Whether your online business has to comply with the obligations contained in the Online Safety Act 2021 (Cth) (OSA), and related standards and industry codes will largely depend on how your business is classified because of the functionality it provides to end users in Australia.
The legislative regime overseen by the eSafety Commission includes many overlapping standards and codes that impose somewhat differing obligations which in some cases are open to interpretation.
What is a Designated Internet Service (DIS)?
Section 14 of the OSA defines DIS as follows:
“(1) For the purposes of this Act, designated internet service means:
(a) a service that allows end – users to access material using an internet carriage service; or
(b) a service that delivers material to persons having equipment appropriate for receiving that material, where the delivery of the service is by means of an internet carriage service;
(c) a social media service; or
(d) a relevant electronic service; or
(e) an on – demand program service; or
(f) a service specified under subsection (2); or
(g) an exempt service (as defined by subsection (3)).
(2) The Minister may, by legislative instrument, specify one or more services for the purposes of paragraph (1)(f).
(3) For the purposes of this section, a service is an exempt service if none of the material on the service is accessible to, or delivered to, one or more end – users in Australia“[1]
[Bold is our emphasis]
The term Material is defined in section 5 of the OSA to mean material:
“(a) whether in the form of text; or
(b) whether in the form of data; or
(c) whether in the form of speech, music or other sounds; or
(d) whether in the form of visual images (moving or otherwise); or
(e) whether in any other form; or
(f) whether in any combination of forms.”
The Online Safety (Designated Internet Services – Class 1A and 1B Material) Industry Standard 2024 (DIS Standard) defines a DIS by reference to section 14 of the OSA which is shown above. The Fact Sheet published by eSafety, “Registration of Designated Internet Services Standard“, says in relation to DIS that:
“as online services such as websites and apps, which are not social media services or relevant electronic services (noting that relevant electronic services mainly provide online communication services). is essentially an online service such as a website or app that is not classified as a social media service or a relevant electronic service“.[2]
[Bold is our emphasis]
There is also a 169 page Explanatory statement to the DIS Standard (DIS Explanatory Statement) which at paragraph 3 on page 3 states:
“Providers of DIS that may carry a higher risk of Australians distributing or getting access to child sexual abuse material or pro-terror material are required to implement appropriate systems, processes and technologies to detect and remove known child sexual abuse and pro-terror material where it is technically feasible and reasonably practicable to do so“.
The DIS Explanatory Statement at the top of page 99 defines a DIS as:
“Designated internet service – is defined in section 14 of the OSA. It is a very broad category of services that includes online services not covered by the other industry section. It will include many apps and websites, as well as online storage services which are used by end-users to upload, store and manage their files including photos and other media. Examples include websites (excluding social media, email, chat, messaging, online gaming and dating sites), and consumer cloud storage such as iCloud, Dropbox, OneDrive and Google Drive.”
The definition of a DIS contained in Section 14 of the OSA would seem to capture every online service which allowed an end-user to upload Material of any kind to its service. However, the DIS Explanatory Statement seems to imply a narrower meaning in that end-users of services that are classes as DIS’s have more freedom as to what they upload and store or publish.
Paragraph 1.6.2 on page 36 of the DIS Explanatory Statement states:
“End-user managed online file and image storage services are examples of DIS“.
Another example of a DIS referred to in the DIS Explanatory Statement is a “File storage service“.
In both examples cited in the DIS Explanatory Statement the end-user is able to upload what they want to the service without oversight or control. So, it is reasonable to infer that a characteristic of a DIS is that they allow end-users to have seemingly complete control over what they upload and could share.
What is a Relevant Electronic Service (RES)
A RES is an electronic service whose primary purpose is enabling end‑users to communicate with one another. Section 13A of the OSA, states that a RES includes:
“(a) a service that enables end – users to communicate, by means of email, with other end – users;
(b) an instant messaging service that enables end – users to communicate with other end – users;
(c) an SMS service that enables end – users to communicate with other end – users;
(d) an MMS service that enables end – users to communicate with other end – users;
(e) a chat service that enables end – users to communicate with other end – users;
(f) a service that enables end – users to play online games with other end – users;
(g) an electronic service specified in the legislative rules“.[3]
Other references to RES
The Online Safety (Relevant Electronic Services—Class 1A and Class 1B Material) Industry Standard 2024 (RES Standard) describes various subcategories or types RES in the definitions section including:
- Communication Relevant Electronic Service;
- Enterprise Relevant Electronic Service;
- Gaming Service with Limited Communications Functionality;
- Telephony Relevant Electronic Service; and
- Pre-assessed Relevant Electronic Service, which means:
- a communication relevant electronic service;
- a dating service; or
- a gaming service with communications functionality.
All of the above terms have defined meanings in the RES Standard.
The Explanatory Statement for the Online Safety (Relevant Electronic Services – Class 1A and Class 1B material Industry Standard 2024 (RES Explanatory Statement) may assist to clarify the meaning of a RES, on page 3:
“Providers of RES that may carry a higher risk of Australians distributing or getting access to child sexual abuse material or pro-terror material are required to implement appropriate systems, processes, and technologies to detect and remove known child sexual abuse and pro-terror material where it is technically feasible and reasonably practicable to do so.”
At page 100 the RES Explanatory Statement defines RES as:
“Relevant Electronic Service– is defined in section 13A of the OSA. It broadly refers to those online services that enable-end users to communicate with one another, including email, instant messaging, short message services, multimedia service, online gaming and dating services.”
Paragraph 1.6.1 the RES Explanatory Statement provides examples of RES’s and how they may be used on messaging and gaming services:
- messaging services, including private and end-to-end encrypted services (which are RES) are used by offenders to network and exchange child sexual abuse material;
- messaging services and peer-to-peer networks that use end-to-end encryption are preferred by many perpetrators due to the lower risk of detection; and
- gaming platforms and private messaging services are used by offenders to initiate contact with children and groom them.
Why is the difference important?
The eSafety Commissioner has issued two (2) Unlawful Material Standards which contain slightly different compliance obligations depending on whether the respective online business is classed as a DIS or an RES as follows:
- Online Safety (Designated Internet Services – Class 1A and Class 1B Material) Industry Standard 2024; and
- Online Safety (Relevant Electronic Services – Class 1A and Class 1B Material) Industry Standard 2024.
There are also Industry Codes that apply to Class 1A and Class 1B Material with dedicated schedules that apply to certain classes of business as follows:
- Head Terms – Consolidated Industry Codes of Practice for the Online Industry:
- Schedule 1 – Social Media Services Online Safety Code;
- Schedule 2 – App Distribution Services Online Safety Code;
- Schedule 3 – Hosting Services Online Safety Code;
- Schedule 4 – Internet Carraige Services Online Safety Codes;
- Schedule 5 – Equipment Online Safety Codes; and
- Schedule 6 -Internet Search Engine Services Online Safety Code.
The Head Terms contain various compliance obligations which are supplemented depending on the type of online business.
It is essential that someone looking to comply with their businesses obligations has a good understanding of whether their business is a DIS or a RES as first step towards eSafety Compliance.
Links and further information
Legislation
Standards
Online Safety (Designated Internet Services – Class 1A and 1B Material) Industry Standard 2024
Online Safety (Designated Internet Services) Industry Standard 2024
Online Safety (Relevant Electronic Services) Industry Standard 2024
Online Safety Codes
Consolidated Industry Codes of Practice for the Online Industry
Other links
Online Safety (Designated Internet Services – Class 1A and 1B Material) Industry Standard 2024
eSaftey Fact Sheet: Registration of the Relevant Electronic Services Standard
eSafety Fact Sheet: Registration of Designated Internet Services Standard
Further information about online safety compliance obligations
If you need advice on your businesses online safety compliance obligations, please contact us for a confidential and obligation‑free discussion.
Malcolm Burrows B.Bus.,MBA.,LL.B.,LL.M.,MQLS.
Legal Practice Director
T: +61 7 3221 0013 (preferred)
M: +61 419 726 535
E: mburrows@dundaslawyers.com.au
Disclaimer
This article contains general commentary only. You should not rely on the commentary as legal advice. Specific legal advice should be obtained to ascertain how the law applies to your particular circumstances
[1] Section 14, Online Safety Act 2021(Cth).
[2] eSafety, Fact Sheet “Registration of Designated Internet Services Standard“ published June 2024.
[3] Section 13A Online Safety Act 2021(Cth).
Related insights about internet law
-
![ACCC v Allergy Pathway Pty Ltd (No 2) [2011] FCA 74](data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==)
ACCC v Allergy Pathway Pty Ltd (No 2) [2011] FCA 74
The Court case of Australian Competition and Consumer Commission v Allergy Pathway Pty Ltd (No 2) [2011] FCA 74 has highlighted the importance of monitoring and promptly removing false statements on social media. Find out what happened and how it affects organisations.
-
Are your EDM’s compliant with the Spam Act?
The Spam Act 2003 (Cth) regulates the sending of unsolicited Commercial Electronic Messages. Penalties range from $220,000 for individuals to $1.1 million for corporations with prior records. Learn more about what’s prohibited and the enforcement of the Act.
![ACCC v Allergy Pathway Pty Ltd (No 2) [2011] FCA 74](https://www.dundaslawyers.com.au/wp-content/smush-webp/misleading-and-deceptive-scaled-1.png.webp)
