AustraliaSpam Act 2003, Address-Harvesting Software and Harvested-Address Lists
Spam Act 2003 (Cth), ss. 20-22, 24-25
In force since .
A commercial messages rule binding public and private bodies.
- Obligation class
- Prohibition
What it requires
- Do not supply, or offer to supply, address-harvesting software (software specifically designed or marketed for searching the internet for electronic addresses and collecting, compiling, capturing or otherwise harvesting them) or a harvested-address list, or a right to use either, to another person, where you or the customer is physically present in Australia or an entity carrying on business or activities in Australia at the time, if you have reason to suspect it will be used to send a commercial electronic message in contravention of section 16.
- Do not acquire address-harvesting software or a harvested-address list, or a right to use either, while you are physically present in Australia or an entity carrying on business or activities in Australia, if you intend to use it in connection with sending a commercial electronic message in contravention of section 16.
- Do not use address-harvesting software or a harvested-address list, while you are physically present in Australia or an entity carrying on business or activities in Australia, in connection with sending a commercial electronic message in contravention of section 16.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Sections 20, 21 and 22 are civil penalty provisions "other than" subsection 16(1), (6) or (9) for the purposes of section 25, so they carry that lower tier: with no prior record, 50 penalty units per contravention for a body corporate (1,000 aggregate for 2 or more contraventions on one day) or 10 units for an individual (200 aggregate); with a prior record, 250 units for a body corporate (5,000 aggregate) or 50 units for an individual (1,000 aggregate). The figures recorded here are the highest tier (body corporate, prior record), converted at $364 per penalty unit, the amount the Crimes (Amount of a Penalty Unit) Instrument 2026 fixes under Crimes Act 1914 subsection 4AA(1A) for a civil penalty provision committed on or after . Schedule 3 separately lets the ACMA give an infringement notice of 10 penalty units for a single alleged contravention by a body corporate (up to 500 units for 50 or more), or half that for a person other than a body corporate, as an alternative to Federal Court proceedings.
- Rule
- Per violation only
- As of
- Currency
- AUD
- Fixed cap
- 1,820,000
- Per violation unit
- Violation
- Per violation amount
- 91,000
What this law does
Address-harvesting software is software specifically designed or marketed to search the internet for electronic addresses and to collect, compile, capture or otherwise harvest them; a harvested-address list is a list or collection of electronic addresses assembled using such software or a similar method.
Section 20 bars supplying or offering to supply either, or a right to use either, to another person where the supplier or the customer is physically present in, or an entity carrying on business or activities in, Australia at the time, unless the supplier had no reason to suspect the software or list would be used to send a commercial electronic message in contravention of section 16.
Section 21 bars a person physically present in, or an entity carrying on business or activities in, Australia from acquiring either, unless they did not intend that use. Section 22 bars using either, by a person or entity in Australia, unless the use was not in connection with a section 16 contravention. All three are civil penalty provisions carrying the same section 25 penalty tiers as any civil penalty provision other than section 16.
When LexLint raises it
When your app profile says your app sends automated outreach or crawls the web.
Back to the example · Lint your app
Page updated .