Joint committee publishes report on improving Online Safety Bill

As it currently stands, the draft Online Safety Bill would impose a statutory “duty of care” on technology companies that host user-generated content or allow people to communicate, meaning they would be legally obliged to proactively identify, remove and limit the spread of both illegal and legal but harmful content, such as child sexual abuse, terrorism and suicide material. Failure to do so could result in fines of up to 10% of their turnover by the online harms regulator, which was confirmed in December 2020 to be Ofcom.

Following its inquiry, the committee said in its report that “in seeking to regulate large multinational companies with the resources to undertake legal challenges”, Parliament should provide more clarity around the overarching duty of care through specific duties that explicitly set out what service providers should be doing to prevent harm online.

“We recommend the bill is restructured. It should set out its core objectives clearly at the beginning. This will ensure clarity to users and regulators about what the bill is trying to achieve and inform the detailed duties set out later in the legislation,” it said.

“Everything flows from these: the requirement for Ofcom to meet those objectives, its power to produce mandatory codes of practice and minimum quality standards for risk assessments in order to do so, and the requirements on service providers to address and mitigate reasonably foreseeable risks, follow those codes of practice and meet those minimum standards.”

The report added the Online Safety Bill should include a specific responsibility on service providers to create systems and processes to identify any “reasonably foreseeable risks of harm arising from the design of their platforms”, which they must take proportionate steps to mitigate.

On top of drawing up mandatory codes of practice for tech companies to follow, the committee further added that Ofcom should be required to produce a mandatory “safety by design” code of practice as well.

To further encourage compliance with the bill, the committee also recommends that Parliament requires internet service providers to conduct internal risk assessments to record reasonable foreseeable threats to user safety, which would go beyond content to also include the potentially harmful impact of algorithms.

“It should not be possible for a service provider to underestimate the level of risk on their service without fear of sanction. If Ofcom suspects such a breach, it should have the power to investigate, and, if necessary, to take swift action. We are not convinced that the draft bill as it currently stands achieves this,” said the report, adding that Ofcom should be required to set binding minimum standards to ensure the accuracy and completeness of risk assessments.

“Ofcom must be able to require a provider which returns a poor or incomplete risk assessment to redo that risk assessment. Risk assessments should be carried out by service providers as a response to the Online Safety Act before new products and services are rolled out, during the design process of new features, and kept up to date as they are implemented.”

It also recommended that the largest and highest-risk service providers should be placed under a statutory responsibility to commission annual, independent third-party audits of the effects of their algorithms, as well as of their risk assessments and transparency reports.

“Ofcom should be given the explicit power to review these and undertake its own audit of these or any other regulated service when it feels it is required. Ofcom should develop a framework for the effective regulation of algorithms based on the requirement for, and auditing of, risk assessments,” it said, adding that the various regulators of the Digital Regulation Cooperation Forum (DCRF) – which includes the Information Commissioner’s Office and the Competition and Markets Authority – should be placed under their own statutory requirement to cooperate and consult with one another.

“[The Online Safety Bill] seems to rely entirely on the platforms’ own risk assessments and their own reporting on how well their systems work at reducing harm”