Draft UK Online Safety Bill published

The UK Government published the draft Online Safety Bill on 12 May 2021. The Bill is in pre-legislative form only and is potentially subject to significant change. This blog sets out the key points in the Bill as currently drafted, how it might impact your business, and how Fieldfisher may be able to assist.

Will the Bill apply to my business?
What duties will apply?

The Bill contains wide ranging duties in relation to illegal content, as well as content that is deemed to be harmful but not illegal.[2] It will increase liability for all businesses within scope. Currently, social media platforms and tech companies are liable only for content that they host. The Bill introduces secondary liability for failure to remove material that the company is put on notice of, and for failure to have sufficient systems and processes in place to identify and prevent the hosting of harmful or illegal content. There will likely be significant commercial implications for most, if not all, companies falling within scope.

Different duties will apply depending on whether the company is a user-to-user service or a search service.[3]  These include duties to:
 

1. carry out risk assessments in relation to illegal and harmful content;
2. comply with safety duties (including taking proportionate steps to reduce and manage the risk of harm to individuals);
3. have regard to the importance of protecting users’ rights to freedom of expression and protecting users from unwarranted infringements of privacy when deciding on and implementing safety policies;
4. reporting and redress duties (to have appropriate reporting systems and complaints processes in place that allow users and affected persons to easily report content); and
5. record keeping and review duties.

Is my business' service likely to be accessed by children?

Companies will be required to assess whether children are likely to access their services or platforms,[4] and if so, additional duties will apply. These include the duty to carry out a children's risk assessment, and safety duties to mitigate and manage the risk of harm to children in different age groups.  

Is my business a Category 1 service?

Further duties will apply to 'Category 1' businesses. This targets a small group of 'high-risk, high-reach services' and imposes additional controls on content that is lawful but still harmful (e.g. abuse that falls below the threshold of a criminal offence; encouragement of self-harm; mis/disinformation). Whether a company is Category 1 will be determined by Ofcom.  The threshold conditions remain unspecified, but are likely to be based on the size of a service provider's audience and the functionalities that it offers. The focus will be on the largest and most popular social media sites.[5] Category 1 companies will be required to conduct adult risk assessments, and to uphold additional safety duties in relation to content that is harmful to adults.[6] They will also be required to consider content of 'democratic importance' and 'journalistic content' when making decisions about safety policies and what action to take.

How will the regime be funded?

The funding details remain unclear in the Bill. All regulated service providers with worldwide revenue above a threshold will be required to pay Ofcom a fee for the implementation and enforcement of the regime. Ofcom will have broad powers to determine what that fee should be.[7] It remains to be seen where the threshold will be set, and correspondingly the impact on small and medium sized business.

Ofcom's role

As the independent regulator, Ofcom will be required to produce codes of practice and guidance to assist businesses to comply with their obligations. The Bill proposes Ofcom's new powers to ensure compliance with the regime will include the power to issue 'use of technology' notices and information notices to companies where it has reasonable grounds to believe that they are non-compliant.  It will be able to conduct investigations, and, where providers fail to meet their duties, impose fines of up to £18 million, or 10% of a companies' annual global revenue, whichever is highest.[8] Ofcom will also be able to seek court orders for a number of business disruption measures against regulated companies.  

Comment

It remains unclear how the Bill will operate in practice. The reception of the draft Bill to date has been mixed, with criticism about its lack of detail and the cost of compliance for regulated companies. Much of the detail of the regime will be provided in secondary legislation and in guidance by Ofcom. Some of the duties in the draft bill are vague and uncertain, such as the test for content 'harmful' to children, and there is increasing concern about the impact of the Bill on freedom of expression online. The Bill has also come under criticism for failing to do enough to protect from online scams, and to restrict children's access to online pornography.

In any event, the potential duties proposed in the Bill and the powers to be granted to Ofcom are extraordinarily wide ranging. Some of the duties, in particular the Category 1 duties around content of democratic importance and journalistic content, are controversial, could lead to significant debate during the legislative process, and may be subject to widespread modification as the Bill progresses. Parliament will need to decide whether it is willing to rely on the tech industry to take decisions and weigh up competing factors in relation to freedom of expression and online safety.

Next steps

The draft Bill will be subject to pre-legislative scrutiny by a joint committee of MPs before a final version is introduced to Parliament. The final legislation is unlikely to enter into force until at least 2023.

There may be opportunities for industry to make submissions to the joint committee in relation to the draft Bill. At Fieldfisher, we are here to advise and assist you in all efforts to engage with the early legislative process. Please get in touch with the Regulatory team for further information and advice.

We can help with:      

• understanding how to best engage with the legislative and policy-making process and to help get your voice heard 
• advice on whether your business is likely to fall within scope of the new regime.
• analysing whether your business may fall within Category 1 and the likely commercial implications.
• advice on whether or not your business is likely to meet Ofcom's test for 'services likely to be accessed by children'.
• initial views on online safety risk assessments, and thinking about your future compliance under the regime.
• any other strategic or legal considerations in light of the Bill.