IT Essentials: Small site owners brace for the OSA
Enforcement of key provisions of the Online Safety Act starts today
Hard cases make bad law, as they say. But equally, badly worded law can make hard cases, potentially many thousands of them when it comes to the Online Safety Act.
As of today, sites in scope should have completed a risk assessment to understand how children could encounter illegal content on their service. They also need to show they can quickly remove such materials and reduce the chance of them appearing in the first place.
Nothing wrong with that in principle most would agree, but for small sites the devil is in the detail. First, site owners may find it difficult to understand whether they are in scope; second, the burden of compliance on low-risk sites run on a shoestring is disproportionate.
The Online Safety Act began its progress through Parliament six years and five prime ministers ago. During its long and torturous journey it accreted measures much as a shaggy dog collects burrs, before being trimmed into some sort of shape and passed into law in 2023. Its provisions are now coming into force, but some stubborn burrs remain.
The Act was driven and shaped by several tragic incidents of harm to children, including the heartbreaking case of Molly Russell, and was targeted at big social media platforms like Facebook, TikTok, Instagram and Twitter/X, which could and should be doing much more. But its long gestation and history of compromises means it is behind the times when it comes to federated platforms, for example, and lacking in definitional clarity where it is most needed.
A long tail of small sites including cycling forums, blogs and community noticeboards have been caught up in the Act's provisions. These are often self-funded and run part-time by hobbyists and small groups of enthusiasts who can ill-afford the time and expense of implementing the required measures. Some have pre-emptively shut up shop rather than go to all the trouble and expense or risk a hefty fine. Others have geo-blocked the UK or changed their site so as not to allow comments.
They are not helped by the vague wording of the Act in which key terms such as "user" and "significant number of UK users” are not clearly defined. It was clearly written with Big Tech (who can easily afford lawyers) in mind, with insufficient consideration given to the complexity and diversity of the online ecosystem.
Calls by campaigners to take small, low-risk sites out of scope have so far met with silence from the government. It's to be hoped that Ofcom, the agency tasked with enforcing the OSA, will be understanding in its approach and forthcoming with additional guidance as issues emerge.
You can read more about this issue in these recent articles: Call to exempt small sites from the Online Safety Act and Online Safety Act's obligations spark concern among small site owners
Recommended Reads
There's been more news about UK technology law, with Penny Horwood hearing legal experts' concerns about the Data (Use and Access) Bill. "Rushing legislation through that is this difficult to read isn’t a wonderful thing," says one. Deja vu.
AI search engines are popping up everywhere, but are they any good? Well, if accurate results are your thing, sadly no. Plus there are signs that LLMs are being infected by Russian propaganda.
I enjoyed chatting to the head of an NHS trust who, while rolling out new security measures, found lots of strange things on the network, including coffee machines, PlayStations and EVs.
Tom Allen interviewed GitHub’s Martin Woodward about the perennial problem of funding vitally important open source projects, while Open UK's Amanda Brock argued that trying to move away from reliance on US tech misses the point that most infrastructure software is the result of global collaboration.