OFCOM's guidance about enforcement action

Protecting people from illegal harms online

Online Safety Enforcement Guidance¶

Guidance Published 16 December 2024

Contents¶

Online Safety Enforcement Guidance ........................................................................................ 1 Contents .......................................................................................................................................... 2 1. Overview ............................................................................................................................. 3 2. Introduction ........................................................................................................................ 4 3. Enforcement action and when we use it ............................................................................ 8 4. Initial assessment of the issues ......................................................................................... 12 5. Opening an investigation and information gathering ....................................................... 17 6. Determining the outcome of our investigation ................................................................ 25 7. Liability of Related Companies and Controlling Individuals .............................................. 37 8. Settlement procedure ....................................................................................................... 43 9. Business disruption measures ........................................................................................... 49 10. Procedural complaints about investigations .................................................................... 54 11. Requirements enforceable by Ofcom ............................................................................... 56

Section 1 Overview¶

1.1 Ofcom is the independent regulator for online safety in the UK. As part of this role we may take enforcement action where it is in the interests of citizens and consumers to promote compliance, deter future wrongdoing, protect users from harm and hold wrongdoing to account.

1.2 The Communications Act 2003 (the Communications Act) requires Ofcom to have regard, in all cases, to the principles under which regulatory activities should be transparent, accountable, proportionate, consistent, and targeted only in cases in which action is needed; and any other principles appearing to Ofcom to represent the best regulatory practice. In terms of enforcement, this means we will take action where it is proportionate and appropriate, but with a willingness to intervene firmly, promptly and effectively when required. We will always seek the least intrusive regulatory methods to achieve our objectives and ensure that interventions are evidence-based, proportionate, consistent, accountable, and transparent in both deliberation and outcome, in line with our regulatory principles.

1.3 This Online Safety Enforcement Guidance sets out how Ofcom will normally approach enforcement under the Online Safety Act 2023. The approach set out in this guidance has been informed by our experience and track record of enforcement in other sectors that we regulate.

Section 2 Introduction¶

2.1 The Online Safety Act 2023 (the Act) imposes duties and other regulatory requirements on providers of three broad categories of internet services, namely: a) a ‘user-to-user (U2U) service’, which means an internet service where content that is generated, uploaded, or shared by users may be encountered by other users of the service;1 b) a ‘search service’, which means an internet service that is, or includes, a search engine;2 or c) a provider of internet services where ‘regulated provider pornographic content’ is published or displayed.3

2.2 Where internet services have significant numbers of UK users or are targeted at the UK market, the providers will be subject to the relevant duties and requirements and must comply with them.4 We refer to the services in scope of the Act as ‘regulated services’ and the providers of such services as ‘service providers’ in this guidance.

2.3 The Act also places certain requirements and duties on persons who are not service providers. For example, where Ofcom issues an information notice to a person who appears to have information that we require for our online safety functions, that person must comply with the requirements of the notice (see paragraph 2.9).

2.4 Certain third parties may also be subject to obligations under the Act or be held liable for a breach by a service provider, because of their relationship with that provider. For example, we may hold another company within the same corporate group as a service provider liable for a contravention of the service provider’s duties under the Act. In addition, in certain circumstances where a service provider is (or is likely to be) in breach of its regulatory obligations, we may seek a court order against businesses that provide services or enable access to the service provider. Such an order, if granted, would require them to take certain action to disrupt the business of the service provider in question (see paragraph 2.10).

2.5 This Guidance sets out how Ofcom will approach enforcement of the duties and requirements that are imposed under the Act and explains how we will exercise our enforcement powers under the Act.

The scope of this guidance¶

2.6 Ofcom’s enforcement powers are set out in Chapter 6 of Part 7 of the Act and enable us to enforce the duties and requirements applying to service providers and, where relevant, other persons or third parties (we refer to these as ‘obligations’ in this Guidance, save where the context indicates otherwise). We must produce guidance about how we propose to exercise these functions.5

1 Section 3(1) of the Act. 2 Section 3(4) of the Act. 3 Section 79(2) and 80(2) of the Act. 4 There are certain exemptions, see for example, Schedule 1 of the Act. 5 See section 151 of the Act. For example, our guidance must give information about the factors that Ofcom would consider it appropriate to take into account when taking, or considering taking, enforcement action

2.7 We may take enforcement action in relation to any of the ‘enforceable requirements’ set out in section 131 of the Act, which include the following:6 • the illegal content and children’s risk assessment duties; • the children’s access assessment duties; • the safety duties about illegal content and children’s safety duties; • the user-empowerment duties that apply to Category 1 services; • the duty about content reporting; • the duties about complaint procedures; • the duties about freedom of expression and privacy; • the duties about record keeping and review; • the duties that apply to providers of pornographic content; • the duty to provide accurate information in accordance with the requirements in an information notice; • the duty to co-operate fully with an investigation; and • Fees: notification to Ofcom.

2.8 We may also take enforcement action in relation to the following: • requirements of a notice given by Ofcom to appoint a skilled person;7 • requirements imposed by a person acting in the exercise of Ofcom’s entry and inspection powers;8 • the duty to pay fees to Ofcom;9 • requirements of a notice imposed under section 121(1) of the Act, to deal with terrorism content and Child Sexual Exploitation and Abuse (CSEA) content (Technology Notices);10 and • the duty to comply with requirements imposed in confirmation decisions.11

2.9 This guidance also applies to the enforcement of regulatory obligations which may be imposed on a person who is not a service provider under the Act, specifically: • requirements in an information notice under section 100 of the Act; and • the duties imposed on persons within section 104(7)(b) or (c) of the Act, to provide assistance to a skilled person.

2.10 The Guidance also explains how our enforcement powers may affect certain third parties, namely: • our powers to hold another undertaking within the same group as a service provider, or individuals which control a service provider, liable for its contravention (see Section 7); and

relating to a person’s failure to comply with different kinds of enforceable requirements. It must also explain how Ofcom will take into account the impact (or possible impact) on children of a failure to comply with: the illegal content duties in section 10 or 27 of the Act; the children’s safety duties in section 12 or 29; or the duty in section 81(2) to prevent children normally being able to access regulated pornographic content.

6 Section 131(2) of the Act. A comprehensive table of the enforceable requirements can be found at Annex 1. 7 Section 131(3)(a) of the Act. 8 Section 131(3)(d) of the Act. 9 See sections 84 and 141 of the Act. 10 See section 140 of the Act. Note that this guidance does not cover the process and procedures that Ofcom will follow when issuing Technology Notices. 11 Section 139 of the Act.

• our power to seek a court order for business disruption measures against a person providing ancillary services or an access facility in respect of a regulated service (see Section 9).

2.11 This guidance does not apply to the criminal enforcement of offences under the Act.12

What does this guidance cover?¶

2.12 This Guidance sets out how Ofcom will normally approach enforcement where it suspects non-compliance with the obligations that apply to service providers and other persons or third parties under the Act.13

2.13 In Sections 3 and 4, we explain the process that we follow when a potential compliance issue comes to our attention, and the factors we consider when deciding whether to open an investigation and exercise our enforcement powers under Part 7, Chapter 6 of the Act. Not all issues will lead to an investigation, and we explain the alternative compliance tools that we may use in response to compliance concerns.

2.14 In Sections 5 and 6, we set out the main stages of a typical investigation, from opening an investigation to our decision on whether there has been a breach. In Section 5, we explain the process Ofcom will generally take following a decision to open an investigation, including an overview of the information-gathering powers that we may use and how we handle the information that we collect. In Section 6, we explain how Ofcom determines the outcome of an investigation, the main stages of the process depending on our decision, and who makes significant decisions. We also set out the actions we can require a service provider to take and our powers to impose a penalty where we conclude, through our investigation, that it has breached one or more of its duties, and explain when we might issue penalty notices.

2.15 In Section 7, we explain which entities connected with a service provider may be held jointly liable for a contravention by the service provider under the Act. We set out the circumstances where we may consider it appropriate to pursue enforcement action against the connected entity in addition to the service provider, and the procedure for doing so.

2.16 In Section 8, we set out our settlement process, whereby the subject under investigation admits it has contravened a relevant duty and agrees to a streamlined administrative process in respect of the remainder of the investigation. We explain the discounts that Ofcom may apply to any penalty that is imposed where a settlement agreement is reached.

2.17 In Section 9, we explain our powers to apply to a court for a business disruption order. This is an order that can be made against certain third parties which provide services to a service provider in respect of its regulated service. The order would require them to take such action, as specified by the order, with a view to disrupting the provision of the regulated service in the UK. We explain the types of third-party services which could be subject to a business disruption order and the circumstances in which we may seek such an order.

2.18 In Section 10, we set out how the subject of an investigation, a complainant, or a third party, that is dissatisfied about any aspect of the investigation procedure, can make a

12 There are a number of criminal offences associated with non-compliance of certain duties and requirements on service providers in the Act. A conviction may result in a financial penalty and/or imprisonment. 13 In this guidance, where we describe our enforcement processes as applying to a service provider, these should be read as references to a person or third party where the person or third party is the subject of the process in question.

complaint to Ofcom. We explain the circumstances when a procedural complaint can be referred to Ofcom’s Procedural Officer and the process for doing so.

2.19 This Guidance sets out the procedures that Ofcom follows within the legal framework outlined in this section, and what to expect at different stages in the enforcement process. The main stages of the enforcement process, and a summary of what to expect and possible outcomes during these stages, are set out in Figure 1.

Figure 1: Enforcement Process

Status of this guidance¶

2.20 This Guidance sets out Ofcom’s general approach to enforcement under the Online Safety Regime and is designed to be flexible. Where we depart from the approach set out in the Guidance, we will explain our reasons for doing so. This Guidance takes effect from 16 December 2024.

2.21 The Guidance is not a substitute for any regulation or law and is not legal advice.

2.22 We will keep this Guidance under review and amend as appropriate, taking into account further experience, developing law and practice, and any change to Ofcom’s powers and responsibilities.

Section 3 Enforcement action and when we use it¶

Introduction¶

3.1 In this section, we explain our regulatory duties that govern the enforcement decisions we take and provide an overview of how we become aware of compliance issues. We also set out the priority framework we use when we become aware of a compliance issue, and the range of tools that we may use to address them.

Ofcom’s general duties when carrying out its enforcement functions¶

3.2 When we are carrying out our enforcement activities, we will act in accordance with our principal duties set out in section 3 of the Communications Act 2003 (Communications Act), which are: • to further the interests of citizens in relation to communications matters; and • to further the interests of consumers in relevant markets, where appropriate by promoting competition.

3.3 In addition, we are required to secure a number of objectives including the adequate protection of citizens from harm presented by content on regulated services, through the appropriate use by providers of such regulated services of systems and processes designed to reduce the risk of such harm.14 In our work to secure this objective, we must have regard to the matters in section 3(4A) of the Communications Act to the extent they appear to us as relevant. These include: • the risk of harm to citizens on services; • the need for a higher level of protection for children than for adults; and • the extent to which providers of services demonstrate, in a way that is transparent and accountable, that they are complying with their duties under the Act.

3.4 We must also have regard to the matters in section 3(3) and (4) of the Communications Act (to the extent relevant in the circumstances). These include our regulatory principles that our activities are transparent, accountable, proportionate, consistent, and targeted only at cases in which action is needed.

How does Ofcom become aware of compliance issues?¶

3.5 Ofcom may receive information from a variety of sources, which we may use to identify and assess potential compliance issues. For example: • where a service provider proactively informs us about concerns they may have about their own compliance with their obligations under the Act; • where an issue has come to light through Ofcom’s regular engagement with a service provider or other relevant third party;

14 Section 3(2)(g) of the Communications Act.

• via our routine monitoring of information provided to our Consumer Contact Team or online safety complaints portal;15 or via our routine monitoring of information provided to us by service providers, for example, through the submission of a transparency report (where applicable),16 or risk assessment;17 • where we have concerns about a service provider’s response to the exercise by Ofcom of other regulatory functions under the Act, for example, its response to a statutory information request or a notice requiring the payment of fees; • a complaint by an industry stakeholder or whistleblower;18 • information provided to us by other bodies (for example, other regulatory bodies, civil society organisations, enforcement agencies,19 MPs, or media reports); or • a super-complaint submitted by an eligible entity.20

3.6 It is important to note that the Online Safety Regime is about service providers’ safety systems and processes, not about regulating individual content found on such services. The presence of illegal content or content that is potentially harmful to children does not necessarily mean that a service provider is failing to fulfil its duties in the Act. We would not therefore be likely to take action solely based on a piece of harmful content appearing on a regulated service. However, evidence of especially harmful material (particularly if it is on a service for a prolonged period without being removed), or a prevalence of harmful material (particularly where this is present on a service that presents a particular risk to children), would be relevant to our assessment of whether the issue is a priority for Ofcom and what type of action may be warranted (see our priority framework below and Section 4).

3.7 In Section 4, we explain how we assess the issues that come to our attention and decide whether further action is merited.

Priority framework¶

3.8 We make decisions about whether to open investigations on a case-by-case basis, having regard to our statutory duties and all the matters that appear to be relevant. We cannot open investigations into every potential compliance issue that arises in relation to each enforceable duty in the Act. It is important that we use our discretion to take action in an efficient and effective way, in accordance with our regulatory principles.

3.9 The priority factors we will generally consider when making decisions about whether to open an investigation or take some other action (where they are relevant to the issue concerned) include:

a The risk of harm or seriousness of the alleged conduct or contravention under consideration, and, where relevant, any impact or potential impact this conduct has

15 Ofcom complaints portal: online services, websites or apps. 16 Section 77 of the Act requires providers of certain regulated services to publish annual transparency reports. 17 Under section 23(10) and section 34(9) of the Act, Category 1 services, and Category 2A services are required to submit their risk assessments to Ofcom. See also section 95 of the Act.

18 Guidance on how to make a complaint is set out in the document ‘Advice for complainants: Submitting a complaint to Ofcom’, Ofcom 2017. Advice for Complainants; and Ofcom, no date. Whistleblowing: Making a protected disclosure to Ofcom. 19 For example, the Information Commissioners Office, National Crime Agency, or the Advertising Standards Authority. 20 Section 169 of the Act.

had on the risk of harm presented by content available on the regulated service. For example:

i) the risk to the interests of citizens or consumers resulting from the alleged contravention (including whether the risk is immediate or not, and whether it is direct or indirect), and conversely, the direct and indirect benefit to citizens or consumers of our taking enforcement action (for example, to deter similar conduct by others); ii) the harm or risk of harm to children resulting from the alleged contravention; iii) whether the conduct is ongoing; iv) whether the allegation concerns conduct that is, or appears to be, a repeated, intentional, systemic, or particularly flagrant contravention; and v) whether the service provider in question has a history of similar contraventions, or a demonstrated record of poor compliance.

b) The strategic significance of addressing the alleged contravention, for example: i) whether enforcement action would help clarify the regulatory or legal framework for other stakeholders; ii) whether the issue directly relates to Ofcom’s broader strategic goals or priorities (including those within Ofcom’s Annual Plan of Work); iii) whether the allegation concerns conduct that is likely to harm, or risks harm to children; and iv) whether there are other steps that are likely to achieve the same ends or deal with the same issues as enforcement action. This could include, for example, whether other agencies may be better placed to take action in relation to an issue (for example, another law enforcement agency may take action against users posting illegal content on a regulated service). c) The resource implications and risks in taking enforcement action. For example, what resources (particularly specialist resources) would be required to take enforcement action, given the need to do justice to the interests of all parties likely to be affected.

3.10 These factors help us decide whether opening an investigation, or some other action, is appropriate in the circumstances. Whilst we will consider these factors in the round, the relevance or appropriateness of them will depend on the circumstances of the particular issue we are considering.

Ofcom’s enforcement and compliance tools¶

3.11 Where we consider that a service provider may not be meeting its obligations under the Act, we have a variety of tools available to us to encourage change and improve compliance.

3.12 These include opening an investigation and using our statutory powers under the Act to investigate whether a service provider has contravened its obligations and make a decision to that effect (see Sections 5 and 6). Where we find a service provider has contravened its obligations, we have the power to impose a penalty of up to 10% of qualifying worldwide revenue or £18 million (whichever is the greater) and require remedial action to be taken (see Section 6). We also have statutory powers under the Act in relation to certain third parties (see paragraphs 2.9 and 2.10).

3.13 In addition to these statutory powers, we have a range of non-statutory tools which we may use in response to a potential compliance concern instead of opening an investigation (we refer to these as 'alternative compliance tools’ throughout this guidance). For example, we may: • undertake compliance remediation and/or accept commitments or assurances to remedy compliance concerns – we may commence a period of engagement with the service provider to give them the opportunity to address or remedy any compliance concerns identified in lieu of opening an investigation. This may involve Ofcom and the service provider agreeing a plan with targets and expectations for improvement against an agreed timescale and may include Ofcom accepting commitments or assurances from the service provider that it has taken or will shortly take steps to remedy any concerns. We may also decide to enter a period of compliance monitoring to ensure the service provider does not repeat behaviour that led to the compliance concerns, or to ensure it continues to comply with any commitments or assurances given. The process that we follow will differ from case to case and we may use our information gathering powers (see paragraphs 5.31 to 5.44) to obtain information to assess compliance during this period. • send warning letters setting out our concerns and expectations for change and any consequences for failing to meet these expectations. We may follow up on any changes made at an appropriate point following the warning letter being sent; and • open an enforcement programme to understand whether there is an industry wide issue which is causing harm to users and to determine the most appropriate response to tackle the harm, including formal enforcement action where appropriate. Sometimes we receive information, including complaints, suggesting an industry-wide issue is causing harm. Where we are considering opening an enforcement programme, we may use consumer research, desk-based research, or analysis of complaints to determine the service provider(s) if any, on which we should focus our resources.

3.14 We may decide to resolve concerns via the use of one or more of these alternative compliance tools where we consider that to be appropriate under our priority framework and in accordance with our general duties. However, where we consider that such alternative compliance tools are likely to be ineffective in addressing a compliance concern, we will consider whether to use our statutory powers under the Act in line with this guidance.

3.15 Alternatively, we still may decide to use other regulatory tools to drive change and improve compliance (see paragraphs 4.21 to 4.26). For example, we may also consider whether other action under the Act is appropriate, such as applying to the court for business disruption measures (see paragraph 4.16).

3.16 We explain the process for how we assess whether to open an investigation, or take some other action, in more detail in Section 4.

Section 4 Initial assessment of the issues¶

Introduction¶

4.1 In this section we explain what an initial assessment is and how we engage with service providers during an initial assessment. We also set out the potential outcomes of the initial assessment.

The purpose of an initial assessment¶

4.2 Where we identify potential compliance concerns, we will assess the issue and consider whether it is appropriate to open an investigation or take some other action. We do this on a case-by-case basis, having regard to our statutory duties and our priority framework (as set out in Section 3).

4.3 We cannot pursue every possible issue that comes to our attention and must make decisions about what action to take by weighing up the likely benefits against the resources required, and the comparative benefits of using those resources in other ways.

4.4 When an issue comes to our attention, we will carry out an initial assessment to explore: a) whether the available evidence merits opening an investigation or other action, having considered all relevant factors; and b) whether the issue is a priority for Ofcom, using the priority framework.

4.5 We will then decide the most appropriate action to take in response to the issue, which may include opening an investigation, resolution through other means or no further action (see paragraphs 4.21 to 4.26 and 4.27 to 4.29).

4.6 We will consider the level of detail and scope for the initial assessment as appropriate, bearing in mind the specific circumstances and the level of complexity of the issue. We aim to complete our initial assessment as quickly as reasonably possible, but the length of time this takes will vary on a case-by-case basis depending on the issues under consideration and whether we need to gather any additional information to inform our assessment.

4.7 During the initial assessment stage, we will not make a substantive decision on whether or not there has been a contravention of the obligations that apply under the Act. However, we will consider whether the evidence we have, or that we consider that we are likely to be able to obtain, merits opening an investigation or taking other action.

Engagement with a service provider during the initial assessment¶

4.8 As part of our initial assessment, we may engage with the service provider to give them an opportunity to comment on the issue(s), and to provide information to assist us in determining what action, if any, we should take.

4.9 Where we are carrying out an initial assessment following receipt of a complaint from an industry stakeholder, other enforcement agency or a whistleblower, we will generally tell the service provider that we are carrying out the initial assessment based on a complaint

and share a non-confidential version of the complaint submission with them for comment. Further details about how we handle information from complainants is set out on Ofcom’s website.21

4.10 Where we consider that such engagement will assist our initial assessment, we will usually write to the service provider, setting out how long it will have to comment and how soon after considering any comments or information received, we aim to take our decision on whether to open an investigation or take other action. We will also provide contact details for the case team while we are making our initial assessment. We will usually provide the same information to the complainant (where the initial assessment results from a complaint) in such cases. We expect to keep the service provider, and any complainant updated should our initial assessment take longer than expected.

4.11 In some cases, we may meet the service provider and/or a complainant where we consider this will assist us in reaching a decision.

4.12 We expect all parties to ensure that the information they provide to Ofcom during our initial assessment is accurate, including where the information has not been requested using our information powers under the Act. We may also ask complainants to provide further information beyond that which they have provided in their complaint as part of our initial assessment.

4.13 We may exercise our statutory information gathering powers during an initial assessment if we consider that we require the provision of information to prioritise our work effectively or to evaluate whether the evidence available to us merits investigation (see paragraphs 5.31 to 5.44).

4.14 In some circumstances, we may decide not to engage with a service provider during our initial assessment. For example: • if we consider that we already have sufficient information to conduct our initial assessment and decide the appropriate next steps; • where there are reasons to open an investigation, or take some other action, more quickly;22 or • where it is important to safeguard the anonymity of a complainant.23

Potential outcomes of an initial assessment¶

4.15 The purpose of an initial assessment is to decide what the most appropriate action to take is in response to a particular compliance concern. Bearing this in mind, our initial assessment can result in Ofcom: • opening an investigation under the Act and potentially using our enforcement powers;

21 Ofcom General Privacy Statement: How we handle your personal data. 22 For example, due to a risk of particularly serious harm to citizens, and, in particular, children. 23 Ofcom will consider requests from complainants to remain anonymous, and ideally, the complainant should request anonymity at the time of making its complaint submission. However, it may not be feasible to carry out our initial assessment, or take enforcement action, without revealing the identity of the complainant to the subject. Additional considerations may apply to whistleblowers, where other guidance is in place. See also footnote 18.

• using means other than an investigation to attempt to resolve the issue, for example the use of one or more of our alternative compliance tools (see paragraphs 3.13 to 3.14) or other regulatory tools (see paragraphs 4.21 to 4.26); or • deciding to take no further action in relation to the issue.

4.16 Where appropriate, we may also consider whether other action under the Act is appropriate, namely whether to: • apply to court for a business disruption order (see Section 9); • issue a Technology Notice;24 or • require a skilled person’s report (see paragraph 5.39).25

4.17 A senior member of Ofcom’s staff with appropriate Board-delegated authority will make the decision about what the appropriate next steps will be.

Opening an investigation¶

4.18 If Ofcom decides to open an investigation, this means we are satisfied that the case is a priority for Ofcom, and that the evidence merits opening an investigation.

4.19 Where we decide to open an investigation, we may use any of our enforcement powers as set out in Part 7, Chapter 6 of the Act, which include issuing provisional notices of contravention, confirmation decisions and penalty notices. However, opening an investigation does not mean that a breach finding will be made. We may decide to close the investigation at any point without any further action, or we may decide it is appropriate to resolve any concerns using other means, such as our alternative compliance tools.

4.20 We set out the process that we follow when opening and conducting investigations under the Act in Sections 5 and 6 of this guidance.

Resolution through other means¶

4.21 Opening an investigation into the compliance of a service provider with its obligations under the Act is not always the most appropriate way to resolve concerns. Where we consider it appropriate, we may try to resolve the issue through other means, without opening an investigation. These could include one or more of the following: • The use of one or more of the alternative compliance tools set out in paragraphs 3.13 to 3.14; • The use of one or more of our other regulatory tools, for example: > issuing additional guidance; > amending our Codes of Practice; > determining the focus of service providers’ annual transparency reports. • Referring the matter, or part of the matter, to an alternative agency such as a law enforcement agency or the Information Commissioner’s Office.

4.22 We may also decide that it is appropriate to engage informally with the service provider to ensure it understands the regulation and what it needs to do to protect its users.

4.23 Where we attempt to resolve issues through other means, we will not generally take any decision about whether any regulatory or legal provision has been contravened. However,

24 Section 124 of the Act sets out the matters relevant to a decision to give a Technology Notice under section 121(1) of the Act. 25 We may consider that these measures are appropriate even where we have not made a contravention decision.

we note that on occasion we may decide to take one of the steps above in conjunction with opening an investigation into whether there has been a contravention of a service provider’s statutory obligations.

4.24 Where appropriate, we may publish details of our actions where we have attempted to resolve issues through other means, for example, where we have accepted assurances that a service provider will make changes to resolve our concerns, if we consider this would be in the interests of potentially affected users or citizens or the broader industry. Where any publication could identify a service provider, we will usually inform the service provider concerned that we will be publishing such details no more than one working day before publication on Ofcom’s website and provide them with a copy of the intended text for information only at that stage.26

4.25 We may also inform any complainant (if applicable) of our decision to resolve an issue through other means.

4.26 Where Ofcom has attempted to resolve the issue through other means, but we later become aware of further issues relating to the same or a similar issue, or where this action is unsuccessful, then we will revisit whether it would be appropriate to open an investigation or take some other action. If we do so, we will use our priority framework to re-assess the issue, considering any relevant actions taken by the service provider during our engagement.

No further action¶

4.27 Following our initial assessment, we may decide not to open an investigation nor take any other steps to resolve the issue through other means, for example, where: • we do not consider any further action is warranted by the available evidence; • the scale of any possible harm appears too low to merit further action, or does not otherwise meet our priority framework; • we are satisfied that a service provider has already taken appropriate steps to address any concerns we have identified, and we do not consider any further intervention would be appropriate; or • we consider that we are not best placed to act (in such cases, we may consider it more appropriate to refer the matter to an alternative agency).

4.28 We will normally explain our decision to the service provider and explain that we might reconsider the need to take action in future (for example, if we received further evidence of a potential compliance issue).27 We may also inform any complainant of our decision. When we inform the service provider or complainant of our decision not to take further action, we will not usually give them the opportunity to comment before we take our decision.

4.29 Ofcom will not usually publicise a decision to take no further action at this stage, unless the issue under review is the subject of press speculation, and we consider we should clarify the position. In such cases, we would usually inform the service provider no more than one

26 We will take appropriate steps to handle confidential information prior to publishing – see paragraphs 5.45 to 5.50. 27 We may make an exception in the event of a referral to another agency if we are concerned that there is a risk of prejudicing an investigation by that agency.

working day before publication on Ofcom’s website that we will be doing so and provide them with a copy of the intended text for information only at that stage.28

28 See footnote 26.

Section 5 Opening an investigation and information gathering¶

Introduction¶

5.1 In this section we explain the purpose of an investigation, the process Ofcom will generally take following a decision to open an investigation and our approach to information gathering during an investigation. We also explain when we generally publish details of investigations and how we treat confidential information. We explain how we determine the outcome of an investigation in Section 6.

The purpose of an investigation¶

5.2 If Ofcom opens an investigation following an initial assessment, this means we are satisfied that the available evidence merits opening an investigation and that the issue is a priority for Ofcom. However, opening an investigation does not imply that Ofcom has taken a view as to whether any regulatory or legal provision has been contravened.

5.3 During an investigation, Ofcom will generally gather and analyse evidence to determine whether a contravention has occurred.

5.4 Where our assessment of the evidence indicates that the subject of the investigation has contravened one or more of its obligations under the Act, we will consider whether to issue a provisional notice of contravention. Following an opportunity for the service provider to make representations, we will then decide whether it is appropriate to confirm our finding(s) and make a contravention decision against the provider, and whether to impose a penalty and/or require remedial action to be taken. We may consider whether we should take other measures at the same time (see paragraph 4.16).

5.5 We may also decide to close the investigation prior to taking a decision (or taking any other action), if we consider that there is insufficient evidence that the subject has contravened one or more of its obligations, where we consider the issue could be resolved through other means, or where we consider the issue is no longer an administrative priority. We explain this further in Section 6.

5.6 Where Ofcom has opened an investigation falling within section 105 of the Act,29 the subject of the investigation is under a duty to co-operate fully with the investigation. This means that if the subject fails to co-operate, for example, by refusing to respond to Ofcom’s inquiries or by withholding information which is relevant to the matters under investigation, the lack of co-operation may itself result in enforcement action being taken (and the potential imposition of a financial penalty).

29 Section 105 of the Act applies where Ofcom opens an investigation into whether a service provider has failed or is failing to comply with an enforceable requirement as defined in section 131 of the Act (with the exception of section 105 of the Act), or with a requirement imposed by a Technology Notice.

Opening an investigation¶

5.7 The decision to open an investigation will be taken by a senior member of Ofcom’s staff with appropriate Board-delegated authority following an initial assessment. Typically, this will be the case supervisor overseeing the investigation (see paragraph 5.13).

Case opening letter¶

5.8 At the outset of an investigation, Ofcom will usually inform the subject of the investigation, and any complainant where appropriate, of our decision by sending them a case opening letter. However, there may be some cases where we delay doing so if we consider it may prejudice our ability to carry out an investigation, for example, in cases where we may need to use our information gathering powers to obtain and preserve evidence prior to alerting the subject.

5.9 We will typically send the case opening letter in electronic form via email.

5.10 The case opening letter will typically set out the following: a) the case team (see paragraph 5.13); b) the scope of the investigation, including the relevant obligation(s) to which the investigation relates (see paragraphs 5.26 to 5.27); c) the identity of any complainant, if appropriate;30 and d) an explanation of how the Procedural Officer can be contacted, as set out in Section 10.

5.11 We may ask the subject and any complainant to each nominate a principal point of contact for communications about the investigation.

5.12 In some cases, Ofcom may have sufficient information to reach a provisional decision on compliance without needing to obtain further information using our statutory information gathering powers. In such cases, we may send the subject a provisional notice of contravention at the same time as, or soon after, we send our case opening letter.

Case team¶

5.13 At the outset of the investigation, Ofcom will usually inform the subject and any complainant, of the: a) case leader: this is the person who will be their main contact at Ofcom for the case during the investigation; and b) case supervisor: this is the person overseeing the investigation who will typically have been responsible for deciding to open the investigation and will also be responsible for deciding whether to issue a provisional notice of contravention (see paragraph 6.6 to 6.7).

Publishing details of an investigation¶

5.14 Ofcom is required to have regard the principle under which regulatory activities should be transparent and accountable. We therefore generally publish information about our investigations at the point we open them and publish updates at important milestones.

30 If a complainant has concerns about Ofcom sharing its identity with the subject of an investigation, the complainant should raise this concern with us, ideally at the time of making its complaint submission. See also footnotes 18 and 23.

5.15 Shortly after sending the case opening letter, we will therefore generally also announce that we have opened an investigation on the Ofcom website, and/or in a media release, although we may delay doing so if we consider it may prejudice our ability to carry out an investigation.

5.16 The case opening announcement will typically include the following details: a) the identity of the subject; b) the scope of the investigation, including the relevant obligations to which the investigation relates; c) the identity of any complainant, if appropriate.31

5.17 Details of how to contact the case team will also be published on our website.

5.18 Following the case opening announcement, we will then publish updates to the same place on the website at important milestones (for example where we issue a provisional notice of contravention or a confirmation decision) or when we consider it to be appropriate or necessary to do so.

5.19 We do not agree the text of website updates or media releases with the subject, or any complainant. Where appropriate, we will inform the subject no more than one working day before publication on Ofcom’s website that we will be doing so and provide it with a copy of the intended text of the update.

5.20 Where we consider an announcement to be potentially market sensitive, we will generally inform the subject after markets have closed, with publication at 7.00am on Ofcom’s website and via the Regulatory News Service, just before markets open. Where the subject is a listed company in other jurisdictions, we will, where possible, seek to avoid publication during stock exchange hours in those jurisdictions.

5.21 There may be certain exceptional cases which we consider it would be inappropriate to publicise, for example because they are particularly sensitive or where publicity could have a detrimental impact on third parties. We would inform the subject and any complainant if we intend to take this approach to an investigation.

What to expect during an investigation¶

5.22 Ofcom will seek to ensure that the investigation is conducted in a fair, transparent, efficient, and timely way.

5.23 When we open an investigation, we aim to progress it in a timely manner and conclude it as soon as reasonably possible. We will normally give the subject, and any complainant, an indication of the likely timescales involved in completing an investigation, typically when we open the investigation.32

5.24 We will meet with the subject and any complainants or other third parties, and/or provide written or verbal updates, where we consider it to be appropriate for reasons of fairness and transparency. We will decide whether and when it is appropriate to do so on a case-by-

31 If a complainant has concerns about being publicly identified on Ofcom’s website, the complainant should raise this concern with us, ideally at the time of making its complaint submission. For the avoidance of doubt, Ofcom will not publish a copy of the complaint submission itself. See also footnote 18 and 23. 32 Although we may delay giving this information in the case opening letter where we consider this may prejudice the conduct of the investigation, such as in cases where we may need to use our information gathering powers to obtain and preserve evidence prior to alerting the subject about our investigation.

case basis, depending on the nature of the investigation and the stage that we have reached in our analysis.

5.25 We will generally provide updates to the subject and any complainant on the progress of investigations, including when we expect to reach specific milestones. We will also provide updates where these change.

Changing the scope of an investigation¶

5.26 We will set out the scope of our investigation in our case opening letter. We may widen the scope of an investigation if we become aware of new issues that merit investigation or reduce the scope if we decide that it is no longer appropriate to pursue particular aspects of the case.

5.27 When we change the scope of an investigation, we will ordinarily inform the subject and any complainant and will update our website. Where we consider it necessary for reasons of fairness, we will give the subject and/or the complainant the opportunity to comment prior to deciding to change the scope of the investigation.

Involvement of third parties and other public bodies¶

5.28 Ofcom recognises that in some cases third parties may be directly affected by the outcome of an investigation and can play a valuable role by drawing issues to our attention and providing us with relevant information during an investigation. We will involve third parties in an investigation to the extent we consider it appropriate in order to carry out our functions fairly, transparently, and effectively.

How to raise concerns with Ofcom¶

5.29 If the subject of an investigation, a complainant or third party (where relevant) is dissatisfied with the way in which Ofcom is dealing with an investigation, they should raise their concerns in writing with the case leader or case supervisor in the first instance.

5.30 Where engagement with the case leader or case supervisor does not resolve a party’s concerns about a significant procedural issue, it may contact the Procedural Officer. The process for doing so is set out in Section 10.

Information gathering during an investigation¶

5.31 During an investigation, Ofcom will generally gather evidence to determine: a) if there has been a contravention of a relevant obligation under the Act; b) if the subject should take specific steps to remedy the consequences of a breach or bring itself into compliance, and if so, what steps are appropriate; and c) if a penalty should be imposed and, if so, what penalty is appropriate.

Information gathering powers¶

5.32 Ofcom relies on accurate information, provided in a timely manner, to carry out efficient investigations. The Act provides Ofcom with a wide range of information gathering powers which we would expect to use to obtain information for the purposes of investigations covered by this guidance.33 Ofcom will act proportionately when deciding which information powers to exercise and the scope of the information required.

33 Ofcom’s information powers are set out in Part 7, Chapter 4 of the Act.

5.33 The following paragraphs give an overview of our information-gathering powers that we may use during an investigation and outline the potential consequences in the event of non-compliance with the requirements imposed under these powers.

Information notices¶

5.34 Ofcom may require the provision of information for an investigation by issuing a notice which sets out the information that must be provided and the deadline for doing so (an ‘information notice’).34 We can require the provision of existing information held by the recipient of the information notice, including information held outside of the UK, or information which the recipient must obtain or generate.

5.35 Ofcom can issue an information notice to a service provider, to a provider of an ancillary service35 or an access facility36 to a regulated service, and to any other person who appears to us to have, or be able to generate, relevant information, for example a Related Company or Controlling Individual of the regulated service (see Section 7).

5.36 The information notice imposes a duty on the recipient to provide Ofcom with accurate information in accordance with the requirements of the notice, including the date for submission, and in the form specified in the notice (for example, electronically). Where information is held in an illegible form, the respondent must provide it in a legible form or in a way in which it can be readily produced in a legible form.37

5.37 Where Ofcom sends an information notice to a service provider, we may require the service provider to name a relevant senior manager who will be responsible for the service provider's response to the notice.38 A senior manager is an individual who plays a significant role in making decisions or managing and organising the service provider's compliance activities in relation to the regulatory requirements applying to the regulated service in question and who may reasonably be expected to be in a position to ensure compliance with the requirements of the notice.39

5.38 Ofcom will typically issue an information notice in electronic form, via email, and where appropriate, we may issue a draft notice before issuing a final information notice.40

Other information powers¶

5.39 Ofcom may make use of other powers to gather information for its investigation. These include its powers to: • require a report from a ‘skilled person’.41 Ofcom may appoint a skilled person (or require the service provider to appoint a skilled person) to provide a report to assist us, amongst other things, in:

34 Section 102 of the Act. 35 Under section 144(11) of the Act, a service is an ‘ancillary service’ in relation to a regulated service if the service facilitates the provision of the regulated service (or part of it), whether directly or indirectly, or displays or promotes content relating to the regulated service (or to part of it). 36 Under section 146(10) of the Act, a facility is an access facility in relation to a regulated service if the person who provides the facility is able to withdraw, adapt or manipulate it in such a way as to impede access (by means of that facility) to the regulated service (or to part of it) by UK users of that service.

37 Section 102(11) of the Act. 38 Section 103 of the Act. This power does not apply to an information notice issued to a third party or other person who we consider may hold or be able to generate relevant information. 39 See footnote 48. 40 See section 208 of the Act, which sets out the prescribed ways in which Ofcom can serve notices. 41 Section 104 of the Act.

> identifying and assessing a failure, or possible failure, to comply with a relevant obligation; or > understanding the issues where a service provider may be at risk of failing to comply with an obligation, and ways to mitigate the risk.42

• issue a notice requiring individuals to attend an interview at a specific time and place and answer questions and provide explanations about any matter relevant to the investigation.43 An individual may be required to attend such an interview if they are the provider of the regulated service under investigation, an officer, employee or partner (where the provider of the service is a partnership) of the service provider or have held such a position at the time to which the required information or explanation relates;44 and • authorise persons to exercise powers of entry and inspection, carry out audits or apply for and execute a warrant.45 Where relevant, we will have regard to relevant guidance on the exercise of our powers, for example, the Home Office's Code of Practice on Powers of Entry, and any Ofcom guidance.46

Failure to comply with information powers¶

5.40 The Act places duties on service providers to comply with the requirements imposed on them in the exercise of our information powers (see for example, paragraph 5.36).

5.41 The requirements that may be imposed when exercising our information gathering powers are enforceable by Ofcom. For example, where Ofcom has exercised its power to appoint a skilled person to prepare a report, a failure by the service provider to give all such assistance as the skilled person reasonably requires to produce the report may result in enforcement action.

5.42 Failure to comply with Ofcom’s information powers may carry significant consequences. Ofcom may take separate enforcement action in relation to one or more failures to comply with such a requirement(s) with power to impose a penalty where it finds non-compliance. When taking enforcement action for non-compliance of such requirements, we will enforce in line with the Act and with this guidance.

5.43 Alternatively, where we consider it may be more appropriate to do so, rather than taking separate enforcement action for a failure to comply with the requirements in relation to the exercise of our information powers, Ofcom may instead take the failure into account as part of our assessment of the appropriate level of any penalty we may decide to impose for a contravention of the regulatory requirement.47

42 In addition, it is a requirement under section 122 of the Act that Ofcom obtains a report from a skilled person when exercising this power. 43 Section 204(3) of the Act provides that Ofcom has the power to require the attendance for interview of an individual who is outside the UK.

44 Section 106 of the Act. 45 Section 107 of the Act. See also Schedule 12 of the Act. 46 See Home Office Code of Practice Powers of Entry, 2014. Home Office Code of Practice Powers of Entry [accessed 28 November 2024]. 47 We would take failure to comply with a statutory information request into account when assessing whether the recipient has cooperated with Ofcom’s investigation. See Ofcom: Penalty Guidelines as amended, and the factors listed in paragraph 1.12.

5.44 A failure to comply with the requirements of Ofcom’s statutory information powers, for example, by providing false information, is a criminal offence, subject to the defences in the Act. This is outside the scope of this guidance.48

Disclosing confidential information gathered during an investigation¶

5.45 We will safeguard information supplied to us during an investigation. However, in accordance with our regulatory principles, it is important that we enforce and investigate in a transparent and accountable manner. We take account of the rights of defence of the subject of an investigation and are mindful that information we obtain may be relevant to any defence they may want to put forward.

5.46 As such, it may be necessary to: • disclose to the subject information we have obtained from third parties for the purposes of our investigation, including providing the subject of a provisional notice of contravention, or confirmation decision, with the evidence that we rely on in support of our findings. • disclose information to third parties, including other enforcement authorities or government organisations to facilitate the exercise of our functions in the context of an investigation.49

5.47 Those providing information to us during an investigation will often regard it as confidential - that is commercially sensitive information or information relating to the private affairs of an individual - the disclosure of which may seriously and adversely affect the interests of the business or person to which it relates. It is important that such information is clearly identified as confidential, along with the reasons why.

5.48 Ofcom is mindful of the importance of protecting confidential information and will generally redact such information or withhold it from disclosures that we make for the purposes of the investigation. However, occasionally, it is necessary to disclose confidential information to ensure due process. When deciding whether to disclose confidential information to the subject of the investigation, we will balance the subject’s rights of defence (see paragraphs 6.18 to 6.20) against the legitimate interests of parties in ensuring that confidential information is appropriately protected.

5.49 If Ofcom is proposing to disclose information which a party considers confidential for the purposes of its investigation, we will take reasonable steps to inform that party and give it a reasonable opportunity to make representations on our proposal, before making a final decision on whether to disclose. This decision will be made by the case team and/or the case supervisor and will be communicated to the party concerned in advance of the disclosure being made.

48 There are a number of criminal offences associated with non-compliance with Ofcom’s information powers which may apply to the service provider, its officers (see section 186 of the Act), a named senior manager and potentially employees or other agents. A conviction may result in a financial penalty and/or imprisonment. See also sections 109 to 113, 199 to 203, 205, and paragraph 18, Schedule 12 of the Act. 49 This Act also enables Ofcom to disclose information to an overseas regulator listed in regulations to be made by the Secretary of State, to facilitate online safety functions of the overseas regulator, which correspond to Ofcom’s functions under the Act.

5.50 In such a case, the party may escalate its concerns to the Procedural Officer (in accordance with Section 10). We would expect to delay disclosing the information until the Procedural Officer has reached their decision. If we intend to disclose the information after taking these steps, we will inform the party concerned in advance.

Section 6 Determining the outcome of our investigation¶

Introduction¶

6.1 This Section explains how Ofcom decides on the outcome of an investigation and who makes the primary decisions. We explain the stages of our process from deciding whether to issue a provisional notice of contravention to deciding whether to issue a confirmation decision on whether there has been a contravention.

Summary: potential outcomes of an investigation¶

6.2 Following an investigation, we may decide: • to close the investigation without issuing a provisional notice of contravention against the subject of the investigation; or • to issue a provisional notice of contravention, if we consider there are reasonable grounds for believing that the subject has failed, or is failing, to comply with one or more obligation(s). Our provisional notice of contravention will also include details of any penalty we propose to impose and any action that we consider the subject should take in respect of the contravention identified.

6.3 As described in more detail below, if we decide to issue a provisional notice of contravention, we will give the subject the opportunity to make written and oral representations on our findings.

6.4 Following consideration of those representations, we may: • issue a confirmation decision that there has been a contravention and impose a financial penalty and/or require steps to be taken to remedy a contravention and/or comply with a regulatory obligation; • issue a confirmation decision that there has been a contravention but decide not to impose a financial penalty and/or require steps to be taken to remedy a contravention and/or comply with a regulatory obligation; • issue a further provisional notice of contravention and allow a further period of representations on these findings before deciding whether to issue a confirmation decision; or • close the investigation without issuing a confirmation decision.

6.5 In some cases, we may accept a request by the subject to settle the case. The process for settlement is discussed in Section 8.

Figure 2: Potential outcomes of an investigation

Responsibilities for deciding the outcome of an investigation¶

6.6 The decision on whether to close the investigation or issue a provisional notice of contravention will typically be taken by the case supervisor, who also made the decision to open the investigation (see paragraph 5.13).

6.7 Following the issue of a provisional notice of contravention and receipt of any written submissions from the subject, Ofcom will nominate a final decision maker who will be responsible for deciding on the final outcome of the investigation. The final decision maker will be a senior member of Ofcom’s staff with appropriate Board-delegated authority, who will not have been involved in the investigation or preparation of the provisional notice of contravention.

Decision to close an investigation¶

6.8 We may decide to close an investigation either prior to, or following, a provisional notice of contravention being issued. We may make this decision for the following reasons: • where we decide there is insufficient evidence of a contravention and close the investigation on that basis; • for administrative reasons, such as where significant further resource would be needed to continue the investigation and we consider that, due to other urgent or important work, our resources could be targeted more appropriately at other investigations/work; or • where we are satisfied that: > the conduct we were concerned about has now ceased; > the subject has taken appropriate action to remedy any harm or has given appropriate assurances that any harm will be remedied; and > we judge that there is no further purpose to be served by continuing with the investigation in the circumstances of the case.

6.9 Where Ofcom has closed an investigation without taking a confirmation decision (whether or not a provisional notice of contravention has been issued), we may decide to resolve issues through other means (see paragraphs 4.21 to 4.26).

6.10 Where Ofcom decides to close the investigation, we will inform the subject of the investigation of our decision in writing.50 Ofcom may also inform any complainant that we have decided to close the investigation.

6.11 In the majority of cases, where Ofcom closes an investigation, we will publish a brief statement indicating case closure and the basis for doing so, which we would expect to publish on our website in line with paragraphs 5.18 to 5.21. Where a subject has given assurances at this stage, we may also publish details of those assurances.51 If there is good reason to do so, we may also publish a non-confidential version of a reasoned case closure document setting out Ofcom’s reasons for taking no further action.

6.12 We will usually inform the subject, and, where appropriate, any complainant, in advance of the intended date of publication, and provide them with a copy of the intended text for information only at that stage.

6.13 In certain cases, we may consider that fairness requires us to provide an opportunity for relevant stakeholders to comment before we finalise our decision to close the investigation.

Decision to issue a provisional notice of contravention¶

6.14 Ofcom may issue a provisional notice of contravention under section 130 of the Act, where, following our investigation, we consider that there are reasonable grounds to believe that the subject of an investigation has failed, or is failing, to comply with one or more of its obligation(s).

6.15 Where we decide to issue a provisional notice of contravention, we will typically send the provisional notice of contravention in electronic form via email.52

Provisional determinations set out in the notice¶

6.16 The provisional notice of contravention will set out that Ofcom considers there are reasonable grounds for believing the subject has failed, or is failing to comply, with its obligations. It will identify the obligations in question, the period in which the failure (or failures) occurred and explain the reasons why Ofcom has reached this provisional finding. It will also explain that the subject may make representations about the matters contained in the provisional notice of contravention, and may also set out our provisional determination on: • any financial penalty we are minded to impose and the reasons we believe this to be appropriate. See paragraphs 6.41 to 6.43.

50 Where we close an investigation after we have issued a provisional notice of contravention and we decide to publish details of case closure, we may decide to include details identifying the subject and describing the reasons for the provisional notice of contravention – see section 149(6) of the Act. We will not disclose information that, in Ofcom’s opinion is confidential in line with section 149(4) and (5) of the Act. 51 For example, if we have accepted assurances about the steps the subject will take to address the issue and we consider it would be in the interests of potentially affected users to publicise these. 52 See footnote 40.

• any steps we consider the subject should take to comply with the relevant obligation and/or remedy the proposed contravention(s) and the reasons we believe these to be appropriate. See paragraphs 6.44 to 6.53).

6.17 Where Ofcom issues a provisional notice of contravention for a continuing failure, we may give the provisional notice of contravention in respect of any period during which the failure has continued and will specify that period in the provisional notice of contravention.53

Access to the evidence relied on and rights of defence¶

6.18 When we issue the provisional notice of contravention, we will also provide the subject with copies of, or access to, the evidence that we rely on in reaching our provisional view.

6.19 Wherever possible and appropriate, we will provide documentary evidence in electronic form, but in some cases, we may provide hard copies (for example, where we consider this reasonable on request from the subject in a particular investigation). Where we have relied upon evidence provided to us by the subject itself, rather than providing copies of the relevant documents, we may instead list these in a schedule so that it is easy for the subject to cross-refer to its own copies.

6.20 Where we have relied on information from a third party that they consider to be confidential, we may consider it necessary to redact or withhold this information. We will, however, make this decision on a case-by-case basis, taking account of the rights of defence of the subject (see paragraphs 5.45 to 5.50). Redacted confidential information in the provisional notice of contravention and any accompanying documents will be marked accordingly.

Sharing details of the provisional notice of contravention¶

6.21 Ofcom will not publish provisional notices of contravention, but we will generally publish an update on our website where we have issued a provisional notice of contravention in line with paragraphs 5.18 to 5.21. The update will provide a summary of the proposed contravention(s) that we are minded to find. Typically, we will not publish details of any proposed penalty or the steps we propose the subject should take in the update, unless we believe this would be in the interests of citizens and consumers.

6.22 Where we consider it to be appropriate for reasons of fairness, we may provide complainants or relevant third parties with the opportunity to comment on a non-confidential copy of the provisional notice of contravention.54 In such cases, Ofcom would expect the complainant or the third party to enter into appropriate agreements with us limiting its use of and onward disclosure of the document. We will set deadlines for representations depending on the circumstances of the case. We will not usually provide a complainant or third parties with copies of, or access to, the underlying evidence relied on, but may do so where appropriate for reasons of fairness.

53 Section 130(10) of the Act. 54 This will typically be where they may have information relevant to the proposed decision and could provide informed comments on the provisional notice of contravention. Another example may be where Ofcom’s provisional findings could have a direct impact on the economic interests of a third party.

Consideration of representations on the provisional notice of contravention¶

6.23 The subject of the investigation will be given the opportunity to provide representations (and any supporting evidence) to Ofcom about the matters contained in the provisional notice of contravention. This will be set out within the provisional notice of contravention along with the period within which such representations must be made.

Written representations¶

6.24 Typically, we will give the subject a period of at least 20 working days to make written representations on our proposed findings. The precise period will depend on the particular circumstances of the case, and more complex cases may require a longer period. There may also be circumstances where a more expedited process is appropriate, for example, where we have reason to believe that there is a failure to comply with the requirements of an information notice which is hindering an investigation, or where we consider it is a continuing failure and is causing significant harm to citizens.

6.25 If the subject decides to provide representations on the matters set out in the provisional notice of contravention (in the time specified for response), then Ofcom will consider these representations in full before deciding on appropriate next steps. If the provisional notice of contravention has been shared with a third party who has been given the opportunity to provide representations, then we will also consider these in full before deciding on appropriate next steps.

6.26 The subject is under no obligation to provide representations. If no representations are received from either the subject, or any third party, and no further information has come to light since the provisional notice of contravention was issued, then Ofcom will proceed to make a decision about whether or not it is appropriate to issue a confirmation decision.

6.27 Alongside consideration of any representations provided by the subject, we may also use our information gathering powers to request further information to help us determine the most appropriate next steps.

Oral hearings¶

6.28 In addition to written representations, we typically offer the subject the opportunity to attend an oral hearing, either in person or remotely, on the matters referred to in the provisional notice of contravention.55 This provides the subject with an opportunity to highlight directly to the final decision maker issues of particular importance to its case, and/or clarify details set out in its written representations.

6.29 Ofcom will normally ask the subject to confirm by a given date if it wishes to attend an oral hearing. We will aim to hold the oral hearing 10 to 20 working days after the deadline for written representations has elapsed.56

6.30 The oral hearing will be held either at the Ofcom offices in which the investigating case team is based, or remotely, and will be chaired by the final decision maker (see paragraph

55 The subject may make oral representations on a provisional notice of contravention and/or a provisional determination of penalty. We expect any oral representations to be made at a single hearing, including in circumstances where Ofcom has exercised its discretion to issue separate contravention and penalty decisions. 56 However, if the subject provides its written representations prior to the deadline, then the oral hearing may be earlier.

6.7). The case supervisor, case leader and other members of the case team may also be present and may comment during the course of the hearing. Other personnel from Ofcom may attend as appropriate, for example legal advisers, and/or technical experts, depending on the circumstances of the case.

6.31 The subject may bring legal advisers or other relevant expert advisers to the hearing to assist in presenting its oral representations, although the number of persons attending on its behalf should be limited to a reasonable number.

6.32 Complainants and other third parties will not usually be invited to attend the meeting.

6.33 Ofcom will agree an agenda with the subject in advance of the hearing, which will include reasonable periods of time for the subject to make oral representations and for the Ofcom officials present to ask the subject questions on its representations.

6.34 The hearing will be recorded and transcribed, and the transcript will be provided to the subject, giving an opportunity for comment on its accuracy. Complainants and other third parties will not be provided with a copy of the transcript except in exceptional circumstances.

Further provisional notice of contravention¶

6.35 In some cases, new information may come to Ofcom’s attention after we have issued a provisional notice of contravention and given the subject the opportunity to provide representations.

6.36 Where such new information or evidence leads us to consider making material changes to our findings in the provisional notice of contravention, for example in relation to the nature of the proposed contravention finding(s), we will withdraw the initial provisional notice of contravention and either issue a further provisional notice or, alternatively, we may decide to close the investigation (see paragraphs 6.8 to 6.13). If we issue a further provisional notice of contravention, the subject will have the opportunity to provide representations, in the manner set out above, before we decide on appropriate next steps.57

Decision to issue a confirmation decision¶

6.37 Following the oral hearing (if applicable) and having considered all relevant evidence and any written representations, the final decision maker will decide on the final outcome of the investigation.58

6.38 The final decision maker may decide to close the investigation at this stage (see paragraphs 6.8 to 6.13) or, if Ofcom is satisfied that the subject has failed, or is failing, to comply with one of more of its obligation(s), we would expect to issue a confirmation decision under section 132 of the Act finding all or some of the contraventions identified in the provisional notice of contravention.

6.39 We will typically send the confirmation decision in electronic form via email.59

57 See section 130(11) of the Act, which sets out the circumstances in which Ofcom may issue a second provisional notice of contravention in respect of a failure to comply with the same obligation(s) as set out in the first provisional notice of contravention. 58 See paragraph 6.7. 59 See footnote 40.

Information contained in the confirmation decision¶

6.40 The confirmation decision will confirm that we are satisfied the subject has failed, or is failing, to comply with one or more obligation(s), as well as setting out our reasons for reaching that conclusion, and the evidence that we have relied on. It will also: • set out any financial penalty imposed and the deadline for paying the penalty, and/or • set out any steps that the subject is required to take to come into compliance, and/or remedy the failure with the obligation(s) (either immediately or by a given deadline).

Financial Penalties¶

6.41 Ofcom may impose a financial penalty in respect of a contravention if it considers that appropriate and proportionate, taking account of the circumstances in the round. We have the power to impose a penalty of up to 10% of qualifying worldwide revenue or £18 million (whichever is the greater).60 The penalty may not be higher than the amount proposed in the provisional notice of contravention, save where we are imposing a penalty on a Related Company or a Connected Person for which it will be jointly and severally liable with the service provider, but the Related Company or Connected Person was not issued with the provisional notice of contravention in relation to the same matter (see paragraph 7.23).61

6.42 Any penalty that we impose will be set in accordance with our Penalty Guidelines that we publish under section 392 of the Communications Act.62 In determining the amount of any penalty, Ofcom will consider all the circumstances of the case and will take into account the potentially relevant factors, examples of which are set out in the Penalty Guidelines. Where there is evidence of harm, or risk of harm to children, arising from the contravention, this will inform our assessment of the factors in the Penalty Guidelines.63

6.43 Ofcom has powers to impose a single penalty, a daily penalty, or a combination of the two. A daily penalty may be imposed where the contravention that Ofcom has identified is continuing and the confirmation decision requires the subject of the decision to take action to bring itself into compliance. A daily penalty will be payable for the period specified in the decision, which will generally be until the date on which the subject takes the action required in the decision to bring it into compliance.64

60 See Schedule 13 of the Act. Ofcom is to make regulations under section 85 of the Act about how qualifying worldwide revenue is to be determined. 61 Schedule 13, paragraph 3(1) and (2) of the Act. 62 See Ofcom: Penalty Guidelines as amended. These cover the principles that we are required to take into account when setting a penalty under Schedule 13 of the Act. Ofcom will set out in the confirmation decision its reasons for imposing the penalty, including its assessment of the relevant penalty factors in the Penalty Guidelines, the period for payment and the consequences of non-payment.

63 For example, seriousness, the degree of harm, and the timeliness of action to bring a contravention to an end. 64 Where the subject is required in the confirmation decision to take action immediately to bring itself into compliance, the daily penalty will become payable from the day after the date of the confirmation decision; where the confirmation decision allows a period for the specified action to be taken, it will become payable on the day after the last day of the period specified.

Requirements to take steps in a confirmation decision¶

6.44 Ofcom can require the subject of an investigation to take specific steps where we have found it has breached one or more of its obligation(s), either to bring the regulated service into compliance and/or remedy the failure to comply.65

6.45 When Ofcom considers that it may be appropriate to impose such requirements on a service in relation to UK users, we will set this out in the provisional notice of contravention, describing the specific steps that we consider that the service provider should take, the regulatory obligation to which they relate and the reasons why we consider the action is required. Taking account of any representations that the service provider may make on these matters (see paragraphs 6.23 to 6.34), we will decide whether to include these requirements in a confirmation decision.66

6.46 Where we decide to impose any requirements to take steps in a confirmation decision, we will specify a reasonable period within which each of the required steps specified must be taken, or, if a step requires the use of a system or process, a reasonable period within which the system or process must begin to be used.67

6.47 In addition, where we find a breach of certain obligations in a confirmation decision, we may require a service provider to take specific actions, which we outline in the following paragraphs.

6.48 Breach of the risk assessment duty:68 the measures that a service provider must take to comply with the safety duties will depend on the outcome of the risk assessment that it carries out in compliance with the risk assessment duties.69 Where we have found non-compliance with one or more of these duties and have identified a risk of serious harm, we can require the service provider to take mitigating action despite the provider itself not having identified the risk in its risk assessment (or having failed to carry out a risk assessment at all). We will specify the date by which the service provider must take or use measures to comply with the duty in question. The requirement to take these measures will apply until the service provider has fully complied with the relevant risk assessment duties.

6.49 Breach of the duties about children’s access assessment:70 service providers must carry out a children’s access assessment when required by section 36 of the Act to assess whether it is possible for children to access their regulated services and, if it is, whether the child user condition is met, namely whether a significant number of children use the regulated service (or part of it) or the service (or part of it) is of a kind likely to attract a significant number of users who are children. Where the service provider concludes that it is likely to be accessed by children, it must conduct a children’s risk assessment under section 11 or section 28 of the Act.

65 Section 133 of the Act. 66 Where steps are imposed in respect of a failure to comply with a duty in section 10(2)(a), (b) or (3)(a) of the Act in relation to, respectively, CSEA offences in Schedule 6 of the Act or CSEA content, Ofcom may designate the requirement a ‘CSEA requirement’. A failure to comply with such a requirement is a criminal offence – see section 138 of the Act.

67 Note that, where a confirmation decision requires a service provider to comply with an information duty, we may require those steps to be taken immediately (see section 133(5) of the Act). 68 Section 134 of the Act. 69 Sections 9, 11, 26, 28 of the Act. 70 Section 135 of the Act.

6.50 Where we find that a service provider has failed to comply with their duty in relation to children’s access assessments, we can require the provider to carry out or re-do the children’s access assessment and would set a deadline for the completion of the assessment in the confirmation decision. The maximum period of time we can allow the service provider to complete the assessment is three months from the date of the confirmation decision although this can subsequently be extended at our discretion.71 We also have power to determine that a regulated service is likely to be accessed by children where there is evidence that it is possible for children to access all or part of the service and the child user condition in section 35(3) of the Act is met.72 Where we make such a determination, the children’s risk assessment duties in section 11 and 28 of the Act, and the children’s safety duties in section 12 and 29 will apply to the service provider. We will specify the date from which the duties would apply in the confirmation decision. Ofcom can also set out the circumstances in which the determination will cease to apply in the confirmation decision, for example, if the service provider were to implement age assurance.

6.51 Proactive technology: the steps we can require a service provider to take in a confirmation decision can include steps to use a kind (or one of the kinds) of proactive technology which we specify in the decision.73 Section 231 of the Act defines proactive technology as consisting of three types of technology: content identification technology, user profiling technology, and behaviour identification technology (subject to certain exceptions). Our powers to require the use of proactive technology in a confirmation decision are subject to constraints as set out in section 136 of the Act.

6.52 We can require the provider of a Part 3 service74 to use proactive technology for the purpose of complying with, or remedying the failure to comply with, the illegal content safety duties in sections 10(2) or (3) or 27(2) or (3) of the Act, the children’s online safety duties in sections 12(2) or (3) or 29(2) or (3), or the fraudulent advertising duties in sections 38(1) or 39(1). The relevant constraints in these cases are that: • we may not require the technology to be used to analyse user-generated content (UGC) that is communicated privately, or metadata relating to such content. Where this is relevant, we will set out in the confirmation decision the content, or parts of the regulated service that include content, that we consider is communicated publicly.75 • we are also required to particularly consider the matters listed in section 136(8) of the Act (so far as they are relevant). These include, for example, the prevalence on the regulated service of relevant content.

6.53 We can also require the provider of an internet service within section 80(2) of the Act to use proactive technology for the purpose of complying with, or remedying the failure to

71 Section 135(2) and (3) of the Act. 72 The child user condition is met if either: (a) a significant number of children are users of the regulated service, or part of the service; or (b) the service, or part of it, is likely to attract a significant number of child users.

73 Such a confirmation decision may also impose requirements about review of the technology by the provider - see section 136(9) of the Act. 74 See section 4 of the Act. 75 “The factors which Ofcom is required to consider when deciding whether content is communicated “publicly” or “privately” are set out in section 232 of the Act. Ofcom has published guidance on the concepts of content communicated “publicly” and “privately”.

comply with, its duty to ensure that children are not normally able to encounter regulated provider pornographic content (for instance, requiring it to implement age assurance technology). The constraints described above do not apply to this case.

Failure to comply with steps required in a confirmation decision¶

6.54 Where Ofcom has required a service provider to take steps in a confirmation decision, we will monitor the regulated service to assess compliance with those requirements. The purpose of monitoring at this stage is to ensure that the service provider complies with any steps required in the confirmation notice, by the date set out in the notice. The process and length of the compliance monitoring will depend on the circumstances of the case, and the steps required in the confirmation decision. We may use one or more of our information gathering powers (see paragraphs 5.31 to 5.44) to gather the information required to monitor compliance.

6.55 Where Ofcom has set a daily penalty in respect of an on-going failure in a confirmation decision, this will become payable on the basis set out in the confirmation decision if the failure continues after the date specified for coming into compliance.76 Otherwise, if we have concerns about whether a service provider has complied with the steps specified in a confirmation decision, for example if a deadline for compliance does not appear to have been met, we will consider what action to take, taking into account the factors listed in our priority framework at 3.9. For example, providing a daily rate penalty has not been set in a confirmation decision, we may issue a penalty notice (see below) in respect of the failure to comply with the confirmation decision.77 We may also consider whether alternative action might be appropriate, for example seeking business disruption measures (see Section 9).

6.56 It is a criminal offence to fail to comply with a requirement imposed in respect of certain breaches in a confirmation decision, notably a children’s online safety duty (as defined in section 138(2) of the Act) or a CSEA requirement.78 An officer of the service provider79 also commits an offence where they have consented or connived in the commission of the offence, or it is attributable to neglect on the part of the officer.80

Penalty notices¶

6.57 Ofcom is able to issue a notice which requires payment of a penalty (a ’penalty notice’) in respect of certain failures, specifically a failure to comply with: the requirements in a confirmation decision;81 a Technology Notice under section 121(1) of the Act;82 and a failure to pay a fee set under section 84 or Schedule 10 of the Act.83 A penalty notice and a notice proposing a penalty84 must contain the information set out in section 142 of the Act,

76 Section 137(8) of the Act. 77 Section 139 of the Act. 78 See footnote 66. 79 See also section 186(3) of the Act as it applies to a Scottish partnership.

80 Section 186 of the Act. 81 Section 139(2) of the Act. 82 Section 140(5) of the Act. 83 Section 141(6) of the Act. 84 See section 140(2) and section 141(2) of the Act which require Ofcom to give a notice of a proposal to impose a penalty in relation, respectively, to a failure to comply with a notice under section 121(1) and the non-payment of a fee.

including the reasons for imposing the penalty and for the penalty amount specified. Where Ofcom proposes to issue a penalty notice, it will follow the guidance set out in this section in relation to provisional notices of contravention and confirmation decisions to the extent relevant.85

6.58 In relation to the non-payment of fees, Ofcom also has powers to issue a non-payment notice, requiring the payment of the fee86 and to bring proceedings to recover the unpaid fees, whether before or after the imposition of a penalty.87

Publishing details of the confirmation decision Publication by Ofcom¶

6.59 Once Ofcom has notified the subject of an investigation of its decision, and issued the confirmation decision, or a penalty notice, we will close the investigation and update the details of the decision on our website in line with paragraphs 5.18 to 5.21.

6.60 As part of our update, we will describe the failure or failures to which the confirmation decision or penalty notice relates, and Ofcom’s response,88 which will typically include details of any penalty imposed and/or any requirement for the subject to take specific steps to come into compliance or remedy the contravention(s).

6.61 As soon as possible after we have closed the investigation, we will also publish a non-confidential version of the confirmation decision on our website. We will not publish information we consider to be confidential when publishing a confirmation decision or penalty notice or information about them. We will create a non-confidential version of the confirmation decision or penalty notice, which we will share with the subject prior to publication, and will give the subject an opportunity to provide representations on confidentiality. We do not accept blanket claims of confidentiality and it is for Ofcom to decide whether the information is confidential in line with section 149(4) and (5) of the Act. Where parties consider that information is confidential, they should explain their reasons for this, specifically whether the information relates to the private affairs of a particular body or individual, or where publication would or might seriously and prejudicially harm the interests of a particular body or individual.

6.62 Where the decision is to publish the information despite the party whose information it is continuing to object to such disclosure, the party may escalate its concerns to the Procedural Officer (in accordance with Section 10). We would expect to delay disclosing the information until the Procedural Officer has reached their decision. If we intend to disclose the information after taking these steps, we will inform the party concerned in advance.

Publication by service providers¶

6.63 Where Ofcom has issued a confirmation decision, or a penalty notice, and any appeals period in relation to the confirmation decision or penalty notice has ended, we may issue a ‘publication notice’ requiring a person to: • publish details describing the failures to which the confirmation decision or penalty notice relates, and Ofcom’s response, and/or

85 Taking into account any other relevant specific requirements set out in the Act. 86 Section 141(2) of the Act. 87 Section 141(10) of the Act. 88 See section 149 of the Act.

• otherwise notify users of those details.89

6.64 The publication notice will contain the following information: a) the confirmation decision or penalty notice to which the publication notice relates; b) a description of the details that must be published or notified; c) the form and manner that the publication or notification must take; d) the date by which the details must be published or notified; and e) the consequences of not complying with the publication notice.

6.65 We may also specify the period during which the publication must continue.

6.66 We will decide on a case-by-case basis whether it is appropriate and proportionate to issue a publication notice, for example for reasons of fairness and transparency or where we consider that dissemination of the outcome of enforcement action by the subject will support the protection of its user base.

6.67 Where we consider that a publication notice may be appropriate, we will send a draft to the subject so that it is able to provide representations on the form and the manner of the publication. We will generally allow 10 working days for the subject to submit any representations unless we think that another period is justified. We will take into account any representations on the form and manner of the publication before issuing the final publication notice.

6.68 When issuing a publication notice, we will take into account restrictions contained in section 150 of the Act in relation to the disclosure of confidential information. We will follow our approach to confidentiality that is set out in paragraph 6.61. Parties should ensure that any confidentiality representations refer to the reasons a matter is considered confidential in sections 150(8) and (9) of the Act.

89 See section 150 of the Act.

Section 7 Liability of Related Companies and Controlling Individuals¶

Introduction¶

7.1 In certain situations, Ofcom may issue a provisional notice of contravention or a confirmation decision to both the service provider and another entity related to the service provider (Related Company) or to an individual or individuals controlling the service provider (Controlling Individuals). Where we do so, the Related Company or Controlling Individual will be jointly and severally liable with the service provider for any contravention that we find in a confirmation decision.

7.2 In this section we explain which Related Companies and Controlling Individuals may be issued with a notice jointly with the service provider under the Act, and the factors we will take into account when deciding whether this might be appropriate. We also explain how our enforcement procedures apply in these situations.

Related Companies and Controlling Individuals which may be issued a joint notice¶

7.3 Schedule 15 of the Act gives Ofcom powers to issue a provisional notice of contravention, confirmation decision or penalty notice to a Related Company or Controlling Individual jointly with the service provider responsible for the contravention in question. Specifically, Ofcom may issue a joint notice to the service provider and an entity (or entities) falling within one of the following categories: • A parent undertaking of the service provider; • A subsidiary undertaking of the service provider; • An undertaking in the same group as the service provider, which has the same parent undertaking as the service provider (described as “fellow subsidiary entities” under the Act); • A person or persons who control the service provider.

7.4 These relationships are illustrated in Figure 3 and the statutory tests for determining whether a Related Company or Controlling Individual could be held jointly and severally liable are described in more detail in paragraphs 7.15 to 7.20.

Figure 3: Related entities and individuals who may be held jointly liable

7.5 Where the service provider plus a Related Company or Controlling Individual are jointly issued with a provisional notice of contravention, those parties will be jointly and severally liable to comply with the requirements and/or pay any penalty imposed by that decision or notice. We will give the parties the opportunity to make representations on whether joint and several liability would be appropriate, as detailed below.

(a) Parent undertakings¶

7.6 In accordance with the Companies Act 2006,90 an undertaking is a parent of the service provider if it: a) holds a majority of the voting rights in the service provider; b) is a member of the service provider and has the right to appoint or remove a majority of its board of directors; c) has the right to exercise a dominant influence over the service provider, by virtue of provisions contained in the provider’s Articles of Association or by virtue of a control contract; d) is a member of the service provider and controls alone, pursuant to an agreement with other shareholders or members, a majority of the voting rights in that undertaking; or e) has the power to exercise, or exercises, dominant influence or control over the service provider, or it and the service provider are managed on a unified basis.

7.7 However, for the purposes of the Act, Ofcom may not issue a joint confirmation decision or penalty notice if it is satisfied, following representations from the parent undertaking, that it only meets the condition in paragraph 7.6(a),91 for example, it is a parent undertaking

90 Sections 1162(2) and (4) of the Companies Act 2006. 91 i.e. section 1162(2)(a) of the Companies Act 2006.

because it holds the majority of the voting shares in the service provider but does not meet any of the conditions in paragraph b) to e) in paragraph 7.6.

(b) Subsidiary undertakings¶

7.8 In accordance with the Companies Act 2006,92 an undertaking will be a subsidiary of the service provider if the service provider: • holds a majority of the voting rights in the Related Company; • is a member of the Related Company and has the right to appoint or remove a majority of its board of directors; or • is a member of the Related Company and controls alone, pursuant to an agreement with other members, a majority of the voting rights in it.

7.9 Ofcom may issue a joint confirmation decision or penalty notice to a subsidiary only where it is satisfied that the subsidiary’s acts contributed to the failure or contravention specified in the confirmation decision or penalty notice.

(c) Fellow subsidiary entities¶

7.10 In accordance with the Companies Act 2006,93 an undertaking is a fellow subsidiary entity in relation to the service provider if the undertakings: a) are subsidiaries of the same parent undertaking (as defined under the Companies Act 2006); and b) are not parent or subsidiary undertakings of each other.

7.11 Ofcom may issue a joint confirmation decision or penalty notice to a fellow subsidiary entity only where it is satisfied that the fellow subsidiary’s acts contributed to the failure or contravention specified in the confirmation decision or penalty notice.

(d) Controlling individuals¶

7.12 For the purposes of the Act, a Controlling Individual is a person who would be, if they were an undertaking, a parent undertaking in relation to the service provider, as defined by the Companies Act 2006.94 In other words, an individual is considered to be a Controlling Individual if they meet the conditions listed at a) to e) of paragraph 7.6.

7.13 However, Ofcom is not entitled to issue a joint confirmation decision or penalty notice to a Controlling Individual if it is satisfied following representations from the individual or individuals in question that they only meet the condition in paragraph 7.6a),95 for example they hold the majority of the voting shares in the service provider but do not meet any of the conditions in paragraph b) to e) in paragraph 7.6.

7.14 There may also be cases where two or more individuals qualify as Controlling Individuals because they may be treated as acting jointly in relation to the service provider for the purposes of the tests in paragraph 7.6. This might be the case, for example, where they are parties to a shareholders’ agreement which governs the exercise of their voting rights in the regulated service or because they are family members, or have an employee or partnership relationship.

92 Section 1159 of the Companies Act 2006. 93 Section 1161(4) of the Companies Act 2006. 94 Specifically, under section 1162(2) or 4(a) of the Companies Act 2006. 95 i.e. section 1162(2)(a) of the Companies Act 2006.

Factors which Ofcom will take into account when considering whether to pursue a Related Company or Controlling Individual¶

7.15 In enforcing the Act, Ofcom’s central objectives are to drive compliance, deter wrongdoing, protect users from harm and hold wrongdoers to account. As such, we consider whether any penalty or steps imposed for a failure to comply with an obligation under the Act are sufficient to have the appropriate deterrent impact on the service provider and the wider industry. We also consider whether they incentivise the management (which is ultimately responsible for the conduct of the regulated service) to change course and come into compliance.

7.16 There are two main reasons which may lead us to consider whether it would be appropriate to pursue a Related Company or Controlling Individual.

7.17 First, if we have grounds to believe that the Related Company or Controlling Individual had some responsibility for the failure under investigation. A Related Company which qualifies as a parent undertaking or a Controlling Individual will generally meet this threshold because of their ability to exercise dominant influence or control over the service provider. However, in making our assessment, we may also take into account: • the degree of control actually exercised over the service provider; or • other factors, such as the closeness of their links, for example, where there are common directors, or shared resources, such as employees and IT systems.

7.18 In the case of other Related Companies, we would expect to have some evidence that the other undertaking potentially contributed to the failure under investigation, for example by providing a service, system or tool used in connection with the regulated service which may have played a part in the issue under investigation.

7.19 Second, where we have reason to believe that any enforcement action we take may be more effective if a Related Company or Controlling Individual has joint and several liability with the service provider. This may be the case for a number of different reasons. For example: • if we have concerns that the qualifying worldwide revenue of the service provider would not allow us to set a penalty which was reflective of the seriousness of the contravention found or provide a sufficient deterrent; • if the service provider is based overseas and we have concerns about the resource required to ensure its compliance with any confirmation decision that we impose via the mechanisms of another jurisdiction, it may be more efficient to incentivise compliance by using our Schedule 15 powers to pursue a UK-based Related Company or Controlling Individual; • when imposing steps on a service provider to remedy the consequences of its failure or bring itself into compliance, it may be appropriate to take action against a parent undertaking in addition because it is in a position to secure the specified steps are taken, so as to prevent further harm to UK users and maintain confidence in the regulatory regime for online safety.

7.20 We will also take account of our priority framework (see paragraph 3.9) when deciding whether to seek to make a Related Company or Controlling Individual jointly and severally liable for any contravention that we find.

The process for issuing a notice or decision jointly to a Related Company or Controlling Individual Notices issued jointly with the service provider¶

7.21 Where Ofcom has decided it would be appropriate to pursue a Related Company or Controlling Individual, and Ofcom has not yet issued a provisional notice of contravention, we will generally involve the Related Company or Controlling Individual in the investigatory processes outlined above at Sections 4 to 6 as soon as practicable in our enforcement process. For example: • Section 4 – prior to opening the investigation, if Ofcom considers it appropriate to do so, we will engage with the Related Company or Controlling Individual at the same time as engaging with the service provider as part of our initial assessment. • Section 5 – once an investigation has been opened, if Ofcom considers it appropriate to do so, we will inform the Related Company or Controlling Individual of our decision to open an investigation or our decision to change the scope of the investigation, where applicable. We may also issue an information notice to the Related Company or Controlling Individual if it appears they have, or are able to generate, information relevant to our investigation. • Section 6 – where Ofcom decides to issue a joint notice, (whether a provisional notice or a proposed penalty notice), we will issue the notice to the Related Company or Controlling Individual at the same time as the service provider. In making representations (as set out in paragraphs 6.23 to 6.34), the Related Company or Controlling Individual will have the opportunity to make representations on whether joint and several liability for the contravention would be appropriate.

7.22 The Related Company or Controlling Individual will also have the opportunity to make representations that Ofcom is not entitled to issue to that party, by reason of that party being out of scope of Ofcom’s powers under the Act, as outlined at paragraphs 7.7, 7.9, 7.11, or 7.13 (as appropriate).

Subsequent issue of a notice or decision to the Related Company or Controlling Individual, where a provisional notice of contravention has not previously been given to them in relation to that matter¶

7.23 In certain situations, it may be appropriate for Ofcom to consider issuing a penalty notice or confirmation decision to a Related Company or Controlling Individual, which was not previously given a provisional notice of contravention in relation to the same matter. For example, when additional evidence has come to the attention of Ofcom at a late stage in the process or there is a change in circumstances which gives us cause to reassess the effectiveness of our enforcement action. In such cases, prior to issuing a confirmation decision or a penalty notice, Ofcom will give the Related Company or Controlling Individual an opportunity to make representations about: a) the matters contained in the decision or notice; and b) whether joint and several liability would be appropriate.

The maximum joint penalty that can be imposed¶

7.24 Where a penalty has been issued jointly with a Related Company or Controlling Individual, the maximum penalty Ofcom may impose on the service provider and the Related Company or Controlling Individual is whichever is the greater of: a) £18 million, and b) 10% of the qualifying worldwide revenue of the group of companies that consists of:

i the service provider; and

ii every other undertaking which, at the time the decision or notice is given, is a group undertaking in relation to 96 the service provider.97

7.25 For the purposes of paragraph 7.24, the ‘qualifying worldwide revenue’ of the group of companies is the amount of the group’s qualifying worldwide revenue for the most recent complete accounting period of the companies liable for the penalty, or, if the first accounting period has not yet ended, the amount Ofcom estimates to be the group’s likely qualifying worldwide revenue for that period.

96 ‘Group undertaking’ is defined in section 1161(5) of the Companies Act 2006. 97 See footnote 60.

Section 8 Settlement procedure¶

Introduction¶

8.1 In some cases, Ofcom may consider that it is appropriate to settle an investigation. Settlement is a voluntary process which leads to a legally binding confirmation decision or penalty notice.98 It involves the subject of the investigation admitting it has contravened one or more of its obligations under the Act and accepting that the remainder of the investigation will follow a streamlined administrative procedure. In such cases, Ofcom will apply a discount to the level of any penalty imposed on the subject in light of the resource savings involved.

8.2 Those who we are investigating are not under any obligation to enter into a settlement process or to settle, and Ofcom has broad discretion to decide whether an investigation is appropriate for settlement or to agree to settlement.

8.3 For the avoidance of doubt, settlement is not a negotiation with Ofcom about what contraventions we might be prepared to find or not to find or the level of the penalty which Ofcom would impose. Nor is it equivalent to the type of discussions which take place between parties to litigation or potential litigation on a ‘without prejudice’ basis for the purposes of seeking to resolve or avoid litigation.

8.4 In this section, we explain the minimum requirements for settlement and the discounts that Ofcom may apply to any penalty that is imposed where settlement is reached.

Requirements for settlement¶

8.5 Ofcom may consider settlement for any investigation in which we believe that we have a sufficient basis to issue a provisional notice of contravention or a proposed penalty notice.99

8.6 We will have regard to our statutory duties in deciding whether it is appropriate to settle an investigation and will also consider other factors such as the likely procedural efficiencies and resource savings that can be achieved through settlement.100 We may decide that an investigation is not suitable for the settlement procedure, for example: • for public policy reasons- for example due to the nature of the harm caused by the contravention; • due to the previous conduct of the subject during the investigation - for example, where the subject has been obstructive or failed to co-operate; • where the subject indicates a willingness to settle the case at a late stage in an investigation; or • due to limited resource savings from settlement - for example in some cases involving contraventions of statutory information request requirements.

98 Settlement is therefore not the same as resolving a case by giving assurances to change conduct which could lead to case closure without resulting in Ofcom issuing a provisional notice of contravention, and, subsequently, a confirmation decision (as described in Section 6). 99 As described in Section 6. 100 Taking into account, among other things, the stage at which settlement is initiated, whether settlement would result in shortening the case timetable and a reduction in resources, and whether settlement is likely to be reached in a reasonable timeframe.

8.7 As a minimum, Ofcom will require the subject of the investigation to: a) make a clear and unequivocal written admission of liability in relation to the nature, scope and duration of the contravention. This would need to reflect Ofcom’s position on the nature of the contraventions we are minded to find and the appropriate level of penalty (as explained further in paragraphs 8.18, 8.20 and 8.23); b) where applicable, cease the contravening behaviour immediately from the date it enters a settlement process with Ofcom and refrain from engaging again in the same or similar contravening behaviour; c) confirm that it:

i accepts that there will be a formal and published finding of contravention against it;

ii will pay any penalty;

iii will take any steps required to comply with the relevant requirement and/or duty, and to remedy the consequences of the contravention (if relevant);

iv will accept a streamlined administrative process;101 and

v will not challenge or appeal against any final decision.

Settlement discounts¶

8.8 Where the settlement process is concluded successfully, the confirmation decision (or where relevant, penalty notice) will contain the penalty amount, including a settlement discount. Our aim will be to conclude the settlement process as swiftly as possible. In line with this aim, the earlier the settlement process is commenced, the greater the discount Davailable, as the resource savings that Ofcom could achieve would be greater.

8.9 The settlement discount will be considered on a case-by-case basis and will be assessed on the basis of the potential administrative saving. We would normally expect this discount to be: • up to a maximum of 30% where a successful settlement process is commenced before the provisional notice of contravention or proposed penalty notice is issued; • up to a maximum of 20% where a successful settlement process is commenced after the provisional notice of contravention or proposed penalty notice is issued, but prior to written representations being received; or • up to a maximum of 10% where a successful settlement process is commenced after the provisional notice of contravention or proposed penalty notice is issued and after written representations are received.

8.10 Where we are concerned that the process is not progressing as swiftly as possible due to delays or inefficiencies caused by the subject, or that it is not providing its full co-operation with the settlement process, we are likely to bring the settlement process to an end or reduce the available discount on account of the time taken and resources used. We would give the subject notice that we are minded to do so at that point.

8.11 Settlement discounts are separate from the application of the Penalty Guidelines, under which we may take into account a subject’s co-operation with an investigation in setting the appropriate level of penalty imposed. The settlement discount is intended to reflect resource savings achieved by Ofcom as a result of following the settlement process and is

101 This will be decided on a case-by-case basis depending on the stage at which the settlement process is commenced but may include no written representations (except in relation to manifest factual inaccuracies) and will include no oral hearing.

applied after other mitigating factors have already been taken into account in determining the appropriate level of the penalty.

Decision making¶

8.12 The decision maker in a settlement case will typically be the person responsible for deciding whether there are grounds to issue a provisional notice of contravention or proposed penalty notice, and therefore will usually be the person responsible for overseeing the investigation (the case supervisor – see paragraph 5.13). The relevant decision maker will then typically oversee the settlement process. In contrast to our usual process, we would expect this decision maker also to be responsible for taking the final decision on the case in the event that the settlement process is successful.

Settlement process¶

8.13 If the subject of an investigation wishes to discuss the possibility of exploring settlement, it should approach the case leader and/or case supervisor in the first instance at any time. Ofcom will consider initiating the settlement process at any point after Ofcom has reached a stage in our analysis where we could come to a provisional view on the nature of the contravention and the appropriate level of penalty. There are three main stages at which a settlement process may be commenced: a) prior to a provisional notice of contravention or proposed penalty notice being issued; b) following a provisional notice of contravention or proposed penalty notice being issued, but prior to the subject making written representations in response; or c) following a provisional notice of contravention or proposed penalty notice being issued, and after the subject has made representations in response, but prior to Ofcom issuing a confirmation decision (or where relevant, a penalty notice).

8.14 If the settlement process is unsuccessful and the subject wishes to enter into a further settlement process at a later stage of the investigation, it remains open for it to do so. However, as noted above, it is at Ofcom’s discretion whether and on what basis to enter into a settlement process at any stage.

Settlement prior to a provisional notice of contravention¶

8.15 We will normally provide details of our thinking on an investigation where we consider this will assist the subject and Ofcom in deciding whether to engage in a settlement process. If Ofcom and the subject both wish to pursue the settlement process, we will then send to the subject a statement of facts, setting out our proposed findings and the evidence on which we propose to rely. We will also provide: a) an indication of the level of penalty that we would be minded to impose (if any) and the level of settlement discount we would be likely to award;102 b) access to documents we rely on, if appropriate, for reasons of fairness and transparency (see paragraphs 6.18 to 6.20); and

102 That discount would reflect the discount that Ofcom would be minded to apply to the penalty were the settlement process successful and concluded swiftly. Were Ofcom minded to reduce the available discount at any point on account of the time taken and the resources used during the settlement process, we would give the subject of the investigation notice of our intention to do so.

c) any specified steps that Ofcom consider the service provider would need to take to comply with the duty or requirement (or duties and requirements) or remedy the failure(s) to comply (see Section 6).

8.16 Ofcom will ask the subject if it would be prepared in principle to make admissions on the basis of the statement of facts.103 If the subject wishes to pursue settlement on the basis of the statement of facts, it will be asked to limit any written representations to identifying any manifest factual inaccuracies in the statement.104

8.17 If the subject is not prepared to agree to a settlement based on the statement of facts, it is unlikely to be appropriate to pursue settlement at this stage and Ofcom would normally proceed to issue a provisional notice of contravention in accordance with its usual process.

8.18 If the subject indicates that it wishes to pursue settlement on the basis set out in the statement of facts, we would proceed to issue a provisional notice of contravention (or proposed penalty notice, which would contain the proposed penalty amount and any requirements to take specified steps.105 This will take account of representations made on manifest factual inaccuracies in the statement of facts and so we would not expect to receive any further representations, or offer an oral hearing, at this stage. We would expect the subject to provide written confirmation of admissions and its acceptance of the settlement requirements following receipt of the provisional notice. We will then follow the process as set out in the 'successful conclusion of the settlement process’ from paragraph 8.24.

Settlement following a provisional notice of contravention and prior to written representations¶

8.19 If the subject of the investigation is in principle prepared to agree to the settlement requirements and admit to the contravention(s) set out in the provisional notice of contravention or proposed penalty notice, it may inform Ofcom that it wishes to enter a settlement on that basis.

8.20 We will provide the subject with an indication of the settlement discount we would be minded to apply if a successful settlement process is commenced at this stage. We will then set a deadline for the subject to indicate its willingness to settle and provide a short period for written representations on manifest factual inaccuracies only in the provisional notice of contravention or proposed penalty notice.106 We then expect the subject to provide written confirmation of admissions and its acceptance of the settlement requirements in the

103 The timeframe for doing so will be set on a case-by-case basis, having regard to possible resource savings through the settlement process. 104 Representation on manifest factual inaccuracies means any significant inaccuracy on the dates or facts set out. If Ofcom considers that the subject’s representations appear to go beyond this (for example into the merits of our provisional findings or on the level of the penalty), we would reassess whether the case remained appropriate for settlement at this stage. 105 This would not typically include the settlement discount because, as discussed further below, we would not typically expect settlement to be formally agreed until after we have issued the provisional decision. We would, however, expect to confirm the level of the available settlement discount at this stage which would, for example, be the same amount as previously proposed to the subject were the settlement process successful and concluded swiftly. The available discount may be reduced in the event the settlement process takes longer, as set out above.

106 The timeframe for doing so will be set on a case-by-case basis having regard to possible resource savings through the settlement process.

manner set out at paragraph 8.24, without further written or oral representations. We will then follow the process as set out in 'successful conclusion of the settlement process’.

Settlement following a provisional notice of contravention and following written representations¶

8.21 If the subject of the investigation wishes to make written representations on the provisional notice of contravention or proposed penalty notice (beyond identifying manifest factual inaccuracies), it may indicate to Ofcom that it wishes to enter into a settlement process after doing so.

8.22 Ofcom would consider any written representations made to it in line with our usual process (as set out in Section 6) including representations as to the level of any penalty, before deciding whether to engage in a settlement process and on what basis. Settlement is not a negotiation. Therefore, if we consider it appropriate to engage in a settlement process after considering the subject’s written representations (or where relevant, oral representations), we would normally provide the subject with a written statement of our position.107 This would set out: a) the contravention(s) we are minded to find; and b) an indication of the level of penalty we would be minded to impose, taking into account our assessment of the nature of the contravention(s) and after applying the settlement discount on the penalty at that stage of the process.108

8.23 We will set a deadline for the subject to indicate its willingness to settle on the basis of the written statement.109 We then expect the subject to provide written confirmation of admissions and its acceptance of the settlement requirements in the manner set out in the ‘successful conclusion of the settlement process’, without further written or oral representations.

Successful conclusion of the settlement process¶

8.24 If the settlement process is successful and the subject indicates that it is prepared to agree to the settlement requirements and make admissions which reflect Ofcom’s position, the subject of the investigation must provide written confirmation of its admissions and acceptance of the settlement requirements. That letter should be sent by its Chief Executive Officer or another senior member of its Executive team.

8.25 Where settlement is agreed prior to the subject making substantive written representations on the provisional notice of contravention or proposed penalty notice, we expect the subject to provide written confirmation of settlement following receipt of that notice. We normally expect in such cases that the confirmation decision or penalty notice would be in the same terms as the provisional notice (subject to any corrections of manifest factual inaccuracies).

107 This may, for example, take the form of a draft final decision, or we might confirm via letter that our position remains unchanged from the provisional decision.

108 That discount would reflect the discount that Ofcom would be minded to apply to the penalty were the settlement process successful and concluded swiftly. Were Ofcom minded to reduce the available discount at any point on account of the time taken and the resources used during the settlement process, we would give the subject notice of this at that point. 109 The timeframe for doing so will be set on a case-by-case basis having regard to possible resource savings through the settlement process.

8.26 Where settlement is agreed after the subject has made substantive written representations on the provisional notice of contravention or proposed penalty notice, we expect the subject to provide its written confirmation of settlement following receipt of Ofcom’s written statement of our position.

8.27 Once we have received the subject’s written confirmation of settlement, the relevant decision maker will then formally make the confirmation decision or penalty notice. This will be in line with the written statement and, will contain any penalty amount, including any settlement discount, as well as any specific steps the subject is required to take to come into compliance or remedy the contravention(s).

8.28 Following the conclusion of a successful settlement process, Ofcom will close the investigation and update the details of the case on Ofcom’s website. This will generally refer to the fact that a settlement has been agreed and include: a) a summary of the contravention(s) Ofcom has found; b) details of the penalty (including the level of the settlement discount); and c) any other measures imposed (such as any requirements on the subject to take steps to bring itself into compliance and/or remedy the consequences of the contravention(s)).

8.29 Ofcom may also publicise the outcome of the investigation in a media release. We will normally share (with the subject) in advance, a copy of the website update for information. It will be shared no more than one working day before publication (see paragraphs 5.18 to 5.21).

8.30 Ofcom will also publish a non-confidential version of the confirmation decision or penalty notice, in accordance with our standard practice, on its website (see Section 6).

Withdrawing from the settlement process¶

8.31 Either the subject of the investigation or Ofcom may withdraw from the settlement process at any point. If the settlement process is unsuccessful, the investigation will revert to the usual process and the content of any settlement discussions will not be revealed to the final decision maker.

8.32 The final decision maker may be aware of the fact that the possibility of settlement has been discussed between Ofcom and the subject. However, neither the substance of any oral discussions between the subject and Ofcom, nor any correspondence relating to, or written records of, such discussions would be disclosed to the final decision maker, so that the decision can be taken impartially based on the relevant evidence.

8.33 Settlement is not akin to ‘without prejudice’ negotiations for the purposes of seeking to resolve litigation. Any additional documentary evidence provided during the settlement process would be placed on the case file and could be taken into account by Ofcom for the purposes of its final decision even if the settlement process is unsuccessful. In addition, Ofcom may follow up any new issues of concern which arise during the settlement process.

8.34 Ofcom’s standard practice is not to comment publicly on the fact that settlement discussions are taking place, or that settlement discussions have been unsuccessful. Where settlement is successfully concluded, this will be referenced in the confirmation decision, along with details of the discount on penalty that is given as a result.

Section 9 Business disruption measures¶

Introduction¶

9.1 In most cases, we expect the enforcement action we take to be sufficient to bring a service provider into compliance and to deter further breaches. However, there will be cases where: a) our enforcement action does not have the intended deterrent effect and the non-compliant conduct by the service provider continues; and/or b) the risk of harm from a regulated service is such that it is appropriate for Ofcom to take other action.

9.2 In such cases it may be appropriate for Ofcom to seek “business disruption measures”. These are court orders which require third parties to withdraw services from, or block access to a regulated service.

9.3 In this section, we describe: a) the business disruption measures that we are empowered to seek from the court; b) when Ofcom may apply for business disruption measures and the factors we will take into account when considering whether such action would be appropriate; and c) the process(es) that we will generally follow in preparation for an application.

Business disruption measures¶

9.4 Business disruption measures are orders made by a court on an application from Ofcom. They apply to third parties which are able to disrupt the provision of the regulated service and thereby reduce the risk of harm to UK citizens and consumers. The third party need not be an Ofcom regulated entity and may not have had any previous dealings with Ofcom.

9.5 The Act provides for four types of business disruption measure: a) a service restriction order; b) an interim service restriction order; c) an access restriction order; and d) an interim access restriction order.

9.6 A service restriction order is an order applying to one or more providers of ‘ancillary services’ to a non-compliant regulated service. An ancillary service is a service that facilitates the provision of the regulated service (or part of it) (for example, payment processing services) or one that displays or promotes content in relation to the regulated service (for example an ad server).110 The criteria with which a court must be satisfied to grant an application for an order are set out in section 144(3) and (4) of the Act and include that the court must be satisfied that the service provider has failed and is continuing to fail with an enforceable requirement or with a Technology Notice under section 121(1) of the Act.111 A service restriction order requires the ancillary service against which an order is obtained to take steps aimed at disrupting the relevant regulated service in the UK, in terms

110 For further examples, see section 144(12) of the Act. 111 See also paragraph 9.11 and footnote 117.

of either the conduct of the business or its revenues, for example, withdrawing payment processing services or advertising services to the regulated service).

9.7 An interim service restriction order is an order made by the court on an interim basis which requires one or more providers of ancillary services to take steps, such as withdrawal of the ancillary services, aimed at disrupting the business or revenue of a regulated service, which is likely to be non-compliant. To grant the order, the court must be satisfied, among other things, that the provider of the regulated service in question is likely to be non-compliant112 and that the level of risk of harm to individuals in the UK relating to the likely failure, and the nature and severity of that harm, are such that it would not be appropriate to wait to establish the failure before applying for the order.113

9.8 An access restriction order is an order applying to one or more providers of facilities which enable access to a non-compliant regulated service (such as internet access services or an App store).114 The order requires the providers of access facilities to which it applies to take steps to impede access to the regulated service by UK users (for example, by restricting internet access to a service provider’s website or removing an app from an App store). Ofcom may only apply for an access restriction order if it considers that: • a service restriction order or an interim service restriction order which has been made is not sufficient to prevent significant harm arising to individuals in the UK as a result of the failure by the regulated service in question; or • a service restriction order or an interim service restriction order would be unlikely to be sufficient to prevent significant harm arising to individuals in the UK, given the likely consequences of the likely compliance failure by the service provider in question.115

9.9 An interim access restriction order is an order made by the court on an interim basis which requires one or more providers of access facilities to take steps to impede access to UK users to a regulated service, which is likely to be non-compliant. As with an interim service restriction order, to grant the order, the court must be satisfied, among other things, that the service provider in question is likely to be non-compliant in respect of its regulated service, and that the risk, nature and severity of harm to individuals in the UK are such that it would not be appropriate to wait to establish the failure before applying for the order. 116

9.10 As with an access restriction order, Ofcom may only apply for an interim access restriction order if it considers that a service restriction order or interim service restriction order which has been made in relation to the regulated service is not sufficient to prevent significant harm or were such an order was to be made, it would be unlikely to be sufficient to prevent such harm.

9.11 To obtain a service restriction order or an access restriction order, Ofcom must show to the court’s satisfaction that a provider of a regulated service has failed to comply with an enforceable requirement or with a Technology Notice. It is not, however, necessary for Ofcom to have issued a provisional notice or a confirmation decision in respect of that

112 Ofcom must show to the court’s satisfaction that it is likely that the provider of the regulated service is failing to comply with an enforceable requirement or a Technology Notice under section 121(1) of the Act. 113 The criteria of which the court must be satisfied are set out in section 145(6) of the Act. 114 See section 146(11) of the Act. 115 See section 146(1) of the Act. The criteria of which the court must be satisfied are set out in section 146(4) of the Act. 116 The criteria of which the court must be satisfied are set out in section 147(4) of the Act.

failure.117 Service restriction orders and access restriction orders will have effect for the period of time specified in the order.

9.12 An interim service restriction order or an interim access restriction order has effect until the court grants (or dismisses) an application for, respectively, a service restriction order or an access restriction order or on the ‘return date’ which is the date specified in the order as a back stop, whichever is the earlier.

9.13 It is the courts in the UK, and not Ofcom, that make service restriction orders, access restriction orders and the respective interim orders. Ofcom’s role in relation to business disruption measures is to apply to the court for an order where it considers it appropriate to do so. The court will then consider whether it is satisfied that the relevant criteria for making an order are met and, if so, on what terms, taking account of the rights and obligations of all relevant parties, including the provider of the regulated service, the person or persons to which the order would apply and UK users of the service in question.

When Ofcom might seek business disruption measures¶

9.14 When deciding whether it is appropriate to seek business disruption measures, we will do so in line with our regulatory principles (see paragraph 1.2) and where we consider it would be proportionate in the circumstances.

9.15 We acknowledge that business disruption measures are a significant regulatory intervention and therefore we are unlikely to find it appropriate to apply to the courts for business disruption measures as a matter of routine where we have identified failures, or likely failures, to comply with enforceable requirements.

9.16 When deciding whether to apply for a business disruption measure, we must consider, as a minimum, that there is a continuing failure to comply or that it is likely that there is or will be such a failure. Where this is the case, we will take account of our priority framework (see paragraph 3.9) when deciding whether to make an application. In particular, we will consider the level and degree of any risk of harm to individuals in the UK from the failure we have identified, including whether there is actual or potential harm to children, and whether there are other steps that are likely to achieve the same ends or deal with the same issues as a business disruption measure.

9.17 Examples of circumstances where we might consider that a business disruption measure would be appropriate and proportionate include: • where a provider has failed to take steps designed to address the serious harm to UK users resulting from the relevant failure specified in a confirmation decision and has failed to engage with Ofcom in relation to bringing itself into compliance; • where the provider has a history of non-compliance and other remedies, for example, financial penalties, have not been effective in deterring further breaches, such that we are concerned that other enforcement tools available to us are unlikely to be effective; and • where the level of risk of serious harm to UK users as a result of the failure is such that it would not be appropriate to wait to establish the failure before applying to the court.

117 See sections 144(3)(c)(iv), (6)(d) and section 146(4)(d) of the Act.

9.18 The decision about whether to apply to the courts for business disruption measures will be taken by an Ofcom nominated decision maker. This will be a senior member of Ofcom’s staff with appropriate Board-delegated authority.

Engagement with third parties and the non-compliant service provider in advance of making an application to the court for business disruption measures¶

9.19 Ofcom will seek to engage with the third parties who may be the subject of a business disruption measure before making an application to the court for such an order. However, this may not be possible in every case, for example in circumstances where the nature and severity of harm arising from the service provider’s conduct is such that it is necessary to make an application to court as a matter of urgency.

9.20 We are likely to use such engagement to obtain information that would be useful to the court in the context of the application. Engagement with the third party may also assist us to formulate proportionate and effective steps that the third party could take to address the harm arising from the service provider’s non-compliance, should the court make an order.

9.21 We may also seek to engage with other entities, for example organisations with expertise relating to relevant technologies, in advance of making an application where appropriate.

9.22 We will take steps to notify the non-compliant service provider, which would be the target of the business disruption measures, in advance of our application. However, we will not invite representations on the merits (or otherwise) of making that application. It is the court that decides whether business disruption measures should be imposed. Potentially affected parties are therefore able to make representations to the court on whether, and if so on what terms, business disruption measures should be imposed as part of the relevant court process.

Applying to the court for business disruption measures¶

9.23 Ofcom can apply for business disruption measures in the courts in any of the four nations of the UK (England and Wales, Scotland and Northern Ireland respectively). If the “third party” against whom Ofcom is seeking an order for business disruption measures has a presence in a particular nation of the UK, Ofcom will endeavour to bring proceedings in that particular nation, unless there is a good reason not to do so (such as because that party has indicated it would prefer that proceedings be brought in a different part of the UK). Where a party has a presence in England and Wales as well as another part of the UK, or no presence in any part of the UK, Ofcom will ordinarily bring proceedings in the High Court of England and Wales.

Once Ofcom has applied to the court for business disruption measures¶

9.24 Once Ofcom has applied to the court for business disruption measures, the remainder of the process is governed by the procedural rules applicable in the relevant court.118 Those procedural rules set out, among other things, when and how parties can participate in this process, the conduct of any hearing, the deadlines for completing any procedural steps required and the appeals process. Ofcom is not able to offer guidance or advice on the court process and potentially affected parties should take their own legal advice in relation to this.

If the court grants business disruption measures¶

9.25 Ofcom will inform the Secretary of State as soon as reasonably practicable after a service restriction order or access restriction order has been made.119

9.26 Where an access restriction or interim access restriction order has been made, we may issue a notice to the person providing the access facility in question, requiring them (where possible) to notify UK users, who attempt to access the relevant regulated service via that facility, of the order and, where relevant, the confirmation decision given to the noncompliant provider.120

9.27 Where we have obtained an order for business disruption measures from the court, we will publish a statement to this effect on our website.

118 In the High Court of England and Wales, these are the Civil Procedure Rules. The current version of the Civil Procedure Rules can be accessed at https://www.justice.gov.uk/courts/procedure-rules/civil/rules [accessed 28 November 2024]. For Scotland, the court rules for the Court of Session and the Sherriff Court can be accessed at https://www.scotcourts.gov.uk/rules-and-practice/rules-of-court [accessed 28 November 2024]. For Northern Ireland, the court rules for the High Court and County Court can be accessed at https://www.justice-ni.gov.uk/publications/court-rules-publications [accessed 28 November 2024].

119 As required under Sections 144(10), 145(8), 146(8) and 147(6) of the Act. 120 Section 146(9) and section 147(7) of the Act.

Section 10 Procedural complaints about investigations¶

Introduction¶

10.1 If the subject of an investigation raises concerns about the conduct of a case and does not consider that its concerns have been satisfactorily resolved by the case leader and/or the case supervisor, then it may refer certain procedural complaints to Ofcom’s Procedural Officer.

The Procedural Officer¶

10.2 A number of appropriately experienced Ofcom staff have Board-delegated authority to act as the Procedural Officer for the purposes of an investigation. The relevant Procedural Officer will be appointed on a case-by-case basis if a relevant procedural complaint is made.

10.3 The Procedural Officer will be independent from the investigation, case team and decision makers, and will not have been involved in the investigation (other than as the Procedural Officer). The role of the Procedural Officer is intended to ensure that procedural issues can be addressed quickly, efficiently and cost effectively, and independently of the case team.

Types of complaint which can be made to the Procedural Officer¶

10.4 Complaints about the procedure followed by Ofcom when conducting an investigation can be made to the Procedural Officer by the subject of the investigation, complainant or a third party (where relevant) once the investigation has been formally opened.

10.5 The Procedural Officer will deal with complaints which relate to the following: • deadlines for parties to respond to information notices, submit documents or provide representations; • requests for redaction of confidential information in documents that Ofcom proposes to publish or disclose; • requests for disclosure or non-disclosure of certain documents or information on Ofcom’s case file; • issues relating to the process for oral hearings; or • other significant procedural issues that may arise during the course of an investigation.

10.6 The Procedural Officer is not able to deal with complaints that relate to decisions taken by Ofcom relating to substantive issues, for example decisions on the scope of information requests or decisions relating to the scope and substance of an investigation.

Making a complaint to the Procedural Officer¶

10.7 If a party wishes to refer its concerns to the Procedural Officer, it should make an application to the Procedural Officer as soon as possible after receiving the decision from the case supervisor, and in any event within five working days.

10.8 The application should be no longer than five sides of A4 paper and should include:

a) the name and contact details of the applicant; b) the name and contact details of the lawyers acting for the applicant (where relevant); c) the Ofcom case name and reference number; d) the date of decision made by the case supervisor; and e) a short summary of the issues including a summary of the case team’s original decision, the decision of the case supervisor, the reason the applicant wants a review of that decision and the outcome the applicant is seeking.

10.9 The applicant should also provide copies of relevant correspondence between it and Ofcom relating to the issue in question and copies of any relevant information or documents which the applicant holds.

10.10 The application should be submitted by email to Procedural.Officer@ofcom.org.uk.

10.11 The Procedural Officer will provide members of the case team and the case supervisor, and the applicant, the opportunity to present their arguments orally on the telephone or at a meeting.

The Procedural Officer’s decision¶

10.12 The Procedural Officer will deal with the application as quickly as possible and will aim to take a decision in most cases within 10 working days from receipt of the application. In any event, the Procedural Officer will reach a decision within 20 working days from receipt of the application. The Procedural Officer may extend this timeframe by no more than 20 working days if there are special reasons to do so.

10.13 The Procedural Officer’s decision will be submitted in writing to the applicant, and it will be binding on the case team and decision makers. A non-confidential version of the Procedural Officer’s decision, or a summary of it, will be published on Ofcom’s website, generally at the time the decision is made or at the end of Ofcom’s investigation.

Section 11 Requirements enforceable by Ofcom¶

Enforceable requirements¶

11.1 Here we provide a list of the ‘enforceable requirements’ as set out in section 131 of the Online Safety Act 2023 (see Section 2 of this guidance).

Provision Subject matter / requirement Section 9 Illegal content risk assessments

Section 10 Illegal content

Section 11 Children’s risk assessments

Section 12 Children’s online safety

Section 15 User empowerment

Section 17 Content of democratic importance

Section 18 News publisher content

Section 19 Journalistic content

Section 20 Content reporting

Section 21 Complaints procedures

Section 22 Freedom of expression and privacy

Section 23 Record-keeping and review

Section 26 Illegal content risk assessments

Section 27 Illegal content

Section 28 Children’s risk assessments

Section 29 Children’s online safety

Section 31 Content reporting

Section 32 Complaints procedures

Section 33 Freedom of expression and privacy

Section 34 Record-keeping and review

Section 36 Children’s access assessments

Section 38 Fraudulent advertising

Section 39 Fraudulent advertising

Section 64 User identity verification

Section 66 Reporting CSEA content to NCA

Section 71 Acting against users only in accordance with terms of service

Provision Subject matter / requirement Section 72 Terms of service

Section 75 Information about use of service by deceased child users

Section 77(3) and (4) Transparency reports

Section 81 Provider pornographic content

Section 83 Fees: notification of OFCOM

Section 102(8) Information notices

Section 104(7) Assistance to skilled person

Section 105(1) Co-operation with investigation

Section 104(5)(a) Requirements of a notice under section 104(5)(a) to appoint a skilled person

Section 175(3) Requirements of a notice given by virtue of section 175(3) (duty to make public statement)

Section 175(5) Requirements of a notice under section 175(5) (information in connection with circumstances presenting a threat)

Schedule 12 Requirements imposed by a person acting— -in the exercise of powers conferred by paragraph 2 of Schedule 12 (entry and inspection without warrant), or -in the execution of a warrant issued under paragraph 5 of Schedule 12.