Professor Lorna Woods:

Yes, we envisaged a formal legal obligation on companies falling within the remit and that it would be enforced by an independent regulator. We suggested Ofcom, the communications regulator in the UK, which has a track record for evidence-based and proportionate regulation. We envisaged that there should be sanctions for a company that did not comply but that there would be a sliding scale in order that the starting point for the regulator would be to try to engage and inform before going to enforcement. We thought that given the size of some of the companies at issue, we should look at GDPR-sized fines and we discussed whether, in the financial model, there might be personal liability for directors to get them to pay attention. The underlying model was the Health and Safety at Work etc Act. The Health and Safety Executive, which is the enforcer for that legislation, has the power to prosecute. Then the question was whether one goes further with recalcitrant operators. The problem with that is that we are still in a free speech context and that would be a very heavy sanction and would be difficult to make proportionate.