Clifford Chance

The UK is positioning itself as a leader in content regulation. From 1 November 2020, new rules apply to UK video-sharing platforms that require concrete steps to be taken to proactively protect children and the general public from harmful online content.

Introduction:

On 21 October, Ofcom published guidance on the new statutory obligations imposed by the Audiovisual Media Services Regulations 2020 (the AVMS Regulations). From 1 November 2020, the AVMS Regulations require that UK-established video-sharing platforms (VSPs) comply with new rules relating to the sharing of harmful online content on their platforms. In the past, various social media platforms have been considered VSPs and authors of a recent study conducted by the Department for Digital, Culture, Media and Sport (DCMS) concluded that platforms such as Twitch.tv, TikTok and Vimeo could potentially fall within the UK jurisdiction if they meet the definition of VSP under the AVMS Regulations.

The Guidance is intended to assist VSPs in determining whether they fall within the scope of the new regime and to understand what they must do to ensure their services are complaint. VSPs are encouraged to consider, closely, the Guidance and how to implement its requirements, whilst also looking forward to the changing UK environment for online content regulation.

What are the new regulations and why do we need them?

The new rules for VSPs were introduced by the Directive EU 2018/1808 (2018 Directive), amending the Audiovisual Media Services Directive (2010/13/EU) (AVMS Directive), with member states given until 19 September 2020 to enshrine the 2018 Directive in national law.

Although the UK left the EU on 31 January 2020, this implementation date fell during the UK-EU transition period and, as such, the UK was required to implement the 2018 Directive, which it achieved by publishing the AVMS Regulations. The AVMS Regulations are implemented primarily through new provisions in the Communications Act 2003 (CA 2003), including a new Part B of the Act governing 'Video-sharing platform services'.

What was the previous liability for hosting harmful content?

Prior to 2018 Directive amending the AVMS Directive, its scope was limited to regulated linear television and 'on-demand' audiovisual media services. This meant that VSPs were protected from legal liability relating to (illegal) content they 'hosted' (rather than created), until they were either (i) notified of its existence; or (ii) their technology identified such content, and they subsequently failed to remove the content from their services in good time.

This approach left a potential regulatory gap for content regulation, as technology alone will not always identify illegal or harmful content.

The 2018 Directive extends these regulations to VSPs and, in doing so, provides a mechanism for ensuring that proactive action is taken by VSPs to identify and remove content.

The Audiovisual Media Services Regulations 2020 (AVMS Regulations)

What is a VSP?

VSPs are a type of online video service. The principal feature of this type of service is that it allows users to upload and share videos with members of the public. Therefore, VSPs let users engage with a huge range of content and social features that they may not normally come into contact with.

To be classified as a VSP under the AVMS Regulations, the following conditions must be satisfied:

(i) it is made available by means of an electronic communication network;

(ii)  it is provided on a commercial basis;

(iii)  the person providing it does not have general control over what videos are available but does have general control over the manner in which videos are organised on it; and

(iv) that person is under the jurisdiction of the UK for the purposes of the AVMS Directive.

This definition includes audio and visual content that may be shared on social media and video sharing sites. It is important to note that the AVMS Regulations apply broadly to any service that provides video sharing capabilities, not just traditional VSPs. This will require content providers who provide audiovisual content but do not ordinarily think of themselves as VSPs to consider the AVMS Regulations and the Guidance carefully to assess whether they fall under their scope.

For example, newspapers themselves will not be subject to this new AVMS Regulation, however newspaper websites that provide audiovisual content could be considered as being VSPs.

What does this regulation require VSPs to do?

On 26 October 2020, the UK House of Lords made a strong statement about their perception of online content responsibility for social media, saying that "social media platforms [must be held] accountable for the ways in which the design of their platforms facilitates the spread of harms…big platforms [cannot] continue to run rings around the government, regulators and British public". The AVMS Regulations, in part, take a step in the direction of regulation that seeks to require organisations to demonstrate accountability for content on their platforms.

Under the AVMS Regulations, VSPs must take 'appropriate measures' to achieve and implement specified protection purposes: These purposes are:

• protecting minors from content and advertising that might impair their physical, mental or moral development;
• protecting the general public from content and advertising that incites violence or hatred towards people with certain protected characteristics; and
• protecting the general public from content and advertising, the circulation of which would constitute a criminal offence under EU law (e.g. terrorist content, content containing child sexual exploitation and abuse, and racist / xenophobic content).

Practically, the legislation outlines various steps that might be considered 'appropriate measures'. These might include:

• having in place certain terms and conditions of service for users;
• establishing and operating flagging and reporting mechanisms;
• age verification systems;
• systems to rate the content and easy-to-access complaints procedures; and
• the provision of parental control systems.

In practice, this means that impacted VSPs should ensure that their content compliance and regulatory frameworks should specifically implement the requirements of the Guidance and AVMS Regulations.

Enforcement and Penalties for Non-Compliance

Ofcom will be the regulatory body in charge of the enforcement of the new provisions under the AVMS Regulations.

Ofcom's powers will include the ability to issue enforcement notices and impose financial penalties.

Under provisions of the Communications Act, Ofcom has the ability to serve maximum fines of up to either: (i) 5% of the VSPs qualifying revenue; or (ii) £250,000, whichever is greater. Ofcom can also charge a fee to cover the costs of regulation and demand information in order to produce and publish reports about compliance.

Looking ahead

The Guidance provides insight into Ofcom's immediate approach to the AVMS Regulations and their plans for enforcement. Ofcom will be seeking to engage with VSPs to help them understand their new regulatory obligations and to learn about different approaches to compliance. The Guidance invites VSPs to engage with Ofcom to inform future guidance and to collaborate on what best practise will look like. However, the Guidance emphasises that VSPs will have the primary responsibility for considering whether they fall under the scope of the new regime and ensuring that the appropriate measures are in place.

The Guidance suggests a number of criteria for VSPs to consider when determining whether the measures they propose are appropriate and proportionate to the risks. These include:

• the size and nature of the VSP
• the nature of the material in question
• the harm that the material may cause
• the characteristics of the persons protected and any rights
• legitimate interests at stake (including the rights to freedom of expression and privacy).

Ofcom will have jurisdiction over VSPs where they have their primary establishment in the UK. In practice, this means that the VSP must be economically active in the UK and the UK must be at the centre of their economic activity. From 6 April 2021, VSPs will be required to notify Ofcom of their services and all notifications must be made by 6 May 2021.

In terms of enforcement, Ofcom has confirmed in the Guidance that its initial focus will be on working with VSPs to ensure compliance. Therefore, whilst Ofcom can take formal enforcement action against VSPs from 1 November 2020, the Guidance confirms that it will prioritise only the most serious breaches until the full Ofcom guidance is published in 2021. Ofcom expects to open a consultation in early 2021 with a view to publishing this further guidance by summer 2021.

The Government has proposed that these new VSP provisions will eventually be replaced by a proposed online harms bill. This bill is a piece of potential legislation that forms a crucial part of the UK government's plans to regulate the internet and make the UK 'the safest place in the world to be online'. There are suggestions that online harms may be regulated by a new independent regulator, which may be Ofcom – but this is not yet confirmed. The UK government has stated that they will introduce the online harms bill as soon as possible but the timeline is not final. As the government continues to divert attention to Brexit issues and the Covid-19 pandemic, it may be sometime before finalising the online harms bill is top of the legislative agenda. That may mean Ofcom will apply the AVMS Regulations with more intensity, to fill what it has identified as a regulatory gap. Organisations within scope should be mindful of this, but also be willing to collaborate with Ofcom to clarify uncertainties as they progress with their implementation journey.

Key next steps for potential VSPs

1.  SCOPE APPLICABILITY: Identify if any of your online services are within the scope of the AVMS Regulations. This may involve consulting with Ofcom. You will be required to confirm to Ofcom whether the AVMS Regulations apply to you by 6 May 2021.

2. RISK ASSESSMENT: Determine whether your existing compliance frameworks will be sufficient to be deemed compliant under the AVMS Regulations.

3. IDENTIFY APPROPRIATE CONTROLS: Identify technical and organisational measures that may need to be implemented to ensure compliance (including technical measures, governance frameworks and policies). This may, again, involve a consultation with Ofcom.

4.  SYNC WITH WIDER COMPLIANCE PROGRAMME: Ensure that you are compliant with other UK and international compliance guidelines and requirements relating to online content (for example, the ICO's age appropriate design code and the various UK Council for Child Internet Safety (UKCCIS) guidelines).

Karim Vellani and Will Hanway contributed to the writing of this article.