On 19 September 2023, the UK's Online Safety Bill ("OSB") passed its final parliamentary debate and is expected to become law in mid to late October 2023. Once the OSB receives Royal Assent it will become law, with certain aspects of the OSB coming into effect immediately, but others will need to wait for secondary legislation together with Ofcom's Codes of Practice.

The first draft of the OSB was first introduced two years ago, although the idea first emerged over six years ago by way of a Green Paper commitment to online safety. Since then, we have kept readers updated on its progression, through various articles. The OSB has proved controversial and has been the subject of significant debate, both within Parliament and the media, which has explained the delay in Parliament passing the final version of the OSB. The OSB was subjected to scrutiny by many bodies, with those advocating free speech on the one hand, and NSPCC claiming that the OSB marks a "new era for children's safety online" as the OSB has a zero-tolerance approach.

Now that it has passed, Ofcom will oversee the implementation of the new regulatory regime and rely on industry engagement through a number of consultation obligations. Ofcom will be kept busy in regulating this new legislation, which will be in addition to its ongoing responsibilities. To that end it has hired an addition team of 400 civil servants to assist. It has a very broad range of responsibilities under the OSB and is required to consult widely before exercising various functions. It expects to start publishing various sets of regulatory codes and guidance for consultation immediately after the OSB is enacted.

In a public announcement, Dame Melanie Dawes, Ofcom Chief Executive, said: “Today is a major milestone in the mission to create a safer life online for children and adults in the UK. Everyone at Ofcom feels privileged to be entrusted with this important role, and we’re ready to start implementing these new laws. Very soon after the Bill receives Royal Assent, we’ll consult on the first set of standards that we’ll expect tech firms to meet in tackling illegal online harms, including child sexual exploitation, fraud, and terrorism.”

Reminder of the Framework

The proposed legal framework seeks to introduce robust new measures to protect the safety of its online users, including granting Ofcom the power to impose significant fines of up to £18m or 10% of global annual turnover, whichever is the higher, should companies fail to comply with the new rules. The OSB also introduces the possibility of personal criminal liability for ‘officers’ (i.e., directors, managers) for offences - such as a failure to comply with children’s safety duties - committed ‘with the consent or connivance’ of that officer, or where it is ‘attributable to any neglect’ of that officer.

The OSB covers a wide range of content which may cause harm, including terrorism, racism, child sexual exploitation, suicide, eating disorders, misogyny and revenge porn. The final version of the OSB has, however, reduced the obligations owed towards vulnerable adults, compared to those which featured in previous iterations. The final version of the OSB also confirms that it will end the era of self-regulation by tech companies, but many question marks still remain, especially in relation to "legal but harmful" content for adults.

The OSB imposes extensive duties of care on providers of internet services that allow users to share user-generated content (user-to-user services) and providers of search engines (search services) (together, “regulated services”).

Examples of companies in scope are as follows:

• providers of internet services which allow users to encounter content generated, uploaded or shared by other users (this is wider than the Tech giants / social media companies and will apply to all companies irrespective of their size);
• providers of search engines which enable users to search multiple websites and databases; and
• providers of internet services which publish or display pornographic content (meaning pornographic content published by a provider).

Companies will be categorised into two tiers according to the size of their online presence and the level of risk posed on the platform. Those companies falling within the scope of the regime will have a duty of care towards users of their platform with those duties taking a multi-layered approach. Many question marks remain on age verification, especially for those users under 18 and many campaigners and other interested parties have advocated for more guidance, which we expect will be introduced in the abovementioned Codes of Practice.

The OSB was initially introduced to protect UK users only to make the "UK the safest place to be online" in the world. However, the provisions on extra-territorial jurisdiction are extremely broad, which could lead to some international platforms blocking their UK users. Many have argued that this goes against the reasons why many users join the platform in the first place, i.e., to be part of a 'global community.' In its drafted form, the OSB will also apply to providers of regulated services which are based outside the UK if it impacts users based in the UK.

What can we expect next?

There is currently no date scheduled for Royal Assent, but once the OSB becomes law, it will be known as the Online Safety Act. Once the OSB receives Royal Assent, Ofcom's powers in respect of regulating and enforcing it will commence.

In June 2023, Ofcom updated its roadmap, providing further insight into how it plans to regulate online safety. Ofcom has confirmed that it will publish various consultations on guidance and codes of practice once the OSB has passed. Ofcom envisages a phased approach to consultations around the codes of practice and guidance, with the following focus:

• Phase one: Illegal harms duties;
• Phase two: Child safety and pornography duties; and
• Phase three: transparency, user empowerment, and other duties on categorised platforms.

The road map indicates that Ofcom will commence with Phase 1 within 100 days of Royal Assent, with Phase 2 and 3 to follow thereafter. However, owing to earlier Parliamentary delays in June 2023, Ofcom announced that it now hopes to be able do this more quickly, with the publication of the first draft guidance for risk assessments and Codes of Practice covering illegal harms duties now expected within weeks of Royal Assent. This will assist companies in understanding what they need to do to comply with their duties in relation to any in scope services.

What can companies/Insurers do to prepare?

Companies should carefully consider if they fall within the scope of the OSB, bearing in mind its wide scope of application. Companies that provide online content, and especially content which may be viewed by children, are likely to be caught by its provisions. However, there are limited practical steps which companies can take at this time. Despite the OSB running to over 300 pages in length, further work is required in terms of the detail for practical steps that companies will need, and be expected, to take. For those companies which are caught under the OSB, they will need to update their Terms of Service, but we will know more once Ofcom finalises its consultations and circulates draft Codes of Practice.

For now, it is something to keep on your radar if your organisation is likely to fall within scope, and for Insurers to consider whether this poses a material risk for a policyholder that requires specific underwriting. We will keep you updated on the progress as Ofcom takes on the extensive task of implementing and enforcing the OSB.