Legislation – Online Safety Act 2023
Changes to legislation:
There are currently no known outstanding effects for the Online Safety Act 2023, CHAPTER 2.
Changes to Legislation
Revised legislation carried on this site may not be fully up to date. At the current time any known changes or effects made by subsequent legislation have been applied to the text of the legislation you are viewing by the editorial team. Please see ‘Frequently Asked Questions’ for details regarding the timescales for which new effects are identified and recorded on this site.
PART 4Other duties of providers of regulated user-to-user services and regulated search services
CHAPTER 2Reporting child sexual exploitation and abuse content
66Requirement to report CSEA content to the NCA
(1)
A UK provider of a regulated user-to-user service must operate the service using systems and processes which secure (so far as possible) that the provider reports all detected and unreported CSEA content present on the service to the NCA.
(2)
A non-UK provider of a regulated user-to-user service must operate the service using systems and processes which secure (so far as possible) that the provider reports all detected and unreported UK-linked CSEA content present on the service to the NCA (and does not report to the NCA CSEA content which is not UK-linked).
(3)
A UK provider of a regulated search service must operate the service using systems and processes which secure (so far as possible) that the provider reports all detected and unreported CSEA content present on websites or databases capable of being searched by the search engine to the NCA.
(4)
A non-UK provider of a regulated search service must operate the service using systems and processes which secure (so far as possible) that the provider reports all detected and unreported UK-linked CSEA content present on websites or databases capable of being searched by the search engine to the NCA (and does not report to the NCA CSEA content which is not UK-linked).
(5)
A UK provider of a combined service must comply with the requirement under subsection (3) in relation to the search engine of the service.
(6)
A non-UK provider of a combined service must comply with the requirement under subsection (4) in relation to the search engine of the service.
(7)
Providers’ reports under this section—
(a)
must meet the requirements set out in regulations under section 67, and
(b)
must be sent to the NCA in the manner, and within the time frames, set out in those regulations.
(8)
If a person is the provider of more than one regulated user-to-user service or regulated search service, requirements under this section apply in relation to each such service.
(9)
Terms used in this section are defined in section 70.
(10)
This section applies only in relation to CSEA content detected on or after the date on which this section comes into force.
67Regulations about reports to the NCA
(1)
The Secretary of State must make regulations in connection with the reports that are to be made to the NCA (including by non-UK providers) as required by section 66.
(2)
The regulations may make provision about—
(a)
the information to be included in the reports,
(b)
the format of the reports,
(c)
the manner in which the reports must be sent to the NCA,
(d)
the time frames for sending the reports to the NCA (including provision about cases of particular urgency),
(e)
the records that providers must keep in relation to the reports, or the details that providers must retain as evidence that they have made the reports, and
(f)
such other matters relating to the reports as the Secretary of State considers appropriate.
(3)
The regulations may also—
(a)
require providers to retain, for a specified period, data of a specified description associated with a report, and
(b)
impose restrictions or requirements in relation to the retention of such data (including how the data is to be secured or stored or who may access the data).
(4)
The power to require the retention of data associated with a report includes power to require the retention of—
(a)
content generated, uploaded or shared by any user mentioned in the report (or metadata relating to such content), and
(b)
user data relating to any such person (or metadata relating to such data).
“User data” here has the meaning given by section 231.
(5)
Before making regulations under this section, the Secretary of State must consult—
(a)
the NCA,
(b)
OFCOM, and
(c)
such other persons as the Secretary of State considers appropriate.
68NCA: information sharing
“(oa)
the exercise of any function of OFCOM (the Office of Communications) under the Online Safety Act 2023;”.
69Offence in relation to CSEA reporting
(1)
A person commits an offence if, in purported compliance with a requirement under section 66—
(a)
the person provides information that is false in a material respect, and
(b)
at the time the person provides it, the person knows that it is false in a material respect or is reckless as to whether it is false in a material respect.
(2)
A person who commits an offence under this section is liable—
(a)
on summary conviction in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court or a fine (or both);
(b)
on summary conviction in Scotland, to imprisonment for a term not exceeding 12 months or a fine not exceeding the statutory maximum (or both);
(c)
on summary conviction in Northern Ireland, to imprisonment for a term not exceeding 6 months or a fine not exceeding the statutory maximum (or both);
(d)
on conviction on indictment, to imprisonment for a term not exceeding 2 years or a fine (or both).
70Interpretation of this Chapter
(1)
This section applies for the purposes of this Chapter.
(2)
A provider of a regulated user-to-user service or a regulated search service is a “UK provider” of the service if the provider is—
(a)
an individual or individuals who are habitually resident in the United Kingdom, or
(b)
an entity incorporated or formed under the law of any part of the United Kingdom.
(3)
Otherwise, a provider of a regulated user-to-user service or a regulated search service is a “non-UK provider” of the service.
(4)
CSEA content is “detected” by a provider when the provider becomes aware of the content, whether by means of the provider’s systems or processes or as a result of another person alerting the provider.
(5)
CSEA content is “unreported”, in relation to a provider, if the reporting of that content is not covered by arrangements (mandatory or voluntary)—
(a)
by which the provider reports content relating to child sexual exploitation or abuse to a foreign agency, or
(b)
by which an entity that is a group undertaking in relation to the provider reports content relating to child sexual exploitation or abuse to—
(i)
the NCA, or
(ii)
a foreign agency.
(6)
CSEA content is “UK-linked” if a provider has evidence of a link between the content and the United Kingdom, based on any of the following—
(a)
the place where the content was published, generated, uploaded or shared;
(b)
the nationality of a person suspected of committing the related offence;
(c)
the location of a person suspected of committing the related offence;
(d)
the location of a child who is a suspected victim of the related offence.
(7)
In this Chapter—
“CSEA content” has the same meaning as in Part 3 (see section 59);
“foreign agency” means a person exercising functions in a country outside the United Kingdom which correspond to the NCA’s functions insofar as they relate to receiving and disseminating reports about CSEA content;
“group undertaking” has the meaning given by section 1161(5) of the Companies Act 2006;
“NCA” means the National Crime Agency.
(8)
Sections 1161(5) and 1162 of, and Schedule 7 to, the Companies Act 2006—
(a)
are to apply in relation to an entity which is not an undertaking (as defined in section 1161(1) of that Act) as they apply in relation to an undertaking, and
(b)
are to be read with any necessary modifications if applied to an entity formed under the law of a country outside the United Kingdom.