Ofcom has today published its ‘roadmap to regulation’  if and when the Online Safety Bill becomes law, together with a ‘call for evidence’ for the first phase of online safety regulation. Both are premised on the current version of the Online Safety Bill, which is acknowledged to be subject to alteration as the legislation goes through the Parliamentary process.

The roadmap and the call for evidence

The roadmap is expressly said not to be intended as a guide to future compliance, but rather an information document setting out Ofcom’s present thinking. It is framed so as to seek to reassure each of the various camps of critics, despite their generally divergent concerns; a tension which is evident from the very first statement of principle, on the first substantive page of the document (emphasis in original):

“Ofcom’s core duty under the Bill is to adequately protect citizens from harm by ensuring online services make appropriate use of systems and processes to keep users safe. In doing so, we will ensure our approach upholds the importance of freedom of expression online.”

Nonetheless, there are various nuggets of interest that can be prised out of the roadmap:

• Ofcom has summarised its duties under the regime as falling into four key areas of ‘streams’:
  • Protecting people from illegal content;
  • Protecting children from age inappropriate content;
  • Empowering adults to protect themselves from legal but harmful content; and
  • Increasing public transparency of ‘categorised’ services’ actions to protect users (as to which, see below).
• Ofcom expects its powers to come into force two months after the Bill becomes law. It intends then to move “as rapidly as possible”:
  • Publishing its draft guidance for risk assessment and Codes of Practice,
  • Carrying out its first sector risk assessments; and
  • Issuing formal information requests to services identified as facing particular risks.
• Priority action will focus on what are deemed to be the most significant online harms: child sexual abuse material and grooming; terrorism; online fraud; and limiting harmful content to children. It is worth noting in passing that the Government has recently proposed amendments to the Online Safety Bill which would further strengthen Ofcom’s powers relating to child sexual abuse material, including an ability to require providers to use or develop technology to identify such content in user communications.
• Ofcom anticipates that consultation on its draft plans etc. may take as much as a year, following which its final guidance and Codes will be published and (subject to the Secretary of State’s intervention) enter into force.
• Alongside publication of its draft plans, Ofcom intends to “prioritise engagement with high-risk or high-impact services to understand their existing safety systems and how they plan to improve them”, adopting a “risk-based ‘supervisory’ approach.”
• The Bill requires Ofcom to establish a register of ‘Category 1’, ‘Category 2A’, and ‘Category 2B’ services (essentially higher volume / higher risk user to user (Cat. 1) and search (Cat. 2), which services are subject to additional duties under the Bill. The roadmap notes the Government’s intention (stated in its Impact Assessment published in January) that there should only be 30-40 ‘categorised’ services. The ‘engagement’ referred to above will not, however, be restricted to ‘categorised’ services, but will include “some smaller services, that we have identified as posing particular risks of harm by virtue of their content offer, userbase or service features.”
• A detailed and helpful overarching timeline of Ofcom’s intended activities can be found at p. 12 of the roadmap, with specific timelines for each of the workstreams in section 4 of the roadmap. In very broad terms, consistently with the above, Ofcom intends to focus first on illegal content, child access, and transparency requirements, with regulation of (particularly controversial) ‘legal but harmful’ content phased in at a later time following secondary legislation.
• Alongside all the promises (if not exactly carrots) of a constructive, risk-based, and collegial approach to regulation lies the stick: Ofcom’s enforcement powers (information notices, skilled person’s reports, fines, and business disruption measures) are summarised, and stated to be “vital to ensure we can take effective action when necessary to protect users.”

The ‘call for evidence’ focuses on matters which Ofcom anticipates will be covered by its first 2023 consultation (assessment of the risk of harm from illegal content, mitigations around illegal content, child access assessments and transparency requirements). It sets out a range of detailed queries in Annex 1: both factual queries to assist Ofcom in understanding the nature of the businesses that it will shortly be regulating, and what those businesses consider to be effective about their present voluntary processes, and thoughts and ideas for how safety improvements might be put in place without unduly affecting user experience.

 

Some thoughts

While the Online Safety Bill wends its way through Parliament, these documents give the first (limited) insight into the reality of ‘on the ground’ regulation to which businesses are likely to be subjected once the Bill becomes law.

Ofcom clearly has a difficult balancing act to manage the different interests at stake, and to be an effective but not overly heavy-handed regulator. However ‘outcome-focused’, flexible and collegiate Ofcom may be, the bottom line is that businesses subject to regulation are likely to face a considerable volume of new regulatory burdens and compliance requirements, with a real risk of the regulatory stick being deployed in the event of non-compliance or faulty compliance with the Bill’s requirements and Ofcom’s regulatory instructions and guidance.

In that context, a significant part of the roadmap’s purpose is evidently to give the earliest possible warning as to when, over 2023 and 2024, businesses will be asked to engage with Ofcom consultations, so that they can plan their thoughts and responses in advance so far as possible. That is a sensible approach, and one for which Ofcom should be commended. It is equally sensible for those businesses with ‘skin in the game’ so far as this new regulation is concerned, particularly (but not exclusively) those which are likely to become ‘Category’ businesses, to take the opportunity to seek to engage with Ofcom so as to shape the nature and process of regulation so far as practicable.

Rupert Paines