Online Harms Legislation: Barrister Charlotte Yarrow on the Implications for the Digital Marketing Sphere

The online harms legislation making its way through parliament has wide-ranging potential implications for business and the data and marketing industry. In this article, Furnival Chambers' Barrister Charlotte Yarrow unpacks the online harms legislation and the potential implications for business and regulation.

Online Harms Reduction Regulator Bill: What you need to know

What is it?

With such a catchy title, it seems surprising that the intention of this Bill doesn’t just spring from the page- doesn’t it?

Well however ‘unsexy’ the title, this new pending legislation is not something to be ignored. Its potential ramifications upon most online industries, are both wide and far-reaching. In short, it promises to do so much more than it says on the proverbial tin…

It is a Bill, currently in the House of Lords, which, when brought in to force will legislate not only how on-line platforms operate but will also place the responsibility for all on-line content (including user generated) on the shoulders of private businesses, requiring those business to put the framework in place to do so.

Will this affect us?

In short, companies who provide a platform for content in the UK will soon face new duties for online protection as a result of this legislation, as and when it is enacted by Parliament. Simply put, companies based anywhere in the world, which have an online presence in the UK, will have an enforceable and defined duty of care towards their online users and those whom the use of the platform may effect. It is anticipated that breaches of the duty will result in civil (and potentially criminal) proceedings that may result not only in very significant financial penalties, but also individual liability, and of course the very real, negative commercial consequences.

This will affect any company who, in the course of business, organises, hosts or displays ‘content’ publicly (or even to any selected audience) particularly where that content is provided and shared by it’s users. This will include social media platforms on one hand, but also any company with a website which allows users to share information/opinions or material.

What is going to do and how?

This legislation, once in force places the responsibility for harmful content, both legal and illegal on to the platform providers in an unprecedented way. The government’s intention is to make the UK the safest place to be online in the world and it plans to do that by making each business responsible for its own content. With this legislation it seeks to place a statutory duty of care firmly on the shoulders of the online platform service operators by ensuring that they themselves tackle the harms that may be caused by any activity or content on their platforms. This will include a responsibility to those whom the material might affect as well as to those who post the material. Compliance with this duty of care will be overseen and enforced by an independent regulator and each business will have to register their compliance.

The Bill in its current format will provide OFCOM, (chosen, it seems because of it’s existing responsibility over the media), with the relevant powers to publish a report. The report will contain recommendations on how and in what form it will reduce online harm as well recommendations for how extensive the duty of care imposed on Internet companies for their users should be and exactly what “harms” should be prevented. The proposed harms currently range very widely to include terrorism, child sexual abuse, child access to porn, hate crime, gang communication, sale of illegal goods, financial crime, electoral fraud, but also, bullying and trolling, fake or misleading information, abusive communication based on race, gender and sexual orientation and influencing toward self harm, to name but a few. Certainly, the data marketing industry is less likely to be affected by the illegal harms, but the latter harms, which can lurk anywhere any opinions are expressed, may remain an area of concern and where steps may be required to be taken.

Of concern commercially, the Bill includes a wide catch-all of any other harms which OFCOM might deem appropriate, including harms which might effect mental health and well-being.

What does it mean for the digital marketing industry?

The answer to this question will largely depend on how the legislation, in its final format, defines companies’ duty of care towards their online users.

Its implementation will have important and far-reaching consequences for those providing online content, particularly, but not limited to those whose target market is children and young people. This will include those with simply a website where user opinions may be shared. It is important to be aware of its likely implications early on. The steps that each host platform/website/business will be required to put in place will take considerable time, research & human and financial resources. If the obligations that are currently forecast come into play, it will place a considerable financial and logistical burden at the door of those who provide and host online content. Companies will need to be ready.

The Nitty-Gritty, in brief: What will be required?

The White Paper proposes that all companies have appropriate systems and processes in place to react to concerns over harmful content and improve the safety of their users. To provide just a flavour: it is anticipated they will be required to source and implement effective technology to discover harmful material, apply effective complaint mechanisms, respond promptly & implement take-down procedures expeditiously. They will be required to put in place transparent decision-making policy over actions taken in response to reports of harm and enforce their own terms and conditions effectively and consistently. And then to annually report on-going monitoring measures and compliance.

For the marketing industry, any company with a host platform for user views or content will be subject to these new rules. The level of exposure to this legislation with vary widely in this industry but all businesses effected to any degree will have to, at very least, action a risk assessment, provide acknowledgement of new policy, amend T&C’s and provide user guidelines in line with the legislation, whereas others will require significant investment in new technology & in substantial policy change.

This of course, throws up a plethora of questions about the mechanisms that internet companies have in place within their systems and their online community guidelines to be able to meet the requirements of the regulator. It may mean that internet companies have to balance their duties under these obligations, and their GDPR obligations very carefully, if these powers are not edited by the final version of the Act. This is a question that companies may be advised to consider early to make sure the right provisions are in place before any legislation takes effect.

When will we need to be compliant?

The Bill is currently in the Lords but it is considered to be a matter with impetus. It is therefore predicted that OFCOM will be charged with producing the report by late summer and for legislation to be passed by summer 2021.

How is it different from the DMA Code?

The government are aware that a plethora of industry bodies have in place a range of regulatory and voluntary initiatives aimed at addressing many of the issues this legislation is also designed to address, but there is a wealth of feeling that these have not gone far or fast enough, or been consistent enough between different companies and industries to keep UK users safe online.

In reality, for some companies, with minimal exposure they will not be required to behave very differently than they have been hitherto, abiding by the Code, other than publicly acknowledging their risk areas and declaring, (rather as with GDPR), their awareness and compliance. For others, this legislation will create a very significant package of new responsibilities which will need to be resourced in a difficult economic climate.

Who will not be affected?

For those who market only using others platforms, it should be borne in mind that it is the social media platform hosting the content that is in scope, not the business using its services to advertise or promote their company. To be in scope, a business would have to operate its own website with the functionality to enable sharing of user-generated content, or user interactions. Most small businesses (where there is a lower risk of harm occurring) will not have to make disproportionately burdensome changes to their service to be compliant with the proposed regulation.

What happens if we are not compliant? Potential Penalties and Enforcement

The White Paper sets out that the regulator is going to have a range of enforcement powers. Some punitive powers are those which exist in other regulatory frameworks, but there will be a variety of tools in this regulator’s toolkit. These are said to include:

• Issuing civil fines for proven failures in clearly defined circumstances. These fines are likely to be linked to metrics such as global annual turnover, volume of harmful material, volume of views of harmful material, and time taken to respond to the regulator. 4% of global annual turnover are figures which have been discussed and are widely anticipated to be implemented.

• Demanding additional disclosure, in effect, searches of the company regarding the alleged breach.

• Naming and Shaming: Publishing public notices detailing the proven failure of the company to comply with standards.​

However, it is thought that the enforcement powers of the regulators are likely to go beyond that of other regulatory systems and additional enforcement measures that are being considered are:

• Disruption of business activities, (particularly to be aimed at those companies based in other jurisdictions but with an online presence in the UK)
• Internet Service Provider blocking
• Senior Management liability ie action or the prosecution of individuals within the organisation. (This may have particularly importance following changes to the Privacy and Electronic Communications which provide powers to allocate liability to a specific person or position within an organisation). It should be noted that with this comes significant negative press, since each pre-trial hearing is likely to attract attention & in the course of a criminal prosecution such hearings can be regular and protracted.

The punitive effects this Bill, once enacted will be considerable and could cause very significant commercial effect.

Children and online content

It is worth bearing in mind for members of DMA, that the bite of this legislation may well be felt by those whose marketing is primarily directed children and young people. The NSPCC were one of the major forces in getting in this Bill on the table. The NSPCC have estimated that 90 cybercrimes are recorded against children every single day and tackling those figures is likely to form a large part of the bill.

And finally

This legislation, when it comes in to force is likely to place a very significant burden at the door of each affected company and strategies and methodologies, indeed investment will need to be put in place by each individual business in good time to demonstrate they are fulfilling their duty of care.

The best way to avoid the expense of crisis management is to avoid the crisis.

Charlotte Yarrow

Specialist practice areas: Criminal/Civil Fraud, Regulatory/Compliance, Serious organised crime, Health & Safety, Inquests & Public Inquiries, Serious sexual offences

Charlotte Yarrow is a highly sought after leading junior in serious crime and regulatory matters with a particularly strong track record in handling high profile and complex financial crime, advising on emerging legislation and a full spectrum of regulatory matters for companies and individuals before charge, during investigation, through to trial, as leading counsel. She has been involved in training regulatory investigators and has written papers advising regulatory authorities on the application of the law in practice and businesses on how to prevent and manage investigations. More about Charlotte Yarrow

To discuss the online harms legislation and potential implications for the industry and your business, Charlotte can be contacted at Cyarrow@furnivallaw.co.uk.