Online Safety Bill – An Expansion of Criminal Liability for Tech Bosses

4 minute read

The UK Prime Minister Rishi Sunak conceded a point to rebel Conservative MPs who were backing an amendment to the Online Safety Bill (the “OSB”) this week, which may result in executives at technology companies facing possible criminal liability. 

The OSB is a troubled piece of legislation in the U.K.  Initially announced by Theresa May in April 2019, it still has not been passed by Parliament. It has fallen victim to the numerous Prime Ministers, Culture Ministers and the ongoing push and pull between tech business development champions and online safety advocates.  The OSB passed the third reading in the House of Commons on 17 January 2023, without a vote, following the concession by the Prime Minister, and will now proceed to the House of Lords for further scrutiny.  

Despite many calls for more liability in the context of social media bosses, the only criminal liability within the OSB as it stood prior to 17 January 2023 was for failing to respond to an information notice from the regulator, Ofcom.  There was no criminal liability for failing to comply with any of the safety duties contained within the OSB itself.

The Proposed Amendment

Before the last-minute concession, which avoided the Prime Minister losing a vote, the proposed amendment to the OSB, New Clause 2, intended to add a provision which would impose criminal liability, with a risk of imprisonment of up to two years, a fine or both, for a senior manager of the online service, or someone who purports to act in such a capacity, should they fail to comply with a “relevant duty” in the OSB.  The relevant duty specified in the amendment concerned compliance with safety duties to protect children in clause 11 of the OSB.

The safety duties concerning children in the OSB are wide-ranging, applying to all user-to-user services that are likely to be accessed by children.  The duties include taking measures to protect children from risks of harm (that should have already been identified in the required children’s risk assessment), preventing them from encountering harmful content (for example, by using age verification) and specifying and applying provisions in the terms of service concerning how children are protected and prevented from encountering harmful content. 

In the proposed amendment, where the offence is committed with the consent or connivance of a senior manager or other officer of the provider, or is attributable to their neglect, the officer, as well as the entity, would be guilty of the offence.

The Concession

In a written statement on 17 January 2023, Culture Secretary Michelle Donelan agreed that the Government would work to introduce an amendment designed to “capture instances where senior managers, or those purporting to act in that capacity, have consented or connived in ignoring enforceable requirements, risking serious harm to children.”  The statement went on to say that the “criminal penalties, including imprisonment and fines, will be commensurate with similar offences” and that whilst “this amendment will not affect those who have acted in good faith to comply in a proportionate way, it gives the [OSB] additional teeth to deliver change and ensure that people are held to account if they fail to properly protect children.”

Key Takeaways

There is immense public pressure in the U.K. to protect people, especially children, online, and MPs across all parties widely support the introduction of the OSB.  The U.K. has fallen behind Europe, which has already introduced the Digital Services Act that imposes wide-ranging regulation on online services with users in Europe. 

Much still remains unknown in the context of criminal liability for failing to comply with the OSB.  It will undoubtedly be challenging to prosecute any offence under this legislation.  However, there will surely be momentum and drive to find the first or possible test case. 

Will wider criminal sanctions for individual managers in online companies who fail to protect those under 18 act as a deterrent? Only time will tell.  However, those user-to-user online services that may have thought that the OSB had no bite and was something which could essentially be ignored, would be well advised to reconsider. Now is the time for companies to be conducting risk assessments and addressing the identified risks of harm, as the OSB is well and truly back on the Government’s agenda.