Implementation of the Online Safety Act – the risk assessment phase has begun

This significant piece of legislation has as its objective making the internet a far safer place for online activities – be this using search engines or interacting with other users – both experiences from which harm can develop.

Take an education publisher providing textbooks and online content for use in schools. To add value to its offering, the publisher makes a forum available. Teachers are provided with unique registration numbers authorising use of the forum thereby limiting it use to verifiable individuals.

The forum is moderated to ensure it is used only for purposes permitted by the publisher and to ensure any content uploaded is appropriate.

While the arrangements have been made with online safety in mind, the forum nonetheless is now expected to be made available to users in a manner supported by the publisher’s observation of online safety compliance requirements. To quote Ofcom, “The new rules apply to organisations big and small, from large well-resourced companies to very small micro-businesses.”

There are relatively few exceptions, but a notable one is any forum which has a closed community of users within (as one of the situations) the same school. The legislation does not appear to reflect the organisational structure of the education system however, meaning that multi-academy wide forums need to be available using a different exemption – forums operated by employers for internal use only.

If your business provides your network of customers a forum facility, the rest of this article is important to you. The legislation has been developed to recognise that certain online services present little risk to users, but this first phase of work applies to all who are in principle caught by the law.

The Online Safety Act has taken time to move into implementation but Ofcom, as the organisation responsible for online safety regulation, has been busy providing a significant amount of guidance.  A phased approach to implementation is being taken and within this first phase that began on January 1, affected businesses have just under three months to complete documented risk assessments. These risk assessments must then be acted upon should further measures be required to be taken to embed online safety to the extent the law expects.

How is a forum defined in the legislation?

The legislation does not refer to forums but the rather a broader concept of User to User services. To be in scope:

• the service must be available to a significant number of UK users or, if delivered from overseas, is targeting UK users
• users, in accessing the service, may encounter content in the form of images, videos, messages or comments generated by other users.

If we provide a forum what steps are we expected to take?

First of all, decide whether the forum is just to provide comments on your products and services and do not allow for direct interactions involving multiple users (for example one teacher gives a comment on some class work prepared by another teacher which has been uploaded to the website).

Consider then, whether you have a significant body of users of the facility provided by the forum. Significant is not specifically defined but caution should be taken in seeking to opt out of requirements of the legislation where the commercial activity undertaken attracts many users and use is likely to increase. If a decision is taken to regard the service as not regulated it will be important to have documented information around that decision should there subsequently be challenge to the conclusion made.

The first practical requirement is to conduct a risk assessment. Guidance as to how to approach this can be found here. It’s important to read the guidance carefully as different risk profiles have been developed covering different circumstances. Refer to this document which provides considerable detail which needs to be reviewed with aspects relevant to the business activity involved understood.

Secondly ensure records are kept of all stages of the process that is embarked upon. Note that evidence should be referenced, demonstrating that the conclusions reached are not just theoretical.

Businesses operating in the education and skills sector can support the sector with highly appropriate means of interaction and nothing in the legislation is intended to suggest otherwise. The degree of detail in the legislation and policies arising from the Act recognises the diverse range of online harms that exist, and which must be avoided as much as possible through pro-active steps taken by service providers.

Is there more to come?

A further development that we can expect to see shortly is a finalised policy covering the safety of services likely to be accessed by children. Children’s Access Assessments will be required to be undertaken following a further code of practice currently under consultation.

Implementation is expected to begin in April at which time assessments will require to be completed following the requirements of the code. A draft of the code is available here.  At Freeths we will be following developments and providing thoughts on many aspects of this new and important legislation.