Online Safety Act 2023

CHAPTER 5 Regulated user-to-user services and regulated search services: notices to deal with terrorism content and CSEA content

121 Notices to deal with terrorism content or CSEA content (or both)

(1) If OFCOM consider that it is necessary and proportionate to do so, they may give a notice described in subsection (2), (3) or (4) relating to a regulated user-to-user service or a regulated search service to the provider of the service.

(2) A notice under subsection (1) that relates to a regulated user-to-user service is a notice requiring the provider of the service—

(a) to do any or all of the following—

(i) use accredited technology to identify terrorism content communicated publicly by means of the service and to swiftly take down that content;

(ii) use accredited technology to prevent individuals from encountering terrorism content communicated publicly by means of the service;

(iii) use accredited technology to identify CSEA content, whether communicated publicly or privately by means of the service, and to swiftly take down that content;

(iv) use accredited technology to prevent individuals from encountering CSEA content, whether communicated publicly or privately, by means of the service; or

(b) to use the provider’s best endeavours to develop or source technology for use on or in relation to the service or part of the service, which—

(i) achieves the purpose mentioned in paragraph (a)(iii) or (iv), and

(ii) meets the standards published by the Secretary of State (see section 125(13)).

(3) A notice under subsection (1) that relates to a regulated search service is a notice requiring the provider of the service—

(a) to do either or both of the following—

(i) use accredited technology to identify search content of the service that is terrorism content and to swiftly take measures designed to secure, so far as possible, that search content of the service no longer includes terrorism content identified by the technology;

(ii) use accredited technology to identify search content of the service that is CSEA content and to swiftly take measures designed to secure, so far as possible, that search content of the service no longer includes CSEA content identified by the technology; or

(b) to use the provider’s best endeavours to develop or source technology for use on or in relation to the service which—

(i) achieves the purpose mentioned in paragraph (a)(ii), and

(ii) meets the standards published by the Secretary of State (see section 125(13)).

(4) A notice under subsection (1) that relates to a combined service is a notice requiring the provider of the service—

(a) to do any or all of the things described in subsection (2)(a) in relation to the user-to-user part of the service, or to use best endeavours to develop or source technology as described in subsection (2)(b) for use on or in relation to that part of the service;

(b) to do either or both of the things described in subsection (3)(a) in relation to the search engine of the service, or to use best endeavours to develop or source technology as described in subsection (3)(b) for use on or in relation to the search engine of the service;

(c) to do any or all of the things described in subsection (2)(a) in relation to the user-to-user part of the service and either or both of the things described in subsection (3)(a) in relation to the search engine of the service; or

(d) to use best endeavours to develop or source—

(i) technology as described in subsection (2)(b) for use on or in relation to the user-to-user part of the service, and

(ii) technology as described in subsection (3)(b) for use on or in relation to the search engine of the service.

(5) For the purposes of subsections (2) and (3), a requirement to use accredited technology may be complied with by the use of the technology alone or by means of the technology together with the use of human moderators.

(6) See—

(a) section 122, which requires OFCOM to obtain a skilled person’s report before giving a notice under subsection (1),

(b) section 123, which requires OFCOM to give a warning notice before giving a notice under subsection (1), and

(c) section 124 for provision about matters which OFCOM must consider before giving a notice under subsection (1).

(7) A notice under subsection (1) that relates to a user-to-user service (or to the user-to-user part of a combined service) and requires the use of technology in relation to terrorism content must identify the content, or parts of the service that include content, that OFCOM consider is communicated publicly on that service (see section 232).

(8) For the meaning of “accredited” technology, see section 125(12) and (13).

122 Requirement to obtain skilled person’s report

(1) OFCOM may give a notice under section 121(1) to a provider only after obtaining a report from a skilled person appointed by OFCOM under section 104(4).

(2) The purpose of the report is to assist OFCOM in deciding whether to give a notice under section 121(1), and to advise about the requirements that might be imposed by such a notice if it were to be given.

123 Warning notices

(1) OFCOM may give a notice under section 121(1) to a provider relating to a service or part of a service only after giving a warning notice to the provider that they intend to give such a notice relating to that service or that part of it.

(2) A warning notice under subsection (1) relating to the use of accredited technology (see section 121(2)(a) and (3)(a)) must—

(a) contain a summary of the report obtained by OFCOM under section 122,

(b) contain details of the technology that OFCOM are considering requiring the provider to use,

(c) specify whether the technology is to be required in relation to terrorism content or CSEA content (or both),

(d) specify any other requirements that OFCOM are considering imposing (see section 125(2) to (4)),

(e) specify the period for which OFCOM are considering imposing the requirements (see section 125(7)),

(f) state that the provider may make representations to OFCOM (with any supporting evidence), and

(g) specify the period within which representations may be made.

(3) A warning notice under subsection (1) relating to the development or sourcing of technology (see section 121(2)(b)and (3)(b)) must—

(a) contain a summary of the report obtained by OFCOM under section 122,

(b) describe the proposed purpose for which the technology must be developed or sourced (see section 121(2)(a)(iii) and (iv) and (3)(a)(ii)),

(c) specify steps that OFCOM consider the provider needs to take in order to comply with the requirement described in section 121(2)(b) or (3)(b), or both those requirements (as the case may be),

(d) specify the proposed period within which the provider must take each of those steps,

(e) specify any other requirements that OFCOM are considering imposing,

(f) state that the provider may make representations to OFCOM (with any supporting evidence), and

(g) specify the period within which representations may be made.

(4) A notice under section 121(1) that relates to both the user-to-user part of a combined service and the search engine of the service (as described in section 121(4)(c) or (d)) may be given to the provider of the service only if—

(a) two separate warning notices have been given to the provider (one relating to the user-to-user part of the service and the other relating to the search engine), or

(b) a single warning notice relating to both the user-to-user part of the service and the search engine has been given to the provider.

(5) A notice under section 121(1) may not be given to a provider until the period allowed by the warning notice for the provider to make representations has expired.

124 Matters relevant to a decision to give a notice under section 121(1)

(1) This section specifies the matters which OFCOM must particularly consider in deciding whether it is necessary and proportionate to give a notice under section 121(1) relating to a Part 3 service to the provider of the service.

(2) In the case of a notice requiring the use of accredited technology, the matters are as follows—

(a) the kind of service it is;

(b) the functionalities of the service;

(c) the user base of the service;

(d) in the case of a notice relating to a user-to-user service (or to the user-to-user part of a combined service), the prevalence of relevant content on the service, and the extent of its dissemination by means of the service;

(e) in the case of a notice relating to a search service (or to the search engine of a combined service), the prevalence of search content of the service that is relevant content;

(f) the level of risk of harm to individuals in the United Kingdom presented by relevant content, and the severity of that harm;

(g) the systems and processes used by the service which are designed to identify and remove relevant content;

(h) the contents of the skilled person’s report obtained as required by section 122;

(i) the extent to which the use of the specified technology would or might result in interference with users’ right to freedom of expression within the law;

(j) the level of risk of the use of the specified technology resulting in a breach of any statutory provision or rule of law concerning privacy that is relevant to the use or operation of the service (including, but not limited to, any such provision or rule concerning the processing of personal data);

(k) in the case of a notice relating to a user-to-user service (or to the user-to-user part of a combined service), the extent to which the use of the specified technology would or might—

(i) have an adverse impact on the availability of journalistic content on the service, or

(ii) result in a breach of the confidentiality of journalistic sources;

(l) whether the use of any less intrusive measures than the specified technology would be likely to achieve a significant reduction in the amount of relevant content.

(3) The references to relevant content in subsection (2)(f), (g) and (l) are to—

(a) in the case of a user-to-user service (or the user-to-user part of a combined service), relevant content present on the service;

(b) in the case of a search service (or the search engine of a combined service), search content of the service that is relevant content.

(4) In the case of a notice relating to the development or sourcing of technology, subsection (2) applies—

(a) as if references to relevant content were to CSEA content, and

(b) with the omission of paragraphs (i), (j), (k) and (l).

(5) In this section—

• “journalistic content” has the meaning given by section 19;

• “relevant content” means terrorism content or CSEA content or both those kinds of content (depending on the kind, or kinds, of content in relation to which the specified technology is to operate);

• “specified technology” means the technology to be specified in the notice under section 121(1).

125 Notices under section 121(1): supplementary

(1) In this section “a notice” means a notice under section 121(1) (including a further notice under that provision).

(2) If a provider is already using accredited technology in relation to the service in question, a notice may require the provider to use it more effectively (specifying the ways in which that must be done).

(3) A notice relating to a user-to-user service (or to the user-to-user part of a combined service) may also require a provider to operate an effective complaints procedure allowing for United Kingdom users to challenge the provider for taking down content which they have generated, uploaded or shared on the service.

(4) A notice relating to a search service (or to the search engine of a combined service) may also require a provider to operate an effective complaints procedure allowing for an interested person (see section 227(7)) to challenge measures taken or in use by the provider that result in content relating to that interested person no longer appearing in search results of the service.

(5) A notice given to a provider of a Part 3 service requiring the use of accredited technology is to be taken to require the provider to make such changes to the design or operation of the service as are necessary for the technology to be used effectively.

(6) A notice requiring the use of accredited technology must—

(a) give OFCOM’s reasons for their decision to give the notice,

(b) contain details of the requirements imposed by the notice,

(c) contain details of the technology to be used,

(d) contain details about the manner in which the technology is to be implemented,

(e) specify a reasonable period for compliance with the notice,

(f) specify the period for which the notice is to have effect,

(g) contain details of the rights of appeal under section 168,

(h) contain information about when OFCOM intend to review the notice (see section 126), and

(i) contain information about the consequences of not complying with the notice (including information about the further kinds of enforcement action that it would be open to OFCOM to take).

(7) A notice requiring the use of accredited technology may impose requirements for a period of up to 36 months beginning with the last day of the period specified in the notice in accordance with subsection (6)(e).

(8) A notice relating to the development or sourcing of technology must—

(a) give OFCOM’s reasons for their decision to give the notice,

(b) describe the purpose for which technology is required to be developed or sourced (see section 121(2)(a)(iii) and (iv) and (3)(a)(ii),

(c) specify steps that the provider is required to take (including steps relating to the use of a system or process) in order to comply with the requirement described in section 121(2)(b) or (3)(b), or both those requirements (as the case may be),

(d) specify a reasonable period within which each of the steps specified in the notice must be taken,

(e) contain details of any other requirements imposed by the notice,

(f) contain details of the rights of appeal under section 168,

(g) contain information about when OFCOM intend to review the notice (see section 126), and

(h) contain information about the consequences of not complying with the notice (including information about the further kinds of enforcement action that it would be open to OFCOM to take).

(9) In deciding what period or periods to specify for steps to be taken in accordance with subsection (8)(d), OFCOM must, in particular, consider—

(a) the size and capacity of the provider, and

(b) the state of development of technology capable of achieving the purpose described in the notice in accordance with subsection (8)(b).

(10) A notice may impose requirements only in relation to the design and operation of a Part 3 service—

(a) in the United Kingdom, or

(b) as it affects United Kingdom users of the service.

(11) OFCOM may vary or revoke a notice given to a provider by notifying the provider to that effect.

(12) For the purposes of this Chapter, technology is “accredited” if it is accredited (by OFCOM or another person appointed by OFCOM) as meeting minimum standards of accuracy in the detection of terrorism content or CSEA content (as the case may be).

(13) Those minimum standards of accuracy must be such standards as are for the time being approved and published by the Secretary of State, following advice from OFCOM.

126 Review and further notice under section 121(1)

(1) This section applies where OFCOM have given a provider of a Part 3 service a notice under section 121(1).

(2) The power conferred by section 125(11) includes power to revoke the notice if there are reasonable grounds for believing that the provider is failing to comply with it.

(3) If a notice is revoked as mentioned in subsection (2), OFCOM may give the provider a further notice under section 121(1) if they consider that it is necessary and proportionate to do so (taking into account the matters mentioned in section 124).

(4) Except where a notice under section 121(1) is revoked as mentioned in subsection (2), OFCOM must carry out a review of the provider’s compliance with the notice—

(a) in the case of a notice requiring the use of accredited technology, before the end of the period for which the notice has effect;

(b) in the case of a notice relating to the development or sourcing of technology, before the last date by which any step specified in the notice is required to be taken.

(5) In the case of a notice requiring the use of accredited technology, the review must consider—

(a) the extent to which the technology specified in the notice has been used, and

(b) the effectiveness of its use.

(6) Following the review, and after consultation with the provider, OFCOM may give the provider a further notice under section 121(1) if they consider that it is necessary and proportionate to do so (taking into account the matters mentioned in section 124).

(7) If a further notice under section 121(1) is given, subsections (3) to (6) apply again.

(8) A further notice under section 121(1) may impose different requirements from an earlier notice under that provision.

(9) Sections 122 (skilled person’s report) and 123 (warning notices) do not apply in relation to a further notice under section 121(1).

127 OFCOM’s guidance about functions under this Chapter

(1) OFCOM must produce guidance for providers of Part 3 services about how OFCOM propose to exercise their functions under this Chapter.

(2) Before producing the guidance (including revised or replacement guidance), OFCOM must consult the Information Commissioner.

(3) OFCOM must keep the guidance under review.

(4) OFCOM must publish the guidance (and any revised or replacement guidance).

(5) In exercising their functions under this Chapter, or deciding whether to exercise them, OFCOM must have regard to the guidance for the time being published under this section.

128 OFCOM’s annual report

(1) OFCOM must produce and publish an annual report about—

(a) the exercise of their functions under this Chapter, and

(b) technology which meets, or is in the process of development so as to meet, minimum standards of accuracy (see subsections (12) and (13) of section 125) for the purposes of this Chapter.

(2) OFCOM must send a copy of the report to the Secretary of State, and the Secretary of State must lay it before Parliament.

(3) For further provision about reports under this section, see section 164.

129 Interpretation of this Chapter

In this Chapter—

• “search content” has the same meaning as in Part 3 (see section 57);

• “search results” has the meaning given by section 57(3);

• “terrorism content” and “CSEA content” have the same meaning as in Part 3 (see section 59).