Online Safety Act 2023

136 Confirmation decisions: proactive technology

(1) This section sets out what powers OFCOM have to include in a confirmation decision a requirement to take steps to use a kind, or one of the kinds, of proactive technology specified in the decision (a “proactive technology requirement”).

(2) A proactive technology requirement may be imposed in a confirmation decision if—

(a) the decision is given to the provider of an internet service within section 80(2), and

(b) the decision is imposed for the purpose of complying with, or remedying the failure to comply with, the duty set out in section 81(2) (provider pornographic content).

(3) The following provisions of this section set out constraints on OFCOM’s power to include a proactive technology requirement in a confirmation decision in any case not within subsection (2).

(4) A proactive technology requirement may be imposed in a confirmation decision only if the decision is given to the provider of a Part 3 service.

(5) A proactive technology requirement may be imposed in a confirmation decision only for the purpose of complying with, or remedying the failure to comply with, any of the duties set out in—

(a) section 10(2) or (3) (illegal content),

(b) section 12(2) or (3) (children’s online safety),

(c) section 27(2) or (3) (illegal content),

(d) section 29(2) or (3) (children’s online safety), or

(e) section 38(1) or 39(1) (fraudulent advertising).

(6) Proactive technology may be required to be used on or in relation to any Part 3 service or any part of such a service, but if and to the extent that the technology operates (or may operate) by analysing content that is user-generated content in relation to the service, or metadata relating to such content, the technology may not be required to be used except to analyse—

(a) user-generated content communicated publicly, and

(b) metadata relating to user-generated content communicated publicly.

(7) Before imposing a proactive technology requirement in relation to a service in a confirmation decision, OFCOM must particularly consider the matters mentioned in subsection (8), so far as they are relevant.

(8) The matters are as follows—

(a) the kind of service it is;

(b) the functionalities of the service;

(c) the user base of the service;

(d) the prevalence of relevant content on the service and the extent of its dissemination by means of the service, or (as the case may be) the prevalence of search content of the service that is relevant content;

(e) the level of risk of harm to individuals in the United Kingdom presented by relevant content present on the service, or (as the case may be) search content of the service that is relevant content, and the severity of that harm;

(f) the degree of accuracy, effectiveness and lack of bias achieved by the kind of technology specified in the decision;

(g) the extent to which the use of the kind of proactive technology specified in the decision would or might result in interference with users’ right to freedom of expression within the law;

(h) the level of risk of the use of the kind of proactive technology specified in the decision resulting in a breach of any statutory provision or rule of law concerning privacy that is relevant to the use or operation of the service (including, but not limited to, any such provision or rule concerning the processing of personal data);

(i) whether the use of any less intrusive measures than the proactive technology specified in the decision would be likely to result in compliance with, or would be likely to effectively remedy the failure to comply with, the duty in question.

(9) A confirmation decision that imposes a proactive technology requirement on a provider may also impose requirements about review of the technology by the provider.

(10) A confirmation decision relating to a service which requires the use of technology of a kind mentioned in subsection (6) must identify the content, or parts of the service that include content, that OFCOM consider is communicated publicly on that service (see section 232).

(11) In this section—

• “content that is harmful to children” has the same meaning as in Part 3 (see section 60);

• “fraudulent advertisement” has the meaning given by section 38 or 39 (depending on the kind of service in question);

• “illegal content” has the same meaning as in Part 3 (see section 59);

• “relevant content” means illegal content, content that is harmful to children or content consisting of fraudulent advertisements, or any or all of those kinds of content (depending on the duties (as mentioned in subsection (5)) for the purposes of which the proactive technology requirement is imposed);

• “search content” has the same meaning as in Part 3 (see section 57);

• “user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).