Online Safety Act 2023

Business disruption measures

144 Service restriction orders

(1) OFCOM may apply to the court for an order under this section (a “service restriction order”) in relation to a regulated service where they consider that—

(a) the grounds in subsection (3) apply in relation to the service, or

(b) in the case of a Part 3 service, the grounds in subsection (4) apply in relation to the service.

(2) A service restriction order is an order imposing requirements on one or more persons who provide an ancillary service (whether from within or outside the United Kingdom) in relation to a regulated service (see subsection (11)).

(3) The grounds mentioned in subsection (1)(a) are that—

(a) the provider of the regulated service has failed to comply with an enforceable requirement that applies in relation to the regulated service,

(b) the failure is continuing, and

(c) any of the following applies—

(i) the provider has failed to comply with a requirement imposed by a confirmation decision that is of a kind described in section 133(1) relating to the failure;

(ii) the provider has failed to pay a penalty imposed by a confirmation decision relating to the failure (and the confirmation decision did not impose any requirements of a kind described in section 133(1));

(iii) the provider would be likely to fail to comply with requirements imposed by a confirmation decision if given;

(iv) the circumstances of the failure or the risks of harm to individuals in the United Kingdom are such that it is appropriate to make the application without having given a provisional notice of contravention, without having given a confirmation decision, or (having given a confirmation decision imposing requirements) without waiting to ascertain compliance with those requirements.

(4) The grounds mentioned in subsection (1)(b) are that—

(a) the provider of the Part 3 service has failed to comply with a notice under section 121(1) that relates to the service (notices to deal with terrorism content and CSEA content), and

(b) the failure is continuing.

(5) An application by OFCOM for a service restriction order must—

(a) specify the regulated service in relation to which the application is made (“the relevant service”),

(b) specify the provider of that service (“the non-compliant provider”),

(c) specify the grounds on which the application is based, and contain evidence about those grounds,

(d) specify the persons on whom (in OFCOM’s opinion) the requirements of the order should be imposed,

(e) contain evidence as to why OFCOM consider that the persons mentioned in paragraph (d) provide an ancillary service in relation to the relevant service, and specify any such ancillary service provided,

(f) specify the requirements which OFCOM consider that the order should impose on such persons, and

(g) in the case of an application made without notice having been given to the non-compliant provider, or to the persons mentioned in paragraph (d), state why no notice has been given.

(6) The court may make a service restriction order imposing requirements on a person in relation to the relevant service if the court is satisfied—

(a) as to the grounds in subsection (3) or the grounds in subsection (4) (as the case may be),

(b) that the person provides an ancillary service in relation to the relevant service,

(c) that it is appropriate to make the order for the purpose of preventing harm to individuals in the United Kingdom, and the order is proportionate to the risk of such harm,

(d) in the case of an application made on the ground in subsection (3)(c)(iii) or (iv), that it is appropriate to make the order before a provisional notice of contravention or confirmation decision has been given, or before compliance with requirements imposed by a confirmation decision has been ascertained (as the case may be), and

(e) if no notice of the application has been given to the non-compliant provider, or to the persons on whom requirements are being imposed, that it is appropriate to make the order without notice.

(7) When considering whether to make a service restriction order in relation to the relevant service, and when considering what provision it should contain, the court must take into account (among other things) the rights and obligations of all relevant parties, including those of—

(a) the non-compliant provider,

(b) the person or persons on whom the court is considering imposing the requirements, and

(c) United Kingdom users of the relevant service.

(8) A service restriction order made in relation to the relevant service must—

(a) identify the non-compliant provider,

(b) identify the persons on whom the requirements are imposed, and any ancillary service to which the requirements relate,

(c) require such persons to take the steps specified in the order, or to put in place arrangements, that have the effect of withdrawing the ancillary service to the extent that it relates to the relevant service (or part of it), or preventing the ancillary service from promoting or displaying content that relates to the relevant service (or part of it) in any way,

(d) specify the date by which the requirements in the order must be complied with, and

(e) specify the date on which the order expires, or the period for which the order has effect.

(9) The steps that may be specified or arrangements that may be required to be put in place—

(a) include steps or arrangements that will or may require the termination of an agreement (whether or not made before the coming into force of this section), or the prohibition of the performance of such an agreement, and

(b) are limited, so far as that is possible, to steps or arrangements relating to the operation of the relevant service as it affects United Kingdom users.

(10) OFCOM must inform the Secretary of State as soon as reasonably practicable after a service restriction order has been made.

(11) For the purposes of this section, a service is an “ancillary service” in relation to a regulated service if the service facilitates the provision of the regulated service (or part of it), whether directly or indirectly, or displays or promotes content relating to the regulated service (or to part of it).

(12) Examples of ancillary services include—

(a) services, provided (directly or indirectly) in the course of a business, which enable funds to be transferred in relation to a regulated service,

(b) search engines which generate search results displaying or promoting content relating to a regulated service,

(c) user-to-user services which make content relating to a regulated service available to users, and

(d) services which use technology to facilitate the display of advertising on a regulated service (for example, an ad server or an ad network).

(13) In this section “the court” means—

(a) in England and Wales, the High Court or the county court,

(b) in Scotland, the Court of Session or a sheriff, and

(c) in Northern Ireland, the High Court or a county court.

145 Interim service restriction orders

(1) OFCOM may apply to the court for an interim order under this section (an “interim service restriction order”) in relation to a regulated service where they consider that—

(a) the grounds in subsection (3) apply in relation to the service, or

(b) in the case of a Part 3 service, the grounds in subsection (4) apply in relation to the service.

(2) An interim service restriction order is an interim order imposing requirements on one or more persons who provide an ancillary service (whether from within or outside the United Kingdom) in relation to a regulated service (see subsection (9)).

(3) The grounds mentioned in subsection (1)(a) are that—

(a) it is likely that the provider of the regulated service is failing to comply with an enforceable requirement that applies in relation to the regulated service, and

(b) the level of risk of harm to individuals in the United Kingdom relating to the likely failure, and the nature and severity of that harm, are such that it would not be appropriate to wait to establish the failure before applying for the order.

(4) The grounds mentioned in subsection (1)(b) are that—

(a) it is likely that the provider of the Part 3 service is failing to comply with a notice under section 121(1) that relates to the service (notices to deal with terrorism content and CSEA content), and

(b) the level of risk of harm to individuals in the United Kingdom relating to the likely failure, and the nature and severity of that harm, are such that it would not be appropriate to wait to establish the failure before applying for the order.

(5) An application by OFCOM for an interim service restriction order must—

(a) specify the regulated service in relation to which the application is made (“the relevant service”),

(b) specify the provider of that service (“the non-compliant provider”),

(c) specify the grounds on which the application is based, and contain evidence about those grounds,

(d) specify the persons on whom (in OFCOM’s opinion) the requirements of the order should be imposed,

(e) contain evidence as to why OFCOM consider that the persons mentioned in paragraph (d) provide an ancillary service in relation to the relevant service, and specify any such ancillary service provided,

(f) specify the requirements which OFCOM consider that the order should impose on such persons, and

(g) in the case of an application made without notice having been given to the non-compliant provider, or to the persons mentioned in paragraph (d), state why no notice has been given.

(6) The court may make an interim service restriction order imposing requirements on a person in relation to the relevant service if the court is satisfied—

(a) as to the ground in subsection (3)(a) or the ground in subsection (4)(a) (as the case may be),

(b) that the person provides an ancillary service in relation to the relevant service,

(c) that there are prima facie grounds to suggest that an application for a service restriction order under section 144 would be successful,

(d) that the level of risk of harm to individuals in the United Kingdom relating to the likely failure mentioned in subsection (3)(a) or (4)(a) (whichever applies), and the nature and severity of that harm, are such that it is not appropriate to wait for the failure to be established before making the order, and

(e) if no notice of the application has been given to the non-compliant provider, or to the persons on whom requirements are being imposed, that it is appropriate to make the order without notice.

(7) An interim service restriction order ceases to have effect on the earlier of—

(a) the date specified in the order, or the date on which the period specified in the order expires (as the case may be), and

(b) the date on which the court makes a service restriction order under section 144 in relation to the relevant service that imposes requirements on the same persons on whom requirements are imposed by the interim order, or dismisses the application for such an order.

(8) Subsections (7) to (10) of section 144 apply in relation to an interim service restriction order under this section as they apply in relation to a service restriction order under that section.

(9) In this section, “ancillary service” and “the court” have the same meaning as in section 144 (see subsections (11), (12) and (13) of that section).

146 Access restriction orders

(1) OFCOM may apply to the court for an order under this section (an “access restriction order”) in relation to a regulated service where they consider that—

(a) the grounds in section 144(3) or (4) apply in relation to the service, and

(b) either—

(i) a service restriction order under section 144 or an interim service restriction order under section 145 has been made in relation to the failure, and it was not sufficient to prevent significant harm arising to individuals in the United Kingdom as a result of the failure, or

(ii) the likely consequences of the failure are such that if a service restriction order or an interim service restriction order were to be made, it would be unlikely to be sufficient to prevent significant harm arising to individuals in the United Kingdom as a result of the failure,

and in this paragraph, “the failure” means the failure mentioned in section 144(3)(a) or (4)(a) (as the case may be).

(2) An access restriction order is an order imposing requirements on one or more persons who provide an access facility (whether from within or outside the United Kingdom) in relation to a regulated service (see subsection (10)).

(3) An application by OFCOM for an access restriction order must—

(a) specify the regulated service in relation to which the application is made (“the relevant service”),

(b) specify the provider of that service (“the non-compliant provider”),

(c) specify the grounds on which the application is based, and contain evidence about those grounds,

(d) specify the persons on whom (in OFCOM’s opinion) the requirements of the order should be imposed,

(e) contain evidence as to why OFCOM consider that the persons mentioned in paragraph (d) provide an access facility in relation to the relevant service, and specify any such access facility provided,

(f) specify the requirements which OFCOM consider that the order should impose on such persons, and

(g) in the case of an application made without notice having been given to the non-compliant provider, or to the persons mentioned in paragraph (d), state why no notice has been given.

(4) The court may make an access restriction order imposing requirements on a person in relation to the relevant service if the court is satisfied—

(a) as to the grounds in subsection (1),

(b) that the person provides an access facility in relation to the relevant service,

(c) that it is appropriate to make the order for the purpose of preventing significant harm to individuals in the United Kingdom, and the order is proportionate to the risk of such harm,

(d) in the case of an application made on the ground in subsection (3)(c)(iii) or (iv) of section 144 (by virtue of subsection (1)(a)), that it is appropriate to make the order before a provisional notice of contravention or confirmation decision has been given, or before compliance with requirements imposed by a confirmation decision has been ascertained (as the case may be), and

(e) if no notice of the application has been given to the non-compliant provider, or to the persons on whom requirements are being imposed, that it is appropriate to make the order without notice.

(5) When considering whether to make an access restriction order in relation to the relevant service, and when considering what provision it should contain, the court must take into account (among other things) the rights and obligations of all relevant parties, including those of—

(a) the non-compliant provider,

(b) the person or persons on whom the court is considering imposing the requirements, and

(c) United Kingdom users of the relevant service.

(6) An access restriction order made in relation to the relevant service must—

(a) identify the non-compliant provider,

(b) identify the persons on whom the requirements are imposed, and any access facility to which the requirements relate,

(c) require such persons to take the steps specified in the order, or to put in place arrangements, to withdraw, adapt or manipulate the access facility in order to impede users’ access (by means of that facility) to the relevant service (or to part of it),

(d) specify the date by which the requirements in the order must be complied with, and

(e) specify the date on which the order expires, or the period for which the order has effect.

(7) The steps that may be specified or arrangements that may be required to be put in place—

(a) include steps or arrangements that will or may require the termination of an agreement (whether or not made before the coming into force of this section), or the prohibition of the performance of such an agreement,

(b) are limited, so far as that is possible, to steps or arrangements that impede the access of United Kingdom users, and

(c) are limited, so far as that is possible, to steps or arrangements that do not affect such users’ ability to access any other internet services.

(8) OFCOM must inform the Secretary of State as soon as reasonably practicable after an access restriction order has been made.

(9) Where a person who provides an access facility takes steps or puts in place arrangements required by an access restriction order, OFCOM may, by notice, require that person to (where possible) notify persons in the United Kingdom who attempt to access the relevant service via that facility of the access restriction order (and where a confirmation decision has been given to the non-compliant provider, the notification must refer to that decision).

(10) For the purposes of this section, a facility is an “access facility” in relation to a regulated service if the person who provides the facility is able to withdraw, adapt or manipulate it in such a way as to impede access (by means of that facility) to the regulated service (or to part of it) by United Kingdom users of that service.

(11) Examples of access facilities include—

(a) internet access services by means of which a regulated service is made available, and

(b) app stores through which a mobile app for a regulated service may be downloaded or otherwise accessed.

(12) In this section—

• “the court” means—

  (a)

  in England and Wales, the High Court or the county court,

  (b)

  in Scotland, the Court of Session or a sheriff, and

  (c)

  in Northern Ireland, the High Court or a county court;

• “facility” means any kind of service, infrastructure or apparatus enabling users of a regulated service to access the regulated service;

• “internet access service” means a service that provides access to virtually all (or just some) of the end points of the internet.

147 Interim access restriction orders

(1) OFCOM may apply to the court for an interim order under this section (an “interim access restriction order”) in relation to a regulated service where they consider that—

(a) the grounds in section 145(3) or (4) apply in relation to the service, and

(b) either—

(i) a service restriction order under section 144 or an interim service restriction order under section 145 has been made in relation to the likely failure, and it was not sufficient to prevent significant harm arising to individuals in the United Kingdom as a result of the failure, or

(ii) the likely consequences of such a failure would be such that if a service restriction order or an interim service restriction order were to be made, it would be unlikely to be sufficient to prevent significant harm arising to individuals in the United Kingdom as a result of the failure,

and in this section, “the likely failure” means the likely failure mentioned in section 145(3)(a) or (4)(a) (as the case may be).

(2) An interim access restriction order is an interim order imposing requirements on one or more persons who provide an access facility (whether from within or outside the United Kingdom) in relation to a regulated service (see subsection (8)).

(3) An application by OFCOM for an interim access restriction order must—

(a) specify the regulated service in relation to which the application is made (“the relevant service”),

(b) specify the provider of that service (“the non-compliant provider”),

(c) specify the grounds on which the application is based, and contain evidence about those grounds,

(d) specify the persons on whom (in OFCOM’s opinion) the requirements of the order should be imposed,

(e) contain evidence as to why OFCOM consider that the persons mentioned in paragraph (d) provide an access facility in relation to the relevant service, and specify any such access facility provided,

(f) specify the requirements which OFCOM consider that the order should impose on such persons, and

(g) in the case of an application made without notice having been given to the non-compliant provider, or to the persons mentioned in paragraph (d), state why no notice has been given.

(4) The court may make an interim access restriction order imposing requirements on a person in relation to the relevant service if the court is satisfied—

(a) that the ground in section 145(3)(a) or (4)(a) (as the case may be) applies in relation to the service,

(b) as to the ground in subsection (1)(b)(i) or (ii),

(c) that the person provides an access facility in relation to the relevant service,

(d) that there are prima facie grounds to suggest that an application for an access restriction order under section 146 would be successful,

(e) that the level of risk of harm to individuals in the United Kingdom relating to the likely failure, and the nature and severity of that harm, are such that it is not appropriate to wait for the failure to be established before making the order, and

(f) if no notice of the application has been given to the non-compliant provider, or to the persons on whom requirements are being imposed, that it is appropriate to make the order without notice.

(5) An interim access restriction order ceases to have effect on the earlier of—

(a) the date specified in the order, or the date on which the period specified in the order expires (as the case may be), and

(b) the date on which the court makes an access restriction order under section 146 in relation to the relevant service that imposes requirements on the same persons on whom requirements are imposed by the interim order, or dismisses an application for such an order.

(6) Subsections (5) to (8) of section 146 apply in relation to an interim access restriction order under this section as they apply in relation to an access restriction order under that section.

(7) Where a person who provides an access facility takes steps or puts in place arrangements required by an interim access restriction order, OFCOM may, by notice, require that person to (where possible) notify persons in the United Kingdom who attempt to access the relevant service via that facility of the interim access restriction order.

(8) In this section, “access facility” and “the court” have the same meaning as in section 146 (see subsections (10), (11) and (12) of that section).

148 Interaction with other action by OFCOM

(1) Where OFCOM apply for a business disruption order in respect of a failure by a provider of a regulated service to comply with an enforceable requirement, nothing in sections 144 to 147 is to be taken to prevent OFCOM also giving the provider—

(a) a confirmation decision in respect of the failure, or

(b) a penalty notice under section 139 in relation to a confirmation decision in respect of the failure.

(2) Where OFCOM apply for a business disruption order in respect of a failure by a provider of a Part 3 service to comply with a notice under section 121(1) (notices to deal with terrorism content and CSEA content), nothing in sections 144 to 147 is to be taken to prevent OFCOM also giving the provider either or both of the following—

(a) a further notice under section 121(1) (see section 126);

(b) a penalty notice under section 140(5).

(3) In this section, a “business disruption order” means—

(a) a service restriction order under section 144,

(b) an interim service restriction order under section 145,

(c) an access restriction order under section 146, or

(d) an interim access restriction order under section 147.