Online Safety Bill introduced in Parliament

The question

How far off is the Online Safety Bill from finally landing? And, in a nutshell, what are its key elements?

The key takeaway

The Online Safety Bill (the Bill) has now been introduced in Parliament. The Bill will have wide-ranging effects for search engines businesses that host user-generated content, with both the requirements and the risks increasing with the size of the business.

The background

Online safety, particularly with regard to children, remains the hot topic right now, with the ICO’s enforcement of the Children’s Code becoming more apparent in recent months. Whilst the Children’s Code focusses primarily on data protection, the incoming Online Safety Bill seeks to improve the protection of both children and adults who access search engines and websites that host user-generated content (ie where users can interact with each other and/or post their own content).

The development

A draft version of the Bill was drawn up in May 2021, and since then it has undergone many changes to reach its current format. Its shape may change again as it passes through Parliament, however in its current form some of the key points in the Bill include:

• “search services” and “user-to-user services” (ie search engines and websites that host user-generated content) will now have a duty of care towards their users to make an assessment of the potential harm to those users that could be caused by illegal activity and/or content, and to take steps to mitigate these risks. Particular emphasis is placed on content and/or activity that could pose potential harm to children. To enable users to notify the website in question of anything that may be harmful, websites to which the Bill applies must set up a simple complaints procedure
  
  
• on top of these general requirements, companies that are labelled as “Category 1” (ie the largest providers of user-to-user services) and “Category 2A” (ie regulated search services or combined services) will have additional obligations to comply with. For instance, Category 1 organisations must enact, and consistently apply, clear terms of service in relation to how they will handle content that is defined as “legal but harmful”. Category 2A organisations must minimise the risk of fraudulent adverts being encountered by users in their search results through the use of proportionate processes and systems. Exactly who and what counts as “Category 1”, “Category 2A” and “legal but harmful” will be determined by secondary legislation. The good news for companies caught by the scope of the Bill is that it is only where content falls under the “legal but harmful” definition that they will need to act, as opposed to having to assess for itself whether the content is harmful. The purpose of this is to discourage businesses from over-censoring to ensure that they are not in breach of the Bill, which may otherwise have freedom of speech implications
  
  
• communications regulator Ofcom will receive new powers under the Bill, including to demand information on companies’ content algorithms, enter premises to access equipment and data and to interview employees. If companies do not comply with such requests within two months, their executives may be prosecuted
  
  
• the Bill also imposes an obligation on all sites that either host or publish pornography to ensure that its users are a minimum of 18 years old, and introduces a new offence for “cyberflashing” (sending an unsolicited photograph or video of genitals) that carries a maximum two-year prison sentence.

Why is this important?

All search engines and providers of user-to-user services will be caught by the Bill. The powers that will be given to Ofcom to investigate and enforce the Bill’s strict obligations mean that companies will need to ensure that they are compliant at all times, especially given the potential consequences of non-compliance, which include a fine of up to 10% of annual global turnover.

Any practical tips?

Organisations that are set to be affected should begin preparing as soon as possible. Though the costs of compliance are expected to be high (one estimate places the figure at £250,000 for medium-sized businesses), the costs of non-compliance would be far more costly, in terms of the fine received, time spent under investigation and the likely reputational damage inflicted. The Bill may yet change in appearance as it passes through Parliament, however it is likely that something akin to the current version of the Bill will be enshrined in law in the near future. 

One practical question is the extent to which companies caught by the scope of the Bill may seek to use the legislation as an excuse to censor users, and why they should arguably strive to meet, rather than exceed, the Bill’s obligations.