Vin @ Vintuitive ⚡🌐

My submission to the Senate inquiry on the Dystopian DIgital Duty of Care bill. You have until COB today. # Submission: Online Safety Amendment (Digital Duty of Care) Bill 2026 **Jim Stewart** **30 October 2026** **Senate Environment and Communications Legislation Committee** ## My position I work with businesses that depend on the internet to find customers, sell products and get their work done. When I look at this proposal, I don't just see another compliance exercise. I see the Government expanding its control over what Australians can say and access online, while handing businesses the job of interpreting and enforcing those boundaries. I oppose the bill in its present form. I ask the committee to recommend that it not proceed. Protecting people from threats, exploitation and abuse is a legitimate responsibility. That does not give the Government a blank cheque to regulate expression, authorise covert accounts and leave businesses to work out how much compliance is enough. The test should be straightforward. What specific problem does each power solve? What evidence shows it will work? What will it cost? And what stops a future government using it against people who disagree with it? Calling legislation a duty of care does not answer those questions. ## The Government already recognises the risk to speech The Government's own impact analysis acknowledges that online services, including low-risk services, may take a more risk-averse approach than intended, including “more stringent content moderation”. Its proposed response is guidance to align risk assessments with community expectations.[2] That is a significant admission. The risk of excessive restriction is not something opponents have invented. The Department has identified it itself. Put yourself in the position of a business owner. You have an uncertain obligation, a potentially expensive dispute and a piece of content that might attract regulatory attention. The commercial incentive is to remove the content. That does not require the Government to prosecute the person who posted it. The speech may remain lawful for the individual, while carrying it becomes a liability for the business. Australians lose the ability to communicate either way. This matters most when the speech is contested. Criticism of government, institutions, prevailing policy or influential organisations will not always be comfortable. That is precisely why its protection cannot depend on an assurance that today's regulator will be reasonable. The Parliamentary Library identifies uncertainty in some of the bill's harm categories and the meaning of “public interest”. It also questions whether the professional-news exclusion leaves some journalism outside its protection.[1] An independent publisher or ordinary Australian should not need the resources of a major broadcaster to establish that their contribution deserves protection. I acknowledge that the introduced bill contains exclusions, including public-interest material and lawful private communications solely between consenting adults. My objection is not that there are no safeguards. It is that their practical boundaries are uncertain, while the incentive to remove disputed material is clear.[1] ## Ordinary businesses need certainty, not a promise of guidance The Parliamentary Library describes a broad online-service framework. It identifies written risk assessments at least annually and before significant service changes that could introduce new or additional risks. It also identifies a ministerial power to exempt low-risk services.[1] The Government's supplementary explanatory memorandum confirms that assessments must be retained for six years and made available to the Commissioner on request. Amendment 13 makes explicit that those obligations, as well as conducting assessments, are enforceable under section 27B.[6] This is ongoing record-keeping, not a one-off exercise. I am not claiming that every business with a website necessarily has identical obligations. I am asking Parliament to make the boundary clear before imposing them. Consider a small retailer using a hosted ecommerce platform, a business with an informational website, or a service provider adding a customer chatbot. Which obligations belong to the business? Which belong to its platform or software supplier? What must the owner document, and what can the owner reasonably know about systems someone else controls? Those are ordinary commercial situations. They should have ordinary, understandable answers. The Government's impact analysis acknowledges that small or low-risk services may feel they must comply when they consider themselves outside existing regulation. It proposes engagement and guidance, with possible concessions or exemptions in the longer term.[2] That gets the sequence wrong. A business should not have to pay for advice, build a compliance process and then wait to find out whether the Government will exempt it. Time spent interpreting an uncertain obligation is time not spent serving a customer, improving a product or making a sale. A completed document is not evidence that anyone is safer. ## Show us how the cost estimate was calculated The published estimate is an average increase in regulatory costs of **$1.408 million a year over ten years for Australian businesses**. The analysis refers to legal and labour costs, compliance systems and transparency reporting. It also anticipates obligations calibrated to service reach and risk.[2] I want to see how those assumptions match the legislation. The committee should require publication of: - The number and types of businesses and services included in the estimate. - The initial and recurring staff hours, legal fees and technical costs assumed. - The treatment of annual assessments and assessments before significant changes. - The savings expected from replacing existing obligations, and which businesses actually receive them. - The treatment of businesses withdrawing features, restricting content or deciding not to launch a service. - Any revision of the estimate following changes to the bill. I am not offering a made-up national cost figure in response. I am asking for a calculation that businesses can inspect and test. The Office of Impact Analysis says it does not assess the quality of reviews used as an Impact Analysis Equivalent. Its assessment concerns relevance and coverage of the required questions. Its acceptance should not be presented as independent validation of every assumption behind this estimate.[2] There is another problem. According to the Parliamentary Library, proposed section 26A of the introduced bill states that “the cost of the action or measures must not be taken into account” when determining whether they are appropriate or effective.[1] Proportionality to risk and financial feasibility are not the same thing. If a measure is technically possible but commercially prohibitive for a small operator, Parliament needs to explain how that business is expected to continue operating. Dai Le put specific small-business protections before the House: a conditional exemption, a requirement to consider compliance costs for small businesses that remain covered, and an independent cost assessment followed by a six-month delay after the report was tabled in both Houses.[7] The House rejected those amendments together, 11 votes to 72.[12] So this is not simply a detail waiting to be considered. The House had a concrete proposal to assess small-business costs and provide relief. It rejected it. The Senate should revisit that decision. Le's proposal was a useful starting point, not a complete answer. The exemption would not have applied to services allowing users to post, share or send material to other users or otherwise communicate with them. It also had other exclusions and would have permitted the Commissioner to remove the exemption where a service posed a material risk of serious harm.[7] Any replacement should explain how ordinary customer reviews, comments and community features are treated. A small-business exemption needs to work for the services small businesses actually use. ## Covert accounts require more than trust The introduced bill provides for the Commissioner and approved researchers to operate false identities for specified regulatory or research purposes. It includes restrictions on activities and protection from civil proceedings for good-faith conduct under those provisions.[1] I am particularly concerned about these powers. Testing a recommendation system is one thing. Covertly participating in public discussion is another. I do not suggest that the stated purpose of these clauses is party-political campaigning. I am asking what prevents the powers being misused for political purposes, now or by a future government. The answer must be in enforceable limits, not assurances about the intentions of current officeholders. Parliament should require clear prohibitions on covert partisan persuasion, manufactured grassroots support and targeting people merely for lawful dissent. It should require purpose-specific authorisation, auditable records, independent oversight and public reporting that does not compromise legitimate investigations. The Parliamentary Library also identifies an apparent mismatch between the restrictive wording of proposed section 205K and the explanatory memorandum's description of a “non-exhaustive list” of activities.[1] That should be resolved explicitly. Covert powers are not an appropriate place to leave uncertainty about what is authorised. ## Information sharing and researcher access also need limits The Parliamentary Library identifies an expansion of information disclosure to Commonwealth entities, subject to a functions-related test, and the addition of the Commissioner to the Privacy Act's definition of an enforcement body. It also describes a framework for approved researcher access to service data, including information about decision-making algorithms.[1] These provisions deserve scrutiny in their own right. They should not disappear behind the public debate about social media feeds. What information can be collected and shared? Who can use it, for what purpose and for how long? What happens if it is misused? Who pays to provide researchers with secure access, and how can a business challenge an unreasonable request? Maximum penalties, short response periods and review rights also need to be considered together. A right to challenge a decision is of limited practical value if the business cannot afford to exercise it before the damage is done. ## Consultation rules must mean something Government amendments 3 and 4 in sheet JI116 would protect previously registered industry codes and standards from invalidity arising from specified failures to meet public-consultation requirements. For codes, the wording covers failures to publish a draft or invite submissions, and failures to allow at least 30 days for submissions. For standards, it covers failure to comply with section 148 on public consultation.[5] The wording says validity “is not affected, and is taken never to have been affected” by those failures.[5] That deserves a proper explanation. If businesses are expected to meet their legal obligations, the consultation obligations behind the rules imposed on them should matter too. The Government's supplementary explanatory memorandum says the purpose is to preserve the validity of codes and standards during the transition to the new duty.[6] I understand the argument for continuity. It does not answer which consultation failures occurred or who lost the opportunity to be heard. The committee should require an account of the affected codes and standards, any unmet requirements and the consequences for existing disputes or enforcement. Preserving continuity is not a reason to avoid scrutiny or deny affected businesses a meaningful opportunity to have their say. ## The evidence must support the claim being made The House agreed to Kate Chaney's amendments on emotional dependency and the prominence and accessibility of user empowerment tools.[9][12] Giving people usable control over their feeds is a specific measure I can assess on its merits. It does not answer the wider questions about speech, covert powers and business costs. The DCU report behind discussion of rapid exposure to toxic content used ten experimental accounts across YouTube Shorts and TikTok. It reported exposure to toxic content within the first 23 minutes under the tested account behaviours.[3] That finding should not be treated as a population average for Australian boys, proof that all the content was violently misogynistic, or evidence that this bill will prevent subsequent violence. Those are different claims. They require different evidence. I am not arguing that online harm does not exist. I am arguing that observing content in an experiment, establishing its effects on people and demonstrating that a particular law will improve the outcome are separate steps. Parliament should insist on evidence for each of them. ## What I ask the committee to do Recommend that the bill not proceed in its present form. Before any revised proposal returns, require: 1. **Clear limits on scope**, including workable treatment of low-risk businesses and responsibility based on control of the relevant service or feature. 2. **A transparent business-cost model** matched to the legislation actually proposed, with meaningful consideration of small-business feasibility. 3. **Effective protection for legitimate expression**, including political dissent and independent journalism, rather than reliance on uncertain categories and future guidance. 4. **Strict limits and independent oversight for covert accounts**, with enforceable protection against political misuse. 5. **Clear controls on information sharing and researcher access**, including confidentiality, purpose, retention, accountability and practical rights of challenge. 6. **Independent evaluation of results**, measuring harm reduction alongside costs, over-removal of lawful material and withdrawal of services. 7. **Accountability for consultation failures**, including a public explanation of the retrospective validation proposed in JI116 and an effective remedy for any lost opportunity to participate. My concern is the power this legislation creates and the incentives it imposes. Australians should not have to trust that those powers will always be held by people who agree with them. If the Government wants more control over online expression and more compliance work from businesses, it needs to make the case. A safety label and a promise of guidance are not enough. ## Source and version note This submission draws on the Parliamentary Library's analysis of the introduced bill, the Government's published impact analysis, the original DCU report, the amendment sheets and supplementary explanatory memorandum. Amendment outcomes have been checked against the House Votes and Proceedings No. 93 of 28 October 2026, item 8, using the supplied proof copy. The House agreed to government amendments (1)–(15) and Chaney amendments (1)–(8), and rejected the Scamps, Boele and Le detail amendments. References to Le's proposals above concern rejected amendments, not provisions in the House-passed bill.[12] ## Sources [1] aph.gov.au/Parliamentary_Bus… [2] oia.pmc.gov.au/published-imp… [3] dcu.ie/antibullyingcentre/re… [5] parlinfo.aph.gov.au/parlInfo… [6] parlinfo.aph.gov.au/parlInfo… [7] parlinfo.aph.gov.au/parlInfo… [9] parlinfo.aph.gov.au/parlInfo… [12] parlinfo.aph.gov.au/parlInfo…