The UK Government is one of the first individual nations to put forward its own legislative proposals to 'regulate the internet' with the long awaited Online Safety Bill (the “Bill”). The amount of time it has taken the Government to publish the Bill reflects the unenviable challenges facing legislators around the world, of striking a balance between protecting online users and safeguarding freedom of speech and democratic debate online whilst also supporting innovation and the digital economy.
The race to regulate
Harmful and illegal content is seen as too readily available online. Voluntary industry action through existing self-regulation has proven to be unsuccessful in combating this issue and has struggled to keep pace with the changing online environment.
The Bill includes a comprehensive package of tough new measures which seeks to combat illegal and harmful practices online, and applies to all regulated services that have “links with the UK” (whether they are based in the UK or not). This includes tech companies and digital platforms, among others, which provide services that have a significant number of users in the UK, target the UK market or can be used in the UK by individuals. It remains to be seen how the Bill will be monitored and enforced in respect of regulated service providers located overseas.
Publication of the Bill follows hot on the heels of the proposed European Digital Services Act (“DSA”) published by the European Commission in December 2020, which proposes new rules to increase the responsibilities of providers of online intermediary services and reinforce oversight over online platforms’ content policies. There are some key differences between the EU and UK approaches. For example, in contrast to the UK's attempt to regulate harmful as well as illegal content, the EU's proposals only explicitly cover illegal content. In both cases, however, there are likely to be 'grey areas' that will test the limits of the legislation and cause difficulties for service providers trying to interpret their obligations.
Why does it matter?
The Bill provides Ofcom (the UK's communications regulator) with a suite of new enforcement powers in relation to the distribution of illegal and harmful content, including:
- the power to fine companies failing to fulfil their duty of care up to £18 million or 10% of their annual worldwide revenue, whichever is higher; and
- the power to block access to sites.
The Government has also indicated that it may (in the future) give Ofcom new powers to take criminal action against named senior managers of service providers if, for example, they fail to comply with enforcement action.
The Bill does not just apply to tech giants and social media sites. It applies to all providers of internet services that allow users to share user-generated content (user-to-user) and providers of search engines (search services). There are some exemptions, including for “limited functionality services”, which only allow users to post comments or reviews on content which is published by the service provider, or use like/dislike buttons, engage in voting or rate such content.
- The Bill imposes various duties of care on providers of regulated services.
- The Bill incorporates a tiered, risk-based approach to the obligations placed on online platforms and services, with larger/higher risk organisations being subject to greater regulation.
- Regulated service providers with qualifying worldwide revenue at or above a specified threshold will have an obligation to notify Ofcom and pay an annual fee.
- In addition to taking action in respect of illegal content, the Bill addresses content which may be lawful but which is nevertheless considered to be harmful. Whilst it includes a definition of 'harmful content' in an effort to provide clarity, early critics have suggested the definition is currently too vague for organisations to determine without further guidance.
- Much of the detail of the Bill (including the extent of applicable duties relevant to regulated service providers), will be set out in secondary legislation and codes of conduct prepared by Ofcom that have not yet been published.
What can I do to prepare?
- Consider whether the bill applies to your business. If your business offers any user-to-user or search services it may fall within the scope of the Bill. Larger and higher profile companies (including social media companies) are likely to be subject to the strictest regulations under the current proposals.
- Start planning your strategy. Depending on the nature of the business, consider your overall strategy and approach to implementing compliance with the Bill (taking into account any PR or reputational sensitivities and the nature of your user base and content). There may be further opportunities to submit feedback on the Bill and associated secondary legislation to Government over the coming months.
- Try and minimise your compliance burden. If your business has links with the UK and is also likely to be affected by the EU's new Digital Services Act and Digital Markets Act, consider how your compliance programme can be carried out in the most efficient way (given the potential overlap between the EU and UK legislative packages). For example, personnel engaged in content monitoring may be able to be trained in a way that covers both sets of legislation.
- Keep up to date. Secondary legislation is due to be published on the types of business that the Bill will apply to (based on a range of currently unknown thresholds and factors), as well as detailed codes of practice on practical compliance.
The balancing act
It is too early to say when exactly the Bill will come into force and the true impact of the new legislation is not clear at this early stage. It remains to be seen whether the finalised framework will strike an appropriate balance between protecting online users and safeguarding freedom of speech and democratic debate online, or will give rise to potential constraints on innovation and investment for those within its scope.