knowledge 2 January 2025 |

Three Years of Coco’s Law: Impact and Analysis of the Harassment and Harmful Communications Act 2020

Update on CoCo’s law

The Harassment, Harmful Communications and Related Offences Act 2020 (“the Act”) was recently subject to its first official review by the Department of Justice. We consider the impact of the Act through a review of prosecution trends, a recent case study and query whether “deepfake”- created intimate images are prohibited by the Act.

The Act, which commenced on 10 February 2021, extended the scope of harassment under Irish law and criminalised the non-consensual recording, distribution or publishing of intimate images through the establishment of new criminal offences to tackle abusive activities such as “revenge porn” and “sextortion”.  The Act introduced significant reform and required online intermediaries to review and refresh their policies on prohibited communications appearing on their platforms, due to the scope for criminal prosecution of those engaging in acts prohibited by the legislation. See our previous briefing regarding the impact of the Act on online intermediaries (here).

Key provisions of the Act

Under the Act, it is an offence to distribute, publish, share, or threaten to share intimate images without a person’s consent with i) the intent to cause harm, or ii) being reckless as to whether harm is caused.¹

Likewise, it is an offence to distribute, publish or send a threatening or “grossly offensive communication” to another person, with the intent to cause harm.² This offence can occur on a repeat or once-off basis. This offence is aimed at addressing other areas of harmful communications (more broadly than intimate image offences) and extends the existing offence of harassment to deal with communications about a person, as well as communications to a person.³ The term “grossly offensive” is not defined under the Act, leaving its interpretation open to the Courts.

Under the Act, a person is deemed to “intend to cause harm” who “intentionally or recklessly seriously interferes with the other person’s peace and privacy or causes alarm or distress to the other person” where a “reasonable person” would realise that their act(s) would have such an effect.⁴ The Act specifies that “harm” includes “psychological harm”. The Act specifies that “distribute” refers to distribution to the public or a section of the public, and “publish” means to publish, other than by broadcasting, to the public or to a portion of the public.⁵ Victims of intimate image offences are entitled to anonymity, and anyone who publishes or broadcasts information, photos or other representations which would identify the victim, are guilty of an offence.

Penalties

The following penalties under the Act apply:

• A person (natural or legal) found guilty of an offence of recording, distributing or publishing of an intimate image of another person without their consent and which seriously interferes with the person’s peace and privacy or causes alarm, distress or harm to them (without threatening their victim) is liable to receive a fine of up to €5000 and/or a maximum sentence of up to 12 months in prison.⁶ Notably, this offence applies to both recording and distribution.
• Where a threat is made in relation to the distribution or sharing of intimate images, often referred to as “sextortion”, the offender is liable to receive a fine of up to €5000 and/or a sentence of up to 12 months in prison on summary conviction, or on an indictment, a fine and/or a sentence of up to 7 years in prison.⁷
• The offence of distributing, publishing or sending any threatening or grossly offensive communications about or to another person, with the intent to cause harm, is subject on summary conviction to a fine of up to €5000 and/or imprisonment up to 6 months or on indictment, to a fine and/or imprisonment up to 2 years in prison.⁸

The Review of the Act

The Review of the Act, as prescribed under section 12 of the Act was published at the end of September 2024 (the “Review”) and is available here.  The Review indicates that there has been a significant number of prosecutions to date, with almost 100 cases prosecuted by the DPP, including:

• 23 cases prosecuted on indictment in the Circuit Court;
• 8 cases summarily disposed of by the DPP following a guilty plea;
• 68 cases summarily disposed of by a Court; and
• 1 case prosecuted on indictment in the Central Criminal Court.

There is also an increasing trend of prosecutions year on year, increasing from 22 charges brought in 2021, 95 in 2022 and 113 in 2023.

The Review found that almost 1,500 victim reports have been made between September 2021 and December 2023. These reports are made to Hotline.ie an online service and national reporting centre for intimate images reporting. Hotline.ie assesses reported content and if it determines that the content is illegal, issues the online intermediary with a takedown notice concerning the harmful content on its platform under the Hotline.ie Code of Practice. The Hotline.ie notice can be found here and an in depth breakdown of the takedown notice procedure can be found here.⁹

Since the establishment of Hotline.ie, 1,006 complaints made related to images or videos being shared without a person’s consent on a publicly accessible web-location, 400 complaints reported threats to share intimate images, 366 cases concerned sexual extortion and 27 threats were made to share intimate images for harassment purposes. Optimistically, Hotline.ie reports an average success rate of 92% in achieving the removal of the offending content complained of.

Recent case study (Northern Ireland)

This Review’s completion coincided with a recent criminal case in Northern Ireland (R v McCartney)¹⁰ which exhibited the damaging consequences of harmful communications, harassment and intimate image offences.

On 25 October 2024, Alexander McCartney was given a life sentence with a minimum of 20 years for 185 charges including manslaughter of a 12-year-old girl from West Virginia in the US who took her own life in May 2018 after she was targeted by McCartney on social media. McCartney’s offending spanned from 2013 to 2019 and the PSNI described his offending as on an “industrial scale”, stating that they believe the number of victims is approximately 3,500. The case also demonstrates the possibility of a multi-jurisdictional reach of a perpetrator due to the use of technology.

Developing trends - regulation of ‘deepfake’ intimate images

The Act potentially applies to deepfake generated intimate images, as it defines “intimate image” broadly as “any visual representation….made by any means including photographic, film, video or digital representation...” depicting a person in an intimate way. The Act in Ireland has, as outlined above, led to a relatively high number of prosecutions but not, as far as we are aware, to capture a deepfake intimate image-based offence (and this information is not addressed in the Review).

In the UK, we note that the sharing of deepfake intimate images without consent is also criminalised by the Online Safety Act 2023. Proposals were made to establish a new offence for creating sexually explicit images in the UK Criminal Justice Bill (as well as sharing them), and which might have also included deepfake created images, but as of May 2024, a decision was made not to progress this bill further through Parliament.

Under EU law the Digital Services Act (the “DSA”) refers to “manipulated material” and to the onus on very large platforms to ensure that “victims can effectively exercise their rights in relation to content representing non-consensual sharing of intimate or manipulated material through the rapid processing of notices and removal of such content without undue delay” in its preamble.¹¹ Such content will be caught by existing rules governing “illegal content” if it does not comply with EU or national laws, such as the laws regarding intimate images described above. More generally, the new AI Act, EU Regulation (EU) 2024/1689,¹² introduces limited regulation for deepfakes insofar as it requires a transparency disclosure to be made where deepfakes are used, under Article 50 of the AI Act.¹³

Conclusion

The Act was a positive legislative reform that created criminal offences under which perpetrators can be prosecuted for intimate image sharing and grossly offensive communication offences. As demonstrated by the above prosecution statistics, the DPP has taken a pro-active approach in tackling offending in this area and the Hotline.ie platform provides a successful avenue for victims of intimate image offences to seek redress. Whilst the legislation is in its infancy, we expect that as the area develops precedent will evolve to clarify core concepts such as the meaning of “grossly offensive communications.”

Additionally, if it is accepted that deepfakes may fall within the definition of intimate image sharing offences, this will likely place an obligation on online platforms to ensure that such offending material, if considered “illegal content” under the DSA, is removed promptly through the DSA mandated notice and takedown mechanism.

Also contributed to by John Grogan