New OfCom Rules

[SeanDrownedinSound (Sean)]

Hello

The UK government are planning to change the laws of online safety and I was curious what measures Discourse are taking to address this or if there is a suggested response for anyone who is hosting in the UK?

https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/time-for-tech-firms-to-act-uk-online-safety-regulation-comes-into-force/

Our community are looking into this but it’s unclear to me if the onus is on us or Discourse, which in theory would mean every WhatsApp groupchat or Discord server would need to do this.

Thanks in advance for any help (I did check but couldn’t find a recent thread about this)

[ondrej]

From Ofcom’s website: “firms are now legally required to start taking action to tackle criminal activity on their platforms”

I think that Discourse already provides a way to tackle criminal activity by the ‘Its Illegal’ flag to alert staff of illegal activity on the site. Realistically, other than putting in measures like the illegal flag option is there much else that can be done?

[HAWK]

Yup we’re on top of it. We have been monitoring it for most of the year and are prepared.

@SeanDrownedinSound

Our community are looking into this but it’s unclear to me if the onus is on us or Discourse

It’s on both of us. We provide the tools to comply with the OSA (because we have to comply here on Meta) but you are responsible for how you use them.

The key considerations are:

Proactive Moderation: Discourse must have systems in place to identify and remove illegal or harmful content swiftly.

We have this with the illegal content flag that @ondrej posted above, which should trigger you to use the existing tools to remove the content in a compliant way and do the appropriate reporting.

Report Harmful Content: Provide mechanisms for users to report harmful or illegal content, and ensure rapid responses to such reports.

As above – the illegal flag or other custom flag types are available for you to use. We are making a change so that not logged in users can also flag illegal content. Do we have an ETA for that @tobiaseigen?

Content Takedown Procedures: Have a clear procedure for the removal of harmful content, including transparency reports showing how content is moderated.

You will need to define your internal processes yourself, but the data is all logged so you will be able to report on it when required.

Annual Transparency Reports: Platforms (i.e. Discourse customers) must submit annual transparency reports detailing how they are handling harmful content, the volume of takedowns, and actions taken to protect users.

See above.

User Empowerment: Provide users with clear information on content risks and moderation policies, including what actions are taken against violations.

This is on you to create.

Conduct Risk Assessments: Perform mandatory risk assessments to identify potential harm to users, particularly children. Update these assessments regularly.

Also on you to organise.

Respond to Violations: Have a plan in place for quickly responding to violations or incidents that may arise, ensuring proper reporting to authorities where necessary.

Also on you.

Regular Audits: Conduct internal audits to ensure continuous compliance and readiness for Ofcom inspections or enforcement actions.

And… also on you.

[SeanDrownedinSound (Sean)]

For all of the things that are on us, do you have suggested processes and copy?

[Jagster (Jakke Lehtonen)]

Out of curiosity: how is UK defining small, medium and large service providers?

[ondrej]

I’m interested too so if anyone can find it out I’d like to know too. Although I can’t find a specific definition it appears that different sized services are treated slightly differently to larger service providers. “we aren’t requiring small services with limited functionality to take the same actions as the largest corporations.” Gov.uk, para. 6

[Ed_S]

Can the forum software readily provide a list of mod actions over a year? Or perhaps mod actions filtered by, say, responding to flags? I wouldn’t want to have to keep a separate record. (Sometimes I will delete a user because of a flag - that isn’t an option when responding to a flag.)

[HAWK]

@SeanDrownedinSound

For all of the things that are on us, do you have suggested processes and copy?

No and I’m afraid it’s unlikely that we will provide those. As with GDPR we provide the tools to comply but you will need to seek your own legal advice.

[Ed_S]

@Jagster

how is UK defining small, medium and large service providers?

There’s a discussion on HN here (concerning a specific case where a person running 300 forums has decided to close them all) which contains useful information and links to official docs.

AFAICT, 700 thousand monthly active UK users is the threshold for medium. 7 million is the threshold for large.

Note that, I think, some aspects of the law are not sensitive to the size of the service, where others are.

For more, see
(Draft) Illegal content Codes of Practice for user-to-user services (ofcom link)

I think this is a case of the risk to forum owners being low-probability but high-cost. Individual judgement, and perception of risk and attitude to risk will be in play.

[Jagster (Jakke Lehtonen)]

Thanks. So, it apply only to a few, in its full power anyway.

One of my friend living in UK is partly reason why I’m curious, because she in panicking quite a lot because of this.

[HAWK]

Here are the risk assessment guidelines: https://www.ofcom.org.uk/siteassets/resources/documents/online-safety/information-for-industry/illegal-harms/risk-assessment-guidance-and-risk-profiles.pdf?v=387549

[Ed_S]

Thanks Hawk. (I see the pdf link resolves to the latest, despite looking like a link to a specific version.)

Here’s a sensible (but not authoritative) description of what the new laws might mean to self-hosted small-scale forums which don’t specifically target children or offer porn. The main point, I think, is to understand the law and document your approach. From there:

Duties

As a small user-to-user service, the OSA requires you to:

• Assess the risk of illegal content (s9)
• Take proportionate measures to mitigate the illegal content risks you identified (s10(2)(c))
• Take proportionate measures to prevent people encountering priority content (s10(2)(a))
• Take proportionate measures to mitigate the risk of people committing priority offences (s10(2)(b))
• Allow users to easily report illegal content, and content which is harmful to children, and take it down (s20)
• Allow users to complain about reports, takedowns, etc (s21)
• “Have particular regard to the importance of protecting users’ right to freedom of expression” (s22(2))

You don’t have to worry too much about these duties directly – the risk assessment process guides you through what you need to do to comply with them.