Online Safety Act 2023 (c. 50)

PART 7 U.K. OFCOM's powers and duties in relation to regulated services

CHAPTER 4 U.K. Information

Information powers and information notices U.K.

100 Power to require information U.K.

(1) OFCOM may by notice under this subsection require a person within subsection (5) to provide them with any information that they require for the purpose of exercising, or deciding whether to exercise, any of their online safety functions.

(2) The power conferred by subsection (1) includes power to require a person within subsection (5) to—

(a) obtain or generate information;

(b) provide information about the use of a service by a named individual.

(3) The power conferred by subsection (1) also includes power to require a person within any of paragraphs (a) to (d) of subsection (5) to take steps so that a person authorised by OFCOM is able to view remotely—

(a) information demonstrating in real time the operation of systems, processes or features, including functionalities and algorithms, used by a service;

(b) information generated by a service in real time by the performance of a test or demonstration of a kind required by a notice under subsection (1).

(4) But the power conferred by subsection (1) must be exercised in a way that is proportionate to the use to which the information is to be put in the exercise of OFCOM’s functions.

(5) The persons within this subsection are—

(a) a provider of a user-to-user service or a search service,

(b) a provider of an internet service on which regulated provider pornographic content is published or displayed,

(c) a person who provides an ancillary service (within the meaning of section 144) in relation to a regulated service (see subsections (11) and (12) of that section),

(d) a person who provides an access facility (within the meaning of section 146) in relation to a regulated service (see subsections (10) and (11) of that section),

(e) a person who was within any of paragraphs (a) to (d) at a time to which the required information relates, and

(f) a person not within any of paragraphs (a) to (e) who appears to OFCOM to have, or to be able to generate or obtain, information required by them as mentioned in subsection (1).

(6) The information that may be required by OFCOM under subsection (1) includes, in particular, information that they require for any one or more of the following purposes—

(a) the purpose of assessing compliance with—

(i) any duty or requirement set out in Chapter 2, 3, 4 or 5 of Part 3,

(ii) any duty set out in section 64 (user identity verification),

(iii) any requirement under section 66 (reporting CSEA content),

(iv) any duty set out in section 71 or 72 (terms of service),

(v) any duty set out in section 75 (deceased child users),

(vi) any requirement relating to transparency reporting (see section 77(3) and (4)), or

(vii) any duty set out in section 81 (provider pornographic content);

(b) the purpose of assessing compliance with a requirement under section 83 (duty to notify OFCOM in relation to the charging of fees);

(c) the purpose of a consultation about a threshold figure as mentioned in section 86 (threshold figure for the purposes of charging fees);

(d) the purpose of ascertaining the amount of a person’s qualifying worldwide revenue for the purposes of—

(i) Part 6 (fees), or

(ii) paragraph 4 or 5 of Schedule 13 (amount of penalties etc);

(e) the purpose of assessing compliance with any requirements imposed on a person by—

(i) a notice under section 121(1) (notices to deal with terrorism content and CSEA content), or

(ii) a confirmation decision;

(f) the purpose of assessing the accuracy and effectiveness of technology required to be used by—

(i) a notice under section 121(1), or

(ii) a confirmation decision;

(g) the purpose of assessing whether to give a notice under section 121(1) relating to the development or sourcing of technology (see subsections (2)(b) and (3)(b) of that section);

(h) the purpose of dealing with complaints made to OFCOM under section 169 (super-complaints);

(i) the purpose of OFCOM’s advice to the Secretary of State about provision to be made by regulations under paragraph 1 of Schedule 11 (threshold conditions for categories of Part 3 services);

(j) the purpose of determining whether a Part 3 service meets threshold conditions specified in regulations under paragraph 1 of Schedule 11;

(k) the purpose of preparing a code of practice under section 41;

(l) the purpose of preparing guidance in relation to online safety matters;

(m) the purpose of carrying out research, or preparing a report, in relation to online safety matters;

(n) the purpose of complying with OFCOM’s duties under section 11 of the Communications Act, so far as relating to regulated services (media literacy).

(7) See also section 103 (power to include a requirement to name a senior manager).

(8) The reference in subsection (3) to a person authorised by OFCOM is to a person authorised by OFCOM in writing for the purposes of notices that impose requirements of a kind mentioned in that subsection, and such a person must produce evidence of their identity if requested to do so by a person in receipt of such a notice.

(9) The power conferred by subsection (1) does not include power to require the provision of information in respect of which a claim to legal professional privilege, or (in Scotland) to confidentiality of communications, could be maintained in legal proceedings.

(10) In this section—

• “information” includes documents, and any reference to providing information includes a reference to producing a document (and see also section 102(11));

• “regulated provider pornographic content” and “published or displayed” have the same meaning as in Part 5 (see section 79).

Commencement Information

I1 S. 100 not in force at Royal Assent, see s. 240(1)

I2 S. 100(1)-(5) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z5)

I3 S. 100(6)(a)(i) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z5)

I4 S. 100(6)(a)(iv) in force at 10.1.2024 for specified purposes by S.I. 2023/1420, reg. 2(z5)

I5 S. 100(6)(a)(vi) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z5)

I6 S. 100(6)(b)-(n) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z5)

I7 S. 100(7)-(10) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z5)

101 Information in connection with an investigation into the death of a child U.K.

(1) OFCOM may by notice under this subsection require a relevant person to provide them with information for the purpose of—

(a) responding to a notice given by a senior coroner under paragraph 1(2) of Schedule 5 to the Coroners and Justice Act 2009 in connection with an investigation into the death of a child, or preparing a report under section 163 in connection with such an investigation;

(b) responding to a request for information in connection with the investigation of a procurator fiscal into, or an inquiry held or to be held in relation to, the death of a child, or preparing a report under section 163 in connection with such an inquiry;

(c) responding to a notice given by a coroner under section 17A(2) of the Coroners Act (Northern Ireland) 1959 (c. 15 (N.I.)) in connection with—

(i) an investigation to determine whether an inquest into the death of a child is necessary, or

(ii) an inquest in relation to the death of a child,

or preparing a report under section 163 in connection with such an investigation or inquest.

(2) The power conferred by subsection (1) includes power to require a relevant person to provide OFCOM with information about the use of a regulated service by the child whose death is under investigation, including, in particular—

(a) content encountered by the child by means of the service,

(b) how the content came to be encountered by the child (including the role of algorithms or particular functionalities),

(c) how the child interacted with the content (for example, by viewing, sharing or storing it or enlarging or pausing on it), and

(d) content generated, uploaded or shared by the child.

(3) The power conferred by subsection (1) includes power to require a relevant person to obtain or generate information.

(4) The power conferred by subsection (1) must be exercised in a way that is proportionate to the purpose mentioned in that subsection.

(5) The power conferred by subsection (1) does not include power to require the provision of information in respect of which a claim to legal professional privilege, or (in Scotland) to confidentiality of communications, could be maintained in legal proceedings.

(6) Nothing in this section limits the power conferred on OFCOM by section 100.

(7) In this section—

• “information” includes documents, and any reference to providing information includes a reference to producing a document (and see also section 102(11));

• “inquiry” means an inquiry held, or to be held, under the Inquiries into Fatal Accidents and Sudden Deaths etc. (Scotland) Act 2016 (asp 2);

• “relevant person” means a person within any of paragraphs (a) to (e) of section 100(5).

Commencement Information

I8 S. 101 not in force at Royal Assent, see s. 240(1)

I9 S. 101 in force at 1.4.2024 by S.I. 2023/1420, reg. 3(a)

102 Information notices U.K.

(1) A notice given under section 100(1) or 101(1) is referred to in this Act as an information notice.

(2) An information notice may require information in any form (including in electronic form).

(3) An information notice must—

(a) specify or describe the information to be provided,

(b) specify why OFCOM require the information,

(c) specify the form and manner in which it must be provided, and

(d) contain information about the consequences of not complying with the notice.

(4) An information notice must specify when the information must be provided (which may be on or by a specified date, within a specified period, or at specified intervals).

(5) An information notice requiring a person to take steps of a kind mentioned in section 100(3) must give the person at least seven days’ notice before the steps are required to be taken.

(6) An information notice may specify a place at which, and a person to whom, information is to be provided.

(7) A person to whom a document is produced in response to an information notice may—

(a) take copies of, or extracts from, the document;

(b) require the person producing the document, or a person who is or was an officer of that person, or (in the case of a partnership) a person who is or was a partner, to give an explanation of it.

(8) A person to whom an information notice is given has a duty—

(a) to act in accordance with the requirements of the notice, and

(b) to ensure that the information provided is accurate in all material respects.

(9) OFCOM may cancel an information notice by notice to the person to whom it was given.

(10) In this section—

• “information” includes documents, and any reference to providing information includes a reference to producing a document;

• “officer”, in relation to an entity, includes a director, a manager, an associate, a secretary or, where the affairs of the entity are managed by its members, a member.

(11) In relation to information recorded otherwise than in a legible form, references in this section to producing a document are to producing a copy of the information—

(a) in a legible form, or

(b) in a form from which it can readily be produced in a legible form.

Commencement Information

I10 S. 102 not in force at Royal Assent, see s. 240(1)

I11 S. 102 in force at 10.1.2024 for specified purposes by S.I. 2023/1420, reg. 2(z6)

I12 S. 102 in force at 1.4.2024 by S.I. 2023/1420, reg. 3(b)

103 Requirement to name a senior manager U.K.

(1) This section applies where—

(a) OFCOM give a provider of a regulated service an information notice, and

(b) the provider is an entity.

(2) OFCOM may include in the information notice a requirement that the provider must name, in their response to the notice, an individual who the provider considers to be a senior manager of the entity and who may reasonably be expected to be in a position to ensure compliance with the requirements of the notice.

(3) If OFCOM impose a requirement to name an individual, the information notice must—

(a) require the provider to inform such an individual, and

(b) include information about the consequences for such an individual of the entity’s failure to comply with the requirements of the notice (see section 110).

(4) An individual is a “senior manager” of an entity if the individual plays a significant role in—

(a) the making of decisions about how the entity’s relevant activities are to be managed or organised, or

(b) the actual managing or organising of the entity’s relevant activities.

(5) An entity’s “relevant activities” are activities relating to the entity’s compliance with the regulatory requirements imposed by this Act in connection with the regulated service to which the information notice in question relates.

Commencement Information

I13 S. 103 not in force at Royal Assent, see s. 240(1)

I14 S. 103 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z7)