Constant changes to the timetable and scope of the UK government’s Online Safety Bill (OSB) is hindering Ofcom’s ability to prepare for its new responsibilities and functions, says the National Audit Office (NAO).
When it was officially introduced to Parliament in March 2022, a number of criminal offences were added to make senior managers liable for destroying evidence, failing to attend or providing false information in interviews with Ofcom, and for obstructing the regulator when it enters company offices for audits or inspections; building on three previous criminal offences that were added that February.
While the OSB is now expected to become law in October in 2023, the full regulatory regime will be stood up in phases over the following two years.
In a report published 12 July 2023, the NAO examined the preparations undertaken so far by Ofcom to implement the upcoming OSB, finding that while the online harms regulator “has made a good start”, its efforts are being hobbled by uncertainty around the bill’s timetabling and ultimate scope.
Online safety
The NAO noted, for example, that Ofcom completed an organisational restructuring in September 2020 to embed online safety and expand its technology group; has already prepared a “substantial initial evidence base” to inform its enforcement of the new regime; undertaken early engagement with industry; and created a new Online Safety Group in April 2023 with responsibility for strategy delivery and policy development
However, it also noted that Ofcom’s preliminary estimate for the number of online services which could be subject to the new regime is more than 100,000, although this could be higher, and that it will need to produce north of 40 regulatory documents (including codes of practice and guidance) for service providers.
“The great majority of these [100,000 services] will be based overseas and will not have been regulated by Ofcom before and are therefore unfamiliar with it. Monitoring this scale of services will require automated data collection and analysis systems, and the IT capability to support these, which Ofcom is currently developing,” it said, adding the cumulative costs of preparing for and implementing the OSB could total £169m by 2025, with £56m already incurred by the end of 2023.
Given the scope of the regime, the NAO has said further investment and staff are needed to ensure the new regime works as intended, but that uncertainty around the OSB is preventing Ofcom’s preparations in these areas.
“It has been difficult for Ofcom to estimate and then recruit the number of people it requires as the scope of the regime and Ofcom’s responsibilities have changed over time,” said the NAO. “For example, according to Ofcom, as at the start of July 2023 it still needed to work out the staffing requirements arising from amendments to the Bill announced by the government at the end of June, and estimating the required staffing levels remained difficult as the regime’s scope was still uncertain as further additions could still be made to the Bill.”
The NAO added while Ofcom recruited 346 extra staff between July 2020 and March 2023 based on its estimates of what would be required at the time, increases in the regulatory regime’s scope and the establishment of a dedicated supervision unit since then means a further 104 staff will be needed; bring the total to 450 by the end of 2024.
“To successfully implement the regulatory regime, Ofcom must be able to attract the right talent with the right skills and expertise, including knowledge and understanding of the technology sector. Not only does Ofcom require a significant number of extra staff, but many of these are in new areas, such as online safety technology and data,” it said, adding “there is also a risk that continuing extensions to the legislative process could cause recruited staff to disengage or leave”.
Gareth Davies, head of NAO, added: “Ofcom will need to manage several risks in a way that delivers value for money. It will need to move quickly to cover any gaps in its preparations should the scope change between now and implementation … As ever, access to good quality data will be essential for Ofcom to monitor the compliance of services and to evaluate its own effectiveness.”
To deal with the remaining gaps in preparedness, the NAO has made a number of recommendations for Ofcom in four different areas.
Regarding its external communication, for example, the NAO recommended that Ofcom should manage the public’s expectations about the regime’s impact and Ofcom’s role during implementation, a well as further develop its plans to inform industry about its requirements.
On skills and capacity building, the NAO said Ofcom should identify how it will reach the capability and capacity it needs and keep this relevant and up to date; while on financial management it added that Ofcom should establish how it will manage the financial risks presented by the additional year of setup and increased staffing need, as well as clarify its long-term funding plan.
“[Ofcom] has also yet to secure the funding it needs for the extra staff it has identified it will require,” said the NAO. “It will need to regulate a very large number of services, the great majority of which have not been regulated before and are unfamiliar with Ofcom and how it works, and which have no UK corporate or economic presence. It will need to cover its costs by introducing fees so that the regime becomes self-financing. It will also need to obtain good-quality data to monitor the compliance of services and to evaluate its own effectiveness and that of the regime.”
In a recommendation directed at the Department for Science, Innovation & Technology (DSIT), the NAO added that it should “work with Ofcom to identify how the data Ofcom plans to collect as part of its evaluation activities will support DSIT’s own evaluation of the effectiveness of the regime and the achievement of its policy objectives”.