The UK Online Safety Bill – a refresher

On 19 November 2021, the Age Assurance (Minimum Standards) Bill (the AAB) received its second reading in the House of Lords. It sets out certain mandatory minimum standards that any age assurance system operated in respect of online or digital services would need to comply with. It is designed to protect children online.

However, at the time of writing at least, it is reported that the AAB is unlikely to pass due to a lack of Government support, which is instead aimed at the Online Safety Bill (the OSB) to achieve the aims of the AAB. A draft of the OSB was published in May 2021.

What is the OSB? Why is it being considered?

The draft OSB comes in response to growing public pressure in the UK to ensure there is accountability placed on website operators to monitor harmful content (eg content related to cyberbullying, discriminatory material, terrorism or promotion of self-harm) posted by users and take action. Currently, there are no statutory obligations on such operators in respect of the content posted by their users.

The OSB has made several headlines, even being referenced in the Queen’s 2021 speech, and UK Prime Minister Boris Johnson has stated that the second reading of the OSB will be brought forward to before the end of 2021. Ofcom’s (the designated regulator for the OSB) chief executive made a statement on 24 November 2021 stating that “time has come for strong, external oversight” of social media companies, who will be among those in scope of the OSB, but notes that Ofcom “won’t act as a censor” given “Free speech is the lifeblood of the internet.”

We outline the key impacts below if the OSB (in its current form) becomes law.

Who’s in scope?

In summary, it will apply to:

(a) A “user to user” service with links to the UK, ie services that do any of the following:

• host user generated content (UGC) that can be accessed by users in the UK; or
• facilitate public or private online interaction between service users, at least one of whom is in the UK; and

(b) search engines with links to the UK.

It will apply to any company in scope regardless of where the company is based provided that users in the UK are affected. The duties set out in the OSB apply only to the design and operation of the service in the UK or the design and operation as it affects UK users.

The OSB will not apply to:

(a) business-to-business services;

(b) internet service providers (but they’ll need to co-operate with Ofcom on business disruption measures);

(c) “low-risk” businesses (such as businesses with limited functionality like retailers who offer product and service reviews); or

(d) content published by a news publisher on its own website including user comments on that content. There will be protections for journalistic content shared on services that fall within scope.

If you are in scope, what does it mean?

The OSB will impose a duty of care on companies in scope to ensure that those who use their services are not exposed to content that is harmful, although not illegal.

To meet the duty of care, companies will have to put in place systems and processes to improve user safety but the expectation will vary depending on the different categories of content and whether the activity is illegal and harmful to children or legal content for adults which may be harmful to children, if accessed by children.

The Government will introduce legislation proportionately, in an attempt to minimise the regulatory burden on small businesses. The government expects only 5% of UK businesses to fall within scope.

Consequences of non-compliance or a breach

Companies in breach of non-compliance face possible fines of up to £18m or 10% of global annual turnover, whichever is higher. Ofcom could take enforcement action, which may include business disruption measures, against any in-scope company worldwide that provides services to UK users.

The government will reserve the right to introduce criminal sanctions for senior managers if they fail to comply with Ofcom's information requests. However, Ofcom is expected to take a proportionate approach to enforcement. The government will establish a statutory appeals route.

Next steps

Operators of online platforms or search engines with UK users should begin to consider what steps it has in place already to monitor users’ interactions with each other and whether there are any gaps. Given the public concern, and the announcement and implementation of similar regimes in other jurisdictions, it seems quite likely that monitoring online harms is going to be another obligation for such operators to bear in mind.