Written evidence submitted by Ofcom (OSB0021)

Dear Julian, Damian,

As your Committees begin their work scrutinising the draft Online Safety Bill, I thought it would help to write and set out Ofcom’s perspective on the legislation.  This is of course just the beginning of a long period of Parliamentary engagement on the Bill.  I look forward to more detailed discussions with both your Committees through the autumn, and we will be happy to help with briefings and information.

This letter sets out:

• our assessment, based on our research, of why the legislation is needed and what it may seek to achieve.

• the key principles and features of the regime, seen from the operational perspective of the regulator.

• some of the key issues and trade-offs for Parliament to consider, as we seek to make the framework as effective as possible in delivering the Government’s objectives.

• by way of background, a description of the work we have already started in regulating video-sharing platforms established in the UK.

• the preparations we are making to ensure that Ofcom has the skills and resources to be an effective regulator for online safety.  

What an effective system of online safety regulation can achieve 

The wave of technological innovation that has built many of today’s most widely used and best-loved online services should be celebrated for the benefits it has brought to internet users.  Above all, new social media platforms and search services have transformed communications, allowing information to flow freely within and across countries and communities.   As well as driving productivity and helping businesses reach new markets, the internet economy has given users new opportunities to express themselves, communicate more freely and reach a wider, global audience. 

However, the very rapid growth of new services, reaching a scale and breadth of users that is unprecedented, has created some serious challenges.  Companies have too often prioritised growth without giving sufficient consideration to user safety.  We have seen harms scale rapidly, driven by the same data and network economies that have turbocharged the adoption of online services so rapidly across the world.  Ofcom’s own research indicates that 81% of 12-15-year-olds and 62% of adults say they have had a potentially harmful experience online in the past year.[1] Younger internet users aged 12-15 are particularly concerned about bullying, abusive behaviour, hate speech and content promoting self-harm.[2]  Two thirds of adults now support increased regulation for social media.[3]  For some the benefits of freedom of expression have been reversed as they fear attacks and bullying if they express their views online.  

In recent years the platforms have begun to respond to these concerns and have taken steps to adjust algorithms and redesign their services in order to prevent the most serious harms.  User complaints are better moderated and community guidelines have been introduced by most services.   These initiatives – plus cooperation with enforcement and protection agencies to tackle the most serious harms such as child sexual abuse – are welcome.  However, there are no common baselines for assessing the standards different platforms are adopting, and there is no transparency for the public and Parliament on the impact of any changes. In particular, decisions on how to moderate content inevitably involve trade-offs with freedom of expression.   These decisions are currently being made by private companies without democratic oversight.      

We therefore strongly welcome the Government’s draft Bill and its intention to appoint Ofcom as the regulator for Online Safety.    We believe that the legislation – with Ofcom’s oversight as the regulator – has the potential to drive a step change in safety standards across the industry, together with a significant improvement in transparency and accountability for internet users, the public and Parliament. 

The key principles of the regime

Designing the right legislative and regulatory approach to these challenges is a complex task, and inevitably involves some trade-offs.  We believe that the underlying approach of the Bill – putting the onus on the platforms to assess and respond to risks to users, and to design systems and processes to address them – is the right one.  Regulation based solely on enforcement against fixed rules would not be effective for two reasons.  First, these are services where change and innovation are so rapid and so constant that we need an approach to regulation that can respond at speed. Second, the sector itself overwhelmingly drives the relevant technological innovation, from which users derive significant benefit, and this means that the industry itself is best placed to design and own the technical solutions and be held to account for their success or failure.  

There are several elements of the legislative framework set out in the draft Bill which we believe are particularly important to make this regulatory approach effective and to achieve lasting change.

First, the legislation requires transparency from the platforms.  This will make them truly accountable for the first time, with Ofcom overseeing and reporting on their efforts on behalf of Parliament and the public.    The platforms will be required to carry out comprehensive risk assessments, to set out clearly the steps they are taking to address harms to users, to have regard to the importance of protecting users’ freedom of expression and privacy, and – for the biggest platforms with the widest reach – to protect journalistic and democratic content and to publish regular transparency reports.  Ofcom will report regularly and publicly on the industry’s progress.  To do this we will use information gathered from the platforms themselves using our statutory information powers, alongside our own research and monitoring and that of third parties.   Taken together, these are powerful steps forward in addressing the transparency and accountability that have been lacking until now.   

Second, Ofcom’s role will be to look at the platforms’ approach to improve the safety of online users, not to determine whether particular items of content should or should not be made available, or to set content standards. It will be our job to assess the systems and processes used in individual firms and across the industry, and to ensure that companies take a preventative approach to risk.  This is different to the role we play now on broadcasting complaints, where we assess individual broadcast programmes for compliance with the Broadcasting Code.   

We are still developing our view of how best to assess platforms’ systems and processes to ensure we focus on the right elements.  We expect that key elements will include processes to respond to user complaints; the means by which platforms ensure that their terms and conditions are complied with when harmful content is identified; and the way that services are designed including the role of recommendation algorithms. We will also continue to research how technological developments in automated tools may help platforms identify harmful content, in particular to understand their accuracy and commercial viability.

Third, Ofcom will set out clear expectations of companies in Codes, which will be intended to help platforms determine their approach to assessing and mitigating online safety risks.   The codes will have the capacity to provide new industry standards, as well as being a guide to compliance for individual firms.   We will adopt a collaborative approach to the development of Codes, not just with the industry but also with other interested parties and experts. Once established, the codes should be a help to smaller and emerging platforms, allowing them to benefit from the experience of others.

The draft Bill is clear that all businesses hosting user-generated content and search services should expect to take proportionate steps and build safety into their process and service-design thinking. But the firms that present the highest and most wide-reaching risk to users should face the greatest expectations, including demonstrating best practice and supporting industry initiatives. This recognition of the diversity of the services in scope is an important aspect of the regime and will help to support competition and innovation. 

Finally, the Bill gives Ofcom as the regulator a wide range of compliance tools, fines and sanctions so that we can take action where we see significant harm that is not being addressed. These range from the use of transparency, as described above, to shine a light on platforms’ approaches and processes to help users make better informed decisions about the services they use, through to harder-edged enforcement action with sanctions in the most serious cases. We will expect to work constructively with platforms in the first instance to seek to achieve compliance, and will use our enforcement tools where we consider the evidence shows they are necessary and justified, including where platforms are not prepared to engage. We are keenly aware of the challenges of delivering effective enforcement against services located outside of the UK and our enforcement tools will be supported by cooperation with counterparts in other countries.

Throughout, our approach to the new regime we will be to seek to ensure that it upholds the importance of freedom of expression – which is a fundamental right - online[4]. When it comes to regulatory oversight, Ofcom has significant experience of making decisions in this area, operating as an impartial and independent regulator.  Ultimately, however, it is a question for Parliament as to how the right balance should be struck in law between protecting users from harm and upholding freedom of expression.

Key issues and trade-offs

The design of the legislation involves important policy judgments which are clearly a matter for the Government and for Parliament – including the definition of harms that are in scope.  

When it comes to the operation of the regime, with issues as complex and fast moving as this, there are inevitably some difficult judgments to make in framing the legislative approach.  From a regulatory perspective there are three sets of issues which we believe are critical for a workable regime, and which may be useful for Parliament to consider. 

1)      The right range of tools    

As I have described above, the Bill has the capacity to achieve a step change in transparency and accountability, to the benefit of users and the public.   For Ofcom to achieve this we must be able to gather the information we need from platforms to understand the impact of their actions and test the effectiveness of their approaches to mitigating harms.   Flexibility for the regulator to determine the scope of the information we request, and to shape the content and coverage of platforms’ transparency reports, is essential.  We think the draft Bill puts us in a good position on these issues, but we would be concerned about any narrowing of these powers through the Parliamentary process.  

In addition to being able to shine a light on platform practices through effective information gathering powers, we need to have the right tools to act quickly where we see an urgent risk of serious harm.  One particularly difficult issue is in relation to any mandated use of automated tools to detect illegal content such as child sexual abuse images.  It is clearly for Parliament to decide whether and in what circumstances Ofcom should be given a power to require the use of such technologies to detect seriously harmful material, particularly on private channels, taking account of the important concerns about risks to individuals’ privacy and online freedoms that can arise through their use. We believe that the bar for Ofcom to be able to require the use of these technologies should be high.  But if we are given these powers, we will need to be able to use them effectively.  In this regard, we need to avoid a catch-22 whereby it is only through the deployment of these technologies that we are able to generate a threshold of evidence that justifies our requiring their use.

2)      Providing clarity and flexibility

In any regulatory regime, it is important that regulated companies are as clear as possible about what is expected of them, to create sufficient certainty and avoid stifling investment and innovation.  Clarity is also essential for the regulator, so that it can identify breaches and take action. One way in which such clarity can be achieved is through clear, workable definitions and rules being included in primary or secondary legislation in key areas.

However, this clarity for industry and the regulator needs to be achieved without reducing flexibility in such a rapidly evolving sector. The Bill seeks to achieve the right balance by specifying the safety duties at a high level and enabling regulated companies to decide how they choose to comply with the duty of care. Although Ofcom will produce codes of practice these will be non-binding, and companies will have a choice to adopt a different route to compliance through the “comply or equivalence” approach.  This means that a regulated company can either comply with the codes or instead argue that they are complying with the safety duties in a different way to that set out in the codes.  

We believe that leaning towards flexibility is right. However, it is important to acknowledge that this approach, whereby platforms can choose to take a different approach than the industry standard established in codes, will make it harder for Ofcom to judge compliance with the safety duties and ultimately to enforce against any breaches, particularly if the safety duties themselves are specified at a high level.

3)      The roles of the independent regulator and Government

For a regime to work effectively, there also needs be clarity about the respective roles of all those involved in determining the legislative framework, including who is accountable for which decisions. 

The draft Bill sets out the powers and duties of the regulator and ministers.  The powers for ministers to direct the regulator under this regime are extensive, and in a number of areas we believe this is appropriate and necessary.  For example, there will clearly be some issues where the Government has access to expertise or information that the regulator does not, such as national security. The pace of change in the sector also means that it is entirely appropriate, in our view, for ministers to retain significant flexibility to reshape the regime through secondary legislation in the early years.

However, this flexibility needs to be weighed against the need for the regulator to be able to show a clear and evidence-based line of decision making, including in how codes are established, as well as on individual regulatory decisions.  This is particularly important given the likelihood that some decisions will be challenged in the courts.

How Ofcom is preparing for our new role

This is a complex new regime, and the UK is one of the first countries in the world to plan to regulate in this way.  I am delighted that Ofcom has been asked to take on this role, and we believe we can make a success of it.   We are clear that we need to put significant effort into being ready and ensuring that we have the skills and expertise to do the job well. 

Video-sharing platforms

As you know, Ofcom is already regulating some social media platforms and other services for video-sharing, through the transposition of the Audiovisual Media Services Directive (AVMSD). The new regime covers video-sharing platforms established in the UK such as TikTok, Snapchat, and OnlyFans. The regulations have been in force since 1 November 2020 as the Government mobilised the secondary legislation to enact the regime quickly. The UK is significantly ahead of EU countries in its implementation of the Directive. Some of the largest services such as YouTube and Facebook are expected to fall to Irish jurisdiction, where we understand legislation is likely to be introduced in the coming year.

Although the VSP regime will be absorbed into the more comprehensive online safety regime in a few years’ time, and differs in a few important respects from the approach set out in the Bill, it is an excellent test-bed for the approaches we need to adopt.   

Over the last 10 months Ofcom has been in a period of implementation to prepare for the new role. We have engaged extensively with platforms and a broad range of online stakeholders; published new consumer research on user experiences of potential harms on VSPs; commissioned expert reports from the Alan Turing Institute on online hate and the University of East London on protection of minors online; and consulted publicly on draft regulatory guidance for VSPs about the measures they should take to protect users.[5]  

In Autumn 2022 we will publish our first annual VSP report assessing the state of play across the industry. This will be the first cross-cutting report of its kind by any regulator, providing transparency for the public on the steps that in-scope platforms are taking to protect their users.  It will shine a light on important aspects of online safety such as age-appropriate protections on platforms popular with teens, age verification on adult sites, and reporting and flagging mechanisms for harmful content.  It will help users, parents, and the wider public to compare what platforms are doing to protect their customers, so they can make better informed decisions.

In a few weeks’ time we will be publishing guidance for platforms, alongside a document setting out our approach to VSP regulation and our priorities for the next twelve months.  We would be very happy to give the Committees a fuller briefing on this at any point if this is helpful.

Wider preparations for the Online Safety regime

Although regulating VSPs is very helpful in getting us started, the scale and ambition of the full online safety regime will require a significant increase in skills and experience in Ofcom, particularly in online technologies, data analytics and new digital communications services.  

Since Ofcom’s role was first mooted about two years ago, we have been gradually building our preparations.  Our funding over the next few years is subject to discussions as part of the spending review, but we have agreed some temporary budget cover with DCMS to allow us to invest in advance of fees being raised from the industry as envisaged in the Bill.   In January, following the Government’s confirmation that Ofcom would be the online safety regulator, we put our plans onto a full programme footing with a dedicated director to ensure coherence between our policy work and operational planning. 

The main areas where we are investing in our skills and capability include:

• a new Technology function, to extend Ofcom’s traditional expertise in telecoms and spectrum into online and digital technologies.  This will be led by Sachin Jogia, who joins us from Amazon in October as Chief Technology Officer;

• data engineering and analytics, where we have already built a central team skilled in specialist techniques related to the collection and analysis of data at scale. We are now looking at how we can use AI and machine learning techniques to extract new insights from data and tackle complex data sets, including in the online space. We are also improving our understanding of how businesses use machine learning algorithms to deliver services. Subject to our funding, we will continue hiring data specialists into next year;

• policy expertise in online harms and online services – we have already recruited significant expertise from bodies as varied as the NSPCC, Internet Watch Foundation, 5Rights Foundation, NewsGuard, Centre for Data Ethics and Innovation, Albany Associates, platforms such as Google and an advisor to the UN Special Rapporteur on Minority Issues;

• research into online harms and behaviours.  This includes the research on video-sharing platforms mentioned above, and specific research into adults and children in the UK and how they use online services, as part of our Making Sense of Media programme which seeks to improve the online skills, knowledge and understanding of UK adults and children;[6]

• a new Ofcom hub in Manchester, which we announced in March.  This will be a base for our new tech functions, including prospective partnerships with industry and universities, and will open this autumn.  

The complexity of the Online Safety regime, and the global reach of the platforms we will be regulating, means that our partnerships with other bodies will be even more important than usual. As well as developing initial working relationships with platforms such as Google and Facebook, we are already investing time and effort in these wider partnerships.  We will need:

• close working relationships with Government departments and agencies across the UK with relevant expertise, particularly in relation to CSEA and terrorism;

• strong partnerships with universities, research bodies and third sector organisations like the IWF and NSPCC who share our interest in and passion for online safety and can bring specific expertise;

• deeper joint working with other UK regulators, which we have started under the auspices of the DRCF.  The work plan for this group was set out in Spring 2021 in response to our collective challenge of tackling online regulation.[7]

• strong relationships with international partners, including other regulators who are grappling with similar issues and developing regulatory regimes in this area (for instance, engagement with EU partners on the proposed Digital Services Act, and with Australian and Canadian counterparts on their respective legislative initiatives).  

The final resourcing for the regime will, naturally, depend on the outcome of the spending review as well as the final scope of the regime as defined in legislation.  For the regime as set out in the draft Bill, we expect that we will need around 300 additional people in Ofcom over the next few years.  This is in addition to our current headcount of around 1,000 full-time equivalent staff.    While this is a significant increase, it compares with the current size of the FCA at 4,200 staff and the HSE at 2,400.   We will be building on our existing bench-strength as a regulator in a number of respects – including in areas like technology, economics and legal expertise; in our experience of safeguarding freedom of expression while protecting users from harm; and by bringing to bear our experience as an economic regulator, with commercial and market developments always present in our decision-making.   This is a critical reason why we believe we can do the job of online safety regulation efficiently, as well as effectively. 

Some have asked whether Ofcom’s new responsibilities will stretch us too far, given our existing remit on telecoms, post, broadcasting and spectrum.  We are under no illusions about the challenges of our new duties.  However, one of the reasons we believe we can do the job well is because there is so much synergy between what we do now, and the new challenge of online regulation.   The companies in our sectors are increasingly stretching their services across traditional boundaries.  Telecoms networks are migrating from traditional hardware solutions to more flexible software-defined networks, increasingly using cloud technologies provided by the likes of Amazon, Microsoft and Google. Today’s communications services, whether WhatsApp or Zoom, are provided by traditional telecoms operators and internet-based companies working in tandem across the communications value chain. Those networks are increasingly being relied upon to deliver TV and video content, alongside traditional broadcast networks, as people value the flexibility to watch what they want, when they want, on a device of their choosing. As a result of these industry shifts, we have already built strong working relationships with companies like Amazon and Google.

The communications services people now enjoy and rely upon are more converged than ever; more than was envisaged when Ofcom was created almost 20 years ago. I believe that the case for a converged communications regulator has never been stronger.   Our mission – to make communications work for everyone – is as relevant to Ofcom in the future as it was when we were created in 2003. 

I have set out here an overview of Ofcom’s reflections at the current time. As the process of scrutiny gets underway there may be new areas or issues to discuss and I look forward to ongoing engagement with you and your Committees during the coming weeks, and to supporting Parliament during the passage of the Bill.  I am copying this letter to the Secretary of State for Digital, Culture, Media and Sport, and the Home Secretary.

Yours sincerely,

MELANIE DAWES

13 September 2021