OSB in focus: is the Online Safety Bill a skeleton or a springboard for dynamic regulation?

The government has published the Online Safety Bill for pre-legislative scrutiny and stakeholder review and comment.  In doing so, it has set out its justification for the range of flexibilities within the bill including powers: to make further regulations; to issue directions, the framework document, and statutory guidance and codes of practice; and to amend substantial portions of the Bill in the future. The government argues that these sorts of flexibilities are necessary because of potential future changes in technology and that "without these powers the regulatory framework could quickly become inflexible and ineffective".

Lack of consultation requirements

None of the powers given to the government are subject to detailed consultation requirements. The government has the option to consult relevant persons before making the Statement of Strategic Online Safety Priorities under clause 109, a document to which the regulator Ofcom will be required to have regard in future when it makes rules and decisions, and which is intended to follow the precedent of the Statement of Strategic Priorities made previously under the Communications Act 2003.

This statement appears to be one of the means for the government to shape both Ofcom's future enactment of the rules and its application of them (it also has various powers to direct Ofcom to do things or to change its codes of practice).

Apart from this, under the current draft of the Bill, companies affected by the rules are not given the opportunity to review or comment on a great number of significant aspects of the regime that will be brought into force by regulations made by the government, with minimal parliamentary scrutiny in most cases. What, then, are the most significant powers set out in the Bill?

Codes of practice

The only detailed consultation requirements on the face of the Bill are those imposed on Ofcom at clause 29(5) and (6), which require it to consult, amongst others, "persons who appear to OFCOM to represent providers of regulated services" and "persons whom OFCOM consider to have expertise in innovation, or emerging technology, that is relevant to online safety matters", before it makes the codes of practice that lie at the heart of the regime and are the means by which companies can demonstrate compliance with the rules.

Although this requirement to consult is appropriate and well placed, this fundamental "rule book" for compliance is, as yet, unknown and won't be fully understandable until those codes of practice have been published for consultation.

In addition, these powers are subject to a form of what is known as the "negative" parliamentary procedure.  This means that they simply have to be laid before parliament, with no one objecting within 40 sitting days for them to become law. There is no requirement for a positive vote in parliament to approve them. This is the lowest level of parliamentary scrutiny and means that there will be no opportunity for the regulations to be debated in Parliament before they bring the codes of practice into law.

The government itself has acknowledged that these codes will be challenging for Ofcom to produce, acknowledging that "the regulator will be defining these systems and processes for the first time […] rather than drawing on established definitions and precedents" – in our view, more extensive scrutiny over their content should therefore be built into the procedure for bringing them into force.

Qualifying worldwide revenue

In the new Bill, "qualifying worldwide revenue" determines the level of fine that a company may face, and the fees it is required to pay to maintain the regulatory regime.  It is a crucial concept at the heart of the new regime, as the government acknowledges: "[it] is central to the regulatory framework's enforcement processes because it will be used to determine applicable penalties against services (including groups of entities […]). It is vital therefore that the definition is fit for purpose and easily understood by industry and stakeholders. […] Defining the terms in regulations will also allow for the definitions to be amended in future. Flexibility is required to ensure 'qualifying worldwide revenue' remains usable by OFCOM and to enable easy reporting by industry."

While this power is subject to a general requirement to consult Ofcom, there is no specific requirement to take Ofcom's response into account. More importantly, there is no requirement to consult industry more widely.

It is surprising that such an important provision is not subject to a detailed consultation requirement similar the one discussed above in relation to the codes of practice. While the government argues in its Delegated Powers Memorandum – a report prepared by government to justify the use of regulation-making powers in the Bill to Parliament – that it is a "limited, technical power to set the meaning of the term", the impact of the provisions relating to fines in clause 85 cannot yet be fully understood by companies until the definition of this key term is known. In addition, it is unclear whether Ofcom will have a sufficient understanding of how companies currently operate internationally, without the input of those companies whose revenue will be subject to the assessment through the definition. The latter are likely to be well-placed to provide valuable input and comment on this key aspect of the regime.

Exempt services changes and 'regulated content'

There are a range of flexibilities in the Bill allowing the government to make changes to the types of activity and content that is regulated. For example, at clause 3(8), the government can change the list of user-to-user or search services that are exempt from regulation. At paragraph 24 of its Delegated Powers Memorandum, the government states that: "the current list of exempt services is provided in schedule 1 to give OFCOM and companies certainty about which services will initially fall outside of scope.  This power allows the initial list of exempt services to be expanded where there is evidence that other types of user to user or search services present a low risk of harm."

This extract demonstrates the difficult balance that the Bill is seeking to achieve between a degree of "initial certainty" and sufficient flexibility for the government to flex and change the coverage so as to adapt to technological changes. While a balance has to be struck, and some degree of flexibility is required, there's a strong argument that there should be additional mechanisms for scrutiny of such future changes, including by consulting those affected.

The power to change the list of exempt services, and also the power at clause 39(12) to change the definition of "regulated content" are subject to the "affirmative" parliamentary procedure, meaning that they require approval by Parliament before they are made and are, therefore, likely to be subject to debate before being made. We agree that this level of scrutiny is appropriate, but consider that further requirements to consult before making the changes should be included in the Bill.

Definition of illegal content

Clause 41 allows the government to create new offences in relation to "illegal content". To be illegal in the new regime, content must be "regulated content" and must "amount to a relevant offence" (clause 41(2)(a)). The government can also change what is meant by regulated content in future under clause 39(12) so as to bring into scope comments and review sections on platforms.

What amounts to a "relevant offence" is to be set out in future regulations by the government. While it is to include any already existing offences targeting individuals and any of the terrorism and child sexual exploitation or abuse offences listed in schedules to the Bill it will also include any offences specified by the government under powers included in section 41.

Given the severity of the potential penalties included in the Bill, it is important to flag that the full range of content that may be caught by these provisions and, therefore, subject to further penalties is not fully known.

Osborne Clarke comment

While the Bill provides a useful skeleton to the regulatory regime that will emerge in future, there are crucial elements that have not yet been seen, and there are flexibilities built into the structure that decrease the level of certainty that the Bill provides.

There are several steps the government could take to address these issues, including the insertion of clearer consultation requirements on the face of the Bill and the publication of key future regulations that will be made under the powers in the Bill, including those relating to offences and to the meaning of qualifying worldwide revenue. In addition, Ofcom should publish draft codes of practice for consultation at the earliest opportunity.