a) The EU’s commitment to counteracting gender-based violence

As mentioned above, Directive 2024/1385 is the first legislative EU Act that specifically targets violence against women and domestic violence. The issue had been previously spread across several acts, especially in the field of criminal justice (for example, Directive 2012/29/EU establishing minimum standards on the rights, support and protection of victims of crime, and Directive 2011/99/EU on the European Protection Order). Some of these acts had also included harmonisation measures to counteract specific forms of gender-based violence (for example, Directive 2011/36/EU on preventing and combating trafficking in human beings and protecting its victims, recently amended by Directive (EU) 2024/1712). However, neither had any of them adopted a comprehensive approach nor had they tried to define criminal offences in the area of domestic violence^[1].

427Hence, the European Parliament had called for the EU to assume a more proactive role in the fight against gender-based violence on several occasions^[2]; in the same vein, the Gender Equality Strategy announced by the European Commission in March 2020 had planned to propose several measures to combat this form of violence^[3]. More precisely, President von der Leyen had identified three main actions: the completion of the EU’s accession to the Council of Europe Convention on preventing and combating violence against women and domestic violence (hereinafter: the Istanbul Convention); the adoption of a Directive including additional measures to prevent and combat gender-based violence; adding specific forms of violence to the “Eurocrimes” list (Art. 83(1) of the Treaty on the Functioning of the European Union (TFEU))^[4]. While the first two measures were implemented^[5], the last one has yet to materialise.

All these actions were based on the assumption that Member States’ national legislation on violence against women still differs too substantially, and that such broad variation undermines the protection of women’s fundamental rights^[6] and hampers the mutual recognition of judicial remedies such as protection orders^[7]. Indeed, evidence confirms that violence against women remains a widespread phe428nomenon in Europe^[8]. It is also true that existing legal instruments are insufficient to counteract this type of violence effectively. Even if we discount the fact that not all Member States have ratified or enforced the Istanbul Convention^[9], we must remember that this treaty fails to address several forms of gender-based violence, such as those committed using information and communication technologies (ICTs).

b) The legal basis of the Directive

Having identified several reasons for strengthening harmonisation of national law in this field, we need to acknowledge that the EU’s efforts to combat violence against women and domestic violence face structural limits. Primarily, gender-based violence does not actually fall within the EU’s remit, with Art. 83(1) TFEU only recognising a limited competence. It establishes that harmonisation measures can be adopted in specific areas of “particularly serious crime with a cross-border dimension”; in any case, an EU intervention must also satisfy the principles of subsidiarity and proportionality^[10]. Yet problems arise from the fact that, to date, the list of Eurocrimes does not include any explicit reference to domestic violence or gender-based violence^[11]. As seen, the EU Commission had envisaged extending the EU’s competence in the Gender Equality Strategy 2020–2025 to overcome this obstacle; however, this has yet to be finalised.

Given the above, it is easy to understand why the Directive only addresses limited forms of violence. Notably, the EU Commission Proposal placed two offences in the area of “sexual exploitation of women and children” (female genital mutilation and forced marriage) in terms of their legal basis, whereas the other four can be categorised as “computer crime” (non-consensual sharing of intimate or manipulated material; cyber stalking; cyber harassment; cyber incitement to violence or hatred). Regarding the last point, it is noteworthy that, for the first time, the Directive sets minimum standards for the definition of offences that are not necessarily 429committed with an ICT tool. Indeed, acts previously adopted in the domain of “computer crime” (see Directive (EU) 2019/713 on combating fraud and counterfeiting of non-cash means of payment, and Directive 2013/40/EU on attacks against information systems) had covered “computer-dependant crimes”, i.e., offences that can only be committed using ICT. Newly recognised, the Directive encompasses offences that can be committed outside the cyber sphere and that are only facilitated by technology (“cyber-enabled crimes”) under “computer crime” ^[12]. Crucial for the adoption of such a broad interpretation of the concept of “computer crime” was the will to support the implementation of Regulation (EU) 2022/2065 on a Single Market for Digital Services, the so-called Digital Services Act (hereinafter: the DSA), that is referred to several times in the Recitals and Articles of the Directive. This act requires online platforms to adopt notice and take-down procedures to remove “illegal contents”; given the lack of a common definition of the last concept, it was deemed necessary to introduce additional harmonisation measures aimed at enforcing the Internet Service Provider (ISP)’s duties.

In the following section, we will examine the new criminal provisions, starting with “sexual exploitation of women and children” offences, and then moving to “computer crime”. Before examining the new criminal provisions in more detail, however, it seems useful to briefly reflect on the text proposed by the European Commission and on the reasons for its amendment to better understand the features of Directive 2024/1385.

a) Non-consensual sharing of intimate or manipulated material

The first computer crime defined by the Directive is the “non-consensual sharing of intimate or manipulated material”. More specifically, Art. 5(1) asks Member States to criminalise three different types of conduct, all ascribable to the broader phenomenon of image-based sexual abuse. The first one consists of “making accessible to the public, by means of information and communication technologies (‘ICT’), images, videos or similar material depicting sexually explicit activities or the intimate parts of a person, without that person’s consent” (a). The second offence is centred on the non-consensual production or manipulation and subsequent dissemination of “material making it appear as though a person is engaged in sexually explicit activities” (b). Lastly, the third offence addresses the threatening to engage in the unlawful conduct previously described, “in order to coerce a person to do, acquiesce to or refrain from a certain act” (c). The types of conduct penalised in points (a) and (b) must meet the threshold of being “likely to cause serious harm” to the victim; Art. 5(2) clarifies that their punishment must be carried out without prejudice to the principles set out by the Charter of Fundamental Rights of the European Union, such as freedom of expression and information.

According to empirical data, the non-consensual sharing of intimate images, sometimes improperly referred to as “revenge pornography” or “non-consensual pornography”, is a form of violence that is widespread in Europe and is more likely 435to affect women^[29]. It constitutes a violation of the rights to privacy and sexual autonomy and is closely linked to other types of image-based sexual abuse, like the non-consensual creation of intimate images. Considering its detrimental effects, over time almost all European States have introduced offences aimed at punishing the most severe expressions of image-based violence, although with different perspectives and technical solutions. In accordance with Art. 83(1) TFEU, which limits EU intervention to crimes with a cross-border dimension, the Directive focuses only on the dissemination to the public of intimate materials and does not envision punishment solely for their production. In doing so, Art. 5 expressly rejects the victim-blaming approach adopted by some Member States, which consider the victim’s consent to the creation of the material when defining the offence; moreover, it avoids limiting punishment to cases where the offender acts with the intention of harming the victim^[30]. Instead, Art. 5 defines the scope of the offence broadly to encompass both sexual and intimate materials^[31], and extends criminalisation to the sharing of images produced with ICTs (for instance, deepfakes), albeit limited to those of a sexual nature. This decision is noteworthy as, despite their growing prevalence, only a few countries have so far introduced provisions aimed at suppressing the dissemination of pornographic deepfakes^[32]. Last but not least, point (c) targets blackmailing that includes threats to share intimate images (so-called “sextor436tion”). In this regard, it is essential to distinguish this form of violence from image-based sexual abuse, despite their empirical connections, as it constitutes a distinct type of wrongdoing that, while not immediately compromising the victim’s sexual sphere, nonetheless represents a violation of their psychological integrity and autonomy^[33].

Before moving to Arts. 6 and 7, it is worth underlining that the choice to include the non-consensual sharing of intimate images in the Directive is well-founded, as image-based sexual abuse constitutes a serious crime that is not always properly addressed by national legislation. Notwithstanding the Directive’s provisions, the limitations imposed by its legal basis result in some shortcomings. For instance, we have seen that Art. 5 focuses on online abuse only; however, it thus disregards the fact that, although usually perpetrated on the Internet, intimate abuse can also take place offline^[34]. Moreover, since the Directive only covers the public dissemination of images, it does not take into account that the right to privacy and/or sexual autonomy can also be violated through the non-consensual creation of the intimate image as such, or its sharing with a restricted group of people.

b) Cyber stalking and cyber harassment

Arts. 6 and 7 of the Directive target two types of conduct that fall under psychological violence. Given that they partially overlap, we will start by outlining the two Articles before analysing the offences separately. Art. 6 addresses cyber stalking, defined as “the intentional conduct of repeatedly or continuously placing a person under surveillance, without that person’s consent or a legal authorisation to do so, by means of ICT, to track or monitor that person’s movements and activities”. States are called on to resort to criminal law every time such conduct is “likely to cause serious harm”. Art. 7, entitled “cyber harassment”, covers four different forms of abuse. The first one (a) is the intentional conduct of “repeatedly or continuously engaging in threatening conduct directed at a person [...] by means of ICT”; the second (b) refers to “engaging, together with other persons, by means of ICT, in publicly accessible threatening or insulting conduct directed at a person”; the third (c) is the “unsolicited sending, by means of ICT, of an image, video or other similar material depicting genitals to a person”. In all of the above-mentioned cases, a criminal sanction must be applied if the conduct meets a threshold of seriousness. The provision 437is completed by a fourth conduct (d), that of “making accessible to the public, be means of ICT, material containing the personal data of a person, without that person’s consent, for the purpose of inciting other persons to cause physical or serious psychological harm to that person”.

Clearly, both Articles address forms of violence that can be committed in a cyber environment as well as in real life. With regard to Art. 6 for example, in the physical sphere stalking is commonly defined as “persistent harassment” that consists of the imposition of unwanted communications or contacts. While the unwanted behaviour can take different forms, repetition is considered a defining element of stalking^[35]. This phenomenon, which emerged in the 1980s, has gained increasing attention in the last twenty years. Partially due to the widespread adoption of the Istanbul Convention, which devotes a specific norm to it (Art. 34), anti-stalking legislation is now commonplace in Europe. While the spectrum of normative solutions is diverse, offences are typically framed to cover a wide range of behaviours, from repeated threats and communications to monitoring and spying; they also commonly address conduct committed through ICTs^[36].

Moving to Art. 7, harassment is equally a common form of violence that takes place online as well as offline. Here, the scenario is less clear, as harassment is an umbrella term that can include very different types of conduct, some of which overlap with stalking or hate speech^[37]. To make things worse, international human rights treaties neither provide a precise definition of harassment nor call for the punishment of specific kinds of conduct. Moreover, the Istanbul Convention requires adhering States to counteract the typical form of harassment inflicted on women, i.e., sexual harassment, yet without specifying what acts must be addressed or setting out an obligation to criminalise them (Art. 36)^[38]. Some jurisdictions define harassment as the intentional infliction of distress committed by a persistent course 438of conduct, whereas others include isolated incidents^[39]. In many cases, harassment is criminalised only when it takes place in a specific context (for instance, in educational institutions or the workplace) or in a way that causes an appreciable suffering to the victim; ad hoc offences for conduct committed online are quite rare^[40].

This being the background, we can affirm that the Directive covers only specific forms of stalking and harassment; it targets acts that may often be part of a broader pattern of behaviour, and which can occur online as well as offline. As regards stalking, we have seen that Art. 6 only penalises monitoring and controlling behaviours that are characteristic of intimate partner violence (IPV)^[41]; that said, other forms of stalking may be captured by Art. 7(a), which criminalises the persistent issuance of threats against a person.

For harassment, different observations may be made concerning the different types of conduct addressed by the Directive in this regard. As previously noted, the first one consists of repeated threats made by one person against another, often overlapping with stalking. By contrast, the second type of conduct (Art. 7(b)) involves threats or insults perpetrated by multiple individuals in a publicly accessible way. Here, the focus shifts from IPV to violence committed in the public sphere and frequently against women who hold a prominent position^[42]. Whether such an act is classified as wrongdoing hinges on it being perpetrated as part of a larger attack involving several individuals. It is only when considered in this broader context that these acts are likely to compromise the victim’s psychological and/or physical integrity.

Art. 7(c) penalises cyber flashing, which can be defined as the “unsolicited sending of an image, video, or other similar material depicting genitals to a person” (Recital no. 24). This phenomenon has only recently emerged; evidence shows that it is particularly common among younger generations and affects women and girls in a disproportionate way^[43]. Most European States address cyber flashing through general harassment offences; in very few cases, ad hoc provisions have been en439acted to tackle such conduct more effectively and emphasise the denial of a victim’s dignity that is embedded therein^[44]. Admittedly, the idea of introducing dedicated cyber flashing offences has raised some concerns, especially regarding the risk of violating the harm principle; additionally, there are ongoing debates about how to define this criminal offence, with questions arising about whether to take into account the offender’s malicious intent or the victim’s lack of consent^[45]. So, while the Directive does consider cyber flashing a serious crime worthy of punishment, it pays heed to the above-mentioned objections by specifying that such conduct must be “likely to cause serious psychological harm”.

Lastly, as already mentioned, Art. 7(d) targets the disclosure of personal information, an act that may overlap with other offences, such as defamation, non-consensual sharing of intimate images, and hate speech^[46]. Again, while the seriousness of the conduct addressed may appear debatable, depending on the type of information revealed and the extent of the person’s exposure, the Directive nonetheless opts for criminal law, emphasising the perpetrator’s malicious intent to define the scope of the offence.

c) Cyber incitement to violence or hatred

The last offence covered by the Directive is “cyber incitement to violence or hatred”. Art. 8(1) calls on States to punish intentional incitement to violence or hatred “directed against a group of persons or a member of such a group, defined by reference to gender, by publicly disseminating, by means of ICT, material containing such incitement”; Art. 8(2) specifies that States can limit punishment to “conduct which is either carried out in a manner likely to disturb public order or which is threatening, abusive or insulting”.

This provision addresses hate speech on the grounds of gender. In general, hate speech is a global phenomenon that is not new. Indeed, since the 1960s, several documents have dealt with racial hate speech, recognising the legitimacy and necessity of restrictions to the freedom of expression, aimed at upholding the principle of non-discrimination and the right to equal dignity. The EU has also long been com440mitted to tackling hate speech, with the first harmonisation measures dating back to Framework Decision 2008/913/JHA of 28 November 2008 on combating certain forms and expressions of racism and xenophobia by means of criminal law^[47]. Despite this long-lasting commitment, and evidence showing the prevalence of gender-based violence^[48], little attention has traditionally been devoted to sexist hate speech. Only in recent years have human rights organisations and the EU been calling for more action, highlighting the negative effects of this phenomenon on women’s participation in social and political life. The Directive finally fills this gap by harmonising the criminal provisions that address online hate speech based on gender.

Two aspects of Art. 8 merit closer inspection. Firstly, the norm targets only online hate speech. While this narrow scope is a consequence of the limited legal basis of the Directive, the choice to focus on online hate speech may be seen as justified by the unique risks posed by the Internet. It is known that the architecture of the web can facilitate the rapid dissemination of hate speech and exacerbate its seriousness; above all, the permanence of online materials compounds the harm inflicted on individuals, leading them to re-experience the suffering caused by the crime. Moreover, online hate speech based on gender seems to undermine the participation of women in the public debate, thus weakening democracy, especially when the victims are politicians or journalists. For these reasons, the EU had previously undertaken action specifically aimed at counteracting aggressions committed online, such as the EU Code of conduct on countering illegal hate speech online (2018) and the DSA, which, as seen earlier, establishes notice and take-down duties to ensure a prompt removal of illegal contents.

Secondly, Art. 8 also raises questions as to what conduct it covers. We have seen that the Directive is innovative in that it expands the grounds for discriminatory hate speech to include gender; however, there may be uncertainties in delineating the scope of criminal conduct. For one, the concept of gender is broad, as it usually refers to the social role of a person in relation to sex; given the absence of a precise 441definition, it appears unclear whether this includes incitement to hatred based on sexual orientation^[49]. Doubts may also be linked to the identification of unlawful expressions. As Recital no. 25 underlines, language “does not always directly refer to the gender of the targeted person” and “the biased motivation can be inferred from the overall content”; therefore, Art. 8 might theoretically also cover sexualised threats or body shaming comments. In this regard, however, it is worth underlining that conduct must meet the threshold of seriousness that is usually required to criminalise hate speech: in fact, the Directive uses the same wording as adopted by Framework Decision 2008/913/JHA and allows States to restrict the application of criminal law to conduct that is dangerous for the public^[50].