Ofcom prepares for implementation of Online Safety Bill

The question

How and when does Ofcom expect to carry out its new regulatory function for online safety created by the Online Safety Bill?

The key takeaway

In our Snapshots for Summer 2022, we highlighted that the Online Safety Bill (the Bill) has now been presented in Parliament. In readiness for the Bill’s entry into law, Ofcom has set out a roadmap for the steps it intends to take once the Bill is approved.

The background

The Bill was drawn up in May 2021 and was first presented before Parliament in March 2022. It is likely to receive Royal Assent in 2023, although many of its provisions will not take effect until some time after this, as the Bill requires the Secretary of State to make secondary legislation. Following this, Ofcom will then be required to produce several codes of practice. The Bill extends Ofcom’s powers to regulating online safety and seeks to introduce a variety of measures to ensure user safety of all search engines and providers of user-to-user services, particularly focusing on the protection of children and tackling illegal online content.

The development

In readiness for the Bill’s entry into law, Ofcom has laid down a roadmap for its implementation. Ofcom has stated that, in the first 100 days of its powers coming into force (likely in the first half of 2023), it will take several steps including publishing: 

• draft codes on “illegal content harms” (including child sexual exploitation and terrorist content). Organisations will have to inhibit access to such content and conduct a risk assessment of their users encountering such content
• draft guidance on children’s access assessments. This will set out the factors that organisations will have to consider when they carry out their assessment of the likelihood of their services being accessed by children
• draft enforcement guidelines. This will set out Ofcom’s approach to enforcing the numerous powers given to it by the Bill
• a consultation on advice to the government on the thresholds for companies to be placed in a “category” under the Bill.

On timing, Ofcom anticipates that the first codes of practice for illegal content will enter into force in mid-2024, during which time organisations will also have to conduct their illegal content risk assessments. It expects secondary legislation, which will define content which is harmful to children, to be finalised by mid-2023, and Ofcom’s subsequent guidance and codes for protecting children to be finalised by Autumn 2024. Following this, organisations would have three months to implement their measures to ensure compliance. It further expects that organisations exceeding the threshold for “qualifying worldwide revenue” (which is yet to be defined) will have to start paying regulatory fees to Ofcom from 2024/25.

Furthermore, a Private Members’ Bill has been introduced in the House of Lords requiring Ofcom to establish a unit to advise the Secretary of State for the DCMS, regarding content that could be seen to promote self-harm or suicide, and to make recommendations to improve measures to prevent same. This is unlikely to become law, but it will push this issue further up the legislative agenda. While the Bill is still being amended, some of the Private Members’ Bill’s provisions may be incorporated within it, which would give Ofcom further powers.

Why is this important?

This roadmap for Ofcom’s steps following the Bill’s likely entry into law is important for organisations such as search engines and social media organisations, as it will lead to the introduction of new and binding regulations. The Bill in its current form proposes to introduce several penalties for non-compliant organisations, including substantial fines and, in cases of repeated and systemic non-compliance, making the individual designated as the organisation’s “Safety Controller”, liable for an offence. Organisations affected by the Bill would therefore be well-advised to keep abreast of all steps taken to implement the Bill. Furthermore, Ofcom will consult publicly on documents set out in the roadmap such as the guidance on children’s access assessments, codes for the protection of children and protection of adults from legal harms, thereby giving organisations the opportunity to have an input on the new measures.

Any practical tips?

The burdens on organisations to ensure the safety of users will increase under the Bill, and they will have to prepare to comply with it in order to avoid substantial fines and/or reputational harm. Organisations should therefore take steps to engage with the public consultations mentioned above to ensure that any future regulations which are implemented are as effective as possible. This will have the added benefit of allowing them to gain an early understanding of the form that Ofcom’s guidance and enforcement is likely to take, therefore enabling them to consider from an early stage how to adapt their practices to ensure compliance with the new regulations.

Autumn 2022