Online Safety Act super-complaints process must not overwhelm Ofcom

Ofcom already faces an increased workload under the Online Safety Act, so while super-complaints can be a powerful tool to focus regulator and industry minds on systemic harms, as we have notably seen in the retail banking sector, the process for designating who is eligible to raise such complaints needs to be honed to act as a gateway, to avoid adding significant administrative burdens that would put Ofcom’s effectiveness as online safety regulator at risk.

The Online Safety Act super-complaints consultation

Earlier this month, the government issued a consultation on a proposed approach to the super-complaint process provided for in sections 169 to 170 of the Online Safety Act. The government is seeking views from interested parties about which organisations should be able to make super-complaints, the process and format for super-complaints, and how Ofcom should respond to each complaint. The consultation will inform the regulations the Secretary of State must issue in relation to the super-complaint process.

Super-complaints are intended to draw Ofcom’s attention to new risks and systemic issues across in-scope services. They will ensure speedy scrutiny, with the full process – including a substantive response required – within 120 days. They could spur Ofcom to act, including by updating its codes of practice or investigating whether a particular service complies with the OSA.

Responses to the consultation must be submitted by 11 January 2024.

An overview of the proposals

The Online Safety Act super-complaints procedure, if implemented as proposed, would differ from the way that super-complaints are made to other regulators, such as the Competition and Markets Authority and the Financial Conduct Authority, currently.

The existing super-complaint process under the Enterprise Act 2002 permits certain consumer groups designated by the Secretary of State to bring complaints to regulatory bodies, including the Civil Aviation Authority, the Director General of Telecommunications, and the CMA, to alert the regulator that features of a market in the UK for goods or services are harming the interests of consumers.

For Online Safety Act super-complaints, the government has proposed that a range of organisations be permitted to issue super complaints, and that consideration of whether an organisation meets the criteria to issue a super-complaint will only occur after the super-complaint has been issued – it would fall to be determined during the preliminary phase of Ofcom’s review of the super-complaint.

The proposed process would permit a broad range of entities likely to include children’s charities, free speech advocates, and a range of other groups, to raise concerns about online safety and freedom of expression directly to Ofcom.

The number of entities interested in submitting super-complaints against online services could be significant. It is unclear why the government has not adopted a similar approach to that taken under other statutory regimes that provide for super-complaints, such as the Enterprise Act and Policing and Crime Act, and sought to designate a small number of entities with power to make such complaints. Those designated entities could collaborate with other organisations on super-complaints.

When could a super-complaint be made?

The Online Safety Act provides that a super-complaint may be made where the features or conduct, or combination of both, of one or more of the regulated services risks causing significant harm, significantly adversely affecting freedom of expression, or otherwise significantly adversely impacting users, the public, or a particular group. If a complaint is made in relation to a single provider of online services, it will only be admissible as a super-complaint where the complaint is of particular importance, or the complaint relates to impacts on a particularly large number of users of the service or members of the public.

The government has explained that the super-complaints proposal would let organisations such as charities and consumer groups raise new concerns as they emerge, which would alert Ofcom of systemic harmful trends and emerging threats. The features or conduct to which the super-complaint relates does not need to breach the Act’s provisions but could instead relate to features or conduct that are permitted under the Act but give rise to other risks. This may in turn lead to the expansion of obligations on services under the OSA.

An example suggested by the government would be a new social media feature used on multiple services that exposes children to harmful content. The super-complaints procedure appears designed to allow third party organisations to direct Ofcom’s resources towards issues which are having a significant effect on users. Ofcom therefore seeks to leverage the work and research of other organisations to supplement its review and enforcement powers.

The designation criteria and their effect

Section 169(4) of the Online Safety Act provides that, to be eligible to submit a super-complaint, an entity must be a body representing the interests of users of regulated services, or members of the public, or a particular group of users or members of the public. In its consultation paper, the government has proposed that the following criteria must also be met for an entity to qualify as “eligible entity” for raising super-complaints under the Act:

• The entity must demonstrate integrity and impartiality, and must not represent the interests of regulated services;
• The entity must have considerable experience and competence in representing the interests of people of any description in, or within, the UK;
• The entity must have expertise in, and experience of, issues relating to online safety covered by and in scope of the regulations;
• The entity must be willing to cooperate, and work with Ofcom throughout the super-complaints process. This includes that Ofcom will have no reason to believe that the relevant guidance it produces in relation to the handling of super-complaints will not be followed;
• The entity must have a strong track record of publishing high quality research and analysis;
• The entity must have a strong track record of working effectively and collaborating with other civil society groups.

These are fairly flexible criteria. If adopted, they could result in a situation in which a large number of organisations could potentially be permitted to issue super-complaints. It is unclear how Ofcom will assess whether organisations meet some of these standards, including how it would assess and rate the track record of the entity in terms of their research credentials or in terms of their work with other organisations. This appears to be an assessment that could be made now, to identify a small number of eligible organisations, rather than a process which needs to wait until after Ofcom’s enforcement efforts begin.

Perhaps in recognition of the potentially large number of organisations that might fall within these criteria, the government has also proposed measures to ensure that Ofcom is not overwhelmed by multiple super-complaints from eligible entities. These measures include restricting a super-complainant from having another active super-complaint under consideration by Ofcom, or from having submitted another super-complaint within the past six months – except under exceptional circumstances. The government has also said that the super-complaint should not raise substantially similar concerns to super-complaints or other investigations which Ofcom has considered in the prior two years.

Procedural requirements

The government is seeking to develop a super-complaints process which is clear, fair and effective in ensuring that systemic issues can be raised with the regulator. It has proposed the following procedural requirements to ensure that the super-complaints can be made and are dealt with in an efficient and straightforward manner:

• Complainants must pre-notify Ofcom of their intention to make a super-complaint at least 30 days before making a complaint, except in exceptional circumstances;
• Super complaints must be in writing, setting out the feature or conduct to which the complaint relates, identifying the regulated service and provider of such service to which the complaint relates, identifies where the OSA’s criteria for a super-complaint has been met, it must explain how the super-complainant has assessed the current or potential harm caused to users or members of the public., and must give the name of an individual representing the eligible entity who may be contacted about the complaint.

The government has proposed that Ofcom have 120 days to complete the super-complaints process. This is a longer period of time than the 90 days under the Enterprise Act, but is to allow for the fact Ofcom must also determine the complainant’s eligibility to raise a super-complaint.

The Online Safety Act provides for regulations to address the steps that Ofcom must take in relation to a super-complaint, including requirements for publication of responses. The government has proposed that Ofcom must publish its response to all super-complaints, although it may exclude information from the report if its inclusion would be contrary to the interests of national security, might jeopardise the safety of any person, may be commercially sensitive, or would be in conflict with other legislation or rights.

Risks to guard against

The Online Safety Act does not include a private right of action for individuals or organisations to bring claims against online services for failing to meet their duties under the Act, although it does include a right for users to bring contractual claims against services where the user considers the service has taken down or restricted the user’s content, or suspended or banned the user, in breach of the terms of service. Super-complaints will therefore be significant as they will be the predominant means by which parties other than Ofcom can scrutinise the broad activities of online service providers.

The proposals for the super-complaint procedure appear to reflect recognition by the government of the breadth of Ofcom’s remit as the new UK regulator of online safety. The government’s proposal comes after Ofcom published the first in a series of draft new codes of practice and guidance documents designed to support compliance with the Online Safety Act earlier this month – setting out that it believes more than 100,000 online services will be in-scope of regulation under the Act, in the process. This is up from the government’s original estimates of 20-25,000.

Whilst super-complaints may be helpful to Ofcom in alerting it of new systemic risks, if a high number of organisations seek to issue super-complaints it will be a substantial burden for Ofcom to manage. It may be more practical if a small number of bodies are designated as eligible to raise super-complaints under the Online Safety Act, and thought could be given to requiring those bodies to meaningfully engage with other organisations as appropriate on potential complaints.