Ofcom has today launched an investigation into whether the provider of an online suicide forum has failed to comply with its duties under the UK’s Online Safety Act.
This is the first investigation opened into an individual online service provider under these new laws. Specifically, we are investigating whether this provider has failed to:
- put appropriate safety measures in place to protect its UK users from illegal content and activity;
- complete – and keep a record of – a suitable and sufficient illegal harms risk assessment; and
- adequately respond to a statutory information request.
Due to its nature, we have decided not to name the provider and forum.
Legal obligations under the Online Safety Act
Providers of services in scope of the Act[1] had until 16 March to assess how likely people in the UK are to encounter illegal content on their service, and how their service could be used to commit or facilitate ‘priority’ criminal offences – including encouraging or assisting suicide.[2]
On 17 March, duties came into force that mean providers must now take steps to protect their UK users from illegal content and activity, including by using proportionate measures to:
- mitigate the risk of their service being used to commit or facilitate a priority offence;
- prevent individuals from encountering priority illegal content; and
- swiftly take down illegal content once they become aware of it.
Ofcom’s codes of practice and guidance set out ways providers can comply with these duties.
Providers are also required to respond to all statutory information requests from Ofcom in an accurate, complete and timely way.
Early enforcement action
Our starting point in driving compliance is to give service providers an opportunity to engage with our dedicated compliance teams about what they need to do under their new duties.
We’ve been clear, however, that failure to comply with the new online safety duties or adequately respond to our information requests may result in enforcement action, and that we would not hesitate to take swift action where we suspect there may be serious breaches.
We have made several attempts to engage with this service provider in respect of its duties under the Act and issued a legally binding request to submit the record of its illegal harms risk assessment to us.
Having received a limited response to our request, and unsatisfactory information about the steps being taken to protect UK users from illegal content, we have today launched an investigation into whether the provider is complying with its legal obligations under the Act.
Ofcom’s investigation process
UK law sets out the process Ofcom must follow when investigating an individual provider and deciding whether it has failed to comply with its legal obligations.
We will now gather and analyse evidence to determine whether a contravention has occurred. If our assessment indicates a compliance failure, we will issue a provisional notice of contravention to the provider, who can then make representations on our findings, before we make our final decision.
We will provide an update on this investigation as soon as possible.
Enforcement powers
Where we identify compliance failures, we can require platforms to take specific measures to come into compliance. We can also impose fines of up to £18m or 10% of qualifying worldwide revenue, whichever is greater.
Where appropriate, in the most serious cases, we can seek a court order for ‘business disruption measures’, such as requiring payment providers or advertisers to withdraw their services from a platform, or requiring Internet Service Providers to block access to a site in the UK.
Other ongoing enforcement activity
Last month, we launched an enforcement programme to assess the safety measures being taken by file-sharing and file-storage providers to prevent offenders from disseminating child sexual abuse material on their services.
In January, we opened an enforcement programme into age assurance measures in the adult sector.
We expect to make additional announcements on formal enforcement action over the coming months, particularly with further duties coming into force under the Act.
END
Notes to editors:
1. Services in scope of the Online Safety Act include search services and ‘user-to-user’ services with a significant number of UK users or targeting the UK market, regardless of where the provider is based, as the Act includes extra-territorial application and jurisdiction. User-to-user services are where people may encounter content – including images, videos, messages or comments – that has been generated, uploaded or shared by other users. For example, social media or video-sharing platforms, messaging, gaming and dating apps, file-sharing sites and forums.
2. The Act lists over 130 ‘priority offences’ – providers must assess and mitigate the risk of these occurring on their service. The priority offences can be split into 17 categories:
- Terrorism
- Harassment, stalking, threats and abuse offences
- Coercive and controlling behaviour
- Hate offences
- Intimate image abuse
- Extreme pornography
- Child sexual exploitation and abuse
- Sexual exploitation of adults
- Unlawful immigration
- Human trafficking
- Fraud and financial offences
- Proceeds of crime
- Assisting or encouraging suicide
- Drugs and psychoactive substances
- Weapons offences (knives, firearms, and other weapons)
- Foreign interference
- Animal welfare