Ms Anna Morgan:

The DPC thanks the committee for the invitation to discuss our written submission on the general scheme of the online safety and media regulation Bill. While the Bill covers a number of areas, including broadcast media and on-demand audiovisual media services, the DPC's submission focuses primarily on Part 4, online safety, and the specific areas in which there may be potential synergies with the work of the DPC.

While the DPC is primarily concerned with its own area of regulation, namely, data protection, it recognises that the regulation of online safety issues, including harmful content, and data protection will naturally complement and be mutually supportive of each other. The issue of children's data protection rights is a key priority for the DPC and an area in which we are working to raise standards of protection substantially. As such, we are pleased to have this opportunity to bring a data protection perspective to this broader discussion on harmful content and online safety. Although harmful content and online safety issues are outside the remit of data protection law, the DPC considers that these objectives are two sides of the same coin.

Digital technology is an intrinsic part of everyday life for each and every one of us and provides significant opportunities, but the online world also presents new risk scenarios for children and adults alike, many of which areas are not yet subject to oversight or regulation by an appropriate body. Therefore, the DPC strongly welcomes the Government's decision to introduce separate legislation to regulate the area of harmful content, among other issues, and establish a dedicated, independent media commission, including a constituent member who will act as the online safety commissioner, to enforce the law.

As stated in our submission, the DPC notes that the Bill in its current form expressly excludes material that violates data protection or privacy law from falling within the scope of harmful content. However, the DPC believes it is important that the media commission have the power to regulate all types of harmful online content irrespective of whether they involve personal data. This is because there are clear limitations to the reach of data protection regulation, meaning it does not and cannot provide a comprehensive regime for tackling harmful content posted or shared in an online context.

In recent years, the DPC has experienced an increase in the number of complaints received relating to user-generated content that is considered offensive, harmful, defamatory or detrimental to the health, safety or well-being of one or more individuals. In the absence of an existing statutory framework to regulate such issues and handle complaints in this area, the DPC finds itself having to deal with complaints relating to requests for the takedown of user-generated content despite the fact that the data protection regime is not intended to tackle such matters and does not provide an appropriate range of tools for dealing with them. Issues around user-generated content also commonly overlap with the areas of content moderation and online safety, but the general data protection regulation, GDPR, and the Data Protection Act 2018, which gives further effect to the GDPR, do not aim to regulate content. Therefore, that legislation does not provide the tools nor the powers required to tackle such issues, including the power to issue immediate takedown notices on the basis of content alone.

Subject to limited exceptions, data protection law is generally not intended to regulate online interactions between individuals on a personal one-to-one basis, in other words, where there is no relationship between a data subject and a data controller. As set out in further detail in the DPC's submission to the committee, there are a number of criteria that need to be met before data protection law is engaged in the context of a complaint. For example, the content in question must contain personal data and the complaint must be raised by or on behalf of the data subject whose personal data are concerned. However, even in cases where the content in question contains personal data and a complaint is submitted by or on behalf of the data subject, it is not always immediately apparent at the outset whether there has been an infringement of the GDPR. The DPC must therefore embark on a course of action to handle and examine the complaint against the various obligations of data controllers under the GDPR.

It is important to highlight that the DPC cannot simply order the erasure or removal of personal data based on a unilateral assessment of online content. This is because data protection law is not so much concerned with the nature of the content as it is with examining whether the rules in the GDPR and the 2018 Act have been complied with in the use of those personal data. As such, the establishment of a dedicated body with the power to order, among other things, the swift takedown of all types of harmful content is imperative in this regard.

It is for these reasons that data protection regulation, which performs a substantially different policy function, is not the appropriate prism through which to tackle situations where the primary objective of a complainant is to ensure the immediate takedown of content due to its potential to cause real harm, whether physical, psychological or otherwise. On the other hand, the Bill clearly and unequivocally aims to establish the jurisdiction of a new media commission for the purpose of regulating such matters, among others.

It is against this backdrop that the DPC respectfully suggests that the committee give consideration to the potential risks to the public interest of a regulatory lacuna arising following the Bill's enactment. This potentially arises in circumstances where, as contemplated by the Bill, complaints about harmful content may be excluded from the remit of the media commission simply because the harmful online content in question also involves, at some level, the use of an individual's personal data.

We would be happy to discuss the finer points of the DPC's submission in detail and we welcome whatever questions the committee may have.