17
Examination of Witnesses
Paul Scully MP, Lord Parkinson of Whitley Bay and Orla MacRae.
Q1 The Chair: This is the Communications and Digital Committee. We are holding a one-off session on the Online Safety Bill. We are very grateful to Ministers from DCMS, Minister Scully and Minister Parkinson, as well as Orla MacRae, one of the officials who is responsible for the legislation in the department, for joining us this morning. It is probably worth saying before I get going that this is clearly an important Bill. It is now here in the House of Lords. We have the Second Reading on Wednesday 1 February.
In holding this session, we are very conscious that we have limited time, so there will be elements of this Bill that we do not cover, but we want to focus on three areas. One is around the Secretary of State’s powers; we will ask quite a few questions about that. The second thing we want to explore is the effectiveness of the new user empowerment tools. The third is the protection of children. That will be the focus of our attention today.
I will kick off and start with the Secretary of State’s powers. You will know that they have been rather widely criticised for being unnecessarily extensive, and there have been question marks about the impact of them on Ofcom’s operational independence. I know we have exchanged letters about what is in the Bill at the moment, and you have some proposals to amend Clause 39, but the Government are still, by virtue of your proposal, going to be able to direct Ofcom to modify its codes for reasons of public policy, which, in our view, seems too vague.
I wonder whether you can explain why you are still persisting with the route that you are taking and are reluctant to be much more conventional in the way in which the Secretary of State would have powers over an independent regulator.
Paul Scully: Thanks for the opportunity to discuss this ahead of Second Reading; I know my excellent colleague Lord Parkinson is looking forward to the debate. To answer your question directly, it is a novel bit of ground-breaking legislation that we are looking at here. A lot of other countries around the world are looking at how we are approaching this. If we get this right, it is likely to form the basis of an almost global regime. Our aim is to balance the need for regulator independence with the appropriate oversight for Parliament and government.
As you rightly say, concerns have been raised about this, which is why we have proposed the changes in the Written Ministerial Statement that was published on 7 July. Just to outline those, we are going to make it clear in the legislation in your House that this power would be used only in exceptional circumstances. We are going to replace that public policy wording with a more clearly defined list of reasons for which the Secretary of State could make a direction. It might be public health; it might be national security. There will be very specific areas in which Ofcom may not have, or inevitably in those situations would not have, the right level of information to be able to make such judgments. Ofcom’s independence and expertise are obviously of the utmost importance to the success of the regime, but, because of the very broad nature of online harms, there will be subjects that may go beyond its remit as a regulator.
When Ofcom gave evidence to the Joint Committee on the draft Bill, it said that there would be some issues where the Government have access to expertise or information that the regulator does not, such as national security, but the framework itself will always ensure that Parliament has the final say on any codes of practice. The use of the affirmative procedure will make sure that there is an increased level of scrutiny in any of those exceptional cases where this power is used.
The Chair: I want to pick up on some of the things you said there. On exceptional circumstances, at the moment it is not clear what you mean by that, and that is quite different from what we would normally see if there was a power for a Secretary of State to direct Ofcom or a regulator in some way. That would usually be in cases of emergency, which is different from being exceptional.
On your movement from public policy to some more specific categories, and your intention of listing them—you have mentioned a couple of them already—one that is not clear to me, as to what it really means, is something about economic policy and burden to business. There is an interesting range of policy areas that you feel it would be necessary for the Secretary of State to direct an independent regulator on. Even though you have sought to clarify them, it still goes beyond what would seem to be normal government control over a regulator.
If you are concerned about the novel nature of Ofcom having more powers than you would expect it to have, or certainly than it has had in the past, why were you so quick to dismiss a recommendation that originated from this committee, but was also put forward by the joint pre-legislative scrutiny committee, of a Joint Committee of Parliament to be set up specifically for oversight of digital regulation?
Paul Scully: We have not been quick to dismiss anything. We want to make sure that this bit of legislation gets through. We are going to have to revisit this kind of digital regulation sometime in the future anyway, which is one of the reasons why we are trying to make the Bill as flexible, broad and non-technology specific as possible. If we were more prescriptive, frankly, the Bill would be out of date before it gained Royal Assent. The landscape will inevitably change, so we will have to come back to digital regulation. I do not know whether Orla can say anything specific on the cost to business example.
Orla MacRae: We will bring forward amendments in the Lords in Committee. It is about recognising that not only is this novel legislation but the sector it is regulating will be very fast moving. It is difficult to predict exactly every possible future harm or technology that will pose a challenge. The power is merely a recognition that there will be some areas where government has a different level of information compared with the regulator, as Ofcom acknowledged when it gave evidence to the pre-legislative Joint Committee as well. It is not about interfering with Ofcom’s independence but simply providing those checks and balances to ensure that the implementation of the regulation is as Parliament intended.
The Chair: I think we can all agree on the fast-paced nature of change in this area, the risk of legislation being out of date very quickly and, therefore, the need for flexibility. In this new world, we are also concerned to ensure that the various constituent parts of overseeing this area of public policy can do their jobs effectively, whether it is the regulator, the Government or Parliament.
One of the things we are concerned about is making sure we all meet that common goal of ensuring that there is good oversight, flexibility and nimbleness in being able to deal with the nature of change, but not in a way that compromises the relationship that exists between the Executive and the regulator, and the Executive and Parliament and any general oversight of Parliament, which I hope gives people confidence that the oversight a regulator is getting is not inappropriate.
Paul Scully: The original wording talking about public policy mirrors the wording in Schedule 3 to the Competition Act 1998, but obviously we have listened to concerns. As I say, we also want to make sure, being quite explicit, that it is used in exceptional circumstances. Therefore, I hope it can be seen to be a comparatively light-touch approach that will come in only very much as an exception, but I understand the concern. I guess this will be a debating point when it comes in front of you.
The Chair: In terms of drawing comparisons with previous or existing legislation, this goes further. In most of the legislation that provides a Secretary of State the power to set strategic priorities or that sort of thing, that activity is restricted to national security. As I say, what is causing people concern is the combination of directing Ofcom and the categories of activity where it would be permissible for the Government do so.
I have one final question on the approach and understanding the problem we are all seeking to address here. Why have you not gone for an approach where you could have a public exchange of letters, like that between the Governor of the Bank of England and the Chancellor? If there is a matter of concern or you want to raise something with the regulator, you can do so in an open and transparent way. It might be able to disagree, but it would have to give good reasons. Is that a way of dealing with this that you have looked at already and have a view on?
Paul Scully: As I say, it is mirroring where we come from in other areas. You are going to get to a point, in areas such as national security, where it may not be an appropriate approach to have an exchange of letters in that way. There are some safeguards within our proposals to ensure that it is consistent with having an independent regulator.
We want to make sure that, if the code is subject to the direction under this clause, the reason for the modification has to be laid before Parliament so that it is as transparent as we can make it. We will be able to use the power only at the point the code is submitted to be laid in Parliament, rather than at any time in the process. Ofcom will prepare the draft code or amendments to it and submit it to the Secretary of State, who will lay the code in Parliament unless they decide to make a direction. Finally, in making a direction, the Secretary of State may not require Ofcom to include provision for a particular measure that must be taken by regulated services. If there are decisions that Ofcom must take, we are certainly not going to be treading on that area. This is very much about the codes.
The Chair: We will come on to the dialogue, as it were, that is proposed between Ofcom and the Secretary of State. Lord Lipsey will pick that up in a moment. Lord Foster, do you have a supplementary question?
Q2 Lord Foster of Bath: I did not hear an answer to the Chair’s question earlier about one of the levels of oversight by Parliament. We note what you say about Parliament having the final say and affirmative resolutions, but what about the proposal in relation to a Joint Committee?
Paul Scully: This is in terms of wider digital regulation. It is something that was debated before my time, so I am not sure.
Lord Parkinson: We remain open-minded on it. We are mindful that this committee and the DCMS Select Committee in the Commons are well placed to scrutinise this work in an ongoing way. Statute cannot mandate Parliament to set up new committees. The Bill has benefited from the pre-legislative scrutiny of the Joint Committee, but we would not want to set something up that overrode the work of your Lordships.
Lord Foster of Bath: So I can take away the word “open-minded”.
Lord Parkinson: Yes. We will continue to debate this and the Bills before us in this House, but it has clearly benefited from pre-legislative scrutiny. As the Minister says, it will need to be monitored on an ongoing basis, but we are interested in the views of this committee in particular. It seems to be very much part of the bread and butter of your work.
The Chair: You will know that we are also very interested in the digital markets and competition Bill and the need for that. We see that as the other side of the same coin, as it were. It is complementary to a lot of what is in this Bill in ensuring that there is good regulation in the digital sphere. Some of the concerns that people have about practice in the online world are related to competition issues, not just the regulation of content.
We saw a Joint Committee of both Houses on digital regulation, reflecting the fact that digital regulation issues now cut across a lot of different regulators. For regulation in this area to remain up to date, regulators have to be much more principles-based in their approach, which requires closer scrutiny, and the most appropriate place for that sort of scrutiny would be Parliament. It was broader than just legislation of that kind.
Q3 Baroness Harding of Winscombe: I want to press a bit more on why these additional Secretary of State powers were necessary, particularly for areas of economic policy and burden to business. You wrote before Christmas, setting out more detail beyond public policy. I can understand national security being a reason for Ofcom not having certain information and the Secretary of State therefore needing to intervene. I am really struggling to understand why you would need to retain that power for economic policy and burden to business reasons.
Paul Scully: It is the considered view that, when you look at wider economic policy and how it fits within the wider landscape of the economy, there may be situations where the Secretary of State has more information. Rather than taking that out, though—I know you have concerns about it—we are putting the checks in so that they cannot just use that willy-nilly because they are having some sort of discussion about a bonfire of regulations or whatever the order of the day is that is driving a headline somewhere.
You have to have the checks and balances of Parliament. That is the approach we have taken. We are trying to keep it as wide as possible because of known unknowns and unknown unknowns, but with checks in place.
Baroness Featherstone: Because I am a deeply suspicious person, my take on this is that it might be in case Ofcom does something you do not like. That is the underlying concern in having a power where you can intervene. Is there a timeframe written into the Bill—forgive me; I do not yet know the Bill off by heart—between issuing an edict and a change in action that Ofcom would be given? How is that going to work?
The Chair: That probably relates to the next set of questions.
Baroness Featherstone: Forgive me.
The Chair: No, that is okay. Hold that thought and let me move straight to Lord Lipsey, and then we can deal with both at the same time.
Q4 Lord Lipsey: I am pursuing the parliamentary route, because I do not really understand what is being said. Ofcom produces a code of practice that says, “You have to do this”. It goes to the Secretary of State. The Secretary of State bumps into a chum in the corridor who says, “My business is going to have to pay a fortune on that”. He says, “We can’t have that” and sends it back to Ofcom. Ofcom sends it back to the Secretary of State. The Secretary of State sends it back to Ofcom. Parliament, which is supposed to govern this nation, does not get a look in. It is entirely private business between Ofcom and the Secretary of State.
It might never happen. The code of practice might be held up for ever because the Secretary of State does not accept that thing. I am not suggesting anything personal, because I am sure the Secretary of State is a most admirable person. Are you not aware that, when this comes to Parliament and to the Lords, we will not accept this? I am co-ordinating amendments to the Bill for Back-Benchers and I have seen all the Labour amendments. We will not accept this. It is not a runner. Is it not time that you thought again before putting too much investment into something that cannot possibly survive?
Paul Scully: I will bring in Orla in a minute to talk about the process and the timing that Baroness Featherstone was talking about, but that is why the checks are there. There is no question, with the checks that we are suggesting, that a deal can be done in a corridor. First, we are talking about exceptional circumstances. Secondly, as I say, Parliament has to have the final say on any directions that the Secretary of State comes in with, and that is what we want to bake in with the changes we are making, according to the Written Ministerial Statement. Would you like to add anything in terms of timing?
Orla MacRae: I have two points. In terms of everything happening in corridors and behind closed doors, it is important to remember that this comes at the very end of the process for producing codes of practice. As part of that process, Ofcom is obliged to consult widely, including with a specified list of external people, so everyone will be aware of what Ofcom’s draft code said before it got to this point, and will be aware of where it is in the process.
To Baroness Featherstone’s point, there is a timeline set out in the Bill. The direction from the Secretary of State must be made within 45 days of receiving the code from Ofcom, so there is that timescale. Then, as the Minister explained previously, once that direction is issued, there is that process of transparency to ensure that the reasons for that direction and what Ofcom has done in response to it are clear. There is the provision that prohibits a Secretary of State from requiring specific measures to be inserted into the code, so it is not about taking out a particular thing or adding something else in.
Lord Lipsey: I may have got this wrong. Do correct me if I am wrong, but one of the things about the Secretary of State intervening is exceptional circumstances. The judge of that is the Secretary of State. It does not get near Parliament in time for that judgment to be made. If ever a code comes before Parliament and we want to question whether something is exceptional, yes, we have a say then, but by then the water has flowed under the bridge.
Orla MacRae: We have not yet tabled the amendments with regard to the “exceptional circumstances” addition, so we could certainly take away those concerns.
Lord Lipsey: That is very helpful because, just as a word of advice—not that I should be giving advice—you will not get it through as it is.
Baroness Featherstone: My timing question was less about the 45 days that the Secretary of State had. It was more about the timeframe in which Parliament could intervene after the direction.
Orla MacRae: Once the direction is issued, Ofcom must respond to that direction, setting out how it has modified the code in relation to it. Then it will send it back to the Secretary of State, who can either issue another direction or lay it in the House, so it is at the point at which it is laid in the House that Parliament can intervene.
The Chair: From that exchange, I am still not clear whether there is an ongoing facility for the Secretary of State to engage in a form of ping-pong with Ofcom before something gets agreed between those two entities and then gets laid before Parliament.
Paul Scully: Theoretically, that is possible; in practice, we do not expect that to happen. The Bill requires Ofcom to consult a broad range of people and organisations when preparing the code of practice, so it is exactly as Orla says. The fact is that this is already out there in the open, so a lot of potential issues that might require the direction will have been raised at an early stage. As I say, it will be a particular issue that clearly goes beyond Ofcom’s remit, but that is why we built the framework such that Parliament has the final say within it. The theory is there that that may happen, but this is already an extraordinary circumstance, so I am not sure I can envisage a circumstance that will be even more extraordinary in that regard.
The Chair: Can I ask one other general question about timing? You are already running way behind the original timetable for introducing the legislation, for all the reasons that we know. Do you have any concerns about the impact of the current timeline on the enactment of the legislation and the ability of the regime to get going, bearing in mind that it is going to be coming in in stages anyway once the Bill has been passed? What are your current expectations for even the first bit of this Bill, once it becomes an Act, to be live and operational? Do you think it will be before the next general election?
Paul Scully: There will be things operational between now and the next general election, assuming this goes comparatively smoothly in your House and we get Royal Assent. I see chuckles from a sedentary position, as we say. Absolutely, it is important.
The Chair: I get the fact that this is a balance all the time. We are juggling something that is incredibly difficult and new, but the extent to which there is ongoing dialogue between the Secretary of State and Ofcom on codes is only going to delay things further. If there is already concern within Ofcom about the timeline, how likely is a situation where we have an election and have not actually started?
Paul Scully: I do not see that, because we have already started the discussion with Ofcom. It knows what we are proposing and expecting, and we are in discussions with it. It is building up its resource to be able to tackle these issues head-on. I know there is, rightly, concern about the timetable. Lord Bethell has raised a number of issues about whether we can stage some of the barriers, for example around access to pornography. These are valid debating points, but because that work has gone on I am not sure I have seen—correct me if I am wrong—any barriers that Ofcom has been raising about timing.
Lord Parkinson: We want the Bill to be operational as quickly as possible. As Paul says, that depends on how quickly Parliament does its work, but it is clear that all the parties that will be contesting the next election want to see it as an Act of Parliament swiftly. There is clear consensus to act in this area, though understandable disagreement on how.
Ofcom published its implementation road map in July last year, and the fact that the Bill is now in the second Chamber with that strong consensus behind it should be a clear message to the industry that this is going to become law and that it ought to prepare for it. Some parts of the Bill require secondary legislation, which will come in through a phased approach, but other areas of it will be law and should be turned into practice swiftly.
Paul Scully: This is a key point. Lord Parkinson is absolutely right when he says the industry knows the sense of direction. We have been talking on a number of occasions with all the big platforms, especially those that are likely to be the category 1 platforms within this Bill, so they know exactly what is coming down the road. We do not expect them to have to wait for Royal Assent when the fundamental bit of this, beyond child protection, which we all want in this Bill, is to make sure that they enforce their terms and conditions. It should not be beyond the wit of man to realise that that is what they need to be doing now, but it is important to get the regime around it as well.
Baroness Featherstone: On affirmative action, you still have a majority, so I am still not completely satisfied. “We don’t like that. It’s damaging us as a Government, so we’re going to stop something that Ofcom has put in its code.” I do not see where we get to stop that, or is that just life?
Paul Scully: Partly it is, because any Government could do that. As you say, it is not just a Secretary of State who comes from my party. It might be that this is future Governments.
Baroness Featherstone: Can you see why I am worried?
Paul Scully: Look, I am as cynical as the next person on some of these things.
Baroness Featherstone: I am very cynical.
Paul Scully: To Orla’s point, a lot of this will have been out in the public before it even gets to the Secretary of State discussing this. The affirmative procedure will also be public, so if there is a sniff of deals being done in the corridors, as Lord Lipsey says, that is not going to make any Secretary of State look particularly good. It would take a pretty emboldened Secretary of State to go down the route, frankly, because of the public looking in on it. It is the old approach that sunlight is the best form of disinfectant.
Q5 Baroness Bull: I want to ask about risk assessments, particularly as they relate to adult safety duties. There has been a strong focus throughout on protecting children through this Bill. The next question is going to look at that. I fully support those efforts, of course, but I have long been concerned about the inadequacy of protection in the Bill for adults, particularly adults who are vulnerable. When I say “vulnerable”, I mean those defined by the Department of Health as vulnerable, but also people who are vulnerable in specific areas or parts of their life while not in others.
In previous versions of the Bill, platforms had a duty to undertake risk assessments and to publish a summary of that with their terms of service. Many people have argued that the removal of this is a backward step because, without a risk assessment, it is quite hard to argue that the regime the Bill introduces is a risk management regime. Without a risk assessment, how do you know what harm occurs, who it is going to affect and with what severity? How do you work out what needs mitigating? How do users make an informed choice as to whether to engage with a service?
Removing the risk assessment also implies that harm is caused only by content. I will come on to the user empowerment list in my next question, but we know that harm can also be caused by a platform’s functions, design or features. These can all play a part in promoting or preventing harm.
The Government did not really give us a reason or evidence underpinning the removal of the risk assessment requirement. Indeed, the Secretary of State said a few days ago that she intends to think about whether that is the right move. Is the Secretary of State planning to revisit this? Perhaps you can just tell us that it is coming back, in which case we will move on. If not, can you enlighten us as to what evidence underpins the removal of that requirement, and what you think the implications might be of that removal?
Paul Scully: In terms of risk assessments, I talked about the fact that a lot of this is about getting the companies to enforce their own terms and conditions. We want to make sure that those terms and conditions, and the risk assessments where they are in place, are clear, concise and very easy to understand.
There were some amendments proposed by the Labour Party in our House, looking at whether there should be specific risk assessments written for children and people with learning disabilities. We did not go down that line because we wanted to make sure that risk assessments were comprehensive enough so that they could be understood by parents and others. Risk assessments are not always simple to analyse, but we would expect those platforms to have a simplified version of these sorts of things for the children themselves.
Baroness Bull: I am not talking about children.
Paul Scully: Sorry, it is so that people with learning disabilities and other vulnerabilities can understand what they are looking at as well. The risk assessment is partly for the companies to assess what measures they need to put in place, but partly for the user also to be able to analyse what they are signing up for, effectively, alongside the terms and conditions.
Baroness Bull: You have just argued for a risk assessment, but the requirement to produce a risk assessment has been removed. There is no longer a requirement on category 1 companies to carry out a harm to adults risk assessment, but you have just argued that there should be one.
Paul Scully: No, not quite.
Orla MacRae: The Bill is very complex and very long. There are requirements on all companies to do risk assessments under the Bill as it stands in relation to illegal content and content harmful to children, where they are likely to access it. That will give users an understanding of the level of risk arising from those platforms, as the Minister said, including measures about things such as their design and the nature of their operation.
The Government have decided to remove the adult safety duties from the Bill in recognition that government determining categories of content that may be legal but harmful might incentivise companies to remove legal speech from their platforms, which may have a negative impact on freedom of expression. Once you get rid of the concept of “legal but harmful”, as a necessary consequence of that you also have to remove the risk assessment, because you are talking not about risk any more but about transparency and accountability. The new duties are focused on transparency and accountability, and there will be that information for users, as the Minister said, in the terms and conditions, which have to be easily accessible to all users, including those with a variety of vulnerabilities.
It is important to remember that Ofcom still has very wide-ranging information-gathering and transparency powers. It will be able to understand what systems and processes companies have put in place in order to ensure that they are enforcing their own terms and conditions effectively. Where they are falling short of that, Ofcom will still be able to take enforcement action.
Over the several years of development of this Bill, one of the main problems we have heard for adults is this disconnect between what platforms say they are going to do in their terms and conditions and what they do in practice. The new measures address that on both sides by increasing that transparency and introducing new accountability to an independent regulator. We will see significant improvements for adult safety online, including through the new measures in the Bill, even if there is not a specific risk assessment in those provisions.
Baroness Bull: Are you aware of the conversation my noble friend Lord Foster reported back to me in which the Secretary of State said that she was minded to revisit this?
Orla MacRae: That is not something I would recognise.
Paul Scully: I was not part of that conversation. It is not a conversation I have heard, but clearly this is coming to your place for debate, and I am sure it will come up there. I do not want to have an open cheque book for my boss. We want to make sure that this gets through and we can implement it to the timetable that we have just been discussing.
On this argument about a risk assessment and terms and conditions, what we want could be boiled down to the risk assessment being distilled into the terms and conditions, if the terms and conditions are something that you do not just scroll past, tick a box and move on without understanding. That is partly the onus that we want to put on the platforms because we want to make sure that the platforms enforce them.
I keep talking about this because it is so vital to get to the crux of what we are trying to do with the adult part of this Bill. At the moment, the social media platforms are not geared up to enforce their terms and conditions. That is not how their business model works, because algorithms design predictability in any user engagement. Their engagement pushes people into corners that allow people to market ideas and products. That does not always sit comfortably among the terms and conditions when you may be talking about harm and abusive behaviour.
It is about having clear terms and conditions that people understand and can agree with, knowing that there is a clear reporting mechanism that will be usable, be user-friendly and see action. That is really at the heart of what we are trying to achieve for adults as well as children.
Baroness Bull: That all assumes that adults have capacity and are in a fit mental state to engage with those terms and conditions. Let me come on to the user empowerment duties. With the user empowerment duties, we have a defined list of things that the Government believe to be harmful across category 1 services. Although it is not a bad list, it is not exactly complete. The crucial thing is that it is static. Of course, that list is exactly the sort of thing that should be informed by platforms’ risk assessments, because the online environment is a very fluid environment. Harms arise and spread quickly.
I have three questions. How do you intend the new user empowerment tools to work? Are you confident that the platforms are able to implement them, given what you have already said about terms and conditions? Crucially, why does the Bill not require platforms to set them on as the default? People who are at the point of crisis, perhaps with suicidal thoughts or at risk of eating disorders, may be in an affected mental state that does not allow them to turn the tools on, because they are seeking content that is harmful to them. They may have to engage with sites that have harmful content in order to turn them off.
If the Bill assumes that a rational adult should be able to find the tools to turn them on, would they not just as easily be able to find the tools to turn them off? Should they not be set on as the default? You could then make the choice to turn them off if that was what you wanted to engage with.
Paul Scully: That is understandable. Again, this has come up on a few occasions. The word “toggle” has been used quite a lot. There is no single approach to adhering to user enforcement duties, because it really depends on what the platform is and the actual technology behind it, such as whether it is just a simple button. It goes back to the reason we removed “legal but harmful” in the first place: freedom of speech and expression. We consider that to have them off in the first instance, understanding the examples you have just given, would be an automatic shield against people’s ability to explore what they want to explore on the internet.
Lord Parkinson: I am mindful that this is an area we will debate in Committee when the Bill is before us. I have already spoken to colleagues about it, particularly on the question of how to define the vulnerability of adults. We want to make sure that people are not shut off from the benefits of the internet. There is obviously a question of adults deciding whether to say that they are vulnerable. It is important that we get that right.
We want all people to have the same right of access to material online. As Paul says, we are mindful of the chilling effect on freedom of expression, which is why the Bill upholds that, while giving users the tools to decide what they see and interact with online. It is setting that balance, but the questions of definition and particularly of vulnerable adults will, I am sure, be well explored.
Paul Scully: Bear in mind that this is the third shield of the triple shield that we talk about. It is the safety net, if you like. You have already gone through two of those shields beforehand. If it is illegal, it goes. If it is against the terms and conditions, it goes.
I keep coming back to enforcing terms and conditions because the big platforms that are likely to be category 1 are, by their business model, broad. They attract advertisers; that is how they bring in their revenue. In their terms and conditions, they ought to and would be mad not to—they would barely have a business if they did not—have things that we would expect to be in priority content that would have otherwise been legal but harmful, such as abusive or racist behaviour. The user enforcement is a safety net catch-all.
Baroness Bull: To summarise, what I have heard you say is that the terms and conditions will not be informed by a risk assessment, so they will be guessing about the nature of that harm and who is affected by it. You have also told me that it is not going to be a standard on-off toggle, so finding the ability to turn on the user empowerment tools may not be as straightforward for people who are in a vulnerable condition.
Paul Scully: I say it is not a toggle only inasmuch as we are not being technology specific. We are not saying, “You must have a toggle”. Each company can approach it in whatever way. It may be a toggle. We are not stopping them from doing that, but we do not want to say, “You must have a single button to do this”.
We talk a lot about social media platforms, but I had Trustpilot in front of me yesterday, for example, which comes under some of these responsibilities because it has people giving reviews of their experiences with various services. You would not expect any of the harms we have been talking about to come up. It is in the name, “trust”, but you never know. It comes under the regime. It would not necessarily be appropriate for it to have a toggle talking about self-harm, legal suicide pages or these kind of things in that instance. That is what I meant about not being particularly specific.
Baroness Featherstone: To pursue the point on user control, I do not really agree with you. It would be better to put it in the hands of the users in the default mechanism that was specified. I do not think that is too much for companies. You yourself just said that, when faced with a lot of choice on accepting terms and conditions, or everything that flashes up every time you go on Google to find something, you accept because you cannot be bothered to go through it. A default mechanism would be crucial for individuals to control harms that might come their way that they wish not to see. I am a freedom of expression advocate and really strong on it, and I do not see them in conflict the way you do.
Paul Scully: I suppose this is the point that Lord Parkinson was saying you will debate when it comes in front of you, because you talked about the fact that you are giving the user the choice, but then you are saying it is off by default. As I say, it is very much a debating point. If you are giving the user that choice but it is already switched off, they do not know what is out there, whereas if you see something and you say, “I don’t want to see that; I will switch it off”, that is just as valid a reason, frankly. It is probably just a difference of opinion that will come out in the debate.
The Chair: As you say, I think this matter will be debated at some length once we get to the Committee stage of the Bill. On the risk assessment question, this is just a brief point. If the Secretary of State has committed to revisit this question as to whether risk assessments should be carried out by the platforms in relation to those categories of content that will be listed as applicable for user empowerment, there is an argument for their value in the context of freedom of speech as well. If user empowerment is an answer to ensuring freedom of speech but still involves categorising content, there is a question as to how the platforms are going about doing that in a way that also satisfies people’s concerns about platform control and freedom of speech.
I would not want any consideration of this by the department only to be through the prism of greater safety for adults. There is a value to this in freedom of speech as well. It just magnifies the problem that there is no simple answer to this tension between freedom of speech and protection. You have come up with a proposal, which is user empowerment, but, as part of that, risk assessment may still have a valid place.
Q6 Baroness Harding of Winscombe: I want to move us on to children. I am one of many people who have campaigned on child internet safety for the best part of a decade, and so I want to start by marking how important it is that this legislation gets on to the statute book to protect children. While we talk about all the detail and I am sure that my noble friends will do an awful lot of probing, challenging and advising, I ask these questions in the spirit of wanting to get this on to the statute book to protect children.
In removing “legal but harmful” for perfectly valid reasons—personally, I agree with removing it—there are unfortunately also some consequences for children. You will go from a protected child digital world to an entirely unrestricted adult world. Are you confident that, in removing the “legal but harmful” protections for adults, you have mitigated the negative impacts that there could be on children by creating that very stark dividing line?
Paul Scully: Yes. In terms of mitigation, I cannot sit here and guarantee that nobody going through that transition in age is going to see something harmful. That is just impossible to police and to enforce. With this Bill, I always say that we should not make perfection the enemy of the good. We have to get this through, understanding that things change and will improve.
We are already working with companies to better understand their age assurance regimes and age verification where appropriate. That is what I mean about not being technology specific, because Ofcom needs to assure itself that the companies have addressed this. It will be different for different platforms. Frankly, there will not be one approach that we can just roll out across all these platforms, because they are different in their nature. This is everything from the Lego website and Trustpilot, which I cited, through to Twitter. They all have a slightly different approach and will therefore need a different solution.
Yes, in answer to your question, I think we have mitigated that risk, but part of that mitigation is allowing Ofcom the space to assure itself that the measures are in place and that it can look at accurate and effective age verification and assurance.
Baroness Harding of Winscombe: Can I just follow up and push on a couple of areas where there is some debate? On age assurance, this completely black and white “children versus free-for-all” world puts a huge premium on age assurance being good enough. Otherwise, it is not about suddenly turning 18; you might be seven years old and, if the age assurance is not good enough, you could suddenly be in a very dangerous, unprotected world. Why would you not want Ofcom to publish minimum standards for age assurance, given that we have removed the protections of “legal but harmful”?
Paul Scully: Again, it is for the flexibility in future-proofing the legislation. Each provider will have to specify in its terms of service exactly what measures it is using to prevent underage access, and will have to apply those terms consistently. That goes back to what I was saying to Baroness Bull about how the terms and conditions and the approach we are taking need to be easily understandable to children through working with the platforms, but also to the parents.
I appreciate that you were talking about 16, 17 and 18 year-olds, but the whole point with protection is that we are not devolving parenting to Google or one of the other platforms. It is important that we make a landscape that is easy for parents to understand so that they can play their role in it as well.
Baroness Harding of Winscombe: Are we not doing exactly that, devolving responsibility to the tech platforms, by not setting minimum standards? This is technically complex, and my worry is that we think of it as a black box rather than trying to work out how, in plain English, you set some minimum standards or outcomes that you would expect from a fit-for-purpose age assurance product.
Orla MacRae: There has been some slight misunderstanding about the impact of the removal of the “legal but harmful” duties in terms of child protection, because there is not that impact. All the previous “legal but harmful” duties required of companies was to clearly say how they approached different types of content. They did not require platforms to limit or prohibit access to types of legal but harmful content, so what the internet looks like for adult users is not going to be vastly different.
There is another area that may be helpful for us to clarify. I know there has been this debate about minimum standards. It is really important to understand that Ofcom has that role. It will be Ofcom setting out what is acceptable and effective when it comes to meeting the safety duties set out in the Bill. Ofcom will be able to set out, in its codes of practice and other regulatory guidance, its expectation for the use of age assurance technologies. It can specify standards or principles for the use of those, including effectiveness and accessibility for different types of users.
There are also strong safeguards in the Bill with regard to privacy. When providers are choosing which safety processes or technologies they want to use, they need to have particular regard to users’ privacy. This will ensure not only that those age assurance technologies meet existing data protection law but that they consider the impact in the context of their use under the Bill.
I know there has been some debate about this issue, but we are confident that Ofcom will be the arbiter of what is sufficient in terms of compliance with the duties, including whether the age assurance is good enough. If a company said, “We are meeting our child safety duties because we are using this age assurance tool”, and it was very obvious to Ofcom, through either its own information-gathering powers or the use of a skilled person report, that that age assurance solution was not delivering sufficiently high confidence or was plain ineffective, Ofcom could take enforcement action against the company. I just wanted to clarify that there is not that gap. There are minimum standards, in effect, because that is what Ofcom sets out in its codes of practice.
Baroness Harding of Winscombe: Can I just play back and make sure I understand what you said? You are saying that Ofcom would have the freedom to effectively define minimum standards for age assurance in its codes of practice.
Orla MacRae: Yes.
Baroness Harding of Winscombe: That is hugely helpful. I want to ask two other things. One is staying tightly on children. It is about the definition of services that will be captured by the requirements. Again, the language really matters here in how we define which are the services used by children. Do we define it by the proportion of their users under a given age? Do we define it as whether children are likely to find either the services themselves or the app store that provides access to them? I would really love to hear from you, Minister, on how you define the services that we should be capturing in the child protection elements of the Bill.
Paul Scully: We are saying that a company is to be considered likely to be accessed by children not only if it already has a significant number of child users but if it is of a kind likely to attract a significant number of them. Again, Ofcom is able to step in here to override the company’s own conclusions about children’s use of services.
Baroness Harding of Winscombe: That is really helpful. What is your view on whether app stores are captured by this, such as Google Play and the Apple App Store?
Orla MacRae: App stores are not captured in the scope of the Bill.
Baroness Harding of Winscombe: Why not?
Orla MacRae: Because they are not a user-to-user or search service. They provide an infrastructure-like ability rather than controlling the particular types of content.
Baroness Harding of Winscombe: At the risk of sounding very dumb, they are a shop. If I am a retailer and I sell alcohol, I am not allowed to sell it to underage people. Why, if I am a retailer of digital apps, would I be allowed to sell those digital apps to underage children?
Orla MacRae: We put the duties on those who have the greatest level of control over what children access online, the people who build those apps and decide whether children can access them and what types of content they see on them.
Paul Scully: It is the user interaction. It is a good point, but we are not covering retail. We are covering user-generated content. Within those apps, there may be issues that come within the scope of the Bill.
Baroness Harding of Winscombe: I am sure that Apple is delighted that you do not think it is very powerful in its App Store.
The Chair: To push harder on that point, there is interest in why the app stores, as retailers, are not given greater responsibility for preventing children accessing the services that they are selling. Why is this something that you have not wanted to include in the Bill?
Paul Scully: Orla, step in if you want to, because you have been on it for five years. This is predominantly tackling user-generated content rather than products and the companies’ own areas. The apps themselves may generate that user-generated content that falls within the auspices of this Bill, but I always describe it as a Venn diagram. There are other areas we are looking at, such as the online advertising programme, that may be better suited to capture apps that are age specific but open to people below the age that is set. That can be covered under different legislation and programmes, but not necessarily within this Bill.
The Chair: It may be something that we can come back to. I am just about to wrap this up, but my colleague Lord Vaizey, whose last meeting this is, signalled that he wanted to ask a question.
Lord Vaizey of Didcot: Yes, I wanted to ask your question. I just wanted to reinforce what you and Baroness Harding have said, which is that Apple knows exactly what your age is when you buy an iPhone. The idea that it can flog whatever apps it likes to anyone willy-nilly is ridiculous. This is something we need to look at in the Lords, partly to make Orla’s life even more delightful than it has been for the past five years.
Paul Scully: There is one thing about that, actually. This is where age assurance comes in, because when you buy an iPhone—other phones are available—you know how old the credit card holder is. What you do not know is how old the user is at any given time, which is why age assurance is really important to assure the company not just of the age at that time but of the ongoing age of the user, in case someone else is taking someone’s credit card and those kinds of things. A wide range of technology is already being used to address that, such as facial recognition and keystroke technology.
Lord Vaizey of Didcot: Good answer.
Paul Scully: Thank you.
The Chair: I am going to draw this to a close. Thank you very much to the Ministers and to Orla MacRae for being here today. There are some issues on which there is clearly a collective position of the committee and, once you have left us, we will discuss some of those further. There is also a difference of views among us on specific parts of the Bill, so our noble friend Lord Parkinson will enjoy debating with us once we get to the full scrutiny of the Bill on the Floor of the House. I will leave it at that. Thank you very much for joining us today.
