Section 21(8) of the Cybercrime Code Act 2016 is one of the most consequential provisions in the Act for ordinary users.
Section 21(8)
Where the defamatory publication consists of or relates to electronic writings, images, audio, visual or audiovisual recordings of a sexual nature or depicting sexual conduct, the defence of truth is not available to the offender — notwithstanding that the published defamatory material complained of was produced with the knowledge or consent of the person defamed.
What the subsection targets
The provision addresses the publication of intimate images and recordings without the subject’s consent — often by a former partner, often after a relationship ends.
Without section 21(8), such a publisher could answer a charge under section 21(2) by relying on section 21(5)(a): that the material was true. The images are genuine; the conduct depicted occurred.
Section 21(8) removes that answer entirely. And the closing words remove the second one: consent to the material’s production is irrelevant. A person who agreed to an image being taken has not agreed to its publication.
The width of the provision
| Words | Effect |
|---|---|
| “Consists of or relates to” | Not only the material itself, but a publication about it — describing or referring to sexual material or conduct |
| “Electronic writings, images, audio, visual or audiovisual recordings” | Every medium — including text and audio alone |
| “Of a sexual nature or depicting sexual conduct” | Two alternatives. Material may be of a sexual nature without depicting any act |
| “Notwithstanding ... knowledge or consent” | Consent to production is no answer to publication |
A publication need not contain the material. A post describing a person’s sexual conduct, or referring to the existence of such recordings, relates to material of a sexual nature.
So the truth defence is unavailable not only to the person who posts an image, but to the person who publishes an account of what the image shows.
The other defences remain
Section 21(8) removes the defence of truth. The other three defences in section 21(5) are untouched:
(b) benefit of the public; (c) fair comment; and (d) good faith — the last carrying the burden shift in section 21(7), under which the party alleging absence of good faith must prove it.
In practice those defences will rarely assist someone publishing intimate images of another person. But they preserve room for legitimate reporting — for example, journalism exposing exploitation, or coverage of proceedings — where publication genuinely serves a public purpose. Section 21(6) makes each a question of fact.
The section 362E public interest protection of the Criminal Code Act (Chapter 262), applied by section 21(9), also remains available.
The other offences engaged
| Provision | When it applies | Maximum (individual) |
|---|---|---|
| s 21(2) | Publishing the material | 15 years / K25,000 |
| s 21(4) | Threatening to publish, or offering to prevent publication, to extort or induce a benefit | 25 years / K100,000 |
| s 17 | Producing for distribution, making available, distributing or transmitting pornography | 15 years / K25,000 |
| s 18 | Where the person depicted is a child — under 18 | 25 years / K100,000 |
| s 25 | Disclosing sensitive data — which includes data potentially detrimental or damaging to its subject | 15 years, or 25 for an insider |
| s 23 | Where the publication is part of conduct to coerce, intimidate, threaten, harass, stalk or cause emotional distress | 7 years, or 10 where harm results, or life where death results |
| s 24(2)(b) | Threatening to expose sensitive data to procure gain | 25 years / K100,000 |
Section 2 defines “sensitive data” to include data potentially detrimental or damaging to the person who is the subject of such information or personal data.
Intimate images plainly satisfy that. So publishing them is also capable of being unlawful disclosure under section 25(1) — and note that section 25 can be committed recklessly.
If this happens to you
- Preserve the evidence. Screenshots showing the account, the content, the date and any messages. Do not delete the messages that led to the publication.
- Do not pay. Where a demand accompanies the threat, that is section 21(4) and section 24(2) — each carrying 25 years.
- Report to police. Part IV gives them the tools: search and seizure, preservation notices requiring data to be kept, production orders for subscriber information, and restraining orders to prevent material being destroyed or moved.
- Ask about a takedown order. Under section 44(1)(d)(ii) a court may order an ICT service provider to terminate or prevent a certain action which would result in the commission or continuation of an offence already committed — and non-compliance is itself a crime.
- Truth is not the offender’s answer. Section 21(8) removes it, and consent to the material being made is expressly irrelevant.
Further guidance is in what to do if you are a victim of cybercrime.
Sources
- Cybercrime Code Act 2016 — ss 2, 17, 18, 21, 23–25, 32–38, 44
- Criminal Code Act (Chapter 262) — s 362E
Before relying on anything here, read the current text of the Cybercrime Code Act 2016 and check for later amendments. If a decision matters to you, get advice — start with the Office of the Public Solicitor, or find a firm in the law firms directory.