Communications and Digital Committee

Tuesday 3rd November 2026

(began 8 hours, 52 minutes ago)

Share Debate
Watch Live
Skip to latest contribution
This debate has concluded
14:02
14:02
14:03
14:03
14:03
14:03
14:03
14:04
14:04
None Portrait Speaker 1
-

Yes. I think the answer to that is yes. I think it still does have that potential. I suppose I should declare, as the committee knows, a sense of parental responsibility for this bill. So I'm perhaps not the most impartial observer of it, but I do think that the structure of the bill will survive the test of time. And we had essentially a choice back in the day, when we were trying to decide the way in which we should approach this challenge. We could either have had a rules based regulation approach where we had a list of do's and don'ts, essentially for online platforms, or we could take a different approach, which is a much more principles based approach to regulation based on a duty of care model.

 And Lorna and indeed Will Perrin, who's probably the other intellectual godfather of this particular approach, persuaded me at the time that the duty of care approach was right, and I'm still persuaded of that. I think if you pursue a rules based approach, a list of do's and don'ts, what you find in this space above all others is that your list becomes out of date almost as soon as you've finished writing it. So the approach that's set out broadly in the bill is, I think, the right one. What we have to recognise, and this is probably reflected in the Ofcom report, is that the harms multiply all the time.

So there are many, many more and many different kinds of online harms, particularly affecting children. So the fact that we appear to be standing still doesn't necessarily mean we're failing. It may mean that the harms are multiplying and we are trying to keep pace with them. But and I think you may find this is a theme of the evidence we all give to you this afternoon. It is important that the bill is properly implemented. And I think we are now in a place where the bill allows for more action than the regulator is prepared to take.

 And so I think a large part of the problem is that we have handed over a piece of legislation, imperfect though, except that it is, which I think could be used more effectively by the regulator than it is currently using it.
14:06
14:06
None Portrait Speaker 2
-

I agree with what Jeremy has said. Maybe there is a certain amount of of bias given my my work on why the duty of care would be a good thing. I think focusing on the choice architecture of the services reflects the fact that they're not neutral as to content and to behaviours, and it is also something that the companies control. And so to me, it seems legitimate and appropriate to link that responsibility with some responsibility for doing something about it. I think I had assumptions that perhaps proved unfounded as to how far the the regulator was prepared to go without explicit steer in the legislation.

 And I think you can see if you look at Ofcom codes, that there is a focus in those codes on aspects that were specifically mentioned in the legislation. So, for example, the requirement to have an effective takedown system. There's a lot in the codes on that. The illegal content codes for user to user services and highly effective age verifications. There are two specific things the act required, and it's noticeable that they're the two specific things Ofcom has focused on. So maybe the regulator was at sea, I suppose. Picking up a couple of points that Jeremy made the the the world has changed.

 I think having a principles based approach and an approach that focuses on requiring services to look at what they're developing. Helps with future proofing. So for that reason, I don't think moving away from from the approach we've got at the moment is is right. I would say the Online Safety Act could never have been a silver bullet. It is looking at a particular segment of the market and their particular role in an environment. You're going to have to look at, I suppose, people posting content and the rules relating to those as well, and how those fit in.

 And finally, just the voice of, of pragmatism. If, if you try and bring in something entirely new, I think it disincentivizes services, complying with what we've got now, and then you have the time lag. Again, I think it is difficult to assess how well the regime is is functioning at the moment, partly because there was the the time lag in the codes coming in. And then you need to wait for enforcement.

 And, and I think we're only really just at the beginning of seeing that enforcement.
14:10
14:10
Lord Knight of Weymouth Portrait Lord Knight of Weymouth
-
-
Thank you. Chairman. The sort of premise of your question is that the act has not delivered the results that were hoped for. And therefore, the question has to be why that is the case. I don't disagree with what Lorna or Jeremy have said. I'm sure during the course of the afternoon we won't disagree that much. But what I would say is this I think at the heart of this, the heart of this debate is a problem of the way Ofcom is interpreting the powers that it's been given. And I would say if you read clause ten of the act on which which deals with the duties relating to the safety duties relating to illegal harms, and you look at Ofcom's written evidence to this committee and use your judgment as to whether Ofcom have interpreted that act in the way that it is written and the way that Parliament intended at the time, and specifically the extent to which the platforms have proactive obligations to scan for and mitigate the existence of illegal content.

 Now, the written evidence to the committee, they're saying that those don't exist. The the the act very clearly says that there is duty to prevent access, to prevent access. The. In Canada, they've recently introduced their own version of the Online Safety Bill, the Safe Social Media Act, on that. It expressly says there's no obligation to proactively scan. It's written on the face of the bill in our. The Online Safety Act. It was always intended that the legal safety duties would give guidance to the companies. The duty of care rested on a series of priority legal offences.

 We expected the companies to have systems in place to address those needs. It didn't require a perfection, but what it did require, in our view, was that the companies were aware of those obligations and they would proactively seek to identify illegal content and act against it, to make it harder for users to find and remove it, not wait for someone to complain, and then then retrospectively deal with it. In fact, during the passage of the legislation, one of the lobbies from the tech companies was that as we were no longer in the European Union, the e-commerce directive no longer applied.

And in the e-commerce directive, the companies are protected from an obligation to monitor generally what goes on, on these platforms. And we didn't want to introduce that in the Online Safety Act, because we knew that it would be used as a get out of jail free card by the companies where every time they were found to have failed in their duties, they could say yes, but there's no obligation for us to monitor everything the way this these provisions in clause ten have been interpreted, I think, by the regulator is wrong. It's certainly not what we intended, and I think it is at the heart of why enforcement has been weak.
14:12
14:12
Lord McNally Portrait Lord McNally
-
-
I broadly agree with what everyone said, and I wanted to start by saying the report from Ofcom that you mentioned, chair at the outset is a travesty. I mean, the idea that it took ten years to get here and then nine months later, after implementation, nothing has changed. And I and I really just want to put into this room the voices of parents and children who are desperate. At the other end of the. Nothing has changed. And so we don't just forget about their experience as we talk about the technical aspects of the bill. But.

 But agreeing largely with the colleagues, I say, yes, it does still work, but there are four things that absolutely have to be thought about. I think the first is whether the powers that have been given to Ofcom have been adequately interpreted. As you've heard, I think the general view on this side of the table is no, they haven't. Number two is what has changed, what has moved and what could we not have anticipated at the time, or what the government of the day did not allow us to put in? So where are the gaps, and by what mechanism will those gaps be filled?

 And the third is, I think, a sort of a culture question about Ofcom, which is really about is it too cumbersome? They've got a very big budget, hundreds of people. But it's very, very hard to get a sense of urgency. And even, you know, even in the recommendations here, there are a number of things that they could decide to do right now, but they're waiting for future action from the government. And I think this sort of slightly more in sorrow than in anger sort of communication from Ofcom is something that that maybe the committee might look at and say, you know, are they supervisory or are they enforcers?

 Because if they're enforcers, then it's on them that it's not working . Or their recommendations would have been, we need this power, that power, the other power right now in order to do our job. And my final thing is really about enforcement, where I have some sympathy with with Ofcom. I don't think the enforcement powers are all there. And I think unless there is proper enforcement capability, really the act won't work. And if I could finish by just saying, I think one of the critical mistakes of both government regulator and to a degree even Parliament itself, was that we were all used to and had in our imagination regulation of sectors that are used to being regulated and are willing to be regulated.

And I cannot emphasize enough how both ideologically and practically, the tech sector does not see itself as being willing to be regulated. And I think that when you finally, you know, go with your recommendations, it is it is understanding that and seeing how then enforcement needs to change, which we may get to later. That is critical to the way forward. And I think that is something that sits with all of us, not just the regulator.
14:16
14:16
14:16
14:18
14:18
None Portrait Speaker 1
-

Can I slightly disagree with that? I do think that there is merit in safe harbor provisions. I think because we are in a very flexible and fast moving landscape, it's important that we are fair to those we are regulating. And if we are simply going to say to them, we want you to keep your users safe and not explain precisely or at least roughly how that might be done, I think that would be unfair to them. However, I do think that the safe harbor provisions need to work on the basis that Ofcom, as the regulator, has higher, not lower expectations.

 And I fear what's gone wrong here is that Ofcom's expectations are too low. So what's in the codes of practice? Offering the safe harbour, if you do what they say is frankly not ambitious enough. And this is strange to me , because these are some of the most inventive companies on the planet. We can expect them to innovate all over the place in order to advance their own cause. Offer us a product we're more willing to buy. I don't see why we shouldn't expect them to be equally imaginative and innovative when they're presenting safer options, or worrying about the safety of their users.

 So what I want to see is the interpretation of Safe Harbour being. We offer you safe harbour if you are innovative, if you are ambitious, if you do as much as you proportionately can, we might come back to the definition of proportionate because I think it's important. But I do think that it's important in this context to expect an ambitious response. And I think that's what's missing.
14:21
14:23
14:26
14:26
14:27
14:27
14:27
Lord McNally Portrait Lord McNally
-
-
I've always been interested in the fact that the risk register that Ofcom does to set out the totality of risk is much richer, much better and actually more straightforward than the codes themselves. And I think if you didn't have safe harbour and and I think it is interesting what what colleagues have said, because actually there seems to me to be little difference about whether you have safe harbour that guarantees you, if you've tried everything, i.e. been ambitious versus having no safe harbour, as in, you know, you don't have a low bar of a code.

 And I really want to just say to the committee that in spring 2025, when Ofcom was doing these codes, somebody came to me from within the companies and said, this is ridiculous. We are going to fix feasibility at what we can, at what we think we can do, not even what we think. They said what we say we can do in 2025 and it will be there for all time. So it's a flaw and it's pushing us downwards. And I think that the safe harbour is part of what makes it unambitious. I agree with others that there must be some flexibility like there is in the DSA of interpretation.

 But when I went to Ofcom and said, could your codes be guidance and the risk register be what you're going for? They said, but how do we measure that? And I go, but I don't understand how you measure against the code. You always at some point have to make a judgment about whether you have reached the bar. And I think that the bar that they should reach is the overarching risk register that they've already done, that is better.
14:31
14:31
14:34
14:34
14:37
None Portrait Speaker 1
-

Yeah, I mean, I agree with all of that. I think that when Laura and I were discussing the principles of this way back in the mists of time, what we envisaged was an overarching duty of care that would be the keystone to this entire legislative edifice that's gone, really. And the duty of care has been broken down into its component parts. I think had we retained it, there would have been the opportunity to say whatever else we say to you about detail. You've got this residual overarching duty of care to keep your users as safe as you reasonably, proportionately can.

 But the other point I would make is that the expectation that, as I said earlier, I think the regulated are entitled to have, which is that you give me some idea of what this duty of care really means. In practical terms, if you are not expecting a good deal of people, then they will default to the minimum that you are asking of them. And one of the problems I have with the way in which Ofcom have approached, particularly the way in which they decide what to put into their codes of practice, is that they have decided that they can only recommend, in a code of practice, something that would be proportionate to expect of a platform to do.

 So far, so reasonable. But when you define the word proportionate as meaning, we know it works, we have evidence to show that it works. Then what you're actually doing is fixing the benchmark at current good practice, because you only have evidence that it works. If people have been doing it, probably doing it for long enough to create an evidence base. So my worry here is that back to this point about lack of ambition, if what Ofcom are saying is we will only recommend something in a code of practice, something which then gives you protection from regulatory intervention, because that's what Safe harbour means, and we set the benchmark at things.

 We can prove work because people are already doing them. Then either you fix things at the status quo in , again, a fast moving landscape where the whole point was, we want these platforms to scan the horizon and be responsive to the problems they can see emerging. But worse than that, if you are an innovator, if you are a platform that's out there trying to do your best and move the needle on safety such that you are doing something exciting and newly effective in keeping your users safe, what you'll then being told is you're better off retrenching back to the standard current practice, because that's what gives you the regulatory protection.

 And I think that's the exact opposite of what we were trying to achieve, which is to encourage, as I say, platforms to be ambitious, to be scanning the horizon themselves and put the weight of obligation on them through the duty of care model so that regulators and legislators, like all of us, don't have to run to catch up all the time.
14:42
14:43
None Portrait Speaker 1
-

Well, it's rare for me to disagree with Nadine, but on this. occasion I do. I do think it was viable. I think if, again, if you go back and Laura will correct me if I misremembered this. But the original thought was we can do something in the online space similar to the operation of the Health and Safety at Work Act of 1974. The Health and Safety at Work Act doesn't require you to do something specific with the buckets on the floor, or do something with the shelving. Specifically, what it says is you've got to create a safe environment.

 The objective here was to do the same online, and I'm not persuaded that that wouldn't have worked. And as I say, it would have addressed some of the problems which we've identified already in this session. It's not a panacea. I accept that, and it's not easy to do, but I think it is feasible. And I think what it would have done is set the tone for the obligation, being on the platforms to do what they sensibly can to keep their users safe. I am perfectly prepared to accept, and always was, that if platforms do all that they reasonably can to keep their users safe and something bad happens to a vulnerable user, nonetheless, I don't expect them to be in the stocks for that, but I do think that we need to set our expectations high because again, these are companies capable of meeting high expectations.

 We are not asking companies to do something that they cannot do, and we shouldn't ask them to do something they cannot do. This is asking them only to do what they can do. But that should be our expectation.
14:47
14:47
14:48
14:48
14:48
14:48
Lord Knight of Weymouth Portrait Lord Knight of Weymouth
-
-
Yes, I think so. Firstly, if you go back to the moment of that exchange, the bill was in a very different was framed very differently, structured very differently. So the idea of having priority legal offences in a schedule of existing acts of Parliament written on the face of the Bill that the safety duties will be built on, that wasn't in the bill at the time. And actually, one of the challenges at the time was what does the duty of care rest on? Does it rest on the Human Rights Act? Does it rest on as it does in the EU, on the Charter of Fundamental Rights of citizens of the EU?

 And what does it rest on? And there was some concern at the time about whether we were then delegating to a regulator, lots of interpretations of rules around speech in particular, which would be where the regulator would be giving rulings on harm based on things that weren't actually unlawful, behaviours weren't necessarily unlawful. So I think the question at the time was very much, what does that duty of care rest on? We felt the duty of care rested on the priority legal offences, and also the proper enforcement of the platform's own terms of service. I think it's interesting that Ofcom is saying in its evidence that certainly with regards to children accessing younger children accessing their services, they're not entirely certain what powers that they have.

 Again, I think it's another example of the way in which the powers that were given to the regulator have been used or interpreted, are weaker than we thought they would be at the time.
14:51
14:54
14:54
14:54
Lord Tarassenko Portrait Lord Tarassenko
-
-
Thank you, Mr. Chair. And I'm interested, possibly because of my engineering background in design and design choices. And in fact, there's a very interesting blog by the president of Royal Academy of Engineering about making the right designs for chatbots and so on that you may have read, because what we've heard, and I think everybody in the horseshoe and everywhere in this room will probably agree that the act has not succeeded in making online services safe by design. And I've read the document that was produced by the Coalition of Five Rights, the Molly Rose Foundation, Online Safety Network, SPC and yourself, Lorna, from cover to cover.

 I think it's got some very interesting ideas, but I wanted to explore a little bit, whether that is one way to go and one of the things that you advocate together with that document is that the government should introduce a statutory definition of safety by design, and then require Ofcom to develop a dedicated code in the same way that you've put a template together. So I have one question, but slightly different to the different members of the panel. We think today for for Jeremy and Damien, it's kind of a general question. Do you think the type of proposals that are in this model of safety by design, code of practice would require?

 What do you think they would require platforms to do differently that they're not doing now? And do you think that Ofcom has the powers to introduce these different measures for Lorna, I wanted to ask you which parts of the code could Ofcom adopt tomorrow under section 41, and which would need legislation and the technical amendments that you mentioned in your document? Are they amendments to the act? Minutes that you mentioned in your document. Are they amendments to the act? And finally, I'll give you the chance to take the .
14:59
14:59
15:00
15:00
15:03
15:03
15:03
15:03
15:03
15:03
15:04
15:04
None Portrait Speaker 2
-

For.
15:04
15:04
15:05
15:05
15:05
15:07
15:07
15:09
15:09
15:09
15:09
15:09
15:09
15:10
15:11
15:11
15:12
15:12
None Portrait Speaker 4
-

Say in data.
15:12
15:12
None Portrait Speaker 4
-

In cyber .
15:12
15:13
15:13
15:13
15:13
15:13
15:15
15:15
15:15
15:15
15:16
15:16
15:17
15:17
15:17
15:18
15:19
15:19
15:19
15:19
15:20
15:21
15:21
15:22
15:22
15:22
15:22
15:22
15:22
15:23
15:23
15:25
15:25
15:25
15:25
15:25
15:26
15:26
15:27
15:27
15:27
15:28
15:28
15:28
15:29
15:29
15:30
15:30
15:31
15:31
15:31
15:32
15:32
15:32
15:32
15:32
15:33
15:33
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
None Portrait Speaker 2
-

Can and should be.
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
None Portrait Speaker 4
-

There may be .
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
None Portrait Speaker 1
-

Tools to .
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
None Portrait Speaker 2
-

In order to work out what it is that we're asking for. Thank you. Yes. Well, the when we recommended the permanent Joint Committee, when we were on the Joint Committee, that actually and a lot of the work had been done by predecessor committee to this committee as well. It was to not just oversee the way regulator Ofcom uses powers, but also to improve scrutiny of the coordination between different regulators as well. There was a discussion at the time do we have like an internet regulator? Almost like the internet was a discrete thing rather than being part of everything.

 So it was more sensible to look at how different regulators that work across the online online world, be it the ICO or Ofcom, use their powers, and whether it's what Parliament. intended and recognising that the. Whilst we have departmental select committees, they are busy with lots of other important issues they have to deal with as well, and the ability to build up a field of expertise and knowledge in this regulatory environment over a period of time, and for that to be a permanently sitting joint committee, I think would have been a huge value. And I congratulate this committee for doing this.

 Post-legislative scrutiny of the of the act, when there's no other attempt has been made to do that since it was passed. I'd just say briefly as well, I think we actually the the principal architecture of the act, of the duty of care based on the priority illegal harms, was actually the recommendation of the Joint Committee wasn't the way the government intended to structure it. And it was recommended with the future in mind, to make it easy through secondary legislation for Parliament to add those offences in. But in some ways it was always, I think, always envisaged, I think rightly, that future enforcement on new harms should be as a consequence of an act, both by Parliament as well as as well as the.

 regulator and Parliament has got to decide is this an offence or not, as Parliament has done over Baroness Owen's amendments on intimate, intimate image sharing, we didn't consider AI as a tool to fabricate intimate images. We were more concerned at the time with sharing ones that had already been captured. But you can create a new offence. Parliament can decide what it is. It can include it in the Act as a priority legal offence, and then Ofcom has the regulatory regulatory duty to enforce it. Imagine if we didn't have that architecture and we were basically going now to Ofcom and saying, we think you should do something about this.

 We haven't actually decided whether it's illegal or not, but we think you should stretch powers you don't quite have in order to include this. Would we want to delegate that responsibility? And even if we did, it would almost .
15:34
15:34
15:34
None Portrait Speaker 4
-

Move on to Charlotte,
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
None Portrait Speaker 1
-

Yeah.
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
None Portrait Speaker 6
-

Structure would be .
15:34
15:34
15:34
None Portrait Speaker 5
-

I .
15:34
None Portrait Speaker 1
-

Will send you .
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
None Portrait Speaker 8
-

My one thing .
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
None Portrait Speaker 1
-

Power to enforce that?
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
None Portrait Speaker 1
-

New powers are .
15:34
15:34
15:34
None Portrait Speaker 1
-

So thank .
15:34
15:34
15:34
This debate has concluded
Return to start of debate - Return to top of page