Towards an EU criminal law on violence against women: The ambitions and limitations of the Commission’s proposal to criminalise image-based sexual abuse

Terminology and its impacts

While the draft Directive refers to the ‘non-consensual sharing of intimate or manipulated material’, in this article, we adopt the broader terminology and concept of ‘image-based sexual abuse’. ¹¹ This term refers to all forms of the non-consensual creating, taking or sharing of intimate images or videos, including altered or manipulated media, and threats to distribute such material. It is an ‘umbrella’ term capturing a range of interrelated forms of abuse, and not therefore limited to the non-consensual distribution of intimate materials. ¹²

The term ‘image-based sexual abuse’ includes practices problematically labelled as ‘revenge porn’ where malicious ex-partners share intimate material without consent, as well as other behaviours such as threats to share without consent and the sharing of hacked images. ¹³ Significantly, the term image-based sexual abuse goes beyond distribution, to encompass the non-consensual creation of intimate images or videos, particularly using technology and artificial intelligence to alter material to make it sexual or pornographic, often known as ‘deepfakes’. ¹⁴ It also includes the taking of intimate images without consent, including situations where victims are filmed or photographed without their knowledge when they are changing, showering, asleep, or drug- or alcohol-affected, or with the aid of hidden cameras in public places or on public transport, or as a result of coercion. Many of these forms of abuse are given specific labels such as ‘upskirting’ or ‘sextortion’, and also includes images of sexual assault. ¹⁵

The aim of bringing together these forms of abuse and conceptualising them as ‘image-based sexual abuse’ is to better reflect the nature and extent of abuse, specifically victims’ experiences some of whom describe their experience as a form of sexual assault. ¹⁶ Further, this concept identifies the overlapping and inter-related nature of these forms of abuse, ensuring they are better understood as part of a pattern of offending, rather than as separate, specific, isolated behaviours. It also provides the normative space to future-proof laws, policies and terminology when new ways of perpetrating such abuse are developed. Besides, this approach recognises image-based sexual abuse as a form of sexual violence and ensures the connections are made between this form of digital, online abuse and other forms of ‘offline’ or ‘physical’ sexual violence.

In addition, the term image-based sexual abuse was developed in response to the dominant use of the term ‘revenge porn’ which remains in common use across the world, but is both misleading and victim-blaming. Many victims experience the term as blaming them for their abuse, as it implies that they are somehow responsible for precipitating the ‘revenge’ actions. The term is also misleading when used to describe this broad phenomenon, as it only covers one type of abuse – where a malicious ex-partner distributes images without consent. In focussing on only one form of abuse, and only one motivation for abuse, the term ‘revenge porn’ has distorted law and policy debates across the world in ways not reflective of victims’ interests or experiences.

This is why the choice of terminology is significant; it shapes public discourse and legal measures. ¹⁷ In practice, the use of the term ‘revenge porn’ is a key reason for the limited scope of many criminal laws and reduced understanding of the phenomenon of image-based sexual abuse. Unfortunately, these constraints and misunderstandings are also evident in the Commission’s proposal, despite the broader terminology and understanding of image-based sexual abuse being used in many European contexts. For example, the European Parliament has deployed the term image-based sexual abuse in its work on violence against women and girls, recognising that terms such as ‘revenge porn’ are unsuitable. ¹⁸ This was also the terminology originally deployed in the Parliament’s recent proposals to amend the Digital Service Act. ¹⁹ In its general recommendation on the digital dimension of violence against women and girls, the expert body responsible for monitoring the implementation of interpreting the Council of Europe Convention against violence against women and domestic violence (hereinafter: the Istanbul Convention) uses the term ‘image-based sexual abuse’ in delineating the scope of online sexual harassment. ²⁰ Further, a range of organisations across Europe also recognise the need to use terminology and concepts beyond ‘revenge porn’ showing a developing awareness of this phenomenon and its connections to broader forms of violence against women and girls. ²¹

Nature and extent of image-based sexual abuse

As with other forms of online violence against women and girls, image-based sexual abuse is alarmingly common. ²² For example, in 2020, over 100,000 images of Irish women and girls were leaked online which ultimately led to the introduction of new legislation criminalising all forms of image based sexual abuse. ²³ Comparable experiences have been reported in other countries, such as in Italy where websites with thousands of users sharing sexual images without consent were recently uncovered. ²⁴ A 2021 survey of 51 countries, including many European countries, reported that 57% of women had been victims of image-based sexual abuse. ²⁵ This high incidence reflects patterns across the world, with a study across Australia, New Zealand and the UK finding 1 in 3 adults reporting victimisation across all forms of image-based sexual abuse. ²⁶ Incidence and experiences vary considerably depending on multiple characteristics and structural inequalities, with victimisation higher among younger people, sexual minorities, disabled people and black and minority ethnic individuals. ²⁷

In relation to threats specifically, there is a dearth of data relating to the EU, though recent statistics from Ireland reveal an 85% increase over the last year in cases involving threats to share intimate images. ²⁸ Other studies have found that 1 in 5 participants have experienced such threats, with over half of participants identifying as victims of image-based sexual abuse reporting threats. ²⁹

Image-based sexual abuse also includes the non-consensual creation and/or distribution of imagery altered or manipulated to make it sexual or pornographic, using various forms of technology including artificial intelligence, often referred to as ‘deepfakes’. ³⁰ The vast majority of deepfakes, estimated at around 96%, are pornographic. ³¹ In terms of understanding the scale of the problem, in one international survey, 14% of participants disclosed that someone had either created or shared digitally altered nude or sexual images of them without their consent. ³² Specifically, of those whose images had been taken without their consent, in one third (34%) of cases the images had been digitally altered. ³³ Recent Irish reports reveal that thousands of deepfake pornographic images of women are being created and traded online. ³⁴ Not surprisingly, therefore, when German organisation HateAid conducted a survey in 2021, it found that 30% of women across the EU fear that fake intimate images of them may be shared without their consent. ³⁵ A similar phenomenon is that of ‘nudification’ apps, accessed by millions worldwide, where non-sexual images can be uploaded and almost instantly a nude image is generated. ³⁶

It is also vital to recognise the inter-relationship between these various forms of abuse. In one international study, for example, two-thirds of victims experienced more than one form of image-based sexual abuse. ³⁷ That many victims experience multiple forms of abuse, and as one overall connected experience, challenges legal approaches which seek to separate out the abuses into different legal categories and those jurisdictions that may not even criminalise some forms of abusive conduct. As will be discussed further below, legal responses which are reflective of victims’ experiences will be comprehensive in covering all forms of abuse.

Finally, in considering prevalence, it is also important to recognise that just as there is considerable under-reporting of violence against women and girls, this will also be the case for online abuse and image-based sexual abuse. ³⁸ Further, many women and girls will be unaware that they have been victims of image-based sexual abuse, particularly deepfakes and forms of voyeurism with hidden cameras, or where material is shared in groups and internet fora where victims are unaware their material has been distributed. ³⁹ The reported incidence of abuse, therefore, is likely to be a considerable under-estimate.

This under-reporting and the nature of hidden victimisation points to the gendered nature of image-based sexual abuse. Studies consistently report that women and girls experience image-based sexual abuse at higher rates than men and boys. ⁴⁰ Not only do women and girls experience higher levels of online abuse and image-based abuse, but the vast majority of images and targets of abuse on dedicated ‘revenge porn’ websites are of women. ⁴¹ While men do experience image-based sexual abuse, their experiences often differ. For example, when women report abuse to the UK’s Revenge Porn Helpline an average of 42 images are reported, whereas it is less than two for male victims. ⁴² Further, the vast majority of perpetrators of image-based sexual abuse are men, with studies finding motivations including seeking power and control, misogyny and masculine entitlement, sexual gratification, a “prank”, distress, humiliation and to build up social capital. ⁴³ This underscores that it is long-standing gender inequality that underpins much of this behaviour, particularly evident in what is referred to as the ‘collector culture’ where men are trading and sharing intimate images without consent across internet fora and private groups. ⁴⁴

Harms and impacts of image-based sexual abuse

Image-based sexual abuse can be life-ending and it is often life-shattering. It often leads to a ‘social rupture’ – an extreme, unsettling and intrusive violation that leads victims to dividing their lives into ‘before’ and ‘after’ the abuse. ⁴⁵ Rather than experienced as a discrete incident which happens and then comes to pass, victims feel the ‘constancy’ of the abuse, with each new distribution or viewing being experienced as abusive. Threats can in and of themselves have significant, life-threatening impacts, with victims describing the paralysing effect they have on their daily lives. ⁴⁶ Perhaps not surprisingly, therefore, many victims experience a profound sense of ‘isolation’, the abuse shattering their trust and connections with family and friends, the online world and social media. ⁴⁷ Many withdraw from social media, notwithstanding the significant adverse impacts on their social and professional lives, and other forms of civic engagement. It can adversely impact financial stability and employment, as many victims incur significant financial costs from forced to leave employment, legal costs and the expenses for psychological treatment and similar. ⁴⁸ In terms of physical and mental impacts specifically, studies have found significant adverse psychological impacts on victims, including depression, self-harm and suicide ideation, as well as many physical symptoms. ⁴⁹ It also has severe implications for women’s participatory rights online, reducing women’s voices in public debate. ⁵⁰ Finally, image-based sexual abuse, as with all forms of online abuse and violence against women and girls, has significant adverse economic impacts across all of society. ⁵¹

Overall, therefore, image-based sexual abuse is a common experience, particularly for younger women, sexual minorities and women from minority ethnic and religious communities, with many experiencing multiple, inter-related forms of this abuse due to intersecting racism, sexism and other structural inequalities. It often generates significant adverse impacts which span all aspects of victims’ lives, including their economic and professional roles, their relationships, physical and mental well-being and ability to contribute to society through online and civic engagement. It is a gendered practice, with women more commonly being victims and experiencing more significant harms, with the perpetrators being predominantly men. Furthermore, the ways in which the abuse is perpetrated and the harms which result are due to deeply entrenched gendered norms in society, particularly regarding women’s sexuality. ⁵²

Conceptual foundations

As suggested above, image-based sexual abuse is commonly experienced as a breach of sexual autonomy and form of sexual assault. For many victims, therefore, this abuse is best conceptualised as a sexual offence. ⁵⁹ This has been recognised by the European Parliament which has called on Member States to update their national laws to include ‘image-based sexual abuse’ in the ‘list of sexual offences’. ⁶⁰ Some jurisdictions, such as Romania, have adopted this approach, enacting new criminal laws against some forms of image-based sexual abuse as sexual offences, as part of their transposition of the Istanbul Convention. ⁶¹ Similarly, Belgium classifies some forms of image-based sexual abuse as crimes against sexual integrity, sexual self-determination and public morality. ⁶² While other jurisdictions may not have formally labelled these crimes as sexual offences, this is the common understanding. For example, recent legislation in Ireland proscribing the taking and sharing of intimate images without consent was routinely referred to by Government ministers and in public discourse, and recently by the Irish Prime Minister, as ‘image-based sexual abuse’. ⁶³

Many other jurisdictions characterise image-based sexual abuse as predominantly a privacy violation, as with recent French legislation. ⁶⁴ In an even more specific way, the Spanish Criminal Code compares the non-consensual distribution of private images with the ‘discovery and disclosure of secrets” and as part of those crimes targeting privacy and intimacy. ⁶⁵ Swedish law includes many forms of image-based sexual abuse as acts of ‘intrusive photography’ and a breach of privacy, as well as part of laws on ‘liberty’ and ‘peace’. ⁶⁶ Another example can be found in the Slovakian Criminal Code which includes some provisions under the section “Criminal Offences against other Rights and Freedoms”. ⁶⁷

The point here is not that one conceptualisation is necessarily better than others, as there are relative benefits to each of the above approaches and the concepts overlap, such as when characterising these abuses as breaches of ‘sexual privacy’. ⁶⁸ However, the approach adopted does impact on the scope and nature of any legal reforms. From these varied conceptual foundations, therefore, it is unlikely that we will see much harmony across the jurisdictions in terms of specific criminal measures.

Defining the scope: sexual, private or intimate images or videos

The first issue of comparison relates to the scope of the images (to include videos but excluding text), ⁶⁹ with three main approaches focussing on definitions of sexual, private or intimate images. In their analysis of Member State legislation, De Vido and Sosa found that ‘most’ countries refer to the ‘sexual’ nature of the material being disseminated. ⁷⁰ Nonetheless, this broad term covers a range of approaches. For example, the Italian Criminal Code refers to ‘sexually explicit content’, with no further clarification. ⁷¹ The Dutch legislation refers to ‘sexual’ material, with the explanatory report broadly stating that an image should be considered of a sexual nature if it is “of such an intimate sexual character that any reasonable person would consider the image to be private.” ⁷² These relatively broad definitions of ‘sexual’ can be contrasted with Maltese provisions which state that the term “sexual shall include the depiction of all or part of a person’s exposed genitals or pubic area, or, in the case of females, of the breasts, or of any content that, when taken as a whole, a reasonable person would consider to be sexual because of its nature.” ⁷³

Most criminal frameworks construe the interpretation of the sexual dimension with reference to the nudity of the person being depicted and/or their engagement in sexual activities. This is the case of Articles 417/8, 417/9, and 419/10 of the Belgian Criminal Code, as well as Article 191a of the Polish Criminal Code. The Austrian and German legislators, instead, have referred to places that are specially protected from view and have listed specific body parts to be covered, including specifics on whether wearing underwear is included, though without legally qualifying this content as ‘sexual’. ⁷⁴ In this way, it is likely the law will also cover nude images taken without consent in changing rooms, toilets and other public spaces.

Another approach is to delineate the scope by reference to ‘intimate’ images. This terminological choice could serve as a synonym for the word ‘sexual’, or be included as additional clarification, or expand the scope. For example, section 1 of the Irish Harassment, Harmful Communications and Related Offences Act 2020 refers to ‘intimate’ images, defined as encompassing “what is, or purports to be the persons’ genitals, buttocks or anal region and, in the case of a female, her breasts”, the underwear covering these body parts, the nudity of the person being depicted, and their engagement in sexual activities. This therefore includes sexual material and nudity, all within the idea of ‘intimate’ images. The Irish provision, therefore, while adopting language of intimacy, remains similar in scope to other jurisdictions in focussing on sexual and nude imagery.

Nonetheless, the terminology of ‘intimate’ images could be interpreted more broadly. In particular, it could include images which are deemed sexual and/or intimate in some marginalised or minority communities, such as images of women from black and minoritised groups not wearing their expected dress, such as headscarves and other religious attire. ⁷⁵ Imagery from other cultures also expands what is conventionally considered sexual in dominant communities in European democracies, such as images of black and minoritised women dancing in a private group, in attire which would not be worn publicly. These are intimate and sometimes sexual images, though not obviously included in existing definitions and approaches in current laws across Europe which reflect a predominantly white, ‘western’ cultural approach. ⁷⁶ Nonetheless, it may be that in the future such interpretations are introduced where there are sufficiently broad definitions, such as Swedish laws on ‘intrusive photography’ covering covert images taken of a person in a private space and Belgian criminal provisions on ‘voyeurism’ targeting the disclosure of a body part that, because of their sexual integrity, the person would have kept hidden, if they had known someone was observing or recording. ⁷⁷

Another area not covered by most Member State laws is whether the scope includes images created by altering non-sexual images to make them nude, sexual or intimate using technology such as photoshopping, or more recently the development of AI, generating what are commonly known as ‘deepfakes’. Irish law specifically covers altered material stating that ‘intimate image’ includes images ‘made by any means including … digital representation’. ⁷⁸ Dutch law refers to ‘creating’ images which may include altered imagery and deepfakes, ⁷⁹ with most other jurisdictions making no specific provision for altered images. Therefore, while it is possible that future interpretations may expand to include such material, this is by no means certain, leaving current victims without options for redress.

A final element of scope relates to whether laws exclude images which were originally taken or shared with consent. Such distinctions introduce elements of blame, such that the victim is held responsible for their own harms, as they originally shared the image themselves, though without consent for onward sharing. In principle, there should be no such distinctions, as the focus should be on any subsequent non-consensual taking or distribution, regardless of whether an image was first taken or shared with consent. ⁸⁰ Belgian law endorses this principle, making it clear by specifically referring to the fact that an offence can be committed ‘even if the person has consented to it being taken’; ⁸¹ an approach also taken by the Spanish Supreme Court. ⁸² Irish law makes no distinction, focussing on non-consent as the key wrong, ⁸³ as is also the case for Malta, ⁸⁴ Slovakia ⁸⁵ and Portugal. ⁸⁶

However, many other jurisdictions do differentiate between these situations. French law provides for different offences depending on whether the images were first taken with consent, making the law complicated and confusing as different criteria and penalties apply in the different circumstances. ⁸⁷ Dutch law also differentiates between images unlawfully created and other sexual images, requiring proof of an intention to harm the victim in the latter case. ⁸⁸ Italian law requires an additional threshold of proof of an intention to harm the victim where material was originally taken or shared with consent, ⁸⁹ and Polish law only applies where the image was originally taken with force, threat or deception. ⁹⁰

These differences demonstrate the confusing and complicated nature of the law in some Member States, with victims, prosecutors and courts being left to navigate many different legal provisions, and different thresholds, to determine their applicability to each situation. This neglects to understand victims’ experiences which may, for example, involve the non-consensual distribution of images that were both taken with consent and some without. It also underlines different conceptual approaches, with cases where images were originally consensual not being taken as seriously, despite there being no evidential basis in victims’ experiences for such legal differences.

Conduct: criminalising taking, creating, sharing and threats

As discussed above, image-based sexual abuse involves a range of behaviours including the non-consensual taking and creating of intimate images, distribution and threats to distribute material. The extent to which Member States criminalise these acts varies considerably. Examining non-consensual distribution first, the study by De Vida and Sosa found ten Member States have recently introduced specific legislation broadly criminalising this conduct. ⁹¹ The study also suggests that all other jurisdictions cover non-consensual distribution in other criminal laws, though the details and extent of such laws are not known. ⁹² There are likely to be many thresholds and limitations on the applicability of such general laws to forms of image-based sexual abuse, such as requiring repeated actions (for harassment prosecutions) or particularly explicit or obscene images (for some pornography and communications offences). Nonetheless, this does suggest that, at a very general level, there is consensus around criminalising the non-consensual distribution of some forms of intimate image.

It is less clear the extent to which threats to distribute images without consent are covered. The recently enacted Irish provisions make it a specific offence to threaten to distribute intimate images without consent, ⁹³ recognising the potentially life-shattering experience of threats, commonly arising in contexts of abusive relationships or sexual extortion and blackmail. While some laws are relatively comprehensive, such as Austria’s coverage of taking and distributing intimate images, it does not cover threats. However, it may be that there are more general provisions in some countries covering threats. But the risk is that the applicability of such provisions is not widely known or understood, inhibiting reporting and investigations, and/or that there are specific thresholds and limits to such more general provisions (likely intentions to cause direct harm) which limit the scope of such laws to threats to distribute intimate images without consent.

Compared to non-consensual distribution of images, the situation regarding taking and creating images is more difficult to discern due to the patchwork of coverage, often due to some older laws covering behaviours such as voyeurism, or laws recently adopted to cover specific forms of abuse, such as upskirting. For example, Austrian law criminalises taking images of intimate body parts that the person had protected from public view (thereby including upskirting for example), or the person is in a dwelling or room specially protected from view, thereby covering conventional voyeuristic images. Similarly, German law covers conventional voyeurism, now supplemented by the recently introduced provisions specifically targeting upskirting and which notably also include ‘downblousing’. ⁹⁴ Nonetheless, there remain different criteria and thresholds for the various provisions, including what types of images are covered, meaning the law is piecemeal and potentially confusing.

Further, while Austrian and German laws have extended beyond conventional approaches to voyeurism, such limits remain in the laws of France where the offence is one of recording the image of a person in a ‘private place’. This is also the case under Belgian law which criminalises observing or taking images of someone naked or engaged in sexual activity in private circumstances. It is not clear, therefore, whether Belgian and French law will cover non-consensual taking of images in public, such as upskirting, ⁹⁵ or where images are taken without consent in private spaces but by friends and partners who are legitimately present. ⁹⁶

On a final note, it is worth noting that to our knowledge no Member State criminalises the mere creation of an intimate image by digital technology, such as deepfakes, the only exception potentially being Article 139h of the Dutch Criminal Code. ⁹⁷ This is a significant issue in view of the increasing prevalence of digitally manipulated content and the potential for pornographic deepfakes to cause considerable harm. ⁹⁸

Mental requirements: intent, motivations and harm

Across the Member States, the criminal provisions all require proof of the offender’s intent, though Ireland extends this to reckless intention in specific cases. Other elements of the mental requirements vary in crucial ways. For example, a key distinction is between provisions which focus on non-consent, and those requiring additional proof relating to the perpetrator’s motivations. Maltese law, for example, requires proof in all cases that a perpetrator intended to cause distress or harm to the victim. ⁹⁹ While Irish law does provide a basic offence focussing on non-consent, requiring only proof of intentional recording or distributing an intimate image without consent, nonetheless it must also be proven that such acts either caused harm or are likely to seriously interfere with a victim’s peace and privacy. ¹⁰⁰ There are further examples of where the harm caused remains part of the offence, though also separate from the mental intention. Section 6c, Chapter 4 of the Swedish Criminal Code illustrates this, when making the unlawful breach of privacy dependent on the serious damage brought about to the person being depicted. Likewise, Article 197(7) of the Spanish Criminal Code requires the disclosure to undermine the right to privacy.

Other differences emerge such as under Italian law where no intent to harm is required where images are stolen or taken without consent, but if acquired consensually, distribution without consent requires the intention to harm. ¹⁰¹ In other countries, an intention to cause harm is an aggravating circumstance in relation to sentencing (e.g., Article 160b(3) of the Slovakian Criminal Code) or an element of a more serious crime (e.g., Article 417/10 of the Belgian Criminal Code and section 2 of the Irish Harassment, Harmful Communications and Related Offences Act 2020).

Sanctioning image-based sexual abuse

Regarding the non-consensual distribution of intimate images, the average maximum sentence is normally up to one to two years’ imprisonment (e.g., Section 201a of the German Criminal Code, Article 192 of the Portuguese Criminal Code), with higher penalties possible in Belgium (5 years), Italy (6 years) and Ireland (7 years), depending on the specific crime. ¹⁰² In most cases, the prison sentence can be replaced by a fine (e.g., Article 139h of the Dutch Criminal Code, Article 197.7 of the Spanish Criminal Code), although in some cases the fine is or can be a mandatory part of the sentence. In France, for instance, a person found guilty of the non-consensual distribution of a sexual image will be fined up to €60,000, while, in Italy, the range is between €5000 and €15,000. The variety of sanctions reflects the divergence in national approaches to punishment and imprisonment which is identifiable across all criminal offences. ¹⁰³

Divergent, piecemeal and confusing

Overall, therefore, it can be seen that the Member State laws vary considerably in how they tackle image-based sexual abuse. This divergence begins with differing conceptual foundations and continues into the specific focus of laws both in terms of definitions of material to be included and the conduct to be criminalised. While there are some examples of Member States taking a more holistic approach, recognising the inter-related nature of various forms of image-based sexual abuse as experienced by victims, there are many more examples of a myopic approach which has not kept pace with emerging understandings of harm, particularly the nature of threats, or with new technology, particularly altered imagery and deepfakes. In relation to the digital dimension of violence against women, the Istanbul Convention’s expert group noted that few states ‘consider and specifically address the compound experiences of women and girls and do not place it in the context of a continuum of violence against women that women and girls are exposed to in all spheres of life, including in the digital sphere.’ ¹⁰⁴ Unfortunately, this is particularly the case for Member State actions relating to image-based sexual abuse.

Evolving EU measures targeting online violence against women

The EU has a long-standing commitment to combating violence against women, the origins of which can be traced back to a European Parliament Resolution in 1986. ¹⁰⁵ This resolution was ground-breaking in recognising a European dimension to violence against women as a human rights and public health problem, moving beyond the EU’s focus on equal opportunities in the labour market. ¹⁰⁶ By 2016, the European Commission was recognising that gender-based violence happens “everywhere – at home, at work, at school, in the street and online.” ¹⁰⁷ Around the same time, the European Parliament expressed alarm at the widespread harassment of women online and the rise of gender-based cyberviolence, including the distribution “on social media of private images and videos without the consent of the people involved”. ¹⁰⁸

In 2021, the Parliament called on the EU and its Member States to take action to eradicate cyber violence against women, understood as a continuum of the sexual violence and abuse women experience offline. ¹⁰⁹ It has also recognised the extensive range of forms that online violence against women and girls can take including ‘online sexual and psychological harassment, cyber-bullying, cyberstalking, non-consensual disclosure of sexual images, sexist hate speech online and new forms of online harassment such as zoom bombing or threats online’. ¹¹⁰ In particular, it has explicitly identified ‘image-based sexual abuse’, including where a ‘sexual encounter was recorded or disseminated without consent’ is ‘weaponised’ against women, and the growing problem of deepfake pornography whereby artificial intelligence is harnessed to ‘exploit, humiliate and harass women’. ¹¹¹

It is in this context that in 2020 the European Commission proposed tackling gender based-violence either via EU accession to the Istanbul Convention or by means of a legislative proposal designed to reach the same goals. ¹¹² In view of accession remaining blocked due to the reference to the notion of gender in its text, ¹¹³ the Commission introduced its proposed directive in March 2022. ¹¹⁴ The proposed Directive is ambitious in seeking to establish European rules on areas of significant public interest and controversy, including criminalising rape in the absence of consent, moving away from definitions requiring force, as well as measures on female genital mutilation, various forms of cyber violence including stalking and incitement, as well as the provisions on the non-consensual distribution of intimate and manipulated material. ¹¹⁵

Examining the legal basis for action

In terms of the legal basis, the Commission relies on Article 83.1 TFEU which provides competence to establish minimum rules and define criminal offences “in the areas of particularly serious crime with a cross-border dimension resulting from the nature or impact of such offences or from a special need to combat them on a common basis”. ¹¹⁶ This provision proceeds to list the specific crimes within scope to include ‘sexual exploitation of women and children’ and ‘computer crime’. The Commission relied on the former as the basis for the proposals on rape and female genital mutilation, though with some controversy as it excludes male rape. ¹¹⁷ The proposals on non-consensual sharing of intimate images, cyber stalking and cyber harassment, on the other hand, are characterised as a form of ‘computer crime’ which is understood to mean any criminal offence “against or intrinsically linked to the use of information and communication technologies” ¹¹⁸ and therefore includes most forms of image-based sexual abuse having a serious and cross-border dimension.

As outlined above, image-based sexual abuse should be considered a ‘serious crime’ in terms of the nature, scale, significance and impact of the wrongful conduct. It is also a threat to the normative interests of the EU, in particular equality between women and men and the fundamental rights protected in the EU Charter, especially rights to human dignity, integrity of the person, right to liberty and security, respect for private and family life and the protection of personal data. ¹¹⁹ Although there is a degree of uncertainty about how to define a serious crime, the literature has commonly drawn on similar empirical evidence identifying serious wrongs and/or has referred to the potential threat to the fundamental interests of the EU arising from the wrongdoing. ¹²⁰

As well as being a serious crime, crimes must have a cross-border dimension to come within Article 83.1 TFEU. There are three elements to this, namely the nature, or impact, or ‘special need’ to combat them on a common basis. ¹²¹ The cross-border nature can stem from the way the crime is committed, namely its nature. When image-based sexual abuse is committed through information and communication technologies, its borderless nature implies that national responses cannot adequately respond to it and the Member States need to collaborate. ¹²² A crime can also be cross-border whenever it is committed nationally, but its impact is transnational. In the case of image-based sexual abuse and the technologies involved, it is clear that while the non-consensual creating, taking, and/or sharing of a sexual image occurs within national borders, its harms spread beyond them. Next, and in relation to a ‘special need’ to tackle the crime on a common basis, Jenia I. Turner emphasises the symbolic potential harmonisation might have, stemming from the function of criminal law to re-affirm the EU’s identity and values, such as equality and fundamental rights. ¹²³ Accordingly, it can be argued that the accepted wrongfulness of image-based sexual abuse further legitimises common EU action, clearly expressing that this conduct should have no place in the EU. ¹²⁴ Accordingly, therefore, image-based sexual abuse has a transnational, negative impact, justifying Member States’ cooperation in criminal matters. ¹²⁵

Nonetheless, this legal basis constrains action on image-based sexual abuse and, in relation to other areas of the proposed Directive, raises serious issues of concern. A more effective and comprehensive way forward, therefore, would be to adopt the Parliament’s proposal for a Council decision to include gender-based violence as a new area of particularly serious crime with a cross-border dimension. ¹²⁶ However, the Commission’s approach to the Directive, and legal basis, can be seen as pragmatic in light of the said resistance of some Member States to take broader action including objections to the very concept of gender. ¹²⁷ The result, however, is a patchy legal protection targeting rape and female mutilation as a form of sexual exploitation against women, whereas the non-consensual sharing of intimate or manipulated material and other forms of cyber-harassment and stalking fall within the scope of computer crimes.

Ambitions and conceptual foundations

Article 7 states that Member States must criminalise the intentional distribution of ‘intimate images or videos or other material depicting sexual activities’ where the person depicted does not consent and where the material is distributed through technology to a ‘multitude of end-users’. The inclusion of this provision is a welcome recognition of the prevalence and harms of a form of abuse that has spiralled over recent years, and which has led to a global movement to secure criminal justice redress. Further, setting this measure within the overall framework of violence against women recognises the gendered nature of these crimes, whilst also acknowledging that other groups, such as LGBTIQ* communities, are also adversely impacted. ¹²⁸ The violence against women framework should also enable greater understanding of the nature and motivations of perpetration, as well as the nature of the harms experienced, all of which impact on legal definitions, scope and sanctions.

Nonetheless, there remain concerns regarding the approach taken. While the focus on cyber violence represents a welcome recognition of the significance of these harms, its legal qualification as a computer crime risks entrenching distinctions between ‘offline’ and ‘online’ behaviours which are not reflective of women’s experiences. Women commonly experience violence and abuse, such as stalking or harassment, not in separate categories depending on the mode of perpetration, but as a whole experience. While such concerns are less dominant when considering image-based sexual abuse, as this is almost exclusively a crime committed via information and communication technologies, the overall concern remains as offline/online distinctions commonly also manifest in cyber acts being taken less seriously. ¹²⁹

Scope and definitions

Moving on to consider the specific scope of Article 7, the first issue is the nature of the materials included. Article 7(a) refers to ‘intimate images, or videos or other material depicting sexual activities’. In terms of the type of material to be included, the focus is on visual material, such as photos and videos, rather than text. ¹³⁰ In relation to content, the measure covers ‘intimate’ images as well as those depicting ‘sexual activities’. This is a potentially broad definition which will certainly include images of nudity and should also include other private activities such as toileting. There is no limit in terms of public or private acts meaning that intimate images of body parts taken in public, such as upskirting and downblousing, should also be covered. Potentially, ‘intimate’ can go beyond sexual and nude images, such as those of women from some black and minority ethnic communities without their expected attire. ¹³¹ While no jurisdiction yet includes such images in their criminal laws, this proposal does not preclude such an option.

In definitional terms, the proposal rejects the victim-blaming approach of some Member State laws which limit the scope of redress where images were originally taken or shared with consent. The Commission text refers to images taken without the depicted person’s consent and the preamble states that the measure should apply ‘irrespective of whether the victim consented to the generation of such material or may have transmitted it to a particular person’. ¹³² Nonetheless, Member States could still apply different thresholds or sanctions in these different situations, so long as, at a minimum, there is some form of redress where material is non-consensually shared. Maintaining such a fragmented approach, however, would constitute an injustice to victims, making reporting and prosecutions more difficult and sustaining mistaken and detrimental beliefs that women who take or share intimate images with consent are somehow responsible for subsequent harms.

Intention and perpetrator motives

In relation to the mental element, Article 7(a) straightforwardly refers to intentional distribution without consent, without limiting the scope to proof of specific motives such as causing distress. This ensures that the broad range of motivations are all included and rejects the dominant ‘revenge porn’ narrative where some acts are criminalised only where the perpetrator acted to harm the victim, such as in Malta. It affirms the core wrong of non-consent and that criminal sanctions should apply regardless of perpetrator motives. This should also make cases more straightforward, as evidence suggests that higher thresholds inhibit criminal justice personnel from pursuing prosecutions. ¹³³

Manipulated media and deepfakes

Another demonstration of the Commission’s ambition comes in Article 7(b) which covers material that is ‘produced or manipulated’ to make it ‘appear as though another person is engaged in sexual activities’ without the depicted person’s consent. This provision is designed to cover altered images or videos, often referred to as fakeporn or pornographic deepfakes. ¹³⁴ In seeking to criminalise the non-consensual distribution of manipulated intimate material, the draft Directive is following international best practice where many jurisdictions are recognising altered and deepfake pornographic materials as the new frontier in image-based sexual abuse. In effect, ‘real’ intimate images or videos are no longer required to perpetrate harms, as intimate material can be quickly and cheaply generated using increasingly common and user-friendly technology. Unfortunately, the rate at which deepfakes are being generated demonstrates the market and virality of this content. However, across the EU there is little legislative action in this field, with recent Irish legislation being a notable exception.

However, there is a potentially significant limitation on this measure’s scope. Article 7(b) only applies to material manipulated so that the person appears to be ‘engaged in sexual activities’. What might constitute ‘sexual activities’ is likely to vary considerably and give rise to definitional confusion. There will be cases where this definition is clearly met, including much standard pornography. On the other hand, it is not clear whether it will apply to other situations such as nudity per se, as not all nudity is sexual, such as images of those changing their clothes and toileting. Secondly, the provision applies to images of people ‘engaged’ in sexual activities which may also rule out nudity as this may not be of someone engaging in sexual activities, even if the nude image itself is considered sexual. This definition, therefore, is likely to exclude all material produced through ‘nudification’ apps and subsequently distributed without consent. ¹³⁵ Regrettably, therefore, the definition in the draft is not comprehensive and will lead to potential confusion and some exclusions. A more comprehensive and straightforward approach would be to cover all intimate images, defined to include nude or sexual images as in Article 7(a).

Accessible to a multitude of end-users

The proposal is also limited by only applying to material made ‘accessible to a multitude of end-users by means of information and communication technologies’. This limitation is unnecessary in view of the proposal’s legal basis being its status as a computer crime, thereby already recognised as having a serious, cross-border dimension and being likely to reach a broad audience. If it remains in any final text, questions of interpretation will arise, potentially excluding many harmful experiences.

The preamble states that the term ‘multitude’ should be understood as referring to reaching a ‘significant number’ of end-users and that the term ‘should be interpreted and applied having regard to the relevant circumstances, including the technologies used to make that material accessible and the means these technologies offer for amplification’. ¹³⁶ This means the scope is to be determined by the relatively vague term ‘multitude’, understood as meaning ‘significant’, with dictionary definitions stating this to be a ‘large number’. ¹³⁷ None of these terms advances our understanding. For sure, uploading material to some widely accessed websites, such as pornographic platforms, will easily be covered. Similarly, material shared on public fora such as Twitter will be within scope. What is less clear is where the boundaries will lie with more limited distributions.

Sometimes a perpetrator will share images with victims’ family and friends which might be any number of people ranging from ten, to hundreds, to thousands. However, the serious harms experienced by the victim will not necessarily be greater simply because the image has been shared with more people. A perpetrator may share the material with an employer and work colleagues, again this might be any number of people, but even small numbers could generate devastating impacts. Is it right that working for a large organisation, with a ‘multitude’ of colleagues, means possible criminal redress, but not a small employer, even though in both cases your professional life is significantly harmed? In some communities, for example some minority religious communities, disclosure to a small number may again have devastating impacts, perhaps more than where images are shared with thousands of ‘friends’ online who are not so concerned about the intimate activity being disclosed. Similar concerns have been raised by the European Economic and Social Committee, which argues that this requirement is ‘ambiguous, vague and highly open to interpretation’, nor does it ‘deal with the real reputational harm which is sometimes greater if the material is shared only with people from the victim's close social, family or work circles’. ¹³⁸

While this terminology and limitations on scope might provide some flexibility for Member States, it will lead to significantly different levels of protection and redress. Redress becomes dependent not on the harms experienced, but on technical choices regarding the means by which material is disseminated without consent. Finally, it will make it more difficult to determine in advance whether conduct is criminal or not, and may hinder educative and prevention initiatives as the message regarding wrongful conduct is not clearly focussed on consent, but on technological details.

Conduct categories: failing to reflect victims’ experiences

It is positive that the draft Directive includes measures to tackle the non-consensual distribution of intimate images. This ambitious element of the proposal will help to ensure that Member State laws are keeping pace with international best practice. However, limiting the measure to only distribution fails to reflect the prevalence of abuse and victims’ experiences. As noted above, victims are commonly subjected to a range of forms of image-based sexual abuse, including the taking of intimate images or videos without consent, alongside their distribution and threats to do so. In other words, they do not experience the abuse in the discrete categories of ‘taking’ and ‘distributing’, but as a whole. Having different legal categories, laws and practices varying according to specific acts is not, therefore, reflective of victims’ experiences. Further, in and of itself, the taking of intimate images without consent is experienced as a fundamental violation of privacy and sexual autonomy and should be proscribed by the criminal law. As noted above, some jurisdictions do cover some forms of taking intimate material without consent, but coverage is patchwork and the boundaries of protection are often unclear. This mosaic of laws covering image-based sexual abuse is confusing for victims, as well as criminal justice personnel, meaning fewer reports, investigations and prosecutions. An alternative approach would be to include gender-based violence as a new area of crime listed in Article 83.1 TFEU which would then provide a clearer legal basis to for minimum provisions covering all forms of image-based sexual abuse.

Criminalising coercive threats

The potential harm experienced when faked sexual or pornographic videos are created without consent arises from threats to subsequently distribute such material. Similarly, threats to distribute ‘real’ intimate material is a particularly egregious form of abuse, often experienced as life-threatening and paralysing. For others, the threat of disclosure is continuous, cumulative and can become overwhelming, casting a relentless shadow over victims’ lives. It is welcome, therefore, that Article 7(c) provides that it should be a criminal offence to intentionally threaten to distribute intimate images or videos, including deepfakes. As with the provision on manipulated material and deepfakes, including within the Directive threats demonstrates the ambition of the proposal as it will require many Member States to alter their criminal laws.

However, as with other elements, the provision on threats is not comprehensive as it only includes where done so ‘in order to coerce another person to do, acquiesce or refrain from a certain act’. This will include coercive circumstances such as sexual extortion where a victim has already shared intimate images and the perpetrator threatens to distribute them, unless further intimate material is shared. It should also cover blackmail where the perpetrator demands money to prevent distribution, a more common form of extortion where adults are the victims. The provision may also cover some situations of domestic abuse where a perpetrator threatens to distribute material as part of a broader pattern of control and abuse which might include a direct focus on a ‘certain act’ as required by the provision. However, the prosecutorial challenge will be identifying and proving the ‘certain act’ and its connection with the specific threats to distribute intimate material.

But this is as far as the measure goes. It will not, therefore, cover threats made with the aim of causing distress to the victim. For example, an ex-partner may threaten to distribute intimate images to deliberately cause distress, rather than to coerce the victim to do a particular act. Similarly, many other perpetrators may make threats for reasons not always apparent, but designed to cause direct harm, perhaps to exercise power and control over the victim, but without it being related to ‘certain acts’. Regrettably, therefore, while it is positive that the provision includes threats, limiting it to only certain threats means the provision fails to live up to its ambition and leaves considerable gaps in protection. In addition, it applies an additional threshold which will make prosecutions more challenging and therefore less likely.

Sanctions

In terms of sanctions, Article 12(6) provides that the criminal offences in Article 7 must be punishable by a maximum penalty of at least one year of imprisonment. This penalty has been criticised by the EESC which considers that the sanction should be equivalent to the minimum for cyber-stalking which is a maximum of two years’ imprisonment. ¹³⁹ If there was a change to two years, many more countries would also need to revise their laws. There are difficulties with ranking violence against women offences, assuming some are more intrinsically ‘serious’ than others, when victims’ experiences vary considerably. Further, increasing criminal penalties is not necessarily the best way to target abuse. Criminalisation is a necessary foundation for establishing that conduct such as image-based sexual abuse is serious and harmful, but with the aim of changing societal cultures and behaviours, rather than increasing imprisonment. ¹⁴⁰

Revising Article 7 towards a more comprehensive, straightforward proposal

Overall, therefore, while the inclusion in the draft Directive of measures covering some forms of image-based sexual abuse is positive, particularly the key focus on consent, and the inclusion of threats and altered imagery, revisions are required to ensure that the measure is straightforward, comprehensive and offers the real opportunity of redress for many victims. The Article should be revised to cover taking intimate and sexual images or videos without consent, reflecting victims’ holistic experiences. In relation to the provisions on altered images and deepfake pornography, the restriction of scope to only material of people ‘engaging in sexual activity’ should be removed, utilising the broader definition of intimate images to ensure harmony across the provisions of Article 7. Similarly, in relation to threats, the limitation of this provision to only cases where it can be proven the threat was designed to coerce the individual into specific acts or omissions should be removed. A threat to distribute such material, without consent, is harmful, regardless of the motives. The focus should be on the harm to victims, not the specific motives of perpetrators.