Revised legislation carried on this site may not be fully up to date. At the current time any known changes or effects made by subsequent legislation have been applied to the text of the legislation you are viewing by the editorial team. Please see ‘Frequently Asked Questions’ for details regarding the timescales for which new effects are identified and recorded on this site.

PART 7OFCOM’s powers and duties in relation to regulated services

CHAPTER 4Information

Information powers and information notices

100Power to require information

(1)

OFCOM may by notice under this subsection require a person within subsection (5) to provide them with any information that they require for the purpose of exercising, or deciding whether to exercise, any of their online safety functions.

(2)

The power conferred by subsection (1) includes power to require a person within subsection (5) to—

(a)

obtain or generate information;

(b)

provide information about the use of a service by a named individual.

(3)

The power conferred by subsection (1) also includes power to require a person within any of paragraphs (a) to (d) of subsection (5) to take steps so that a person authorised by OFCOM is able to view remotely—

(a)

information demonstrating in real time the operation of systems, processes or features, including functionalities and algorithms, used by a service;

(b)

information generated by a service in real time by the performance of a test or demonstration of a kind required by a notice under subsection (1).

(4)

But the power conferred by subsection (1) must be exercised in a way that is proportionate to the use to which the information is to be put in the exercise of OFCOM’s functions.

(5)

The persons within this subsection are—

(a)

a provider of a user-to-user service or a search service,

(b)

a provider of an internet service on which regulated provider pornographic content is published or displayed,

(c)

a person who provides an ancillary service (within the meaning of section 144) in relation to a regulated service (see subsections (11) and (12) of that section),

(d)

a person who provides an access facility (within the meaning of section 146) in relation to a regulated service (see subsections (10) and (11) of that section),

(e)

a person who was within any of paragraphs (a) to (d) at a time to which the required information relates, and

(f)

a person not within any of paragraphs (a) to (e) who appears to OFCOM to have, or to be able to generate or obtain, information required by them as mentioned in subsection (1).

(6)

The information that may be required by OFCOM under subsection (1) includes, in particular, information that they require for any one or more of the following purposes—

(a)

the purpose of assessing compliance with—

(i)

any duty or requirement set out in Chapter 2, 3, 4 or 5 of Part 3,

(ii)

any duty set out in section 64 (user identity verification),

(iii)

any requirement under section 66 (reporting CSEA content),

(iv)

any duty set out in section 71 or 72 (terms of service),

(v)

any duty set out in section 75 (deceased child users),

(vi)

any requirement relating to transparency reporting (see section 77(3) and (4)), or

(vii)

any duty set out in section 81 (provider pornographic content);

(b)

the purpose of assessing compliance with a requirement under section 83 (duty to notify OFCOM in relation to the charging of fees);

(c)

the purpose of a consultation about a threshold figure as mentioned in section 86 (threshold figure for the purposes of charging fees);

(d)

the purpose of ascertaining the amount of a person’s qualifying worldwide revenue for the purposes of—

(i)

Part 6 (fees), or

(ii)

paragraph 4 or 5 of Schedule 13 (amount of penalties etc);

(e)

the purpose of assessing compliance with any requirements imposed on a person by—

(i)

a notice under section 121(1) (notices to deal with terrorism content and CSEA content), or

(ii)

a confirmation decision;

(f)

the purpose of assessing the accuracy and effectiveness of technology required to be used by—

(i)

a notice under section 121(1), or

(ii)

a confirmation decision;

(g)

the purpose of assessing whether to give a notice under section 121(1) relating to the development or sourcing of technology (see subsections (2)(b) and (3)(b) of that section);

(h)

the purpose of dealing with complaints made to OFCOM under section 169 (super-complaints);

(i)

the purpose of OFCOM’s advice to the Secretary of State about provision to be made by regulations under paragraph 1 of Schedule 11 (threshold conditions for categories of Part 3 services);

(j)

the purpose of determining whether a Part 3 service meets threshold conditions specified in regulations under paragraph 1 of Schedule 11;

(k)

the purpose of preparing a code of practice under section 41;

(l)

the purpose of preparing guidance in relation to online safety matters;

(m)

the purpose of carrying out research, or preparing a report, in relation to online safety matters;

(n)

the purpose of complying with OFCOM’s duties under section 11 of the Communications Act, so far as relating to regulated services (media literacy).

F1(7)

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(8)

The reference in subsection (3) to a person authorised by OFCOM is to a person authorised by OFCOM in writing for the purposes of notices that impose requirements of a kind mentioned in that subsection, and such a person must produce evidence of their identity if requested to do so by a person in receipt of such a notice.

F2(8A)

The power to give a notice conferred by subsection (1) does not include power to require processing of personal data that would contravene the data protection legislation (but in determining whether processing of personal data would do so, the duty imposed by the notice is to be taken into account).

(9)

The power conferred by subsection (1) does not include power to require the provision of information in respect of which a claim to legal professional privilege, or (in Scotland) to confidentiality of communications, could be maintained in legal proceedings.

(10)

In this section—

“information” includes documents, and any reference to providing information includes a reference to producing a document (and see also section 102(11));

“regulated provider pornographic content” and “published or displayed” have the same meaning as in Part 5 (see section 79).

101Information in connection with an investigation into the death of a child

F3A1

Subsection (C1) applies if a senior coroner (in England and Wales), a procurator fiscal (in Scotland) or a coroner (in Northern Ireland) (“the investigating authority”)—

(a)

notifies OFCOM that they are conducting an investigation in connection with the death of a child, and

(b)

provides OFCOM with the details in subsection (B1).

B1

The details are—

(a)

the name of the child who has died,

(b)

the child’s date of birth,

(c)

any email addresses used by the child (so far as the investigating authority knows), and

(d)

if any regulated service has been brought to the attention of the investigating authority as being of interest in connection with the child’s death, the name of the service.

C1

Where this subsection applies, OFCOM—

(a)

must give a notice to the provider of a service within subsection (E1) requiring the provider to ensure the retention of information relating to the use of the service by the child who has died, and

(b)

may give a notice to any other relevant person requiring the person to ensure the retention of information relating to the use of a service within subsection (E1) by that child.

D1

The references in subsection (C1) to ensuring the retention of information relating to the child’s use of a service include taking all reasonable steps, without delay, to prevent the deletion of such information by the routine operation of systems or processes.

E1

A service is within this subsection if it is—

(a)

a regulated service of a kind described in regulations made by the Secretary of State, or

(b)

a regulated service notified to OFCOM by the investigating authority as described in subsection (B1)(d).

F1

A notice under subsection (C1) may require information described in that subsection to be retained only if it is information—

(a)

of a kind which OFCOM have power to require under a notice under subsection (1) (see, in particular, subsection (2)(a) to (d)), or

(b)

which a person might need to retain to enable the person to provide information in response to a notice under subsection (1) (if such a notice were given).

G1

OFCOM must share with the investigating authority any information they receive in response to requirements mentioned in section 102(5A)(d) that are included in a notice under subsection (C1).

(1)

OFCOM may by notice under this subsection require a relevant person to provide them with information for the purpose of—

(a)

responding to a notice given by a senior coroner under paragraph 1(2) of Schedule 5 to the Coroners and Justice Act 2009 in connection with an investigation into the death of a child, or preparing a report under section 163 in connection with such an investigation;

(b)

responding to a request for information in connection with the investigation of a procurator fiscal into, or an inquiry held or to be held in relation to, the death of a child, or preparing a report under section 163 in connection with such an inquiry;

(c)

responding to a notice given by a coroner under section 17A(2) of the Coroners Act (Northern Ireland) 1959 (c. 15 (N.I.)) in connection with—

(i)

an investigation to determine whether an inquest into the death of a child is necessary, or

(ii)

an inquest in relation to the death of a child,

or preparing a report under section 163 in connection with such an investigation or inquest.

(2)

The power conferred by subsection (1) includes power to require a relevant person to provide OFCOM with information about the use of a regulated service by the child whose death is under investigation, including, in particular—

(a)

content encountered by the child by means of the service,

(b)

how the content came to be encountered by the child (including the role of algorithms or particular functionalities),

(c)

how the child interacted with the content (for example, by viewing, sharing or storing it or enlarging or pausing on it), and

(d)

content generated, uploaded or shared by the child.

(3)

The F4powers conferred by this section include power to require a relevant person to obtain or generate information.

(4)

The power conferred by subsection (1) must be exercised in a way that is proportionate to the purpose mentioned in that subsection.

(5)

F5(5A)

The powers to give a notice conferred by this section do not include power to require processing of personal data that would contravene the data protection legislation (but in determining whether processing of personal data would do so, the duty imposed by the notice is to be taken into account).

(6)

Nothing in this section limits the power conferred on OFCOM by section 100.

(7)

In this section—

“information” includes documents, and any reference to providing information includes a reference to producing a document (and see also section 102(11));

“inquiry” means an inquiry held, or to be held, under the Inquiries into Fatal Accidents and Sudden Deaths etc. (Scotland) Act 2016 (asp 2);

“relevant person” means a person within any of paragraphs (a) to (e) of section 100(5).

102Information notices

(1)

A notice given under section 100(1) or F6101(C1) or (1) is referred to in this Act as an information notice.

(2)

An information notice may require information in any form (including in electronic form).

(3)

An information notice F7under section 100(1) or 101(1) must—

(a)

specify or describe the information to be provided,

(b)

specify why OFCOM require the information,

(c)

specify the form and manner in which it must be provided, F8…

F9(ca)

specify when the information must be provided (which may be on or by a specified date, within a specified period, or at specified intervals), and

(d)

contain information about the consequences of not complying with the notice.

F10(4)

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(5)

An information notice requiring a person to take steps of a kind mentioned in section 100(3) must give the person at least seven days’ notice before the steps are required to be taken.

F11(5A)

An information notice under section 101(C1) must—

(a)

specify or describe the information to be retained,

(b)

specify why OFCOM require the information to be retained,

(c)

require the information to be retained for the period of one year beginning with the date of the notice,

(d)

require the person to whom the notice is given—

(i)

if the child to whom the notice relates used the service in question, to notify OFCOM by a specified date of steps taken to ensure the retention of information;

(ii)

if the child did not use the service, or the person does not hold any information of the kind required, to notify OFCOM of that fact by a specified date, and

(e)

contain information about the consequences of not complying with the notice.

(5B)

If OFCOM give an information notice to a person under section 101(C1), they may, in response to information received from the investigating authority, extend the period for which the person is required to retain information by a maximum period of six months.

(5C)

The power conferred by subsection (5B) is exercisable—

(a)

by giving the person a notice varying the notice under section 101(C1) and stating the further period for which information must be retained and the reason for the extension;

(b)

any number of times.

(6)

An information notice may specify a place at which, and a person to whom, information is to be provided.

(7)

A person to whom a document is produced in response to an information notice may—

(a)

take copies of, or extracts from, the document;

(b)

require the person producing the document, or a person who is or was an officer of that person, or (in the case of a partnership) a person who is or was a partner, to give an explanation of it.

(8)

A person to whom an information notice is given has a duty—

(a)

to act in accordance with the requirements of the notice, and

(b)

to ensure that the information provided is accurate in all material respects.

(9)

OFCOM may cancel an information notice by notice to the person to whom it was given.

F12(9A)

OFCOM must cancel an information notice under section 101(C1) by notice to the person to whom it was given if advised by the investigating authority that the information in question no longer needs to be retained.

(10)

In this section—

“information” includes documents, and any reference to providing information includes a reference to producing a document;

F13“the investigating authority” has the same meaning as in section 101;

“officer”, in relation to an entity, includes a director, a manager, an associate, a secretary or, where the affairs of the entity are managed by its members, a member.

(11)

In relation to information recorded otherwise than in a legible form, references in this section to producing a document are to producing a copy of the information—

(a)

in a legible form, or

(b)

in a form from which it can readily be produced in a legible form.

103Requirement to name a senior manager

(1)

This section applies where—

(a)

OFCOM give a provider of a regulated service an information notice, and

(b)

the provider is an entity.

(2)

OFCOM may include in the information notice a requirement that the provider must name, in their response to the notice, an individual who the provider considers to be a senior manager of the entity and who may reasonably be expected to be in a position to ensure compliance with the requirements of the notice.

(3)

If OFCOM impose a requirement to name an individual, the information notice must—

(a)

require the provider to inform such an individual, and

(b)

include information about the consequences for such an individual of the entity’s failure to comply with the requirements of the notice (see section 110).

(4)

An individual is a “senior manager” of an entity if the individual plays a significant role in—

(a)

the making of decisions about how the entity’s relevant activities are to be managed or organised, or

(b)

the actual managing or organising of the entity’s relevant activities.

(5)

An entity’s “relevant activities” are activities relating to the entity’s compliance with the regulatory requirements imposed by this Act in connection with the regulated service to which the information notice in question relates.

Skilled persons’ reports

104Reports by skilled persons

(1)

OFCOM may exercise the powers in this section where they consider that it is necessary to do so for either of the following purposes—

(a)

assisting OFCOM in identifying and assessing a failure, or possible failure, by a provider of a regulated service to comply with a relevant requirement, or

(b)

developing OFCOM’s understanding of—

(i)

the nature and level of risk of a provider of a regulated service failing to comply with a relevant requirement, and

(ii)

ways to mitigate such a risk.

(2)

But the powers in this section may be exercised for a purpose mentioned in subsection (1)(b) only where OFCOM consider that the provider in question may be at risk of failing to comply with a relevant requirement.

(3)

Section 122 requires OFCOM to exercise the power in subsection (4) for the purpose of assisting OFCOM in connection with a notice under section 121(1).

(4)

OFCOM may appoint a skilled person to provide them with a report about matters relevant to the purpose for which the powers under this section are exercised (“the relevant matters”), and, where OFCOM make such an appointment, they must notify the provider about the appointment and the relevant matters to be explored in the report.

(5)

Alternatively, OFCOM may give a notice to the provider—

(a)

requiring the provider to appoint a skilled person to provide OFCOM with a report in such form as may be specified in the notice, and

(b)

specifying the relevant matters to be explored in the report.

(6)

References in this section to a skilled person are to a person—

(a)

appearing to OFCOM to have the skills necessary to prepare a report about the relevant matters, and

(b)

where the appointment is to be made by the provider, nominated or approved by OFCOM.

(7)

It is the duty of—

(a)

the provider of the service (“P”),

(b)

any person who works for (or used to work for) P, or is providing (or used to provide) services to P related to the relevant matters, and

(c)

other providers of internet services,

to give the skilled person all such assistance as the skilled person may reasonably require to prepare the report.

(8)

The provider of the service is liable for the payment, directly to the skilled person, of the skilled person’s remuneration and expenses relating to the preparation of the report.

(9)

Subsections (10) to (12) apply in relation to an amount due to a skilled person under subsection (8).

(10)

In England and Wales, such an amount is recoverable—

(a)

if the county court so orders, as if it were payable under an order of that court;

(b)

if the High Court so orders, as if it were payable under an order of that court.

(11)

In Scotland, such an amount may be enforced in the same manner as an extract registered decree arbitral bearing a warrant for execution issued by the sheriff court of any sheriffdom in Scotland.

(12)

In Northern Ireland, such an amount is recoverable—

(a)

if a county court so orders, as if it were payable under an order of that court;

(b)

if the High Court so orders, as if it were payable under an order of that court.

(13)

In this section “relevant requirement” means—

(a)

a duty or requirement set out in any of the following—

(i)

section 9, 11, 26 or 28 (risk assessments);

(ii)

section 10 or 27 (illegal content);

(iii)

section 12 or 29 (children’s online safety);

(iv)

section 14 (assessments related to the adult user empowerment duty set out in section 15(2));

(v)

section 15 (user empowerment);

(vi)

section 20 or 31 (content reporting);

(vii)

section 21 or 32 (complaints procedures);

(viii)

section 23 or 34 (record-keeping and review);

(ix)

section 36 (children’s access assessments);

(x)

section 38 or 39 (fraudulent advertising);

(xi)

section 64 (user identity verification);

(xii)

section 66 (reporting CSEA content);

(xiii)

section 71 or 72 (terms of service);

(xiv)

section 75 (deceased child users);

(xv)

section 77(3) or (4) (transparency reports);

(xvi)

section 81(2) (children’s access to pornographic content);

(b)

a requirement under section 83 to notify OFCOM in connection with the charging of fees (see subsections (1), (3) and (5) of that section); or

(c)

a requirement imposed by a notice under section 121(1) (notices to deal with terrorism content and CSEA content).

Investigations and interviews

105Investigations

(1)

If OFCOM open an investigation into whether a provider of a regulated service has failed, or is failing, to comply with any requirement mentioned in subsection (2), the provider must co-operate fully with the investigation.

(2)

The requirements are—

(a)

a requirement imposed by a notice under section 121(1) (notices to deal with terrorism content and CSEA content), and

(b)

an enforceable requirement as defined in section 131 (except the requirement in subsection (1) of this section).

106Power to require interviews

(1)

The power conferred by this section is exercisable by OFCOM for the purposes of an investigation that they are carrying out into the failure, or possible failure, of a provider of a regulated service to comply with a relevant requirement.

(2)

OFCOM may give an individual within subsection (4) a notice requiring the individual—

(a)

to attend at a time and place specified in the notice, and

(b)

to answer questions and provide explanations about any matter relevant to the investigation.

(3)

A notice under this section must—

(a)

indicate the subject matter and purpose of the interview, and

(b)

contain information about the consequences of not complying with the notice.

(4)

The individuals within this subsection are—

(a)

if the provider of the service is an individual or individuals, that individual or those individuals,

(b)

an officer of the provider of the service,

(c)

if the provider of the service is a partnership, a partner,

(d)

an employee of the provider of the service, and

(e)

an individual who was within any of paragraphs (a) to (d) at a time to which the required information or explanation relates.

(5)

If OFCOM give a notice to an individual within subsection (4)(b), (c) or (d), they must give a copy of the notice to the provider of the service.

(6)

An individual is not required under this section to disclose information in respect of which a claim to legal professional privilege, or (in Scotland) to confidentiality of communications, could be maintained in legal proceedings.

(7)

In this section—

“officer”, in relation to an entity, includes a director, a manager, an associate, a secretary or, where the affairs of the entity are managed by its members, a member;

“relevant requirement” has the meaning given by section 104(13).

Powers of entry, inspection and audit

107Powers of entry, inspection and audit

Schedule 12 makes provision about—

(a)

OFCOM’s powers of entry and inspection, and

(b)

the carrying out of audits by OFCOM.

108Amendment of Criminal Justice and Police Act 2001

(1)

The Criminal Justice and Police Act 2001 is amended as follows.

(2)

In section 57(1) (retention of seized items), after paragraph (t) insert—

“(u)

paragraph 8 of Schedule 12 to the Online Safety Act 2023.”

(3)

In section 65 (meaning of “legal privilege”)—

(a)

after subsection (8B) insert—

“(8C)

An item which is, or is comprised in, property which has been seized in exercise or purported exercise of the power of seizure conferred by paragraph 7(f), (j) or (k) of Schedule 12 to the Online Safety Act 2023 is to be taken for the purposes of this Part to be an item subject to legal privilege if, and only if, the seizure of that item was in contravention of paragraph 17(3) of that Schedule (privileged information or documents).”;

(b)

in subsection (9)—

(i)

at the end of paragraph (d) omit “or”;

(ii)

at the end of paragraph (e) insert “or”;

(iii)

before the closing words insert—

“(g)

paragraph 7(f), (j) or (k) of Schedule 12 to the Online Safety Act 2023.”

(4)

In Part 1 of Schedule 1 (powers of seizure to which section 50 of the Act applies), after paragraph 73U insert—

“Online Safety Act 2023

73V

Each of the powers of seizure conferred by paragraph 7(f), (j) and (k) of Schedule 12 to the Online Safety Act 2023.”

Information offences and penalties

109Offences in connection with information notices

(1)

A person commits an offence if the person fails to comply with a requirement of an information notice.

(2)

It is a defence for a person charged with an offence under subsection (1) to show that—

(a)

it was not reasonably practicable to comply with the requirements of the information notice at the time required by the notice, but

(b)

the person has subsequently taken F14all of the steps that it was reasonable, and reasonably practicable, to take to comply with those requirements.

(3)

A person commits an offence if, in response to an information notice—

(a)

the person provides information that is false in a material respect, and

(b)

at the time the person provides it, the person knows that it is false in a material respect or is reckless as to whether it is false in a material respect.

(4)

A person commits an offence if, in response to an information notice, the person—

(a)

provides information which is encrypted such that it is not possible for OFCOM to understand it, or produces a document which is encrypted such that it is not possible for OFCOM to understand the information it contains, and

(b)

the person’s intention was to prevent OFCOM from understanding such information.

(5)

A person commits an offence if—

(a)

the person suppresses, destroys or alters, or causes or permits the suppression, destruction or alteration of, any information required to be provided, or document required to be produced, by an information notice, and

(b)

the person’s intention was to prevent OFCOM from being provided with the information or document or (as the case may be) from being provided with it as it was before the alteration.

F15(6A)

A person who is given an information notice under section 101(C1) commits an offence if—

(a)

the person deletes or alters, or causes or permits the deletion or alteration of, any information required by the notice to be retained, and

(b)

the person’s intention was to prevent the information being available, or (as the case may be) to prevent it being available in unaltered form, for the purposes of any official investigation into the death of the child to whom the notice relates.

(6B)

For the purposes of subsection (6A) information has been deleted if it is irrecoverable (however that occurred).

(6)

The reference in subsection (5) to suppressing information or a document includes a reference to destroying the means of reproducing information recorded otherwise than in a legible form.

(7)

Offences under this section may be committed only in relation to an information notice which—

(a)

relates to—

(i)

a user-to-user service,

(ii)

a search service, or

(iii)

an internet service on which regulated provider pornographic content is published or displayed; and

(b)

is given to the provider of that service.

(8)

If a person is convicted of an offence under this section, the court may, on an application by the prosecutor, make an order requiring the person to comply with a requirement of an information notice within such period as may be specified by the order.

(9)

See also section 201 (supplementary provision about defences).

(10)

In this section, “regulated provider pornographic content” and “published or displayed” have the same meaning as in Part 5 (see section 79).

110Senior managers’ liability: information offences

(1)

In this section “an individual named as a senior manager of an entity” means an individual who, as required by an information notice, is named as a senior manager of an entity in a response to that notice (see section 103).

(2)

An individual named as a senior manager of an entity commits an offence if—

(a)

the entity commits an offence under section 109(1) (failure to comply with information notice), and

(b)

the individual has failed to take all reasonable steps to prevent that offence being committed.

(3)

It is a defence for an individual charged with an offence under subsection (2) to show that the individual was a senior manager within the meaning of section 103 for such a short time after the information notice in question was given that the individual could not reasonably have been expected to take steps to prevent that offence being committed.

(4)

An individual named as a senior manager of an entity commits an offence if—

(a)

the entity commits an offence under section 109(3) (false information), and

(b)

the individual has failed to take all reasonable steps to prevent that offence being committed.

(5)

An individual named as a senior manager of an entity commits an offence if—

(a)

the entity commits an offence under section 109(4) (encrypted information), and

(b)

the individual has failed to take all reasonable steps to prevent that offence being committed.

(6)

An individual named as a senior manager of an entity commits an offence if—

(a)

the entity commits an offence under section 109(5) (destruction etc of information), and

(b)

the individual has failed to take all reasonable steps to prevent that offence being committed.

F16(6A)

An individual named as a senior manager of an entity commits an offence if—

(a)

the entity commits an offence under section 109(6A) (deletion etc of information), and

(b)

the individual has failed to take all reasonable steps to prevent that offence being committed.

(7)

It is a defence for an individual charged with an offence under subsection (4), (5) F17, (6) or (6A) to show that the individual was not a senior manager within the meaning of section 103 at the time at which the act constituting the offence occurred.

(8)

It is a defence for an individual charged with an offence under this section to show that the individual had no knowledge of being named as a senior manager in a response to the information notice in question.

(9)

See also section 201 (supplementary provision about defences).

111Offences in connection with notices under Schedule 12

(1)

A person commits an offence if the person fails without reasonable excuse to comply with a requirement of an audit notice.

(2)

A person commits an offence if, in response to an audit notice—

(a)

the person provides information that is false in a material respect, and

(b)

at the time the person provides it, the person knows that it is false in a material respect or is reckless as to whether it is false in a material respect.

(3)

A person commits an offence if—

(a)

(b)

the person’s intention was to prevent OFCOM from being provided with the information or document or (as the case may be) from being provided with it as it was before the alteration.

(4)

The reference in subsection (3) to suppressing information or a document includes a reference to destroying the means of reproducing information recorded otherwise than in a legible form.

(5)

Subsection (3) applies to—

(a)

a notice under paragraph 3 of Schedule 12 (information required for inspection), and

(b)

an audit notice (see paragraph 4 of that Schedule).

(6)

If a person is convicted of an offence under this section, the court may, on an application by the prosecutor, make an order requiring the person, within such period as may be specified by the order, to comply with a requirement of a notice under paragraph 3 of Schedule 12 or an audit notice (as the case may be).

112Other information offences

(1)

A person commits an offence if the person intentionally obstructs or delays a person in the exercise of the power conferred by section 102(7)(a) (copying a document etc).

(2)

A person commits an offence if the person fails without reasonable excuse to comply with a requirement under section 106 (interviews).

(3)

A person commits an offence if, in purported compliance with a requirement under section 106—

(a)

the person provides information that is false in a material respect, and

(b)

at the time the person provides it, the person knows that it is false in a material respect or is reckless as to whether it is false in a material respect.

(4)

If a person is convicted of an offence under this section, the court may, on an application by the prosecutor, make an order requiring the person, within such period as may be specified by the order, to permit the making of a copy of a document, or to comply with a requirement under section 106 (as the case may be).

113Penalties for information offences

(1)

A person who commits an offence under section 109(1), 110(2) or 111(1) is liable—

(a)

on summary conviction in England and Wales, to a fine;

(b)

on summary conviction in Scotland or Northern Ireland, to a fine not exceeding the statutory maximum;

(c)

on conviction on indictment, to a fine.

(2)

A person who commits an offence under section 109(3), F18(4), (5) or (6A), 110(4), F19(5), (6) or (6A), 111(2) or (3) or 112(1) is liable—

(a)

on summary conviction in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court or a fine (or both);

(b)

on summary conviction in Scotland, to imprisonment for a term not exceeding 12 months or a fine not exceeding the statutory maximum (or both);

(c)

on summary conviction in Northern Ireland, to imprisonment for a term not exceeding 6 months or a fine not exceeding the statutory maximum (or both);

(d)

on conviction on indictment, to imprisonment for a term not exceeding 2 years or a fine (or both).

(3)

A person who commits an offence under section 112(2) or (3) is liable—

(a)

on summary conviction in England and Wales, to a fine;

(b)

on summary conviction in Scotland, to a fine not exceeding level 5 on the standard scale;

(c)

on summary conviction in Northern Ireland, to a fine not exceeding level 5 on the standard scale.

Disclosure of information

114Co-operation and disclosure of information: overseas regulators

(1)

OFCOM may co-operate with an overseas regulator, including by disclosing online safety information to that regulator, for the purposes of—

(a)

facilitating the exercise by the overseas regulator of any of that regulator’s online regulatory functions, or

(b)

criminal investigations or proceedings relating to a matter to which the overseas regulator’s online regulatory functions relate.

(2)

The power conferred by subsection (1) applies only in relation to an overseas regulator for the time being specified in regulations made by the Secretary of State.

(3)

Where information is disclosed to a person in reliance on subsection (1), the person may not—

(a)

use the information for a purpose other than the purpose for which it was disclosed, or

(b)

further disclose the information,

except with OFCOM’s consent (which may be general or specific) or in accordance with an order of a court or tribunal.

(4)

Except as provided by subsection (5), a disclosure of information under subsection (1) does not breach—

(a)

any obligation of confidence owed by the person making the disclosure, or

(b)

any other restriction on the disclosure of information (however imposed).

(5)

Subsection (1) does not authorise a disclosure of information that—

(a)

would contravene the restriction imposed by section 116 (intelligence service information),

(b)

would contravene the data protection legislation (but in determining whether a disclosure would do so, the power conferred by that subsection is to be taken into account), or

(c)

is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.

(6)

Section 18 of the Anti-terrorism, Crime and Security Act 2001 (restriction on disclosure of information for overseas purposes) has effect in relation to a disclosure authorised by subsection (1)(b) as it has effect in relation to a disclosure authorised by any of the provisions to which section 17 of that Act applies.

(7)

In this section—

“online regulatory functions”, in relation to an overseas regulator, means functions of that regulator which correspond to OFCOM’s online safety functions;

“online safety information” means information held by OFCOM in connection with any of OFCOM’s online safety functions;

“overseas regulator” means a person exercising functions in a country outside the United Kingdom which correspond to any of OFCOM’s online safety functions;

F20…

115Disclosure of information

(1)

Section 393 of the Communications Act (general restrictions on disclosure of information) is amended as follows.

(2)

In subsection (1)—

(a)

at the end of paragraph (c) omit “or”,

(b)

at the end of paragraph (d) insert “or”, and

(c)

after paragraph (d) insert—

“(e)

the Online Safety Act 2023,”.

(3)

In subsection (2)(e), after “this Act” insert “or the Online Safety Act 2023”.

(4)

In subsection (3), after paragraph (h) insert—

“(ha)

a person appointed under—

(i)

paragraph 1 of Schedule 3 to the Coroners and Justice Act 2009, or

(ii)

section 2 of the Coroners Act (Northern Ireland) 1959 (c. 15 (N.I.));

(hb)

the procurator fiscal, within the meaning of the enactment mentioned in subsection (5)(s);”.

(5)

In subsection (5)—

(a)

before paragraph (d) insert—

“(ca)

the Coroners Act (Northern Ireland) 1959;”,

(b)

after paragraph (na) insert—

“(nb)

Part 1 of the Coroners and Justice Act 2009;”, and

(c)

after paragraph (r) insert—

“(s)

the Inquiries into Fatal Accidents and Sudden Deaths etc. (Scotland) Act 2016 (asp 2).”

(6)

In subsection (6)(a), after “390” insert “, or under section 149 of or Schedule 11 to the Online Safety Act 2023”.

(7)

In subsection (6)(b), at the end insert “or the Online Safety Act 2023”.

116Intelligence service information

(1)

OFCOM may not disclose information received (directly or indirectly) from, or that relates to, an intelligence service unless the intelligence service consents to the disclosure.

(2)

If OFCOM have disclosed information described in subsection (1) to a person, the person must not further disclose the information unless the intelligence service consents to the disclosure.

(3)

If OFCOM would contravene subsection (1) by publishing in its entirety—

(a)

a statement required to be published by section 47(5), or

(b)

a report mentioned in section 164(5),

OFCOM must, before publication, remove or obscure the information which by reason of subsection (1) they must not disclose.

(4)

In this section—

“information” means information held by OFCOM in connection with an online safety matter;

“intelligence service” means—

(a)

the Security Service,

(b)

the Secret Intelligence Service, or

(c)

the Government Communications Headquarters.

117Provision of information to the Secretary of State

(1)

Section 24B of the Communications Act (provision of information to assist in formulation of policy) is amended as follows.

(2)

In subsection (2)—

(a)

at the end of paragraph (d) omit “or”,

(b)

at the end of paragraph (e) insert “or”, and

(c)

after paragraph (e) insert—

“(f)

the Online Safety Act 2023,”.

(3)

After subsection (3) insert—

“(4)

Subsection (2) does not apply to information—

(a)

obtained by OFCOM—

(i)

in the exercise of a power conferred by section 100 of the Online Safety Act 2023 for the purpose mentioned in subsection (6)(c) of that section (information in connection with a consultation about a threshold figure for the purposes of charging fees under that Act), or

(ii)

in the exercise of a power conferred by section 175(5) of that Act (information in connection with circumstances presenting a threat), and

(b)

reasonably required by the Secretary of State.”

118Amendment of Enterprise Act 2002

In Schedule 15 to the Enterprise Act 2002 (enactments relevant to provisions about disclosure of information), at the appropriate place insert—

“Online Safety Act 2023.”

119Information for users of regulated services

(1)

Section 26 of the Communications Act (publication of information and advice for consumers etc) is amended as follows.

(2)

In subsection (2), after paragraph (d) insert—

“(da)

United Kingdom users of regulated services;”.

(3)

After subsection (6) insert—

“(7)

In this section the following terms have the same meaning as in the Online Safety Act 2023—

“regulated service” (see section 4 of that Act);

“United Kingdom user” (see section 227 of that Act).”

120Admissibility of statements

(1)

An explanation given, or information provided, by a person in response to a requirement imposed under or by virtue of section 100, 101 or 106 or paragraph 2(4)(e) or (f), 3(2), 4(2)(i) or (j) or 7(d) of Schedule 12, may, in criminal proceedings, only be used in evidence against that person—

(a)

on a prosecution for an offence under a provision listed in subsection (2), or

(b)

on a prosecution for any other offence where—

(i)

in giving evidence that person makes a statement inconsistent with that explanation or information, and

(ii)

evidence relating to that explanation or information is adduced, or a question relating to it is asked, by that person or on that person’s behalf.

(2)

Those provisions are—

(a)

section 69(1),

(b)

section 109(3),

(c)

section 110(4),

(d)

section 111(2),

(e)

section 112(3),

(f)

paragraph 18(1)(c) of Schedule 12,

(g)

section 5 of the Perjury Act 1911 (false statements made otherwise than on oath),

(h)

section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995 (false statements made otherwise than on oath), and

(i)

Article 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714 (N.I. 19)) (false statutory declarations and other false unsworn statements).