Online Safety Act 2023

133 Confirmation decisions: requirements to take steps

(1) A confirmation decision may require the person to whom it is given to take such steps as OFCOM consider appropriate (including steps relating to the use of a system or process) for either or both of the following purposes—

(a) complying with a notified requirement;

(b) remedying the failure to comply with a notified requirement.

(2) But see section 136 in relation to OFCOM’s power to include in a confirmation decision requirements as described in subsection (1) relating to the use of proactive technology.

(3) A confirmation decision may impose requirements as described in subsection (1) only in relation to the design or operation of a regulated service—

(a) in the United Kingdom, or

(b) as it affects United Kingdom users of the service.

(4) A confirmation decision that includes requirements as described in subsection (1) must—

(a) specify the steps that are required,

(b) give OFCOM’s reasons for their decision to impose those requirements,

(c) specify which of those requirements (if any) have been designated as CSEA requirements (see subsections (6) and (7)),

(d) specify each notified requirement to which the steps relate,

(e) specify the period during which the failure to comply with a notified requirement has occurred, and whether the failure is continuing,

(f) specify a reasonable period within which each of the steps specified in the decision must be taken or, if a step requires the use of a system or process, a reasonable period within which the system or process must begin to be used (but see subsection (5) in relation to information duties),

(g) (if relevant) specify the period for which a system or process must be used,

(h) contain details of the rights of appeal under section 168, and

(i) contain information about the consequences of not complying with the requirements included in the decision (including information about the further kinds of enforcement action that it would be open to OFCOM to take).

(5) A confirmation decision that requires a person to take steps for the purpose of complying with an information duty may require the person to take those steps immediately.

(6) If the condition in subsection (7) is met in relation to a requirement imposed by a confirmation decision which is of a kind described in subsection (1), OFCOM must designate the requirement as a “CSEA requirement” for the purposes of section 138(3) (offence of failure to comply with confirmation decision).

(7) The condition referred to in subsection (6) is that the requirement is imposed (whether or not exclusively) in relation to either or both of the following—

(a) a failure to comply with section 10(2)(a) or (3)(a) in respect of CSEA content, or in respect of priority illegal content which includes CSEA content;

(b) a failure to comply with section 10(2)(b) in respect of an offence specified in Schedule 6 (CSEA offences), or in respect of priority offences which include such an offence.

(8) A person to whom a confirmation decision is given has a duty to comply with requirements included in the decision which are of a kind described in subsection (1).

(9) The duty under subsection (8) is enforceable in civil proceedings by OFCOM—

(a) for an injunction,

(b) for specific performance of a statutory duty under section 45 of the Court of Session Act 1988, or

(c) for any other appropriate remedy or relief.

(10) In this section—

• “CSEA content”, “priority illegal content” and “priority offence” have the same meaning as in Part 3 (see section 59);

• “information duty” means a duty set out in section 102(8);

• “notified requirement” has the meaning given by section 132.