80 Scope of duties about regulated provider pornographic content
(1) A provider of an internet service within subsection (2) must comply with the duties set out in section 81 in relation to the service.
(2) An internet service is within this subsection if—
(a) regulated provider pornographic content is published or displayed on the service,
(b) the service is not exempt, and
(c) the service has links with the United Kingdom.
(3) A service is “exempt” for the purposes of this Part if it is —
(a) a user-to-user service or a search service of a description that is exempt as provided for by Schedule 1, or
(b) an internet service of a kind described in Schedule 9.
(4) A service “has links with the United Kingdom” for the purposes of this Part if either of the following conditions is met in relation to the service—
(a) the service has a significant number of United Kingdom users, or
(b) United Kingdom users form one of the target markets for the service (or the only target market).
(5) This Part does not apply in relation to a part of a regulated service if—
(a) in the case of a Part 3 service, the conditions in paragraph 7(2) of Schedule 1 (internal business service conditions) are met in relation to that part;
(b) in the case of an internet service other than a Part 3 service, the conditions in paragraph 1(2) of Schedule 9 (internal business service conditions) are met in relation to that part.
(6) This Part does not apply in relation to a part of a regulated service if that part is an on-demand programme service or a non-UK on-demand programme service that is a Tier 1 service ....
(6A) In subsection (6), “on-demand programme service”, “non-UK on-demand programme service” and “Tier 1 service” have the same meaning as in the Communications Act (see sections 368A, 368AA and 368HA of that Act).
(7) If a person is the provider of more than one internet service within subsection (2), the duties set out in section 81 apply in relation to each such service.
(8) The duties set out in section 81 extend only to the design, operation and use of an internet service in the United Kingdom.
81 Duties about regulated provider pornographic content
(1) This section sets out the duties which apply in relation to internet services within section 80(2).
(2) A duty to ensure, by the use of age verification or age estimation (or both), that children are not normally able to encounter content that is regulated provider pornographic content in relation to the service.
(3) The age verification or age estimation must be of such a kind, and used in such a way, that it is highly effective at correctly determining whether or not a particular user is a child.
(4) In relation to the duty set out in subsection (2), a duty to make and keep a written record, in an easily understandable form, of—
(a) the kinds of age verification or age estimation used, and how they are used, and
(b) the way in which the provider, when deciding on the kinds of age verification or age estimation and how they should be used, has had regard to the importance of protecting United Kingdom users from a breach of any statutory provision or rule of law concerning privacy that is relevant to the use or operation of a regulated service (including, but not limited to, any such provision or rule concerning the processing of personal data).
(5) A duty to summarise the written record in a publicly available statement, so far as the record concerns compliance with the duty set out in subsection (2), including details about which kinds of age verification or age estimation a provider is using and how they are used.
82 OFCOM’s guidance about duties set out in section 81
(1) OFCOM must produce guidance for providers of internet services within section 80(2) to assist them in complying with their duties set out in section 81.
(2) The guidance must include—
(a) examples of kinds and uses of age verification and age estimation that are, or are not, highly effective at correctly determining whether or not a particular user is a child,
(b) examples of ways in which a provider may have regard to the importance of protecting users as mentioned in section 81(4)(b),
(c) principles that OFCOM propose to apply when determining whether a provider has complied with each of the duties set out in section 81, and
(d) examples of circumstances in which OFCOM are likely to consider that a provider has not complied with each of those duties.
(3) The guidance may elaborate on the following principles governing the use of age verification or age estimation for the purpose of compliance with the duty set out in section 81(2)—
(a) the principle that age verification or age estimation should be easy to use;
(b) the principle that age verification or age estimation should work effectively for all users regardless of their characteristics or whether they are members of a certain group;
(c) the principle of interoperability between different kinds of age verification or age estimation.
(4) The guidance may refer to industry or technical standards for age verification or age estimation (where they exist).
(5) Before producing the guidance (including revised or replacement guidance), OFCOM must consult—
(a) the Secretary of State,
(b) persons who appear to OFCOM to represent providers of internet services within section 80(2),
(c) persons who appear to OFCOM to represent adult users of internet services within section 80(2),
(d) persons who appear to OFCOM to represent the interests of children (generally or with particular reference to online safety matters),
(e) the Information Commission,
(f) persons whom OFCOM consider to have expertise in innovation, or emerging technology, that is relevant to online safety matters, and
(g) such other persons as OFCOM consider appropriate.
(6) But if OFCOM propose to revise the guidance, and consider that the minor nature of the proposal means that consultation is unnecessary—
(a) OFCOM must notify the Secretary of State of the proposed changes, and
(b) if the Secretary of State agrees that it is appropriate, the consultation requirements set out in subsection (5) do not apply in relation to the proposed changes.
(7) OFCOM must keep the guidance under review.
(8) OFCOM must publish the guidance (and any revised or replacement guidance).
(1) A provider of a regulated service must notify OFCOM in relation to a charging year which is—
(a) the first fee-paying year in relation to that provider, or
(b) any charging year after the first fee-paying year where—
(i) the previous charging year was not a fee-paying year in relation to the provider, and the charging year in question is a fee-paying year in relation to the provider, or
(ii) the previous charging year was a fee-paying year in relation to the provider, and the charging year in question is not a fee-paying year in relation to the provider.
(2) A “fee-paying year”, in relation to a provider, means a charging year where both of the following conditions apply—
(a) the provider’s qualifying worldwide revenue for the qualifying period that relates to that charging year is equal to or greater than the threshold figure that has effect for that charging year (see section 86), and
(b) the provider is not exempt (see subsection (6)).
(3) A notification under subsection (1) in relation to a charging year must include details of all regulated services provided by the provider, and where it is a notification under subsection (1)(a) or (b)(i), it must also include—
(a) details of the provider’s qualifying worldwide revenue for the qualifying period that relates to that charging year, and
(b) supporting evidence, documents or other information as required by regulations made by OFCOM under section 85.
(4) Section 85 confers power on OFCOM to make regulations about the determination of a provider’s qualifying worldwide revenue, and the meaning of “qualifying period”, for the purposes of this Part.
(5) A notification under subsection (1) must be provided to OFCOM—
(a) in relation to the initial charging year, within four months of the date on which the first regulations under section 86 come into force (first threshold figure);
(b) in relation to subsequent charging years, at least six months before the beginning of the charging year to which the notification relates.
(6) OFCOM may provide that particular descriptions of providers of regulated services are exempt for the purposes of this section and section 84 where—
(a) OFCOM consider that an exemption for such providers is appropriate, and
(b) the Secretary of State approves the exemption.
(7) OFCOM may revoke such an exemption where they consider that it is no longer appropriate and the Secretary of State approves the revocation.
(8) Exemptions, or revocations of exemptions, which are approved by the Secretary of State are to take effect from the beginning of a particular charging year.
(9) Details of an exemption or revocation must be published by OFCOM at least six months before the beginning of the first charging year for which the exemption or revocation is to have effect.
(10) But subsection (9) does not apply in relation to any exemptions which are to have effect for the initial charging year.
(11) For the purposes of this section and section 84, the “provider” of a regulated service, in relation to a charging year, includes a person who is the provider of the service for part of that year.
(1) OFCOM may require a provider of a regulated service to pay a fee in respect of a charging year which is a fee-paying year.
(2) Where OFCOM require a provider of a regulated service to pay a fee in respect of a charging year, the fee is to be equal to the amount produced by a computation—
(a) made by reference to—
(i) the provider’s qualifying worldwide revenue for the qualifying period relating to that charging year, and
(ii) any other factors that OFCOM consider appropriate, and
(b) made in the manner that OFCOM consider appropriate.
(3) For the purposes of this section and section 83—
(a) the amount of a provider’s qualifying worldwide revenue for a qualifying period, or
(b) the amount of a fee to be paid to OFCOM, or of an instalment of such a fee,
is, in the event of a disagreement between the provider and OFCOM, the amount determined by OFCOM.
(4) When determining fees payable under this section, OFCOM must do so in accordance with a statement of principles as mentioned in section 88(1).
(5) Where a person is the provider of a regulated service for part of a charging year only, OFCOM may refund all or part of a fee paid to OFCOM under this section by that provider in respect of that year.
(6) In this section, “fee-paying year” has the same meaning as in section 83.
85 Regulations by OFCOM about qualifying worldwide revenue etc
(1) For the purposes of this Part, OFCOM may by regulations make provision—
(a) about how the qualifying worldwide revenue of a provider of a regulated service is to be determined, and
(b) defining the “qualifying period” in relation to a charging year.
(2) OFCOM may by regulations also make provision specifying or describing evidence, documents or other information that providers must supply to OFCOM for the purposes of section 83 (see subsection (3)(b) of that section), including provision about the way in which providers must supply the evidence, documents or information.
(3) Regulations under subsection (1)(a) may provide that the qualifying worldwide revenue of a provider of a regulated service (P) who is a member of a group during any part of a qualifying period is to include the qualifying worldwide revenue of any entity that—
(a) is a group undertaking in relation to P for all or part of that period, and
(b) receives or is due to receive, during that period, any amount referable (to any degree) to a regulated service provided by P.
(4) Regulations under subsection (1)(a) may, in particular—
(a) make provision about circumstances in which amounts do, or do not, count as being referable (to any degree) to a regulated service for the purposes of the determination of the qualifying worldwide revenue of the provider of the service or of an entity that is a group undertaking in relation to the provider;
(b) provide for cases or circumstances in which amounts that—
(i) are of a kind specified or described in the regulations, and
(ii) are not referable to a regulated service,
are to be brought into account in determining the qualifying worldwide revenue of the provider of the service or of an entity that is a group undertaking in relation to the provider.
(5) Regulations which make provision of a kind mentioned in subsection (3) may include provision that, in the case of an entity that is a group undertaking in relation to a provider for part (not all) of a qualifying period, only amounts relating to the part of the qualifying period for which the entity was a group undertaking may be brought into account in determining the entity’s qualifying worldwide revenue.
(6) Regulations under subsection (1)(a) may make provision corresponding to paragraph 5(8) of Schedule 13.
(7) Before making regulations under subsection (1) OFCOM must consult—
(a) the Secretary of State,
(b) the Treasury, and
(c) such other persons as OFCOM consider appropriate.
(8) Before making regulations under subsection (2) OFCOM must consult the Secretary of State.
(9) Regulations under this section may make provision subject to such exemptions and exceptions as OFCOM consider appropriate.
(10) In this section—
“group” means a parent undertaking and its subsidiary undertakings, reading those terms in accordance with section 1162 of the Companies Act 2006;
“group undertaking” has the meaning given by section 1161(5) of that Act.
(1) OFCOM must carry out a consultation to inform the setting of the threshold figure for the purposes of sections 83 and 84, consulting such persons as they consider appropriate.
(2) After the completion of the consultation, and having taken advice from OFCOM, the Secretary of State must make regulations specifying the threshold figure for those purposes.
(3) The Secretary of State must keep the threshold figure under review.
(4) If the Secretary of State considers that it may be appropriate to revise the threshold figure, the Secretary of State may request OFCOM to carry out a further consultation, and subsections (1) and (2) apply again.
(5) Regulations must provide that a threshold figure is to take effect from the beginning of a particular charging year.
(6) Regulations specifying a threshold figure must be in force at least nine months before the beginning of the first charging year for which that figure is to have effect.
(7) But subsection (6) does not apply in relation to the first regulations made under this section.
(1) The Secretary of State must issue guidance to OFCOM about the principles to be included in a statement of principles that OFCOM propose to apply in determining fees payable under section 84 (see section 88).
(2) The Secretary of State must consult OFCOM before issuing, revising or replacing the guidance.
(3) The guidance may not be revised or replaced more frequently than once every three years unless—
(a) the guidance needs to be corrected because of an amendment, repeal or modification of any provision of this Part, or
(b) the revision or replacement is by agreement between the Secretary of State and OFCOM.
(4) The Secretary of State must lay the guidance (including revised or replacement guidance) before Parliament.
(5) The Secretary of State must publish the guidance (and any revised or replacement guidance).
(6) In exercising any functions under this Part, OFCOM must have regard to the guidance for the time being published under this section.
(1) OFCOM may not require a provider of a regulated service to pay a fee under section 84 unless there is in force a statement of the principles that OFCOM propose to apply in determining fees payable under that section.
(2) Those principles must be such as appear to OFCOM to be likely to secure, on the basis of such estimates of the likely costs as it is practicable for them to make—
(a) that on a year by year basis, the aggregate amount of the fees payable to OFCOM under section 84 is sufficient to meet, but does not exceed, the annual cost to OFCOM of the exercise of their online safety functions;
(b) that the fees required under section 84 are justifiable and proportionate having regard to the functions in respect of which they are imposed;
(c) that the relationship between meeting the cost of the exercise of those functions and the amounts of the fees is transparent.
(3) A statement of principles mentioned in subsection (1) must (among other things)—
(a) include details relating to the computation model used to calculate fees payable under section 84, including details of factors mentioned in subsection (2)(a)(ii) of that section (if any),
(b) include details about the meaning of “qualifying worldwide revenue” and “qualifying period” for the purposes of this Part, and
(c) specify the threshold figure contained in regulations under section 86.
(4) Before making or revising such a statement of principles, OFCOM must consult such persons as they consider appropriate.
(5) Such a statement of principles may make different provision in relation to different kinds of regulated services.
(6) OFCOM must publish such a statement of principles (and any revised or replacement statement).
(7) As soon as reasonably practicable after the end of each charging year, OFCOM must publish a statement setting out, in respect of that year—
(a) the aggregate amount of the fees payable under section 84 for that year that has been received by OFCOM,
(b) the aggregate amount of the fees payable under that section for that year that remains outstanding and is likely to be paid or recovered, and
(c) the cost to OFCOM of the exercise of their online safety functions.
(8) Any deficit or surplus shown (after applying this subsection for all previous years) by a statement under subsection (7) must be carried forward and taken into account in determining what is required to satisfy the requirement imposed by virtue of subsection (2)(a) in relation to the following year.
(9) For the purposes of this section OFCOM’s costs of the exercise of their online safety functions during a charging year include the costs of preparations for the exercise of their online safety functions incurred during that year.
Schedule 10 makes provision about fees chargeable to providers of regulated services in connection with OFCOM’s recovery of costs incurred before the first day of the initial charging year.
90 Meaning of “charging year” and “initial charging year”
In this Part—
“charging year” means any period of 12 months beginning with 1 April, except such a period that falls before the initial charging year;
“initial charging year” means the period of 12 months beginning with 1 April specified by OFCOM in a notice published for the purposes of this Part.
91 General duties of OFCOM under section 3 of the Communications Act
(1) Section 3 of the Communications Act (general duties of OFCOM) is amended in accordance with subsections (2) to (8).
(2) In subsection (2), after paragraph (f) insert—
(g) the adequate protection of citizens from harm presented by content on regulated services, through the appropriate use by providers of such services of systems and processes designed to reduce the risk of such harm.
(3) In subsection (4)(c), at the beginning insert “(subject to subsection (5A))”.
(4) After subsection (4) insert—
(4A) In performing their duties under subsection (1) in relation to matters to which subsection (2)(g) is relevant, OFCOM must have regard to such of the following as appear to them to be relevant in the circumstances—
(a) the risk of harm to citizens presented by regulated services;
(b) the need for a higher level of protection for children than for adults;
(c) the need for it to be clear to providers of regulated services how they may comply with their duties set out in Chapter 2, 3, 4 or 5 of Part 3, Chapter 1, 3 or 4 of Part 4, or Part 5 of the Online Safety Act 2023;
(d) the need to exercise their functions so as to secure that providers of regulated services may comply with such duties by taking measures, or using measures, systems or processes, which are (where relevant) proportionate to—
(i) the size or capacity of the provider in question, and
(ii) the level of risk of harm presented by the service in question, and the severity of the potential harm;
(e) the desirability of promoting the use by providers of regulated services of technologies which are designed to reduce the risk of harm to citizens presented by content on regulated services;
(f) the extent to which providers of regulated services demonstrate, in a way that is transparent and accountable, that they are complying with their duties set out in Chapter 2, 3, 4 or 5 of Part 3, Chapter 1, 3 or 4 of Part 4, or Part 5 of the Online Safety Act 2023.
(5) After subsection (5) insert—
(5A) Subsection (4)(c) does not apply in relation to the carrying out of any of OFCOM’s online safety functions.
(6) After subsection (6) insert—
(6ZA) Where it appears to OFCOM, in relation to the carrying out of any of their online safety functions, that any of their general duties conflict with their duty under section 24, priority must be given to their duty under that section.
(7) In subsection (14), at the appropriate places insert—
“content on regulated services” means—
regulated user-generated content present on regulated services,
search content of regulated services,
fraudulent advertisements present on regulated services, and
regulated provider pornographic content present on regulated services;
;
“online safety functions” has the meaning given by section 235 of the Online Safety Act 2023, except that it does not include OFCOM’s general duties;
.
(8) After subsection (14) insert—
(15) In this section the following terms have the same meaning as in the Online Safety Act 2023—
“content” (see section 236 of that Act);
“fraudulent advertisement” (see sections 38 and 39 of that Act);
“harm” (see section 234 of that Act);
“provider”, in relation to a regulated service (see section 226 of that Act);
“regulated user-generated content” (see section 55 of that Act);
“regulated provider pornographic content” (see section 79 of that Act);
“regulated service” (see section 4 of that Act);
“search content” (see section 57 of that Act).
(9) In section 6 of the Communications Act (duties to review regulatory burdens)—
(a) in subsection (2), after “this section” insert “(except their online safety functions)”, and
(b) after subsection (10) insert—
(11) In this section “online safety functions” has the same meaning as in section 3.
(1) This section applies where a statement has been designated under section 172(1) (Secretary of State’s statement of strategic priorities).
(2) OFCOM must have regard to the statement when carrying out their online safety functions.
(3) Within the period of 40 days beginning with the day on which the statement is designated, or such longer period as the Secretary of State may allow, OFCOM must—
(a) explain in writing what they propose to do in consequence of the statement, and
(b) publish a copy of that explanation.
(4) OFCOM must, as soon as reasonably practicable after the end of—
(a) the period of 12 months beginning with the day on which the first statement is designated under section 172(1), and
(b) every subsequent period of 12 months,
publish a review of what they have done during the period in question in consequence of the statement.
(1) Section 7 of the Communications Act (duty to carry out impact assessments) is amended as follows.
(2) In subsection (2), at the beginning insert “Subject to subsection (2A),”.
(3) After subsection (2) insert—
(2A) A proposal to do any of the following is important for the purposes of this section—
(a) to prepare a code of practice under section 41 of the Online Safety Act 2023;
(b) to prepare amendments of such a code of practice; or
(c) to prepare a code of practice as a replacement for such a code of practice.
(4) After subsection (4) insert—
(4A) An assessment under subsection (3)(a) that relates to a proposal mentioned in subsection (2A) must include an assessment of the likely impact of implementing the proposal on small businesses and micro businesses.
(4B) An assessment under subsection (3)(a) that relates to a proposal to do anything else for the purposes of, or in connection with, the carrying out of OFCOM’s online safety functions (within the meaning of section 235 of the Online Safety Act 2023) must, so far as the proposal relates to such functions, include an assessment of the likely impact of implementing the proposal on small businesses and micro businesses.
(1) Schedule 11 contains provision about regulations specifying the threshold conditions that a Part 3 service must meet to be included in the relevant part of the register established by OFCOM under section 95, and associated provision about the publication of OFCOM’s advice.
(2) In this Chapter, “Category 1 threshold conditions”, “Category 2A threshold conditions” and “Category 2B threshold conditions” have the same meaning as in Schedule 11 (see paragraph 1(1), (2) and (3) of that Schedule).
(3) For the purposes of this Chapter—
(a) references to a service meeting the Category 1, Category 2A or Category 2B threshold conditions are to a service meeting those conditions in a way specified in regulations under paragraph 1 of Schedule 11 (see paragraph 1(4) of that Schedule);
(b) a regulated user-to-user service meets the Category 1 threshold conditions if those conditions are met in relation to the user-to-user part of the service;
(c) a regulated search service or a combined service meets the Category 2A threshold conditions if those conditions are met in relation to the search engine of the service;
(d) a regulated user-to-user service meets the Category 2B threshold conditions if those conditions are met in relation to the user-to-user part of the service;
(e) a regulated user-to-user service meets the conditions in section 97(2) if those conditions are met in relation to the user-to-user part of the service;
(f) references to OFCOM assessing a service (to determine if it meets, or no longer meets, the relevant threshold conditions or the conditions in section 97(2)) are accordingly to be read as references to OFCOM assessing the relevant part (or parts) of a service.
95 Register of categories of certain Part 3 services
(1) As soon as reasonably practicable after the first regulations under Schedule 11 come into force, OFCOM must comply with subsections (2) to (4).
(2) OFCOM must establish a register of particular categories of Part 3 services with—
(a) one part for regulated user-to-user services meeting the Category 1 threshold conditions,
(b) one part for regulated search services and combined services meeting the Category 2A threshold conditions, and
(c) one part for regulated user-to-user services meeting the Category 2B threshold conditions.
(3) OFCOM must assess Part 3 services, as follows—
(a) OFCOM must assess each regulated user-to-user service which they consider is likely to meet the Category 1 threshold conditions, to determine whether the service does, or does not, meet those conditions;
(b) OFCOM must assess each regulated search service and combined service which they consider is likely to meet the Category 2A threshold conditions, to determine whether the service does, or does not, meet those conditions;
(c) OFCOM must assess each regulated user-to-user service which they consider is likely to meet the Category 2B threshold conditions, to determine whether the service does, or does not, meet those conditions.
(4) If OFCOM consider that a service meets the relevant threshold conditions, they must add entries relating to that service to the relevant part of the register established under subsection (2).
(5) But—
(a) if OFCOM consider that a regulated user-to-user service meets the Category 1 threshold conditions and the Category 2B threshold conditions (only), entries relating to that service are to be added to the part of the register established under subsection (2)(a) (only);
(b) if OFCOM consider that a combined service meets the Category 1 threshold conditions, the Category 2A threshold conditions and the Category 2B threshold conditions, entries relating to that service are to be added to the parts of the register established under subsection (2)(a) and (b) (only).
(6) If OFCOM consider that a combined service—
(a) meets the Category 2A threshold conditions, and
(b) meets either the Category 1 threshold conditions or the Category 2B threshold conditions (but not both),
entries relating to that service are to be added to the part of the register established under subsection (2)(b) and to the part of the register established under subsection (2)(a) or (c) (whichever applies).
(7) Each part of the register must contain—
(a) the name, and a description, of each service that, in OFCOM’s opinion, meets the relevant threshold conditions, and
(b) the name of the provider of each such service.
(8) OFCOM must publish the register.
(9) When assessing whether a Part 3 service does, or does not, meet the relevant threshold conditions, OFCOM must take such steps as are reasonably practicable to obtain or generate information or evidence for the purposes of the assessment.
(10) In this Act—
(a) a “Category 1 service” means a regulated user-to-user service for the time being included in the part of the register established under subsection (2)(a);
(b) a “Category 2A service” means a regulated search service or a combined service for the time being included in the part of the register established under subsection (2)(b);
(c) a “Category 2B service” means a regulated user-to-user service for the time being included in the part of the register established under subsection (2)(c).
(1) If regulations are made under paragraph 1(1) of Schedule 11 which amend or replace regulations previously made under that provision, OFCOM must, as soon as reasonably practicable after the date on which the amending or replacement regulations come into force—
(a) assess each regulated user-to-user service which they consider is likely to meet the new Category 1 threshold conditions, to determine whether the service does, or does not, meet those conditions, and
(b) make any necessary changes to the register.
(2) If regulations are made under paragraph 1(2) of Schedule 11 which amend or replace regulations previously made under that provision, OFCOM must, as soon as reasonably practicable after the date on which the amending or replacement regulations come into force—
(a) assess each regulated search service and combined service which they consider is likely to meet the new Category 2A threshold conditions, to determine whether the service does, or does not, meet those conditions, and
(b) make any necessary changes to the register.
(3) If regulations are made under paragraph 1(3) of Schedule 11 which amend or replace regulations previously made under that provision, OFCOM must, as soon as reasonably practicable after the date on which the amending or replacement regulations come into force—
(a) assess each regulated user-to-user service which they consider is likely to meet the new Category 2B threshold conditions, to determine whether the service does, or does not, meet those conditions, and
(b) make any necessary changes to the register.
(4) At any other time, if OFCOM consider that a Part 3 service not included in a particular part of the register is likely to meet the threshold conditions relevant to that part, OFCOM must—
(a) assess the service accordingly, and
(b) (subject to section 95(5)) if they consider that the service meets the relevant conditions, add entries relating to that service to that part of the register.
(5) Nothing in subsection (3) or (4) requires OFCOM to assess a Category 1 service to determine whether the service meets the Category 2B threshold conditions.
(6) A provider of a Part 3 service included in the register may at any time request OFCOM to remove entries relating to that service from the register, or from a particular part of the register.
(7) If OFCOM are satisfied, on the basis of evidence submitted by a provider with such a request, that since the registration day there has been a change to the service or to regulations under paragraph 1 of Schedule 11 which appears likely to be relevant, OFCOM must—
(a) assess the service, and
(b) notify the provider of OFCOM’s decision.
(8) OFCOM must remove entries relating to a Part 3 service from the relevant part of the register if, following an assessment of the service, they consider that it no longer meets the threshold conditions relevant to that part.
(9) Section 95(9) applies to an assessment under this section as it applies to an assessment under section 95.
(10) OFCOM must re-publish the register each time a change is made to it.
(11) See section 167 for provision about appeals against a decision to include a service in the register (or in a particular part of the register), or not to remove a service from the register (or from a particular part of the register).
(12) In this section—
“the register” means the register established under section 95;
“the registration day”, in relation to a Part 3 service, means—
the day on which entries relating to the service were added to the register, or to the particular part of the register in question, or
if later, the day on which OFCOM last completed an assessment of the service under subsection (1), (2), (3) or (7).
(1) As soon as reasonably practicable after the first regulations under paragraph 1(1) of Schedule 11 come into force (regulations specifying Category 1 threshold conditions), OFCOM must comply with subsections (2) and (3).
(2) OFCOM must assess each regulated user-to-user service which does not meet the Category 1 threshold conditions and which they consider is likely to meet each of the following conditions, to determine whether the service does, or does not, meet them—
(a) the first condition is that the number of United Kingdom users of the user-to-user part of the service is at least 75% of the figure specified in any of the Category 1 threshold conditions relating to number of users (calculating the number of users in accordance with the threshold condition in question);
(b) the second condition is that—
(i) at least one of the Category 1 threshold conditions relating to functionalities of the user-to-user part of the service is met, or
(ii) if the regulations under paragraph 1(1) of Schedule 11 specify that a Category 1 threshold condition relating to a functionality of the user-to-user part of the service must be met in combination with a Category 1 threshold condition relating to another characteristic of that part of the service or a factor relating to that part of the service (see paragraph 1(4) of Schedule 11), at least one of those combinations of conditions is met.
(3) OFCOM must prepare a list of regulated user-to-user services which meet the conditions in subsection (2).
(4) If the regulations under paragraph 1(1) of Schedule 11 specify that a service meets the Category 1 threshold conditions if any one condition about number of users or functionality is met (as mentioned in paragraph 1(4)(a) of that Schedule)—
(a) subsection (2) applies as if paragraph (b) were omitted, and
(b) subsections (3) and (8) apply as if the reference to the conditions in subsection (2) were to the condition in subsection (2)(a).
(5) The list must contain the following details about a service included in it—
(a) the name of the service,
(b) a description of the service,
(c) the name of the provider of the service, and
(d) a description of the Category 1 threshold conditions by reference to which the conditions in subsection (2) are met.
(6) OFCOM must take appropriate steps to keep the list up to date, including by carrying out further assessments of regulated user-to-user services.
(7) OFCOM must publish the list when it is first prepared and each time it is revised.
(8) When assessing whether a service does, or does not, meet the conditions in subsection (2), OFCOM must take such steps as are reasonably practicable to obtain or generate information or evidence for the purposes of the assessment.
(9) An assessment for the purposes of this section may be included in an assessment under section 95 or 96 (as the case may be) or carried out separately.
98 OFCOM’s register of risks, and risk profiles, of Part 3 services
(1) OFCOM must carry out risk assessments to identify and assess the following risks of harm presented by Part 3 services of different kinds—
(a) the risks of harm to individuals in the United Kingdom presented by illegal content present on regulated user-to-user services and by the use of such services for the commission or facilitation of priority offences;
(b) the risk of harm to individuals in the United Kingdom presented by search content of regulated search services that is illegal content;
(c) the risk of harm to children in the United Kingdom, in different age groups, presented by content that is harmful to children.
(2) The risk assessments must, among other things, identify characteristics of different kinds of Part 3 services that are relevant to such risks of harm, and assess the impact of those kinds of characteristics on such risks.
(3) OFCOM—
(a) may combine assessment of any or all of the risks of harm mentioned in subsection (1), or may carry out separate assessments of those risks;
(b) in the case of the risk of harm mentioned in subsection (1)(c), may assess regulated user-to-user services and regulated search services separately or together.
(4) The findings of each risk assessment are to be reflected, as soon as reasonably practicable after completion, in a register of risks of Part 3 services prepared and published by OFCOM.
(5) As soon as reasonably practicable after completing their assessment of a risk of harm mentioned in a particular paragraph of subsection (1), OFCOM must prepare risk profiles for Part 3 services which relate to that risk of harm.
(6) For the purposes of the risk profiles, OFCOM may group Part 3 services together in whichever way they consider appropriate, taking into account—
(a) the characteristics of the services, and
(b) the risk levels and other matters identified in the relevant risk assessment.
(7) OFCOM must publish risk profiles prepared under this section.
(8) OFCOM must from time to time review and revise the risk assessments and risk profiles so as to keep them up to date.
(9) References in this section to Part 3 services—
(a) in the case of a risk assessment or risk profiles which relate only to regulated user-to-user services or to regulated search services, are to be read as references to the kind of service in question;
(b) in the case of a risk assessment or risk profiles which relate only to the risk of harm mentioned in subsection (1)(a), are to be read as references to regulated user-to-user services;
(c) in the case of a risk assessment or risk profiles which relate only to the risk of harm mentioned in subsection (1)(b), are to be read as references to regulated search services.
(10) References in this section to regulated search services include references to the search engine of combined services.
(11) In this section the “characteristics” of a service include its functionalities, user base, business model, governance and other systems and processes.
(12) In this section—
“content that is harmful to children” has the same meaning as in Part 3 (see section 60);
“illegal content” has the same meaning as in Part 3 (see section 59);
“priority offence” has the same meaning as in Part 3 (see section 59).
(1) As soon as reasonably practicable after OFCOM have published the first risk profiles relating to the illegality risks, OFCOM must produce guidance to assist providers of regulated user-to-user services in complying with their duties to carry out illegal content risk assessments under section 9.
(2) As soon as reasonably practicable after OFCOM have published the first risk profiles relating to the risk of harm from illegal content, OFCOM must produce guidance to assist providers of regulated search services in complying with their duties to carry out illegal content risk assessments under section 26.
(3) As soon as reasonably practicable after OFCOM have published the first risk profiles relating to the risk of harm to children, OFCOM must produce guidance to assist providers of Part 3 services in complying with their duties to carry out children’s risk assessments under section 11 or 28.
(4) Before producing any guidance under this section (including revised or replacement guidance), OFCOM must consult the Information Commission.
(5) OFCOM must revise guidance under this section from time to time in response to further risk assessments under section 98 or to revisions of the risk profiles.
(6) OFCOM must publish guidance under this section (and any revised or replacement guidance).
(7) If the risk profiles mentioned in subsection (3) relate to regulated user-to-user services only or to regulated search services only, that subsection is to be read as requiring the production of guidance relating only to regulated user-to-user services or to regulated search services, as the case may be.
(8) References in this section to regulated search services include references to the search engine of combined services.
(9) In this section—
“illegality risks” means the risks mentioned in section 98(1)(a);
“risk of harm from illegal content” means the risk of harm mentioned in section 98(1)(b);
“risk of harm to children” means the risk of harm mentioned in section 98(1)(c);
“risk profiles” means risk profiles prepared under section 98.
(1) OFCOM may by notice under this subsection require a person within subsection (5) to provide them with any information that they require for the purpose of exercising, or deciding whether to exercise, any of their online safety functions.
(2) The power conferred by subsection (1) includes power to require a person within subsection (5) to—
(a) obtain or generate information;
(b) provide information about the use of a service by a named individual.
(3) The power conferred by subsection (1) also includes power to require a person within any of paragraphs (a) to (d) of subsection (5) to take steps so that a person authorised by OFCOM is able to view remotely—
(a) information demonstrating in real time the operation of systems, processes or features, including functionalities and algorithms, used by a service;
(b) information generated by a service in real time by the performance of a test or demonstration of a kind required by a notice under subsection (1).
(4) But the power conferred by subsection (1) must be exercised in a way that is proportionate to the use to which the information is to be put in the exercise of OFCOM’s functions.
(5) The persons within this subsection are—
(a) a provider of a user-to-user service or a search service,
(b) a provider of an internet service on which regulated provider pornographic content is published or displayed,
(c) a person who provides an ancillary service (within the meaning of section 144) in relation to a regulated service (see subsections (11) and (12) of that section),
(d) a person who provides an access facility (within the meaning of section 146) in relation to a regulated service (see subsections (10) and (11) of that section),
(e) a person who was within any of paragraphs (a) to (d) at a time to which the required information relates, and
(f) a person not within any of paragraphs (a) to (e) who appears to OFCOM to have, or to be able to generate or obtain, information required by them as mentioned in subsection (1).
(6) The information that may be required by OFCOM under subsection (1) includes, in particular, information that they require for any one or more of the following purposes—
(a) the purpose of assessing compliance with—
(i) any duty or requirement set out in Chapter 2, 3, 4 or 5 of Part 3,
(ii) any duty set out in section 64 (user identity verification),
(iii) any requirement under section 66 (reporting CSEA content),
(iv) any duty set out in section 71 or 72 (terms of service),
(v) any duty set out in section 75 (deceased child users),
(vi) any requirement relating to transparency reporting (see section 77(3) and (4)), or
(vii) any duty set out in section 81 (provider pornographic content);
(b) the purpose of assessing compliance with a requirement under section 83 (duty to notify OFCOM in relation to the charging of fees);
(c) the purpose of a consultation about a threshold figure as mentioned in section 86 (threshold figure for the purposes of charging fees);
(d) the purpose of ascertaining the amount of a person’s qualifying worldwide revenue for the purposes of—
(i) Part 6 (fees), or
(ii) paragraph 4 or 5 of Schedule 13 (amount of penalties etc);
(e) the purpose of assessing compliance with any requirements imposed on a person by—
(i) a notice under section 121(1) (notices to deal with terrorism content and CSEA content), or
(ii) a confirmation decision;
(f) the purpose of assessing the accuracy and effectiveness of technology required to be used by—
(i) a notice under section 121(1), or
(ii) a confirmation decision;
(g) the purpose of assessing whether to give a notice under section 121(1) relating to the development or sourcing of technology (see subsections (2)(b) and (3)(b) of that section);
(h) the purpose of dealing with complaints made to OFCOM under section 169 (super-complaints);
(i) the purpose of OFCOM’s advice to the Secretary of State about provision to be made by regulations under paragraph 1 of Schedule 11 (threshold conditions for categories of Part 3 services);
(j) the purpose of determining whether a Part 3 service meets threshold conditions specified in regulations under paragraph 1 of Schedule 11;
(k) the purpose of preparing a code of practice under section 41;
(l) the purpose of preparing guidance in relation to online safety matters;
(m) the purpose of carrying out research, or preparing a report, in relation to online safety matters;
(n) the purpose of complying with OFCOM’s duties under section 11 of the Communications Act, so far as relating to regulated services (media literacy).
(7) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(8) The reference in subsection (3) to a person authorised by OFCOM is to a person authorised by OFCOM in writing for the purposes of notices that impose requirements of a kind mentioned in that subsection, and such a person must produce evidence of their identity if requested to do so by a person in receipt of such a notice.
(8A) The power to give a notice conferred by subsection (1) does not include power to require processing of personal data that would contravene the data protection legislation (but in determining whether processing of personal data would do so, the duty imposed by the notice is to be taken into account).
(9) The power conferred by subsection (1) does not include power to require the provision of information in respect of which a claim to legal professional privilege, or (in Scotland) to confidentiality of communications, could be maintained in legal proceedings.
(10) In this section—
“information” includes documents, and any reference to providing information includes a reference to producing a document (and see also section 102(11));
“regulated provider pornographic content” and “published or displayed” have the same meaning as in Part 5 (see section 79).
101 Information in connection with an investigation into the death of a child
(A1) Subsection (C1) applies if a senior coroner (in England and Wales), a procurator fiscal (in Scotland) or a coroner (in Northern Ireland) (“the investigating authority”)—
(a) notifies OFCOM that they are conducting an investigation in connection with the death of a child, and
(b) provides OFCOM with the details in subsection (B1).
(B1) The details are—
(a) the name of the child who has died,
(b) the child’s date of birth,
(c) any email addresses used by the child (so far as the investigating authority knows), and
(d) if any regulated service has been brought to the attention of the investigating authority as being of interest in connection with the child’s death, the name of the service.
(C1) Where this subsection applies, OFCOM—
(a) must give a notice to the provider of a service within subsection (E1) requiring the provider to ensure the retention of information relating to the use of the service by the child who has died, and
(b) may give a notice to any other relevant person requiring the person to ensure the retention of information relating to the use of a service within subsection (E1) by that child.
(D1) The references in subsection (C1) to ensuring the retention of information relating to the child’s use of a service include taking all reasonable steps, without delay, to prevent the deletion of such information by the routine operation of systems or processes.
(E1) A service is within this subsection if it is—
(a) a regulated service of a kind described in regulations made by the Secretary of State, or
(b) a regulated service notified to OFCOM by the investigating authority as described in subsection (B1)(d).
(F1) A notice under subsection (C1) may require information described in that subsection to be retained only if it is information—
(a) of a kind which OFCOM have power to require under a notice under subsection (1) (see, in particular, subsection (2)(a) to (d)), or
(b) which a person might need to retain to enable the person to provide information in response to a notice under subsection (1) (if such a notice were given).
(G1) OFCOM must share with the investigating authority any information they receive in response to requirements mentioned in section 102(5A)(d) that are included in a notice under subsection (C1).
(H1) Regulations under subsection (E1)(a) may make provision by reference to a document as amended from time to time.
(1) OFCOM may by notice under this subsection require a relevant person to provide them with information for the purpose of—
(a) responding to a notice given by a senior coroner under paragraph 1(2) of Schedule 5 to the Coroners and Justice Act 2009 in connection with an investigation into the death of a child, or preparing a report under section 163 in connection with such an investigation;
(b) responding to a request for information in connection with the investigation of a procurator fiscal into, or an inquiry held or to be held in relation to, the death of a child, or preparing a report under section 163 in connection with such an inquiry;
(c) responding to a notice given by a coroner under section 17A(2) of the Coroners Act (Northern Ireland) 1959 (c. 15 (N.I.)) in connection with—
(i) an investigation to determine whether an inquest into the death of a child is necessary, or
(ii) an inquest in relation to the death of a child,
or preparing a report under section 163 in connection with such an investigation or inquest.
(2) The power conferred by subsection (1) includes power to require a relevant person to provide OFCOM with information about the use of a regulated service by the child whose death is under investigation, including, in particular—
(a) content encountered by the child by means of the service,
(b) how the content came to be encountered by the child (including the role of algorithms or particular functionalities),
(c) how the child interacted with the content (for example, by viewing, sharing or storing it or enlarging or pausing on it), and
(d) content generated, uploaded or shared by the child.
(3) The powers conferred by this section include power to require a relevant person to obtain or generate information.
(4) The power conferred by subsection (1) must be exercised in a way that is proportionate to the purpose mentioned in that subsection.
(5) The power conferred by subsection (1) does not include power to require the provision of information in respect of which a claim to legal professional privilege, or (in Scotland) to confidentiality of communications, could be maintained in legal proceedings.
(5A) The powers to give a notice conferred by this section do not include power to require processing of personal data that would contravene the data protection legislation (but in determining whether processing of personal data would do so, the duty imposed by the notice is to be taken into account).
(6) Nothing in this section limits the power conferred on OFCOM by section 100.
(7) In this section—
“information” includes documents, and any reference to providing information includes a reference to producing a document (and see also section 102(11));
“inquiry” means an inquiry held, or to be held, under the Inquiries into Fatal Accidents and Sudden Deaths etc. (Scotland) Act 2016 (asp 2);
“relevant person” means a person within any of paragraphs (a) to (e) of section 100(5).
(1) A notice given under section 100(1) or 101(C1) or (1) is referred to in this Act as an information notice.
(2) An information notice may require information in any form (including in electronic form).
(3) An information notice under section 100(1) or 101(1) must—
(a) specify or describe the information to be provided,
(b) specify why OFCOM require the information,
(c) specify the form and manner in which it must be provided, ...
(ca) specify when the information must be provided (which may be on or by a specified date, within a specified period, or at specified intervals), and
(d) contain information about the consequences of not complying with the notice.
(4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(5) An information notice requiring a person to take steps of a kind mentioned in section 100(3) must give the person at least seven days’ notice before the steps are required to be taken.
(5A) An information notice under section 101(C1) must—
(a) specify or describe the information to be retained,
(b) specify why OFCOM require the information to be retained,
(c) require the information to be retained for the period of one year beginning with the date of the notice,
(d) require the person to whom the notice is given—
(i) if the child to whom the notice relates used the service in question, to notify OFCOM by a specified date of steps taken to ensure the retention of information;
(ii) if the child did not use the service, or the person does not hold any information of the kind required, to notify OFCOM of that fact by a specified date, and
(e) contain information about the consequences of not complying with the notice.
(5B) If OFCOM give an information notice to a person under section 101(C1), they may, in response to information received from the investigating authority, extend the period for which the person is required to retain information by a maximum period of six months.
(5C) The power conferred by subsection (5B) is exercisable—
(a) by giving the person a notice varying the notice under section 101(C1) and stating the further period for which information must be retained and the reason for the extension;
(b) any number of times.
(6) An information notice may specify a place at which, and a person to whom, information is to be provided.
(7) A person to whom a document is produced in response to an information notice may—
(a) take copies of, or extracts from, the document;
(b) require the person producing the document, or a person who is or was an officer of that person, or (in the case of a partnership) a person who is or was a partner, to give an explanation of it.
(8) A person to whom an information notice is given has a duty—
(a) to act in accordance with the requirements of the notice, and
(b) to ensure that the information provided is accurate in all material respects.
(9) OFCOM may cancel an information notice by notice to the person to whom it was given.
(9A) OFCOM must cancel an information notice under section 101(C1) by notice to the person to whom it was given if advised by the investigating authority that the information in question no longer needs to be retained.
(10) In this section—
“information” includes documents, and any reference to providing information includes a reference to producing a document;
“the investigating authority” has the same meaning as in section 101;
“officer”, in relation to an entity, includes a director, a manager, an associate, a secretary or, where the affairs of the entity are managed by its members, a member.
(11) In relation to information recorded otherwise than in a legible form, references in this section to producing a document are to producing a copy of the information—
(a) in a legible form, or
(b) in a form from which it can readily be produced in a legible form.
(1) This section applies where—
(a) OFCOM give a provider of a regulated service an information notice, and
(b) the provider is an entity.
(2) OFCOM may include in the information notice a requirement that the provider must name, in their response to the notice, an individual who the provider considers to be a senior manager of the entity and who may reasonably be expected to be in a position to ensure compliance with the requirements of the notice.
(3) If OFCOM impose a requirement to name an individual, the information notice must—
(a) require the provider to inform such an individual, and
(b) include information about the consequences for such an individual of the entity’s failure to comply with the requirements of the notice (see section 110).
(4) An individual is a “senior manager” of an entity if the individual plays a significant role in—
(a) the making of decisions about how the entity’s relevant activities are to be managed or organised, or
(b) the actual managing or organising of the entity’s relevant activities.
(5) An entity’s “relevant activities” are activities relating to the entity’s compliance with the regulatory requirements imposed by this Act in connection with the regulated service to which the information notice in question relates.
(1) OFCOM may exercise the powers in this section where they consider that it is necessary to do so for either of the following purposes—
(a) assisting OFCOM in identifying and assessing a failure, or possible failure, by a provider of a regulated service to comply with a relevant requirement, or
(b) developing OFCOM’s understanding of—
(i) the nature and level of risk of a provider of a regulated service failing to comply with a relevant requirement, and
(ii) ways to mitigate such a risk.
(2) But the powers in this section may be exercised for a purpose mentioned in subsection (1)(b) only where OFCOM consider that the provider in question may be at risk of failing to comply with a relevant requirement.
(3) Section 122 requires OFCOM to exercise the power in subsection (4) for the purpose of assisting OFCOM in connection with a notice under section 121(1).
(4) OFCOM may appoint a skilled person to provide them with a report about matters relevant to the purpose for which the powers under this section are exercised (“the relevant matters”), and, where OFCOM make such an appointment, they must notify the provider about the appointment and the relevant matters to be explored in the report.
(5) Alternatively, OFCOM may give a notice to the provider—
(a) requiring the provider to appoint a skilled person to provide OFCOM with a report in such form as may be specified in the notice, and
(b) specifying the relevant matters to be explored in the report.
(6) References in this section to a skilled person are to a person—
(a) appearing to OFCOM to have the skills necessary to prepare a report about the relevant matters, and
(b) where the appointment is to be made by the provider, nominated or approved by OFCOM.
(7) It is the duty of—
(a) the provider of the service (“P”),
(b) any person who works for (or used to work for) P, or is providing (or used to provide) services to P related to the relevant matters, and
(c) other providers of internet services,
to give the skilled person all such assistance as the skilled person may reasonably require to prepare the report.
(8) The provider of the service is liable for the payment, directly to the skilled person, of the skilled person’s remuneration and expenses relating to the preparation of the report.
(9) Subsections (10) to (12) apply in relation to an amount due to a skilled person under subsection (8).
(10) In England and Wales, such an amount is recoverable—
(a) if the county court so orders, as if it were payable under an order of that court;
(b) if the High Court so orders, as if it were payable under an order of that court.
(11) In Scotland, such an amount may be enforced in the same manner as an extract registered decree arbitral bearing a warrant for execution issued by the sheriff court of any sheriffdom in Scotland.
(12) In Northern Ireland, such an amount is recoverable—
(a) if a county court so orders, as if it were payable under an order of that court;
(b) if the High Court so orders, as if it were payable under an order of that court.
(13) In this section “relevant requirement” means—
(a) a duty or requirement set out in any of the following—
(i) section 9, 11, 26 or 28 (risk assessments);
(ii) section 10 or 27 (illegal content);
(iii) section 12 or 29 (children’s online safety);
(iv) section 14 (assessments related to the adult user empowerment duty set out in section 15(2));
(v) section 15 (user empowerment);
(vi) section 20 or 31 (content reporting);
(vii) section 21 or 32 (complaints procedures);
(viii) section 23 or 34 (record-keeping and review);
(ix) section 36 (children’s access assessments);
(x) section 38 or 39 (fraudulent advertising);
(xi) section 64 (user identity verification);
(xii) section 66 (reporting CSEA content);
(xiii) section 71 or 72 (terms of service);
(xiv) section 75 (deceased child users);
(xv) section 77(3) or (4) (transparency reports);
(xvi) section 81(2) (children’s access to pornographic content);
(b) a requirement under section 83 to notify OFCOM in connection with the charging of fees (see subsections (1), (3) and (5) of that section); or
(c) a requirement imposed by a notice under section 121(1) (notices to deal with terrorism content and CSEA content).
(1) If OFCOM open an investigation into whether a provider of a regulated service has failed, or is failing, to comply with any requirement mentioned in subsection (2), the provider must co-operate fully with the investigation.
(2) The requirements are—
(a) a requirement imposed by a notice under section 121(1) (notices to deal with terrorism content and CSEA content), and
(b) an enforceable requirement as defined in section 131 (except the requirement in subsection (1) of this section).
(1) The power conferred by this section is exercisable by OFCOM for the purposes of an investigation that they are carrying out into the failure, or possible failure, of a provider of a regulated service to comply with a relevant requirement.
(2) OFCOM may give an individual within subsection (4) a notice requiring the individual—
(a) to attend at a time and place specified in the notice, and
(b) to answer questions and provide explanations about any matter relevant to the investigation.
(3) A notice under this section must—
(a) indicate the subject matter and purpose of the interview, and
(b) contain information about the consequences of not complying with the notice.
(4) The individuals within this subsection are—
(a) if the provider of the service is an individual or individuals, that individual or those individuals,
(b) an officer of the provider of the service,
(c) if the provider of the service is a partnership, a partner,
(d) an employee of the provider of the service, and
(e) an individual who was within any of paragraphs (a) to (d) at a time to which the required information or explanation relates.
(5) If OFCOM give a notice to an individual within subsection (4)(b), (c) or (d), they must give a copy of the notice to the provider of the service.
(6) An individual is not required under this section to disclose information in respect of which a claim to legal professional privilege, or (in Scotland) to confidentiality of communications, could be maintained in legal proceedings.
(7) In this section—
“officer”, in relation to an entity, includes a director, a manager, an associate, a secretary or, where the affairs of the entity are managed by its members, a member;
“relevant requirement” has the meaning given by section 104(13).
108 Amendment of Criminal Justice and Police Act 2001
(1) The Criminal Justice and Police Act 2001 is amended as follows.
(2) In section 57(1) (retention of seized items), after paragraph (t) insert—
(u) paragraph 8 of Schedule 12 to the Online Safety Act 2023.
(3) In section 65 (meaning of “legal privilege”)—
(a) after subsection (8B) insert—
(8C) An item which is, or is comprised in, property which has been seized in exercise or purported exercise of the power of seizure conferred by paragraph 7(f), (j) or (k) of Schedule 12 to the Online Safety Act 2023 is to be taken for the purposes of this Part to be an item subject to legal privilege if, and only if, the seizure of that item was in contravention of paragraph 17(3) of that Schedule (privileged information or documents).
;
(b) in subsection (9)—
(i) at the end of paragraph (d) omit “or”;
(ii) at the end of paragraph (e) insert “or”;
(iii) before the closing words insert—
(g) paragraph 7(f), (j) or (k) of Schedule 12 to the Online Safety Act 2023.
(4) In Part 1 of Schedule 1 (powers of seizure to which section 50 of the Act applies), after paragraph 73U insert—
Online Safety Act 2023
73V Each of the powers of seizure conferred by paragraph 7(f), (j) and (k) of Schedule 12 to the Online Safety Act 2023.
109 Offences in connection with information notices
(1) A person commits an offence if the person fails to comply with a requirement of an information notice.
(2) It is a defence for a person charged with an offence under subsection (1) to show that—
(a) it was not reasonably practicable to comply with the requirements of the information notice at the time required by the notice, but
(b) the person has subsequently taken all of the steps that it was reasonable, and reasonably practicable, to take to comply with those requirements.
(3) A person commits an offence if, in response to an information notice—
(a) the person provides information that is false in a material respect, and
(b) at the time the person provides it, the person knows that it is false in a material respect or is reckless as to whether it is false in a material respect.
(4) A person commits an offence if, in response to an information notice, the person—
(a) provides information which is encrypted such that it is not possible for OFCOM to understand it, or produces a document which is encrypted such that it is not possible for OFCOM to understand the information it contains, and
(b) the person’s intention was to prevent OFCOM from understanding such information.
(5) A person commits an offence if—
(a) the person suppresses, destroys or alters, or causes or permits the suppression, destruction or alteration of, any information required to be provided, or document required to be produced, by an information notice, and
(b) the person’s intention was to prevent OFCOM from being provided with the information or document or (as the case may be) from being provided with it as it was before the alteration.
(6A) A person who is given an information notice under section 101(C1) commits an offence if—
(a) the person deletes or alters, or causes or permits the deletion or alteration of, any information required by the notice to be retained, and
(b) the person’s intention was to prevent the information being available, or (as the case may be) to prevent it being available in unaltered form, for the purposes of any official investigation into the death of the child to whom the notice relates.
(6B) For the purposes of subsection (6A) information has been deleted if it is irrecoverable (however that occurred).
(6) The reference in subsection (5) to suppressing information or a document includes a reference to destroying the means of reproducing information recorded otherwise than in a legible form.
(7) Offences under this section may be committed only in relation to an information notice which—
(a) relates to—
(i) a user-to-user service,
(ii) a search service, or
(iii) an internet service on which regulated provider pornographic content is published or displayed; and
(b) is given to the provider of that service.
(8) If a person is convicted of an offence under this section, the court may, on an application by the prosecutor, make an order requiring the person to comply with a requirement of an information notice within such period as may be specified by the order.
(9) See also section 201 (supplementary provision about defences).
(10) In this section, “regulated provider pornographic content” and “published or displayed” have the same meaning as in Part 5 (see section 79).
110 Senior managers’ liability: information offences
(1) In this section “an individual named as a senior manager of an entity” means an individual who, as required by an information notice, is named as a senior manager of an entity in a response to that notice (see section 103).
(2) An individual named as a senior manager of an entity commits an offence if—
(a) the entity commits an offence under section 109(1) (failure to comply with information notice), and
(b) the individual has failed to take all reasonable steps to prevent that offence being committed.
(3) It is a defence for an individual charged with an offence under subsection (2) to show that the individual was a senior manager within the meaning of section 103 for such a short time after the information notice in question was given that the individual could not reasonably have been expected to take steps to prevent that offence being committed.
(4) An individual named as a senior manager of an entity commits an offence if—
(a) the entity commits an offence under section 109(3) (false information), and
(b) the individual has failed to take all reasonable steps to prevent that offence being committed.
(5) An individual named as a senior manager of an entity commits an offence if—
(a) the entity commits an offence under section 109(4) (encrypted information), and
(b) the individual has failed to take all reasonable steps to prevent that offence being committed.
(6) An individual named as a senior manager of an entity commits an offence if—
(a) the entity commits an offence under section 109(5) (destruction etc of information), and
(b) the individual has failed to take all reasonable steps to prevent that offence being committed.
(6A) An individual named as a senior manager of an entity commits an offence if—
(a) the entity commits an offence under section 109(6A) (deletion etc of information), and
(b) the individual has failed to take all reasonable steps to prevent that offence being committed.
(7) It is a defence for an individual charged with an offence under subsection (4), (5) , (6) or (6A) to show that the individual was not a senior manager within the meaning of section 103 at the time at which the act constituting the offence occurred.
(8) It is a defence for an individual charged with an offence under this section to show that the individual had no knowledge of being named as a senior manager in a response to the information notice in question.
(9) See also section 201 (supplementary provision about defences).
111 Offences in connection with notices under Schedule 12
(1) A person commits an offence if the person fails without reasonable excuse to comply with a requirement of an audit notice.
(2) A person commits an offence if, in response to an audit notice—
(a) the person provides information that is false in a material respect, and
(b) at the time the person provides it, the person knows that it is false in a material respect or is reckless as to whether it is false in a material respect.
(3) A person commits an offence if—
(a) the person suppresses, destroys or alters, or causes or permits the suppression, destruction or alteration of, any information required to be provided, or document required to be produced, by a notice to which this subsection applies, and
(b) the person’s intention was to prevent OFCOM from being provided with the information or document or (as the case may be) from being provided with it as it was before the alteration.
(4) The reference in subsection (3) to suppressing information or a document includes a reference to destroying the means of reproducing information recorded otherwise than in a legible form.
(5) Subsection (3) applies to—
(a) a notice under paragraph 3 of Schedule 12 (information required for inspection), and
(b) an audit notice (see paragraph 4 of that Schedule).
(6) If a person is convicted of an offence under this section, the court may, on an application by the prosecutor, make an order requiring the person, within such period as may be specified by the order, to comply with a requirement of a notice under paragraph 3 of Schedule 12 or an audit notice (as the case may be).
(1) A person commits an offence if the person intentionally obstructs or delays a person in the exercise of the power conferred by section 102(7)(a) (copying a document etc).
(2) A person commits an offence if the person fails without reasonable excuse to comply with a requirement under section 106 (interviews).
(3) A person commits an offence if, in purported compliance with a requirement under section 106—
(a) the person provides information that is false in a material respect, and
(b) at the time the person provides it, the person knows that it is false in a material respect or is reckless as to whether it is false in a material respect.
(4) If a person is convicted of an offence under this section, the court may, on an application by the prosecutor, make an order requiring the person, within such period as may be specified by the order, to permit the making of a copy of a document, or to comply with a requirement under section 106 (as the case may be).
(1) A person who commits an offence under section 109(1), 110(2) or 111(1) is liable—
(a) on summary conviction in England and Wales, to a fine;
(b) on summary conviction in Scotland or Northern Ireland, to a fine not exceeding the statutory maximum;
(c) on conviction on indictment, to a fine.
(2) A person who commits an offence under section 109(3), (4), (5) or (6A), 110(4), (5), (6) or (6A), 111(2) or (3) or 112(1) is liable—
(a) on summary conviction in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court or a fine (or both);
(b) on summary conviction in Scotland, to imprisonment for a term not exceeding 12 months or a fine not exceeding the statutory maximum (or both);
(c) on summary conviction in Northern Ireland, to imprisonment for a term not exceeding 6 months or a fine not exceeding the statutory maximum (or both);
(d) on conviction on indictment, to imprisonment for a term not exceeding 2 years or a fine (or both).
(3) A person who commits an offence under section 112(2) or (3) is liable—
(a) on summary conviction in England and Wales, to a fine;
(b) on summary conviction in Scotland, to a fine not exceeding level 5 on the standard scale;
(c) on summary conviction in Northern Ireland, to a fine not exceeding level 5 on the standard scale.
114 Co-operation and disclosure of information: overseas regulators
(1) OFCOM may co-operate with an overseas regulator, including by disclosing online safety information to that regulator, for the purposes of—
(a) facilitating the exercise by the overseas regulator of any of that regulator’s online regulatory functions, or
(b) criminal investigations or proceedings relating to a matter to which the overseas regulator’s online regulatory functions relate.
(2) The power conferred by subsection (1) applies only in relation to an overseas regulator for the time being specified in regulations made by the Secretary of State.
(3) Where information is disclosed to a person in reliance on subsection (1), the person may not—
(a) use the information for a purpose other than the purpose for which it was disclosed, or
(b) further disclose the information,
except with OFCOM’s consent (which may be general or specific) or in accordance with an order of a court or tribunal.
(4) Except as provided by subsection (5), a disclosure of information under subsection (1) does not breach—
(a) any obligation of confidence owed by the person making the disclosure, or
(b) any other restriction on the disclosure of information (however imposed).
(5) Subsection (1) does not authorise a disclosure of information that—
(a) would contravene the restriction imposed by section 116 (intelligence service information),
(b) would contravene the data protection legislation (but in determining whether a disclosure would do so, the power conferred by that subsection is to be taken into account), or
(c) is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.
(6) Section 18 of the Anti-terrorism, Crime and Security Act 2001 (restriction on disclosure of information for overseas purposes) has effect in relation to a disclosure authorised by subsection (1)(b) as it has effect in relation to a disclosure authorised by any of the provisions to which section 17 of that Act applies.
(7) In this section—
“online regulatory functions”, in relation to an overseas regulator, means functions of that regulator which correspond to OFCOM’s online safety functions;
“online safety information” means information held by OFCOM in connection with any of OFCOM’s online safety functions;
“overseas regulator” means a person exercising functions in a country outside the United Kingdom which correspond to any of OFCOM’s online safety functions;
...
(1) Section 393 of the Communications Act (general restrictions on disclosure of information) is amended as follows.
(2) In subsection (1)—
(a) at the end of paragraph (c) omit “or”,
(b) at the end of paragraph (d) insert “or”, and
(c) after paragraph (d) insert—
(e) the Online Safety Act 2023,
.
(3) In subsection (2)(e), after “this Act” insert “or the Online Safety Act 2023”.
(4) In subsection (3), after paragraph (h) insert—
(ha) a person appointed under—
(i) paragraph 1 of Schedule 3 to the Coroners and Justice Act 2009, or
(ii) section 2 of the Coroners Act (Northern Ireland) 1959 (c. 15 (N.I.));
(hb) the procurator fiscal, within the meaning of the enactment mentioned in subsection (5)(s);
.
(5) In subsection (5)—
(a) before paragraph (d) insert—
(ca) the Coroners Act (Northern Ireland) 1959;
,
(b) after paragraph (na) insert—
(nb) Part 1 of the Coroners and Justice Act 2009;
, and
(c) after paragraph (r) insert—
(s) the Inquiries into Fatal Accidents and Sudden Deaths etc. (Scotland) Act 2016 (asp 2).
(6) In subsection (6)(a), after “390” insert “, or under section 149 of or Schedule 11 to the Online Safety Act 2023”.
(7) In subsection (6)(b), at the end insert “or the Online Safety Act 2023”.
(1) OFCOM may not disclose information received (directly or indirectly) from, or that relates to, an intelligence service unless the intelligence service consents to the disclosure.
(2) If OFCOM have disclosed information described in subsection (1) to a person, the person must not further disclose the information unless the intelligence service consents to the disclosure.
(3) If OFCOM would contravene subsection (1) by publishing in its entirety—
(a) a statement required to be published by section 47(5), or
(b) a report mentioned in section 164(5),
OFCOM must, before publication, remove or obscure the information which by reason of subsection (1) they must not disclose.
(4) In this section—
“information” means information held by OFCOM in connection with an online safety matter;
“intelligence service” means—
the Security Service,
the Secret Intelligence Service, or
the Government Communications Headquarters.
117 Provision of information to the Secretary of State
(1) Section 24B of the Communications Act (provision of information to assist in formulation of policy) is amended as follows.
(2) In subsection (2)—
(a) at the end of paragraph (d) omit “or”,
(b) at the end of paragraph (e) insert “or”, and
(c) after paragraph (e) insert—
(f) the Online Safety Act 2023,
.
(3) After subsection (3) insert—
(4) Subsection (2) does not apply to information—
(a) obtained by OFCOM—
(i) in the exercise of a power conferred by section 100 of the Online Safety Act 2023 for the purpose mentioned in subsection (6)(c) of that section (information in connection with a consultation about a threshold figure for the purposes of charging fees under that Act), or
(ii) in the exercise of a power conferred by section 175(5) of that Act (information in connection with circumstances presenting a threat), and
(b) reasonably required by the Secretary of State.
In Schedule 15 to the Enterprise Act 2002 (enactments relevant to provisions about disclosure of information), at the appropriate place insert—
Online Safety Act 2023.
(1) Section 26 of the Communications Act (publication of information and advice for consumers etc) is amended as follows.
(2) In subsection (2), after paragraph (d) insert—
(da) United Kingdom users of regulated services;
.
(3) After subsection (6) insert—
(7) In this section the following terms have the same meaning as in the Online Safety Act 2023—
“regulated service” (see section 4 of that Act);
“United Kingdom user” (see section 227 of that Act).