Legislation – Online Safety Act 2023

Revised legislation carried on this site may not be fully up to date. At the current time any known changes or effects made by subsequent legislation have been applied to the text of the legislation you are viewing by the editorial team. Please see ‘Frequently Asked Questions’ for details regarding the timescales for which new effects are identified and recorded on this site.

PART 7OFCOM’s powers and duties in relation to regulated services

CHAPTER 4Information

Information powers and information notices

100Power to require information

(1)

OFCOM may by notice under this subsection require a person within subsection (5) to provide them with any information that they require for the purpose of exercising, or deciding whether to exercise, any of their online safety functions.

(2)

The power conferred by subsection (1) includes power to require a person within subsection (5) to—

(a)

obtain or generate information;

(b)

provide information about the use of a service by a named individual.

(3)

The power conferred by subsection (1) also includes power to require a person within any of paragraphs (a) to (d) of subsection (5) to take steps so that a person authorised by OFCOM is able to view remotely—

(a)

information demonstrating in real time the operation of systems, processes or features, including functionalities and algorithms, used by a service;

(b)

information generated by a service in real time by the performance of a test or demonstration of a kind required by a notice under subsection (1).

(4)

But the power conferred by subsection (1) must be exercised in a way that is proportionate to the use to which the information is to be put in the exercise of OFCOM’s functions.

(5)

The persons within this subsection are—

(a)

a provider of a user-to-user service or a search service,

(b)

a provider of an internet service on which regulated provider pornographic content is published or displayed,

(c)

a person who provides an ancillary service (within the meaning of section 144) in relation to a regulated service (see subsections (11) and (12) of that section),

(d)

a person who provides an access facility (within the meaning of section 146) in relation to a regulated service (see subsections (10) and (11) of that section),

(e)

a person who was within any of paragraphs (a) to (d) at a time to which the required information relates, and

(f)

a person not within any of paragraphs (a) to (e) who appears to OFCOM to have, or to be able to generate or obtain, information required by them as mentioned in subsection (1).

(6)

The information that may be required by OFCOM under subsection (1) includes, in particular, information that they require for any one or more of the following purposes—

(a)

the purpose of assessing compliance with—

(i)

any duty or requirement set out in Chapter 2, 3, 4 or 5 of Part 3,

(ii)

any duty set out in section 64 (user identity verification),

(iii)

any requirement under section 66 (reporting CSEA content),

(iv)

any duty set out in section 71 or 72 (terms of service),

(v)

any duty set out in section 75 (deceased child users),

(vi)

any requirement relating to transparency reporting (see section 77(3) and (4)), or

(vii)

any duty set out in section 81 (provider pornographic content);

(b)

the purpose of assessing compliance with a requirement under section 83 (duty to notify OFCOM in relation to the charging of fees);

(c)

the purpose of a consultation about a threshold figure as mentioned in section 86 (threshold figure for the purposes of charging fees);

(d)

the purpose of ascertaining the amount of a person’s qualifying worldwide revenue for the purposes of—

(i)

Part 6 (fees), or

(ii)

paragraph 4 or 5 of Schedule 13 (amount of penalties etc);

(e)

the purpose of assessing compliance with any requirements imposed on a person by—

(i)

a notice under section 121(1) (notices to deal with terrorism content and CSEA content), or

(ii)

a confirmation decision;

(f)

the purpose of assessing the accuracy and effectiveness of technology required to be used by—

(i)

a notice under section 121(1), or

(ii)

a confirmation decision;

(g)

the purpose of assessing whether to give a notice under section 121(1) relating to the development or sourcing of technology (see subsections (2)(b) and (3)(b) of that section);

(h)

the purpose of dealing with complaints made to OFCOM under section 169 (super-complaints);

(i)

the purpose of OFCOM’s advice to the Secretary of State about provision to be made by regulations under paragraph 1 of Schedule 11 (threshold conditions for categories of Part 3 services);

(j)

the purpose of determining whether a Part 3 service meets threshold conditions specified in regulations under paragraph 1 of Schedule 11;

(k)

the purpose of preparing a code of practice under section 41;

(l)

the purpose of preparing guidance in relation to online safety matters;

(m)

the purpose of carrying out research, or preparing a report, in relation to online safety matters;

(n)

the purpose of complying with OFCOM’s duties under section 11 of the Communications Act, so far as relating to regulated services (media literacy).

F1(7)

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(8)

The reference in subsection (3) to a person authorised by OFCOM is to a person authorised by OFCOM in writing for the purposes of notices that impose requirements of a kind mentioned in that subsection, and such a person must produce evidence of their identity if requested to do so by a person in receipt of such a notice.

F2(8A)

The power to give a notice conferred by subsection (1) does not include power to require processing of personal data that would contravene the data protection legislation (but in determining whether processing of personal data would do so, the duty imposed by the notice is to be taken into account).

(9)

The power conferred by subsection (1) does not include power to require the provision of information in respect of which a claim to legal professional privilege, or (in Scotland) to confidentiality of communications, could be maintained in legal proceedings.

(10)

In this section—

“information” includes documents, and any reference to providing information includes a reference to producing a document (and see also section 102(11));

“regulated provider pornographic content” and “published or displayed” have the same meaning as in Part 5 (see section 79).

101Information in connection with an investigation into the death of a child

F3A1

Subsection (C1) applies if a senior coroner (in England and Wales), a procurator fiscal (in Scotland) or a coroner (in Northern Ireland) (“the investigating authority”)—

(a)

notifies OFCOM that they are conducting an investigation in connection with the death of a child, and

(b)

provides OFCOM with the details in subsection (B1).

B1

The details are—

(a)

the name of the child who has died,

(b)

the child’s date of birth,

(c)

any email addresses used by the child (so far as the investigating authority knows), and

(d)

if any regulated service has been brought to the attention of the investigating authority as being of interest in connection with the child’s death, the name of the service.

C1

Where this subsection applies, OFCOM—

(a)

must give a notice to the provider of a service within subsection (E1) requiring the provider to ensure the retention of information relating to the use of the service by the child who has died, and

(b)

may give a notice to any other relevant person requiring the person to ensure the retention of information relating to the use of a service within subsection (E1) by that child.

D1

The references in subsection (C1) to ensuring the retention of information relating to the child’s use of a service include taking all reasonable steps, without delay, to prevent the deletion of such information by the routine operation of systems or processes.

E1

A service is within this subsection if it is—

(a)

a regulated service of a kind described in regulations made by the Secretary of State, or

(b)

a regulated service notified to OFCOM by the investigating authority as described in subsection (B1)(d).

F1

A notice under subsection (C1) may require information described in that subsection to be retained only if it is information—

(a)

of a kind which OFCOM have power to require under a notice under subsection (1) (see, in particular, subsection (2)(a) to (d)), or

(b)

which a person might need to retain to enable the person to provide information in response to a notice under subsection (1) (if such a notice were given).

G1

OFCOM must share with the investigating authority any information they receive in response to requirements mentioned in section 102(5A)(d) that are included in a notice under subsection (C1).

(1)

OFCOM may by notice under this subsection require a relevant person to provide them with information for the purpose of—

(a)

responding to a notice given by a senior coroner under paragraph 1(2) of Schedule 5 to the Coroners and Justice Act 2009 in connection with an investigation into the death of a child, or preparing a report under section 163 in connection with such an investigation;

(b)

responding to a request for information in connection with the investigation of a procurator fiscal into, or an inquiry held or to be held in relation to, the death of a child, or preparing a report under section 163 in connection with such an inquiry;

(c)

responding to a notice given by a coroner under section 17A(2) of the Coroners Act (Northern Ireland) 1959 (c. 15 (N.I.)) in connection with—

(i)

an investigation to determine whether an inquest into the death of a child is necessary, or

(ii)

an inquest in relation to the death of a child,

or preparing a report under section 163 in connection with such an investigation or inquest.

(2)

The power conferred by subsection (1) includes power to require a relevant person to provide OFCOM with information about the use of a regulated service by the child whose death is under investigation, including, in particular—

(a)

content encountered by the child by means of the service,

(b)

how the content came to be encountered by the child (including the role of algorithms or particular functionalities),

(c)

how the child interacted with the content (for example, by viewing, sharing or storing it or enlarging or pausing on it), and

(d)

content generated, uploaded or shared by the child.

(3)

The F4powers conferred by this section include power to require a relevant person to obtain or generate information.

(4)

The power conferred by subsection (1) must be exercised in a way that is proportionate to the purpose mentioned in that subsection.

(5)

F5(5A)

The powers to give a notice conferred by this section do not include power to require processing of personal data that would contravene the data protection legislation (but in determining whether processing of personal data would do so, the duty imposed by the notice is to be taken into account).

(6)

Nothing in this section limits the power conferred on OFCOM by section 100.

(7)

In this section—

“information” includes documents, and any reference to providing information includes a reference to producing a document (and see also section 102(11));

“inquiry” means an inquiry held, or to be held, under the Inquiries into Fatal Accidents and Sudden Deaths etc. (Scotland) Act 2016 (asp 2);

“relevant person” means a person within any of paragraphs (a) to (e) of section 100(5).

102Information notices

(1)

A notice given under section 100(1) or F6101(C1) or (1) is referred to in this Act as an information notice.

(2)

An information notice may require information in any form (including in electronic form).

(3)

An information notice F7under section 100(1) or 101(1) must—

(a)

specify or describe the information to be provided,

(b)

specify why OFCOM require the information,

(c)

specify the form and manner in which it must be provided, F8…

F9(ca)

specify when the information must be provided (which may be on or by a specified date, within a specified period, or at specified intervals), and

(d)

contain information about the consequences of not complying with the notice.

F10(4)

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(5)

An information notice requiring a person to take steps of a kind mentioned in section 100(3) must give the person at least seven days’ notice before the steps are required to be taken.

F11(5A)

An information notice under section 101(C1) must—

(a)

specify or describe the information to be retained,

(b)

specify why OFCOM require the information to be retained,

(c)

require the information to be retained for the period of one year beginning with the date of the notice,

(d)

require the person to whom the notice is given—

(i)

if the child to whom the notice relates used the service in question, to notify OFCOM by a specified date of steps taken to ensure the retention of information;

(ii)

if the child did not use the service, or the person does not hold any information of the kind required, to notify OFCOM of that fact by a specified date, and

(e)

contain information about the consequences of not complying with the notice.

(5B)

If OFCOM give an information notice to a person under section 101(C1), they may, in response to information received from the investigating authority, extend the period for which the person is required to retain information by a maximum period of six months.

(5C)

The power conferred by subsection (5B) is exercisable—

(a)

by giving the person a notice varying the notice under section 101(C1) and stating the further period for which information must be retained and the reason for the extension;

(b)

any number of times.

(6)

An information notice may specify a place at which, and a person to whom, information is to be provided.

(7)

A person to whom a document is produced in response to an information notice may—

(a)

take copies of, or extracts from, the document;

(b)

require the person producing the document, or a person who is or was an officer of that person, or (in the case of a partnership) a person who is or was a partner, to give an explanation of it.

(8)

A person to whom an information notice is given has a duty—

(a)

to act in accordance with the requirements of the notice, and

(b)

to ensure that the information provided is accurate in all material respects.

(9)

OFCOM may cancel an information notice by notice to the person to whom it was given.

F12(9A)

OFCOM must cancel an information notice under section 101(C1) by notice to the person to whom it was given if advised by the investigating authority that the information in question no longer needs to be retained.

(10)

In this section—

“information” includes documents, and any reference to providing information includes a reference to producing a document;

F13“the investigating authority” has the same meaning as in section 101;

“officer”, in relation to an entity, includes a director, a manager, an associate, a secretary or, where the affairs of the entity are managed by its members, a member.

(11)

In relation to information recorded otherwise than in a legible form, references in this section to producing a document are to producing a copy of the information—

(a)

in a legible form, or

(b)

in a form from which it can readily be produced in a legible form.

103Requirement to name a senior manager

(1)

This section applies where—

(a)

OFCOM give a provider of a regulated service an information notice, and

(b)

the provider is an entity.

(2)

OFCOM may include in the information notice a requirement that the provider must name, in their response to the notice, an individual who the provider considers to be a senior manager of the entity and who may reasonably be expected to be in a position to ensure compliance with the requirements of the notice.

(3)

If OFCOM impose a requirement to name an individual, the information notice must—

(a)

require the provider to inform such an individual, and

(b)

include information about the consequences for such an individual of the entity’s failure to comply with the requirements of the notice (see section 110).

(4)

An individual is a “senior manager” of an entity if the individual plays a significant role in—

(a)

the making of decisions about how the entity’s relevant activities are to be managed or organised, or

(b)

the actual managing or organising of the entity’s relevant activities.

(5)

An entity’s “relevant activities” are activities relating to the entity’s compliance with the regulatory requirements imposed by this Act in connection with the regulated service to which the information notice in question relates.