Burchett and Kiefel JJ). If deterrence is the object, the penalty should not be greater than is necessary to achieve this object; severity beyond that would be oppression: NW Frozen Foods at 293; see also, Pattinson at [40].

Course of conduct

46    Ordinarily, separate contraventions arising from separate acts attract the imposition of a separate penalty for each contravention: Australian Competition and Consumer Commission v Yazaki Corporation [2018] FCAFC 73; (2018) 262 FCR 243 at [227] (Allsop CJ, Middleton and Robertson JJ).

47    Where, as here, the respondent has admitted multiple contraventions of a civil penalty provision, regard may be had to the “course of conduct” and “totality” principle in the context of s 85 of the Regulatory Powers Act: Chi at [45] to [46], citing Transport Workers’ Union of Australia v Registered Organisations Commissioner (No 2) [2018] FCAFC 203; (2018) 267 FCR 40 at [90] to [91] (Allsop CJ, Collier and Rangiah JJ). The “course of conduct” principle is not a rule but a tool of analysis directed to ensuring that “an offender is not punished twice for what is essentially the same criminality”: Construction, Forestry, Mining and Energy Union v Cahill (2010) 269 ALR 1 at [39] (Middleton and Gordon JJ); see also, Yazaki at [226] to [235].

48    Section 85 of the Regulatory Powers Act provides:

85 Multiple contraventions

(1)    A relevant court may make a single civil penalty order against a person for multiple contraventions of a civil penalty provision if proceedings for the contraventions are founded on the same facts, or if the contraventions form, or are part of, a series of contraventions of the same or a similar character.

Note: For continuing contraventions of civil penalty provisions, see section 93.

(2)    However, the penalty must not exceed the sum of the maximum penalties that could be ordered if a separate penalty were ordered for each of the contraventions.

49    Section 85 has been characterised as enshrining a “form of course of conduct principle”: Balasubramaniyan at [102]. Whether the contraventions form, or are part of, “a series of contraventions of the same or a similar character” within the meaning of s 85(1) is a question of fact: Chi at [53]. Section 85 does not, however, have paramountcy in the process of assessing the appropriate civil penalty and cannot itself operate as a de facto limit on the penalty to be imposed for contraventions of a statute: Australian Competition and Consumer Commission v Hillside (Australia New Media) Pty Ltd trading as Bet365 (No 2) [2016] FCA 698 at [24] to [25] (Beach J) as cited in Coal Mining Industry (Long Service Leave Funding) Corporation v Hitachi Construction Machinery (Australia) Pty Ltd (Penalty) [2023] FCA 1187 at [26] (Raper J).

Totality principle

50    The Court will generally have regard to the “totality principle” in determining the appropriate penalty for a large number of contraventions: Coal Mining Industry at [27] (Raper J). This involves a final consideration of whether the cumulative total of the penalty is just and appropriate and not excessive, having regard to the totality of the relevant contravening conduct: Coal Mining Industry at [27], citing Westpac Banking at [272] and [308]. It is not mandatory to apply the “totality principle” and, if applied, it does not require any effective reduction in penalty: Coal Mining Industry at [27] citing Cahill at [41] to [42]; Mornington Inn Pty Ltd v Jordan [2008] FCAFC 70; (2008) 168 FCR 383 at [58] to [59] (Stone and Buchanan JJ); and Director, Fair Work Building Industry Inspectorate v Construction, Forestry, Mining and Energy Union [2015] FCAFC 59; (2015) 229 FCR 331 at [40] to [42] (Dowsett, Greenwood and Wigney JJ).

Overall approach

51    In all, the Court is required to identify and balance the factors relevant to the contraventions and the circumstances of the respondent and make a value judgment as to what is the appropriate penalty, in light of the purposes and objects of a civil penalty as described at [39] and [40] above: Westpac Banking at [49]. This requires an “intuitive synthesis” rather than “an arithmetical algorithmic process that starts from some pre-determined figure and then makes incremental additions or subtractions for each factor according to a set of pre-determined rules”: Commissioner of Taxation v Balasubramaniyan [2022] FCA 374 at [95] (Beach J); see also, Pattinson at [19].

ASSESSMENT OF PENALTY

Contravention of civil penalty provisions

52    I am satisfied for the reasons outlined at [31] and [32] above that the respondent has contravened each of ss 75, 80 and 83(3) of the Act, thereby enlivening the discretionary power to make a civil penalty order: Regulatory Powers Act, s 82(3).

Submissions as to penalty

53    The Commissioner seeks a civil penalty order against the respondent of between $400,000 and $450,000 as follows:

(a)    a penalty within the range of $100,000 to $112,500 for the six contraventions of s 75 of the Act between 15 November 2022 and 7 March 2023 (in relation to DP1 Image to DP3 Image 3);

(b)    a penalty in the range of $215,000 to $240,000 for the six contraventions of s 75 of the Act between 7 May 2023 and 27 May 2023 (in relation to DP4 Image 1 to DP6 Image 4);

(c)    a penalty in the range of $30,000 to $35,000 for the course of conduct contravening s 80 of the Act; and

(d)    a penalty in the range of $30,000 to $35,000 for the course of conduct contravening s 83(3) of the Act.

54    The Commissioner contends that the civil penalties for which she contends reflect the low to mid-level seriousness of the contraventions of s 75 before, and the mid to high-level seriousness of the contraventions of s 75 after, the removal notice and remedial direction were issued; the mid-level seriousness of the “course of conduct” of the contraventions of s 80 and s 83(3); and an overall discount of 20 per cent for cooperation and 50 per cent on the basis of the totality principle: Regulatory Powers Act, s 85.

55    The amicus curiae characterised the pecuniary penalty sought by the Commissioner as representing “a significant impost [that] would be expected to have a high deterrent value”, but “at a level that may be considered oppressive”, depending on the respondent’s financial circumstances. The respondent did not make any overarching submission with respect to the quantum of the pecuniary penalty sought by the Commissioner beyond that outlined below as to his financial means.

56    The Commissioner addressed, in support of the civil penalties she sought, general deterrence; the mandatory factors in s 82(6)(a), (b) and (d) of the Regulatory Powers Act; the respondent’s admission of contravention, cooperation and contrition; as well as s 85 of the Regulatory Powers Act. The respondent’s submissions were principally confined to the nature of the contraventions and his capacity to pay a civil penalty. The amicus curiae addressed each of the mandatory factors in s 82(6) of the Regulatory Powers Act, the deliberateness of the contravention and the period over which it took place; the respondent’s disposition to cooperate with the Commissioner; the infringement notices he was issued; and s 85 of the Regulatory Powers Act. While somewhat differently framed, there is a degree of overlap between the submissions, to which I now turn.

Maximum penalty

57    The maximum penalty for contravention of each of ss 75, 70 and 83(3) of the Act is 500 penalty units. The value of a penalty unit was $222 between 1 July 2020 and 31 December 2022; $275 between 1 January 2023 and 30 June 2023; and $313 between 1 July 2023 and 6 November 2024: Crimes Act 1914 (Cth), s 4 and s 4AA(3); Acts Interpretation Act 1901 (Cth), s 2B, Notice of Indexation of the Penalty Unit Amount (Cth) (19 May 2020); Crimes Amendment (Penalty Unit) Act 2022 (Cth), s 2 and Sch 1, Item 1.

58    The maximum penalty for the contraventions, taking into account the date on which they occurred, is as follows:

(a)    $1,517,500 for the 12 contraventions of s 75 of the Act comprising:

(i)    $111,000 for each of the five contraventions of s 75 between 15 November 2022 and 27 December 2022 (in relation to DP1 Image, DP2 Image, DP3 Image 1, DP5 Image and DP3 Image 2); and

(ii)    $137,500 for each of the seven contraventions of s 75 between 7 March 2023 and 27 May 2023 (in relation to DP3 Image 3, DP4 Image 1, DP4 Image 2, DP6 Image 1, DP6 Image 2, DP6 Image 3 and DP6 Image 4); and

(b)    $26,323,500 for the contraventions of s 80 of the Act between 6 May and 27 October 2023 comprising:

(i)    $137,500 for each of the 56 days between 6 May 2023 and 30 June 2023, that the respondent failed to comply with the removal notice; and

(ii)    $156,500 for each of the 119 days between 1 July 2023 and 27 October 2023, that the respondent failed to comply with the removal notice.

(c)    $26,323,500 for the contraventions of s 83(3) of the Act between 6 May and 27 October 2023 comprising:

(i)    $137,500 for each of the 56 days between 6 May 2023 and 30 June 2023, that the respondent failed to comply with the remedial direction; and

(ii)    $156,500 for each of the 119 days between 1 July 2023 and 27 October 2023, that the respondent failed to comply with the remedial direction.

General deterrence

59    The Commissioner submits that in determining the penalty, the Court should take into account the objects of the Act and the role ss 75, 80 and 83 play in achieving that statutory purpose – that is, to improve and promote online safety for Australians by prohibiting the non-consensual sharing of intimate images online of Australian residents. The Commissioner relies, in that regard, on the McGlynn Report. Professor McGlynn gives evidence that image-based abuse perpetration may be prevented and deterred by increasing awareness that these behaviours are unlawful and can lead to sanctions and that punishment is likely. I accept, having regard to the matters raised by the Commissioner, that the penalty must be sufficient to send a message that contraventions of this kind are serious and not acceptable: cf, Australian Securities and Investments Commission v Southcorp Ltd (No 2) [2003] FCA 1369; (2003) 130 FCR 406 at [32] (Lindgren J).

60    The Commissioner further contends that considerations of general deterrence are heightened in this case because it is the first arising under these provisions of the Act. To the extent to which that submission is intended to convey that general deterrence in a novel case warrants the imposition of a higher penalty, I reject the submission. As Beach J outlined in Westpac Banking at [48], general deterrence is directed to dissuading others who might be tempted to contravene. The novelty of the case does not relevantly inform how the object of general deterrence is to be achieved.

Nature and extent of the contraventions (s 82(6)(a))

61    The Commissioner submits that the respondent’s contraventions of the Act can properly be characterised as serious, deliberate and sustained. The amicus curiae largely supported those submissions, highlighting the respondent’s acknowledgement that the images were obscene and that he did not have the consent of the Depicted Persons to post them, as well as the period they remained online.

62    The respondent puts in issue the seriousness of his contraventions of the Act, contending that the images were not defamatory and emphasising that they were posted on a pornography website rather than social media. He further contends that before a civil penalty order can be made, the Depicted Persons must successfully prosecute a claim for defamation in respect of the images.

63    I reject the respondent’s submissions. Whether the images were defamatory is irrelevant. It was the posting of the non-consensual intimate images of the Depicted Persons, not the posting of defamatory images that founded the contraventions of the legislation: Act, ss 75, 78(1) and 83(3). The power to make a civil penalty order in respect of these contraventions is not conditioned on the successful prosecution of a defamation claim: Act, ss 75, 80 and 83(3) and Regulatory Powers Act, s 82(3).

64    Further, the Act does not distinguish between a social media service and a designated internet service when it comes to contravention of s 75 of the Act. The civil penalty for posting a non-consensual intimate image of a person ordinarily resident in Australia on either forum is the same, 500 penalty units: Act, s 75(1)(a) and (c).

65    That the Act is relevantly concerned with the sharing of such images rather than the specific service on which they are shared is confirmed by the statements in the Explanatory Memorandum that the civil penalty for s 75 “reflects the serious nature of the non-consensual sharing of intimate images, and the significant harm and distress that can be caused to a person from the sharing of intimate images”: at p 105, see also the Acts Interpretation Act 1901 (Cth), s 15AB(1)(a).

66    I accept that the respondent’s contraventions of the Act were serious, deliberate and sustained. They involved the respondent posting 12 non-consensual deepfake intimate images, depicting six individuals, across a six-month period to an online platform that was accessible worldwide. The failure of the respondent to comply with the removal notice (relating to DP1 Image and DP2 Image) and the remedial direction (relating to Depicted Person 1 and Depicted Person 2) resulted in those first two images remaining on the website for almost one year, until November 2023.

67    The Commissioner submits, and I accept, that the contraventions of s 75 of the Act between 7 May and 27 May 2023 by posting DP4 Image 1 to DP6 Image 4 are of a more serious character. That is for two reasons. First, the respondent admits that he posted some of those images as an act of retaliation against the persons involved in issuing the removal notice. Second, the respondent’s attention was drawn to s 75 by the removal notice and the remedial direction, the latter of which explicitly stated that posting “intimate images of … persons on a website without their consent [contravenes] section 75 of the Act”. In view of those matters, I am satisfied that the respondent posted DP4 Image 1 to DP6 Image 4 in deliberate defiance of the Act.

Nature and extent of any loss or damage suffered because of the contravention (s 82(6)(b))

68    The Depicted Persons have not provided any evidence regarding the nature and extent of the loss or damage they suffered because of the contraventions of the Act. That said, as the agreed facts record, the respondent acknowledged when arrested that the images could cause upset and distress to the Depicted Persons. The evidence before the Court also includes the complaints made by the Depicted Persons pursuant to s 32 of the Act. Depicted Person 2 states in the complaint that:

I am absolutely horrified about being caught up in this.

Even though it is clearly a fake video, I feel violated, vulnerable and completely without agency.

…

69    That statement accords with the view expressed by Professor McGlynn that the harm a victim experiences by the non-consensual sharing of sexually explicit images does not differ between images that are “real” or “deepfakes”. That is because sexually explicit deepfakes “feel real” for victims. I am satisfied, given the nature of the images, the respondent’s admissions, the matters recorded in the complaint and the evidence of Professor McGlynn that the contraventions of s 75 are likely to have caused the Depicted Persons’ hurt and distress. I am also satisfied that the failure of the respondent to comply with either the removal notice or the remedial direction is likely to have exacerbated that hurt and distress for Depicted Person 1 and Depicted Person 2 because those contraventions meant that the images remained online for almost one year.

The circumstances in which the contraventions took place (s 82(6)(c))

70    The matters outlined at [66] and [67] above, are material to the circumstances in which the contraventions took place. For the reasons there stated, I am satisfied that the six contraventions of s 75 of the Act after 5 May 2023, by posting DP4 Image 1 to DP6 Image 6, are of a more serious character.

Whether the person has previously been found by a Court to have engaged in any similar conduct (s 82(6)(d))

71    The respondent has not previously been found to have contravened the Act. As appears from the agreed facts, the respondent was arrested upon his return to Australia on 27 October 2023. I am informed by counsel for the Commissioner that the matters in respect of which he was arrested, charged and subsequently convicted are unrelated to this proceeding: cf, Regulatory Powers Act, s 88. I give this matter neutral weight.

Other relevant but non-mandatory considerations

The extent to which the contravention was the result of deliberate or reckless conduct, as opposed to negligence or carelessness

72    Each contravention of s 75 was deliberate in the sense that the respondent made a conscious decision to create and post the deepfake images on the named website without consent of the Depicted Persons. But any contravention of s 75 would be the result of deliberate conduct given that it requires a positive act by the contravener. That said, for the reasons that are outlined at [67] above, I am satisfied that the six contraventions of s 75 of the Act after 5 May 2023 are of a more serious character because those contraventions were in deliberate defiance of the legislation.

73    The amicus curiae further submits, and I accept, that the contraventions of s 80 and s 83(3) of the Act were deliberate. As to s 80, the removal notice required the respondent to remove DP1 Image and DP2 Image. As the agreed facts record, between 5 May and 27 October 2023, the respondent was capable of taking steps to remove those images but refused to do so, stating in the email dated 5 May 2023, that the notice “means nothing to me”. As to s 83(3), the remedial direction required the respondent, amongst other matters, to delete all intimate images of Depicted Person 1 and Depicted Person 2 within his control. Again, the respondent did not comply with the remedial direction.

The degree of cooperation by the respondent with the Commissioner, including any admission of an actual or attempted contravention

74    The respondent did not, at least initially, cooperate with the Commissioner. He refused to remove DP1 Image and DP2 Image as required by the removal notice. The respondent did not express remorse upon being arrested on 27 October 2023, describing the production of deepfake images as “fun” and stating:

Everyone should live in fear of deepfakes. Every woman on Earth should live in fear of a camera, live in fear of Facebook. There will be nude pictures of everyone on the internet.

75    But from 3 November 2023, the respondent cooperated with the Commissioner in relation to removing the non-consensual deepfake images from the website. The Commissioner submits, and I accept that, the removal of the material was unlikely to have ever occurred without the respondent’s cooperation and that this is a matter that should count significantly in the respondent’s favour. As the amicus curiae further outlines, the respondent’s cooperation in relation to the agreed facts and admissions resulted in reducing the length and complexity of the hearing.

Infringement notice

76    The amicus curiae highlights that the agreed facts record that the respondent received, but has not paid, two infringement notices of $3,330 each in respect of his failure to comply with the removal notice and remedial direction. Neither the Commissioner nor the respondent made any submissions with respect to the infringement notices. In the absence of any further information about the infringement notices and whether they are to be enforced, I give this matter neutral weight.

The capacity of the respondent to pay relevant to the size of the pecuniary penalty that would operate as an effective specific deterrent

77    The respondent’s financial position is material to determining the size of the pecuniary penalty that will operate as an effective specific deterrent: Westpac Banking at [49(d)]; Australian Securities and Investments Commission v AMP Financial Planning Pty Ltd (No 2) [2020] FCA 69; (2020) 377 ALR 55 at [220] (Lee J). At the hearing, the respondent asserted that he has “no money … no capacity whatsoever to pay any penalty”. The Commissioner accepted that it is necessary to identify a pecuniary penalty that “strikes [a] suitable balance between deterrence and being oppressive” but did not engage with the respondent’s submission as to his financial means.

78    The respondent did not put on evidence in support of the contention that he is without financial means. That said, I accept that he is not “well-resourced”: cf, AMP Financial Planning at [220]. I give weight, in that regard, to the submission by the amicus curiae that the pecuniary penalty sought by the Commissioner represents a “significant impost” and is at a level that “may be considered oppressive”.

Section 85 of the Regulatory Powers Act

79    The Commissioner submits that it would be appropriate to treat each of the contraventions of s 80 and s 83(3) of the Act as a course of conduct because they arose out of the same facts – the respondent’s ongoing failure to comply with the removal notice, and the remedial direction, respectively. I am satisfied that the multiple contraventions of s 80 engage s 85(1) of the Regulatory Powers Act, as do the multiple contraventions of s 83(3), and that it is important in this context to mitigate against the risk of imposing a penalty which may be oppressive: Registrar of Personal Property Securities v Brookfield [2024] FCA 29 at [104] (SC Derrington J); see also, Electoral Commissioner of Australian Electoral Commission v Wharton (No 3) [2021] FCA 742 at [33] (Logan J).

80    The amicus curiae submits that the same approach ought to be taken to the contraventions of s 75 of the Act because the respondent posted each of the images, which images were altered, of a similar kind and posted to the same website. The Commissioner resists that characterisation because the images were posted online separately, at different times and dates, and while some of the images depicted the same person (as is the case with DP3 Images 1, 2 and 3 (Depicted Person 3), DP4 Images 1 and 2 (Depicted Person 4) and DP6 Images 2, 3 and 4 (Depicted Person 6)), each image “is independently distressing to the depicted individuals and should be seen to constitute its own harm”.

81    I accept, as a matter of fact, that the multiple contraventions of s 75 of the Act “form, or are part of, a series of contraventions of the same or similar character” for the purposes of s 85(1) of the Regulatory Powers Act for the reasons outlined by the amicus curiae. That is to say, I am satisfied that the contraventions are “substantially connected contemporaneous”: cf, Wharton (No 3) at [33].

82    But as Raper J outlined at [26] of Coal Mining Industry, the course of conduct principle which s 85 enshrines “is a discretionary tool of analysis that I am not compelled to use and … is one which does not have paramountcy in the process of assessing an appropriate penalty”: see also, Hillside at [24]-[25] and Yazaki at [227]. I am not persuaded that there is utility in making a single civil penalty order for the multiple contraventions of s 75 of the Act given the finding I have made that the respondent’s contraventions after the removal notice and remedial notice were issued are of a more serious character: cf, Regulatory Powers Act, s 85(1) and Australian Building and Construction Commissioner v Construction, Forestry, Maritime, Mining and Energy Union (The Nine Brisbane Sites Appeal) [2019] FCAFC 49 at [124(4)] to [124(6)] (Rangiah J, Allsop CJ and Griffiths J agreeing).

Pecuniary penalties

83    Taking all of these matters into account, I determine that it is appropriate to impose the following pecuniary penalties:

(a)    for contravening s 75 of the Act on 15 November 2022 in relation to DP1 Image, $15,000;

(b)    for contravening s 75 of the Act on 24 November 2022 in relation to DP2 Image, $15,000;

(c)    for contravening s 75 of the Act on 5 December 2022 in relation to DP3 Image 1, $15,000;

(d)    for contravening s 75 of the Act on 26 December 2022 in relation to DP5 Image, $15,000;

(e)    for contravening s 75 of the Act on 27 December 2022 in relation to DP3 Image 2, $15,000;

(f)    for contravening s 75 of the Act on 7 March 2023 in relation to DP3 Image 3, $18,500;

(g)    for contravening s 75 of the Act on 7 May 2023 in relation to DP4 Image 1, $35,000;

(h)    for contravening s 75 of the Act on 9 May 2023 in relation to DP4 Image 2, $35,000;

(i)    for contravening s 75 of the Act on 16 May 2023 in relation to DP6 Image 1, $35,000;

(j)    for contravening s 75 of the Act on 19 May 2023 in relation to DP6 Image 2, $35,000;

(k)    for contravening s 75 of the Act on 19 May 2023 in relation to DP6 Image 3, $35,000;

(l)    for contravening s 75 of the Act on 27 May 2023, in relation to DP6 Image 4, $35,000;

(m)    for contravening s 80 of the Act between 6 May 2023 and 27 October 2023, $20,000; and

(n)    for contravening s 83(3) of the Act between 6 May 2023 and 27 October 2023, $20,000.

84    This comes to a total of $343,500. Applying the totality principle, I am satisfied that this amount is appropriate.

COSTS

85    The Commissioner seeks an order that the respondent pay a proportion of her costs of the proceeding on a lump sum basis. The Commissioner’s written submissions contain an approximation of her solicitor-client costs as of 24 January 2025. That figure was not updated at the hearing, and the Commissioner did not file an affidavit in support of a lump sum claim: cf, GPN-COSTS at [4.10]; see also, Clipsal Australia Pty Ltd v Clipso Electrical Pty Ltd (No 4) [2017] FCA 436 at [10] to [16] (Perram J).

86    The Court has a broad discretion to award costs under s 43 of the Federal Court of Australia Act 1976 (Cth). Ordinarily, a successful party is entitled to an award of costs in its favour in the absence of special circumstances that would justify some other order: Ruddock v Vadarlis (No 2) [2001] FCA 1865; (2001) 115 FCR 229 at [11] (Black CJ and French J). The general rule assumes that where an applicant succeeds, it will have incurred costs because the respondent’s costs made it necessary for the applicant to bring the proceedings: Ruddock at [12].

87    I am satisfied that there are no special circumstances that would justify a departure from the ordinary position that costs follow the event. I order that the respondent pay the Commissioner’s costs of the proceedings.

Associate:

Dated:    26 September 2025