Online Safety Act 2023

146 Access restriction orders

(1) OFCOM may apply to the court for an order under this section (an “access restriction order”) in relation to a regulated service where they consider that—

(a) the grounds in section 144(3) or (4) apply in relation to the service, and

(b) either—

(i) a service restriction order under section 144 or an interim service restriction order under section 145 has been made in relation to the failure, and it was not sufficient to prevent significant harm arising to individuals in the United Kingdom as a result of the failure, or

(ii) the likely consequences of the failure are such that if a service restriction order or an interim service restriction order were to be made, it would be unlikely to be sufficient to prevent significant harm arising to individuals in the United Kingdom as a result of the failure,

and in this paragraph, “the failure” means the failure mentioned in section 144(3)(a) or (4)(a) (as the case may be).

(2) An access restriction order is an order imposing requirements on one or more persons who provide an access facility (whether from within or outside the United Kingdom) in relation to a regulated service (see subsection (10)).

(3) An application by OFCOM for an access restriction order must—

(a) specify the regulated service in relation to which the application is made (“the relevant service”),

(b) specify the provider of that service (“the non-compliant provider”),

(c) specify the grounds on which the application is based, and contain evidence about those grounds,

(d) specify the persons on whom (in OFCOM’s opinion) the requirements of the order should be imposed,

(e) contain evidence as to why OFCOM consider that the persons mentioned in paragraph (d) provide an access facility in relation to the relevant service, and specify any such access facility provided,

(f) specify the requirements which OFCOM consider that the order should impose on such persons, and

(g) in the case of an application made without notice having been given to the non-compliant provider, or to the persons mentioned in paragraph (d), state why no notice has been given.

(4) The court may make an access restriction order imposing requirements on a person in relation to the relevant service if the court is satisfied—

(a) as to the grounds in subsection (1),

(b) that the person provides an access facility in relation to the relevant service,

(c) that it is appropriate to make the order for the purpose of preventing significant harm to individuals in the United Kingdom, and the order is proportionate to the risk of such harm,

(d) in the case of an application made on the ground in subsection (3)(c)(iii) or (iv) of section 144 (by virtue of subsection (1)(a)), that it is appropriate to make the order before a provisional notice of contravention or confirmation decision has been given, or before compliance with requirements imposed by a confirmation decision has been ascertained (as the case may be), and

(e) if no notice of the application has been given to the non-compliant provider, or to the persons on whom requirements are being imposed, that it is appropriate to make the order without notice.

(5) When considering whether to make an access restriction order in relation to the relevant service, and when considering what provision it should contain, the court must take into account (among other things) the rights and obligations of all relevant parties, including those of—

(a) the non-compliant provider,

(b) the person or persons on whom the court is considering imposing the requirements, and

(c) United Kingdom users of the relevant service.

(6) An access restriction order made in relation to the relevant service must—

(a) identify the non-compliant provider,

(b) identify the persons on whom the requirements are imposed, and any access facility to which the requirements relate,

(c) require such persons to take the steps specified in the order, or to put in place arrangements, to withdraw, adapt or manipulate the access facility in order to impede users’ access (by means of that facility) to the relevant service (or to part of it),

(d) specify the date by which the requirements in the order must be complied with, and

(e) specify the date on which the order expires, or the period for which the order has effect.

(7) The steps that may be specified or arrangements that may be required to be put in place—

(a) include steps or arrangements that will or may require the termination of an agreement (whether or not made before the coming into force of this section), or the prohibition of the performance of such an agreement,

(b) are limited, so far as that is possible, to steps or arrangements that impede the access of United Kingdom users, and

(c) are limited, so far as that is possible, to steps or arrangements that do not affect such users’ ability to access any other internet services.

(8) OFCOM must inform the Secretary of State as soon as reasonably practicable after an access restriction order has been made.

(9) Where a person who provides an access facility takes steps or puts in place arrangements required by an access restriction order, OFCOM may, by notice, require that person to (where possible) notify persons in the United Kingdom who attempt to access the relevant service via that facility of the access restriction order (and where a confirmation decision has been given to the non-compliant provider, the notification must refer to that decision).

(10) For the purposes of this section, a facility is an “access facility” in relation to a regulated service if the person who provides the facility is able to withdraw, adapt or manipulate it in such a way as to impede access (by means of that facility) to the regulated service (or to part of it) by United Kingdom users of that service.

(11) Examples of access facilities include—

(a) internet access services by means of which a regulated service is made available, and

(b) app stores through which a mobile app for a regulated service may be downloaded or otherwise accessed.

(12) In this section—

• “the court” means—

  (a)

  in England and Wales, the High Court or the county court,

  (b)

  in Scotland, the Court of Session or a sheriff, and

  (c)

  in Northern Ireland, the High Court or a county court;

• “facility” means any kind of service, infrastructure or apparatus enabling users of a regulated service to access the regulated service;

• “internet access service” means a service that provides access to virtually all (or just some) of the end points of the internet.