Online Safety Act 2023

49 Relationship between duties and codes of practice

Duties set out in Chapters 2 and 3

(1) A provider of a Part 3 service is to be treated as complying with a relevant duty if the provider takes or uses the measures described in a code of practice which are recommended for the purpose of compliance with the duty in question.

(2) A provider of a user-to-user service—

(a) is to be treated as complying with the duty set out in section 22(2) (freedom of expression) if the provider takes or uses such of the relevant recommended measures as incorporate safeguards to protect users’ right to freedom of expression within the law;

(b) is to be treated as complying with the duty set out in section 22(3) (privacy) if the provider takes or uses such of the relevant recommended measures as incorporate safeguards to protect the privacy of users.

(3) A provider of a search service—

(a) is to be treated as complying with the duty set out in section 33(2) (freedom of expression) if the provider takes or uses such of the relevant recommended measures as incorporate safeguards to protect the rights of users and interested persons to freedom of expression within the law;

(b) is to be treated as complying with the duty set out in section 33(3) (privacy) if the provider takes or uses such of the relevant recommended measures as incorporate safeguards to protect the privacy of users.

Duties set out in Chapter 5

(4) A provider of a Category 1 service or a Category 2A service (or a provider of a service which is both a Category 1 service and a Category 2A service) is to be treated as complying with a duty set out in Chapter 5 if the provider takes or uses the measures described in a fraudulent advertising code of practice which are recommended for the purpose of compliance with the duty in question.

Alternative measures

(5) A provider of a Part 3 service who seeks to comply with a relevant duty by acting otherwise than by taking or using a measure described in a code of practice or a fraudulent advertising code of practice which is recommended for the purpose of compliance with the duty must have particular regard to the importance of the following (where relevant)—

(a) protecting the right of users and (in the case of search services) interested persons to freedom of expression within the law, and

(b) protecting the privacy of users.

(6) When assessing whether a provider of a Part 3 service is compliant with a relevant duty where the provider has acted otherwise than by taking or using a measure described in a code of practice or a fraudulent advertising code of practice which is recommended for the purpose of compliance with the duty, OFCOM must consider the extent to which the alternative measures taken or in use by the provider—

(a) extend across all areas of a service as mentioned in section 10(4), 12(8), 27(4) or 29(4) (if relevant to the duty in question), and

(b) (where appropriate) incorporate safeguards for the protection of the matters mentioned in subsection (5)(a) and (b).

Interpretation

(7) In subsections (1) to (4), references to taking or using measures recommended for the purpose of compliance with a duty, or to taking or using relevant recommended measures, are to taking or using such of those measures as are relevant to the provider and the service in question.

(8) In this section—

(a) references to protecting the privacy of users are to protecting users from a breach of any statutory provision or rule of law concerning privacy that is relevant to the use or operation of a user-to-user service or search service (including, but not limited to, any such provision or rule concerning the processing of personal data);

(b) references to a search service include references to a combined service (see section 7(6)).

(9) In this section—

• “Chapter 2 safety duty” means a duty set out in—

  (a)

  section 10 (illegal content), or

  (b)

  section 12 (children’s online safety);

• “Chapter 3 safety duty” means a duty set out in—

  (a)

  section 27 (illegal content), or

  (b)

  section 29 (children’s online safety);

• “code of practice” means a code of practice published under section 46, except a fraudulent advertising code of practice;

• “fraudulent advertising code of practice” means a code of practice prepared under section 41(4) and published under section 46;

• “relevant duty” means—

  (a)

  a Chapter 2 safety duty,

  (b)

  a Chapter 3 safety duty,

  (c)

  a duty set out in section 15 (user empowerment),

  (d)

  a duty set out in section 17 (content of democratic importance),

  (e)

  a duty set out in section 19 (journalistic content),

  (f)

  a duty set out in section 20 or 31 (content reporting), or

  (g)

  a duty set out in section 21 or 32 (complaints procedures);

• “relevant recommended measures” means the measures described in a code of practice which are recommended for the purpose of compliance with—

  (a)

  in the case of a user-to-user service—

  (i)

  a Chapter 2 safety duty, or

  (ii)

  a duty set out in section 15 (user empowerment);

  (b)

  in the case of a search service, a Chapter 3 safety duty.