Online Safety Bill

Lord Allan of Hallam Excerpts

Committee stage
Thursday 22nd June 2023 Lords Chamber

[Baroness Kidron (CB)]

My Lords, first, I want to recognise the bravery of the families of Olly, Breck, Molly, Frankie and Sophie in campaigning for the amendments we are about to discuss. I also pay tribute to Mia, Archie, Isaac, Maia and Aime, whose families I met this morning on their way to the House. It is a great privilege to stand alongside them and witness their courage and dignity in the face of unimaginable grief. On behalf of myself, my co-signatories—the noble Lords, Lord Stevenson and Lord Clement-Jones, and the noble Baroness, Lady Morgan—and the huge number of Peers and MPs who have supported these amendments, I thank them for their work and the selflessness they have shown in their determination to ensure that other families do not suffer as they have.

This group includes Amendments 198, 199, 215 and 216, which, together, would create a pathway for coroners and, by extension, families to get access to information relevant to the death of a child from technology services. The amendments would put an end to the inhumane situation whereby coroners and families in crisis are forced to battle faceless corporations to determine whether a child’s engagement with a digital service contributed to their death. Bereaved families have a right to know what happened to their children, and coroners have a duty to ensure that lessons are learned and that those who have failed in their responsibilities are held accountable.

Since the Minister is going to be the bearer of good news this afternoon, I will take the time to make arguments for the amendments as they stand. I simply say that, while parents have been fighting for access to information, those same companies have continued to suggest friends, material and behaviours that drive children into places and spaces in which they are undermined, radicalised into despair and come to harm. In no other circumstance would it be acceptable to withhold relevant information from a court procedure. It is both immoral and a failure of justice if coroners cannot access and review all relevant evidence. For the families, it adds pain to heartbreak as they are unable to come to terms with what has happened because there is still so much that they do not know.

I am grateful to the Government for agreeing to bring forward on Report amendments that will go a very long way towards closing the loopholes that allow companies to refuse coroners’ demands and ignore parents’ entreaties. The Government’s approach is somewhat different from that in front of us, but it covers the same ground. These amendments are the result of the considerable efforts of Ministers and officials from DSIT and the Ministry of Justice, with the invaluable support of the right honourable Sajid Javid MP. I wish to note on the record the leadership of the Secretary of State, who is currently on leave, and the Minister here, the noble Lord, Lord Parkinson.

The Government’s amendments will create an express power for Ofcom to require information from services about a deceased child user’s online activity following the receipt of a Schedule 5 request from a coroner. This will vastly increase the reach and power of that coroner. Information that Ofcom can request from regulated companies under the Online Safety Bill is extremely wide and includes detailed data on what is recommended; the amount of time the child spent on the service when they accessed it; their user journey; what content they liked, shared, rewatched, paused and reported; and whether other users raised red flags about the child’s safety or well-being before their death.

Information notices prompted by a Schedule 5 request from a coroner will be backed by Ofcom’s full enforcement powers and will apply to all regulated companies. If a service fails to comply, it may be subject to enforcement action, including senior management liability and fines of up to £18 million or 10% of global turnover—vastly different from the maximum fine of £1,000 under the Coroners and Justice Act 2009. Moreover, these amendments will give coroners access to Ofcom’s expertise and understanding of how online services work and of online services’ safety duties to children. Also, there will be provisions empowering Ofcom to share information freely to assist coroners in their inquiries. Companies must provide a dedicated means of communication to manage requests for information from bereaved parents and provide written responses to those requests. I look forward to the Minister setting out that these will be operated by a team of experts and backed up by Ofcom in ensuring that the communication is adequate, timely and not obstructive. Importantly, if the communication is not adequate, bereaved families will be able to notify Ofcom.

There are a small number of outstanding questions. We remain concerned that only larger companies will be required to set out their policies on disclosure. Sadly, children are often coerced and nudged into smaller sites that have less robust safety mechanisms. Small is not safe. A further issue is to ensure that a coroner is able, via a Schedule 5 notice given to Ofcom, to compel senior management to appear at an inquest. This is a crucial ask of the legal community, who battled and failed to get companies to attend inquests, notably Wattpad at the Frankie Thomas inquest and Snap Inc at Molly Russell’s inquest. Can the Minister undertake to close these gaps before Report?

A number of matters sit outside the scope of the Online Safety Bill. I am particularly grateful to the Secretary of State for committing in writing to further work beyond the Bill to ensure that the UK’s approach is comprehensive and watertight. The Government will be exploring ways in which the Data Protection and Digital Information (No. 2) Bill can support and complement these provisions, including the potential for a code that requires data preservation if a parent or enforcement officer contacts a helpline or if there is constructive knowledge, such as when a death has been widely reported, even before a Schedule 5 notice has been delivered.

The Government are engaging with the Chief Coroner to provide training in order to ensure that coroners have the knowledge they need to carry out inquests where children’s engagement with online services is a possible factor in their death. I am concerned about the funding of this element of the Government’s plans and urge the Minister to indicate whether this could be part of Ofcom’s literacy duties and therefore benefit from the levy. Possibly most importantly, the Secretary of State has undertaken to approach the US Government to ensure that coroners can review private messages that fall outside the scope of this Bill in cases where a child’s death is being investigated. I am grateful to the noble Lord, Lord Allan, for his support in articulating the issue, and accept the invitation to work alongside the department to achieve this.

There are only two further things to say. First, delivery is in the drafting, and I hope that when he responds, the Minister will assure the House that we will see the proposed amendments well before Report so that we can ensure that this works as we have all agreed. Secondly, the Government are now looking very carefully at other amendments which deal with prevention of harm in one way or another. I share the gratitude of Bereaved Parents for Online Safety for the work that has gone into this set of amendments. However, we want to see safety by design; a comprehensive list of harms to children in the Bill, including harms caused or amplified by the design of service; principles for age assurance which ensure that the systems put in place by regulated services are measurable, secure and fit for purpose; and a proper complaints service, so that children have somewhere to turn when things go wrong. What we have been promised is a radical change of status for the coroner and for the bereaved families. What we want is fewer dead children. I beg to move.

[Lord Allan of Hallam (LD)]

My Lords, some of the issues that we have been dealing with in this Bill are more abstract or generic harms, but here we are responding to a specific need of families in the UK who are facing the most awful of circumstances.

I want to recognise the noble Baroness, Lady Kidron, for her direct support for many of those families, and for her persistent efforts to use policy and the tools we have available to us here to improve the situation for families who, sadly, will face similar tragedies in future. I appreciate the time that she has spent with me in the spirit of finding workable solutions. It is an alliance that might seem improbable, given our respective responsibilities, which have sometimes placed us in publicly adversarial roles. However, one of the strengths of this Committee process is that it has allowed us to focus on what is important and to find that we have more in common than separates us. Nothing could be more important than the issue we are dealing with now.

I am pleased that it looks like we will be able to use this Bill to make some significant improvements in this area to address the challenges faced by those families, some of whom are here today, challenges which add to their already heart-wrenching distress. The first challenge these families face is to find someone at an online service who is willing and able to answer their questions about their loved one’s use of that platform. This question about contacts at online platforms is not limited to these cases but comes up in other areas.

As noble Lords will know, I used to work for Facebook, where I was often contacted by all sorts of Governments asking me to find people in companies, often smaller companies, concerning very serious issues such as terrorism. Even when they were dealing with the distribution of terrorist content, they would find it very challenging. There is a generic problem around getting hold of people at platforms. A real strength of the Online Safety Bill is that it will necessarily require Ofcom to develop contacts at all online services that offer user-to-user and search services to people in the UK. The Government estimate that 25,000 entities are involved. We are talking about Ofcom building a comprehensive database of pretty much any service that matters to people in the UK.

Primarily, these contacts will be safety focused, as their main responsibility will be to provide Ofcom with evidence that the service is meeting its duties of care under the Bill, so again, they will have the right people in the right companies on their database in future. Importantly, Ofcom will have a team of several hundred people, paid for by a levy on these regulated services, to manage the contacts at the right level. We can expect that, certainly for the larger services, there may be a team of several people at Ofcom dedicated to working with them, whereas for the smaller services it may be a pooled arrangement whereby one Ofcom staff member deals with a group. However, in all cases there will be someone at the regulator with a responsibility for liaising with those companies. We do not expect Ofcom to use those contacts to resolve questions raised by individuals in the UK as a matter of course, but it makes sense to make this channel available where there is a relatively small number of highly impactful cases such as we are dealing with here.

--- Later in debate ---

If a provider outside the UK ignores letters and fines, these measures may well be the only possibility. Many pornography providers probably have absolutely no intention of even trying to comply with the kinds of regulations that are envisaged in the Bill. They are probably not based in the UK, are never going to pay a fine and are probably incorporated in some obscure offshore jurisdiction. Ofcom will need to use these powers in such circumstances, and on a bulk scale. We should not put that enforcement activity at risk of the legal stalling games that these sites will undoubtedly play. For that reason, I ask the Minister to commit to these changes by government amendment before Report next month.

[Lord Allan of Hallam (LD)]

My Lords, I want to speak to Amendment 218JA in this group, in my name, to which the noble Baroness, Lady Morgan of Cotes, has added her name. This is really trying to understand what the Government’s intentions are in respect of access restriction orders.

Just to take a step back, in the Online Safety Bill regime we are creating, in effect, a licensing regime for in-scope services and saying that, if you want to operate in the United Kingdom and you are covered by the Bill—whether that is the pornography services that the noble Lord, Lord Bethell, referred to or a user-to-user or search service—here are the conditions to which you must adhere. That includes paying a fee to Ofcom for your supervision, and then following the many thousands of pages of guidance that I suspect we will end up producing and issuing to those companies. So what we are exploring here is what happens if a particular organisation does not decide to take up the offer of a licence.

Again, to go back to the previous debate, success for the Bill would be that it has a sufficient deterrent effect that the problems that we are seeking to fix are addressed. I do not think we are looking to block services or for them to fail—we are looking for them to succeed, so stage one is that Ofcom asks them nicely. It says, “You want to operate in the UK, here is what you need to do—it’s a reasonable set of requests we are making”, and the services say, “Fine”. If not, they choose to self-limit—and it is quite trivial for any online service to say, “I’m going to check incoming traffic, and if this person looks like they are coming from the UK, I’m not going to serve them”. That is self-limiting, which is an option that would be preferable if a service chose not to accept the licence condition. But let us assume that it has accepted the licence condition, and Ofcom is going to be monitoring it on a routine basis—and if Ofcom thinks it is not meeting its requirements, whether that is to produce a risk assessment or to fulfil its duty of care, Ofcom will then instruct it to do something. If it fails to follow that instruction, we are in the territory of the amendments that we are considering here: either it has refused to accept the licence conditions and to self-limit, or it has accepted them but has failed to do what we expect it to do. It has signed up and thought that it is not serious, and it is not doing the things that we expect it to do.

At that point, Ofcom has to consider what it can do. The first stage is quite right, in the group of clauses that we are looking at—Ofcom can bring in these business disruption measures. As the noble Lord, Lord Bethell, rightly pointed out, in many instances that will be effective. Any commercial service—not just pornography services, but an online service that depends on advertising—that is told that it can no longer take credit card payments from UK businesses to advertise on the service, will, one hopes, come into line and say, “That’s the end of my business in the UK—I may as well cut myself off”. But if it wants to operate, it will come into line, because that way it gets its payment services restored. But there will be others for which that is insufficient—perhaps that is not their business model—and they will carry on regardless. At that point, we may want to consider the access restrictions.

In a free society, none of us should take pleasure in the idea that we are going to instruct the internet services or block them. That is not our first instinct, but something that is rather potentially a necessary evil. At some point, there may be services that are so harmful and so oblivious to the regime that we put in place that we need to block them. Here we are trying to explore what would happen in those circumstances. The first kind of block is one that we are used to doing, and we do it today for copyright-infringing sites and a small number of other sites that break the law. We instruct service providers such as BT and TalkTalk to implement a network-level block. There are ways you can do that—various technical ways that we do not need to go into in this debate—whereby we can seek to make it so that an ordinary UK user, when they type in www.whatever, will not get to the website. But increasingly people are using technology that will work around that. Browsers, for example, may create traffic between your web browser and the online service such that TalkTalk or BT or the access provider has no visibility as to where you are going and no capability of blocking it. BT has rightly raised that. There will be different views about where we should go with this, but the question is absolutely legitimate as to what the Government’s intentions are, which is what we want to try to tease out with this amendment.

Again, we should be really candid. Somebody who is determined to bypass all the access controls will do so. There is no world in which we can say that we can guarantee that somebody with a UK internet connection can never get to a particular website. What we are seeking to do is to make violating services unavailable for most of the people most of the time. We would be unhappy if it was only some of the people some of the time, but it is not going to be all of the people all of the time. So the question is: what constitutes a sufficient access restriction to either bring them to heel or to ensure that, over the longer term, the harm is not propagated, because these services are generally not made available? It would be really helpful if the Minister was able to tease that out.

Certainly, in my view, there are services such as TOR—the Onion Router—where there is no entity that you can ask to block stuff, so if someone was using that, there is nothing that you can reasonably do. At the other end of the spectrum, there are services such as BT and TalkTalk, where it is relatively straightforward to say to them that they should block. Then there are people in between, such as browser owners that are putting in place these encrypted tunnels for very good reasons, for privacy, but which can also add value-added stuff—helping to manage bandwidth better, and so on. Is it the Government’s intention that they are going to be served with access restriction orders? That is a valid question. We might have different views about what is the right solution, but it is really important for the sector that it understands and is able to prepare if that is the Government’s intention. So we need to tease that out; that is the area in which we are looking for answers from the Government.

The second piece is to think about the long term. If our prediction—or our hope and expectation—is that most companies will come into line, that is fine; the internet will carry on as it does today but in a safer way. However, if we have misjudged the mood, and a significant numbers of services just stick their thumb up at Ofcom and say, “We are not going to play—block us if you dare”, that potentially has significant consequences for the internet as it will operate in the United Kingdom. It would be helpful to understand from the Minister whether the Government have any projections or predictions as to which way we are going to go. Are we talking about the vast majority of the internet continuing as it is today within the new regime, with the odd player that will be outside that, or is it the Government’s expectation that there may need to be blocking of significant numbers of services, essentially for the foreseeable future?

Other countries such as France and Germany have been dealing with this recently, as the noble Lord, Lord Bethell, is probably aware of. They have sought to restrict access to pornography services, and there have been all sorts of consequent knock-on effects and challenges at a technical level. It would be helpful to understand whether our expectation is that we will see the same in the United Kingdom or that something else is going to happen. If the Government do not have that information today, or if they have not made those projections, it would be helpful to know their thinking on where that might happen. Who will be able to inform us as to what that the future landscape is likely to look like as it evolves, and as Ofcom gains these powers and starts to instruct companies that they must obtain licences, and then seeks to take enforcement action against those that choose not to play the game?

[Lord Curry of Kirkharle (CB)]

My Lords, I support Amendment 217 in the name of the noble Lord, Lord Bethell, and very much support the comments that he has made. I will speak to Amendments 218C, 218E, 218H and 218K in my name within this group. I also support the intent of the other amendments in this group tabled by the noble Lord, Lord Bethell.

I appreciate the process helpfully outlined by the noble Lord, Lord Allan. However, when looking at Ofcom’s implementation of existing provisions on video-sharing platforms, the overwhelming impression is of a very drawn-out process, with Ofcom failing to hold providers to account. Despite being told by Ofcom that a simple tick-box declaration by the user confirming that they are over 18 is not sufficient age verification, some providers are still using only that system. Concerningly, Ofcom has not taken decisive action.

When children are at severe risk, it is not appropriate to wait. Why, for example, should we allow porn sites to continue to host 10 million child sexual abuse videos while Ofcom simply reports that it is continuing to partner with these platforms to get a road map of action together? As has been mentioned by the noble Lord, Lord Bethell, Visa and Mastercard did not think it was appropriate to wait in such circumstances—they just acted.

Similarly, when systems are not in place to protect children from accessing pornography, we cannot just sit by and allow all the egregious associated harms to continue. Just as in Formula 1, when a red flag is raised and the cars must stop and go into the pits until the dangerous debris is cleared, sometimes it is too dangerous to allow platforms to operate until the problems are fixed. It seems to me that platforms would act very swiftly to put effective systems and processes in place if they could not operate in the interim.

The Bill already contains this emergency handbrake; the question is when it should be used. My answer is that it should be used when the evidence of severe harm presents itself, and not only when the regulator has a moment of self-doubt that its “road maps”, which it is normally so optimistic about, will eventually fix the problem. Ofcom should not be allowed to sit on the evidence hoping, with a wing and a prayer, that things will fix themselves in the end.

--- Later in debate ---

Introducing mandatory requirements would undermine Ofcom’s independence and discretion to manage enforcement on a case-by-case basis. This would also frustrate Ofcom’s ability to regulate in a proportionate way and could make its enforcement processes unnecessarily punitive or inflexible. It could also overwhelm the courts if Ofcom is strictly forced to apply for business disruption measures where any grounds apply, even where the breach may be minor. Instead, Ofcom will act proportionately in performing its regulatory functions, targeting action where it is needed and adjusting timeframes as necessary. I am mindful that on the final day in Committee, the noble Lord, Lord Grade of Yarmouth, continues to be in his place, following the Committee’s deliberations very closely on behalf of the regulator.

[Lord Allan of Hallam (LD)]

I am reminded by my noble friend Lord Foster of Bath, particularly relating to the gambling sector, that some of these issues may run across various regulators that are all seeking business disruption. He reminded me that if you type into a search engine, which would be regulated and subject to business disruption measures here, “Casinos not regulated by GAMSTOP”, you will get a bunch of people who are evading GAMSTOP’s regulation. Noble Lords can imagine similar for financial services—something that I know the noble Baroness, Lady Morgan of Cotes, is also very interested in. It may not be for answer now, but I would be interested to understand what thinking the Government have on how all the different business disruption regimes—financial, gambling, Ofcom-regulated search services, et cetera—will all mesh together. They could all come before the courts under slightly different legal regimes.

[Lord Parkinson of Whitley Bay (Con)]

When I saw the noble Lord, Lord Foster of Bath, and the noble Baroness, Lady Armstrong of Hill Top, in their places, I wondered whether they were intending to raise these points. I will certainly take on board what the noble Lord says and, if there is further information I can furnish your Lordships with, I certainly will.

The noble Baroness, Lady Kidron, asked whether the powers can be used on out-of-scope services. “No” is the direct answer to her direct question. The powers can be used only in relation to regulated services, but if sites not regulated by the Bill are publishing illegal content, existing law enforcement powers—such as those frequently deployed in cases of copyright infringement—can be used. I could set out a bit more in writing if that would be helpful.

My noble friend Lord Bethell’s amendments seek to set out in the Bill that Ofcom will be able to make a single application to the courts for an order enabling business disruption measures that apply against multiple platforms and operators. I must repeat, as he anticipated, the point made by my right honourable friend Chris Philp that the civil procedure rules allow for a multi-party claim to be made. These rules permit any number of claimants or defendants and any number of claims to be covered by one claim form. The overriding objective of the civil procedure rules is that cases are dealt with justly and proportionately. I want to reassure my noble friend that the Government are confident that the civil procedure rules will provide the necessary flexibility to ensure that services can be blocked or restricted.

The amendment in the name of the noble Lord, Lord Allan of Hallam, seeks to clarify what services might be subject to access restriction orders by removing the two examples provided in the Bill: internet access services and application stores. I would like to reassure him that these are simply indicative examples, highlighting two kinds of service on which access restriction requirements may be imposed. It is not an exhaustive list. Orders could be imposed on any services that meet the definition—that is, a person who provides a facility that is able to withdraw, adapt or manipulate it in such a way as to impede access to the regulated service in question. This provides Ofcom with the flexibility to identify where business disruption measures should be targeted, and it future-proofs the Bill by ensuring that the power remains functional and effective as technologies develop.

As the noble Lord highlighted, these are significant powers that can require that services be blocked in the UK. Clearly, limiting access to services in this way substantially affects the business interests of the service in question and the interests of the relevant third-party service, and it could affect users’ freedom of expression. It is therefore essential that appropriate safeguards are included and that due process is followed. That is why Ofcom will be required to seek a court order to be able to use these powers, ensuring that the courts have proper oversight.

To ensure that due process is upheld, an application by the regulator for a court order will have to specify the non-compliant provider, the grounds of the order and the steps that Ofcom considers should be imposed on the third parties in order to withdraw services and block users’ access. These requirements will ensure that the need to act quickly to tackle harm is appropriately balanced against upholding fundamental rights.

It might be useful to say a little about how blocking works—

--- Later in debate ---

[Lord Parkinson of Whitley Bay (Con)]

Yes; he made a helpful point, and I will come back on it.

[Lord Allan of Hallam (LD)]

We share a common interest in understanding whether it would be used against VPNs, but we may not necessarily have the same view about whether it should be. Do not take that as an encouragement—take it as a request for information.