Criminal offences in the Online Safety Act 2023

The Online Safety Act 2023 (the Act) has the potential to dramatically change the online safety landscape in the UK, although it remains to be seen how the legislation fares in delivering the government’s manifesto commitment “to make the UK the safest place in the world to be online while defending free expression”.

While the Act places significant regulatory duties and obligation on companies within its scope, details of which are set out in our recent blog ‘Is your online business caught by the Online Safety Act?’, it also introduces a number of important new criminal offences. Due to their nature, some of these offences (for example, the sexual offences at section 187 and 188) would most likely be committed by individuals, while others could equally be committed by corporates. It is clear that the Act places a significant and broad increased compliance burden on companies, as well as on their directors and officers who may also be criminally liable where certain offences are committed with their consent, connivance or neglect.

Section 179: False communications

A person (including a corporate) commits this offence if they send a message conveying information they know to be false with the intention of causing non-trivial, emotional, psychological or physical harm.

This offence is not completely new. Similar offences were contained in s127(2)(a) and (b) of the Communications Act 2003 making it an offence to send, or cause to be sent, a message which the individual knows to be false and the purpose of sending such message is to cause annoyance, inconvenience or anxiety to another. Similar provision also exists in s1(1)(i)(a)(iii) of the Malicious Communications Act 1988, making it an offence to send information which is false and which is known or believed to be false by the sender. The three offences outlined above have now been repealed (by virtue of s189(1) and (2) of the Act).

The new false communications offence follows a similar pattern to the ones which have been repealed; it requires the sender to have knowledge that the information conveyed is false and to be aware that sending the message is likely to inflict harm. The effects of the sending of false communications are drafted more narrowly than in the Communications Act 2003 – causing mere inconvenience is no longer a sufficient threshold for the offence to be made out.

For the offence to be made out, the following elements must be proven:

1. the person sends or causes to be sent a message (this includes by electronic means or by letter or ‘a thing of any other description’; sending includes transmission, publishing, or giving);
2. the message conveys information that the person knows to be false;
3. at the time of sending it, the person intended the message, or the information in it, to cause non-trivial psychological or physical harm to a likely audience; and
4. the person has no reasonable excuse for sending the message.

For the purposes of this section of the Act, an individual is ‘a likely audience’ of a message if, at the time the message is sent, it is reasonably foreseeable that such an individual:

1. would encounter (read, view, hear or otherwise experience) the message, or
2. in the online context, would encounter a subsequent message which is forwarding or sharing the content of the message.

Time limits for proceedings

Proceedings for this offence may be brought within the period of six months beginning with the date on which evidence is deemed sufficient by the Prosecutor to justify the proceedings, but not more than three years after the commission of the offence (s179(7)-(8)).

Exemptions

Pursuant to s180 of the Act, some entities are exempt from committing a false communications offence. These are:

1. a recognised news publisher;
2. the holder of a licence under the Broadcasting Act 1990 and 1996 in connection with anything done under the authority of the licence;
3. the holder of a multiplex licence in connection with anything done under the authority of the licence;
4. the provider of an on-demand programme service in connection with anything done in the course of providing such a service;
5. anyone in connection with the showing of a film made for cinema to members of the public.

Sentencing

This is a summary only offence (triable only in a magistrates’ court) and s179(5) provides that a person convicted of a false communications offence in England and Wales is liable to receive a fine and/or a maximum term of imprisonment up to 51 weeks (depending on when the offence was committed).

 

Section 181: Threatening communications

This section of the Act introduces a threatening communications offence, where messages are sent or posted to convey a threat of death or serious harm. For the purposes of the Act, serious harm means:

1. serious injury amounting to grievous bodily harm within the meaning of the Offences Against the Person Act 1861;
2. rape;
3. assault by penetration within the meaning of s2 of the Sexual Offences Act 2003, or
4. serious financial loss.

This offence is aimed at capturing criminal behaviour that would fall short of one covered by the offence contained in s127(1) of the Communications Act 2003, namely sending or causing to be sent a communication that is either grossly offensive, or of an indecent, obscene or menacing character (taken to mean creating a sense of apprehension or fear: see Chambers v DPP [2012] EWHC 2157). However, s127(1) of the Communications Act 2003 will not be repealed and neither will be s1(1)(a)(i) of the Malicious Communications Act 1988 (the offence of sending a message that is indecent or grossly offensive); instead, minor revisions will be made to the existing statutes to avoid an overlap with the new law (as earlier proposed by the Law Commission). The Act does, however, repeal s1(1)(a)(ii) of the Malicious Communications Act (sending a message which conveys a threat).

The government’s website outlines some of the rationale behind this legislative addition, stating: “It will offer better protection for public figures such as MPs, celebrities or footballers who receive extremely harmful messages threatening their safety. It will address coercive and controlling online behaviour and stalking, including, in the context of domestic abuse, threats related to a partner’s finances or threats concerning physical harm.”

For the offence to be made out, the following elements need to be proven:

1. the person sends a message;
2. the message conveys a threat of death or serious harm; and
3. at the time of sending it, the person:
   1. intended an individual encountering the message to fear that the threat would be carried out; or
   2. was reckless as to whether an individual encountering the message would fear that the threat would be carried out.

In proceedings for an offence under this section relating to a threat of serious financial loss, it is a defence (under s181(3)) if it can be shown that:

1. the threat was used to reinforce a reasonable demand, and
2. the person reasonably believed that the use of the threat was a proper means of reinforcing the demand.

Sentencing

This is an either way offence which means it can be tried in a magistrates’ court or Crown Court. In the Crown Court, the maximum penalty is a fine and/or a term of imprisonment of up to five years.

 

Section 183: Sending or showing flashing images electronically

This section introduces new offences of sending communications that include flashing images that induce harm to persons with epilepsy. The offences were introduced following the Law Commission’s recommendation relating to the severity of psychological harm caused by epilepsy trolling.

For the offence to be made out, the following elements of the offence must be proven:

1. a person (A) sends a communication by electronic means which consists of or includes flashing images;
2. either condition 1 or 2 is met (see table below); and
3. (A) has no reasonable excuse for sending the communication.

Condition 1	Condition 2
At the time the communication was sent, it was reasonably foreseeable that an individual with epilepsy would be among the individuals who would view it, and (A) sends the communication with the intention that such an individual will suffer harm (a seizure or alarm/distress) as a result of viewing the flashing images.	(A) knows or suspects that an individual (B) to suffer with epilepsy will or might view it. (A) intends B will suffer harm as a result of viewing the flashing images.

A person also commits an offence if (without reasonable excuse) they show an individual flashing images by means of an electronic communications device and they know or suspect that person is an individual with epilepsy with the intention of causing that person to suffer harm as a result of viewing them (s183 (8)).

Exemptions

Offences under ss183(1) and (8) cannot be committed by a healthcare professional acting in that capacity.

Additionally, the same exemptions contained in s180 (referred to above) apply to offences under s183(1).

Sentencing

This is an either way offence. In the Crown Court, the maximum penalty is a fine and/or a term of imprisonment of up to five years.

 

S184: Encouraging or assisting serious self-harm

Again, this new offence has been included in the Act following the implementation of the Law Commission’s recommendations. The offence is in some ways parallel to the offence of encouraging or assisting suicide in the Suicide Act 1961, but legislating for acts that encourage harm amounting to grievous bodily harm (regardless of whether or not the harm in fact resulted).

S184(1) provides that a person (D) commits an offence if:

1. D does a relevant act capable of encouraging or assisting the serious self-harm of another person, and
2. D’s act was intended to encourage or assist the serious self-harm of another person.

The “another person” referred to above need not be a specific person (or class of persons) known or even identified by D.

A “relevant act” can be carried out, namely if D:

1. communicates in person
2. sends, transmits or publishes communications by electronic means,
3. shows a person such communication,
4. publishes material by any means other than electronic means,
5. sends, gives, shows or makes available to a person—
   1. material published as mentioned in paragraph (d), or
   2. any form of correspondence, or
6. sends, gives or makes available to a person an item on which data is stored electronically.

If D arranges for another person (D2) to do a ‘relevant act’ then D is to be treated as if they themselves did it.

Serious self-harm means harm amounting to grievous bodily harm within the meaning of the Offences Against the Person Act 1861 and includes successive acts of self-harm which cumulatively reach that threshold (s184)(3)(a)).

Exemptions

S184(10) notes that a provider of an internet service by means of which the communication in S184 is sent, transmitted or published is not to be regarded as a person who sends, transmits or published it.

Sentencing

This is an either way offence. In the Crown Court, the maximum penalty is a fine and/or a term of imprisonment of up to five years.

 

Extraterritorial application of ss 179, 181, 183 and 184

It is worth noting that ss 179(1), 181(1) and 183(1) can apply to acts done outside of the United Kingdom, but only if the person doing the act is an individual habitually resident in England and Wales or Northern Ireland, or a body incorporated or constituted under the law of England and Wales or Northern Ireland (see s185(1) and (2)). Section 184(1) also applies extraterritorially but only if the person doing the act is an individual habitually resident in the United Kingdom, or a body incorporated or constituted under the law of any part of the United Kingdom.

Neither the Act nor its Explanatory Notes clarify what counts as habitual residence or provide any further information on the practicalities of the Act’s extraterritorial application in relation to criminal offences. From the reading of the Act, it appears that there are no geographic or nationality limitations as to who can be considered a victim of such criminal conduct, for example, if a person habitually resident in England but on holiday in Spain sends a message to another person threatening to kill them (and intends that they fear the threat is carried out), their conduct is likely going to be caught by provisions of s181 of the Act, regardless of where the recipient of the threat is based and what their nationality is.

 

Liability of corporate officers

Section 186 considers the liability of corporate officers, which came as a result of amendments we wrote about in early 2023.   

If an offence under ss 179, 181, 183 or 184 is committed by a body corporate and it is proved that the offence has been committed with the consent or connivance of an officer of the body corporate, or is attributable to any neglect on the part of an officer of the body corporate, the officer (as well as the body corporate) commits the offence and is liable to be proceeded against and punished accordingly.

For the purposes of this section of the Act, ‘officer’ in relation to body corporate means a director, manager, associate, secretary or other similar officer, or a person purporting to act in any such capacity.

 

Amendment to the Sexual Offences Act 2003

The Act also creates two new offences to be inserted into the Sexual Offences Act 2003 (SOA). These supplement existing offences and seek to close loopholes in the SOA in order to keep up with the ongoing digital transformation of society.

Sending photographs or films of genitals (“cyber-flashing”)

S187 of the Act inserts a new section 66A to the SOA to provide legislative provision for the sending of unsolicited sexual images.

The “cyber-flashing” offence is made out when a person (A) intentionally sends or gives a photograph or film of any person’s genitals to another person (B) and

1. (A) intends that (B) will see the genitals and be caused alarm, distress or humiliation; or
2. (A) sends or gives such a photograph or film for the purpose of obtaining sexual gratification and is reckless as to whether (B) will be caused alarm, distress or humiliation.

References to sending or giving such a photograph or film to another person include sending it to another person by any means, electronically or otherwise; showing it to another person; and placing it for a particular person to find.

Sentencing

This is an either way offence. In the Crown Court, the maximum penalty is a fine and/or a term of imprisonment of up to two years.

 

Sharing or threatening to share intimate photographs or films

S188 of the Act inserts a new section 66B into the SOA to provide legislative provision for the sharing of intimate photographs or films.

The offence can be committed in four distinct ways and each comes with separate sentencing guidelines and defences.

1. an offence is made out when a person (A) intentionally:

1. shares a photograph or film which shows, or appears to show, another person (B) in an intimate state,
2. (B) does not consent to the sharing of the photograph or film, and
3. (A) does not reasonably believe that B consents (s66B(1) SOA).

It is a defence to prove that the person had a reasonable excuse for sharing the photograph or film.

This is a summary only offence carrying a sentence of up to 51 weeks.

2. an offence is made out when a person (A) intentionally:

1. shares a photograph or film which shows, or appears to show, another person (B) in an intimate state,
2. (A) does so with the intention of causing B alarm, distress or humiliation, and
3. (B) does not consent to the sharing of the photograph or film (s66B(2) SOA).

This is an either way offence. In the Crown Court, the maximum penalty is a fine and/or a term of imprisonment of up to two years.

3. an offence is made out when a person (A) intentionally:

1. shares a photograph or film which shows, or appears to show, another person (B) in an intimate state,
2. (A) does so for the purpose of (A) or another person obtaining sexual gratification,
3. (B) does not consent to the sharing of the photograph or film, and
4. (A) does not reasonably believe that B consents (s66B(3) SOA).

This is an either way offence. In the Crown Court, the maximum penalty is a fine and/or a term of imprisonment of up to five years.

S66B(12) notes that if on the trial of a person charged with offences under subsection (2) or (3) above and a magistrates’ court or jury finds the person not guilty it may then find the person guilty of an offence under subsection (1).

4. an offence is made out when a person (A) intentionally:

1. shares a photograph or film which shows, or appears to show, another person (B) in an intimate state,
2. (A) does so
   1. with the intention that (B) or another person who knows (B) will fear that the threat will be carried out, or
   2. being reckless as to whether (B) or another person who knows (B) will fear that the threat will be carried out (s66B(4) SOA).

When a person is charged with this offence, it is not necessary for the prosecution to prove that the photograph or film mentioned in the threat exists, or, if it does exist that it is in fact a photograph or film which shows or appears to show a person in an intimate state (s189(7)).

This is an either way offence. In the Crown Court, the maximum penalty is a fine and/or a term of imprisonment of up to five years.

Exemptions

S66C provides for several distinct exemptions to the above offences:

A person (A) who shares a photograph or film which shows, or appears to show, another person (B) in an intimate state does not commit an offence under section 66B(1), (2) or (3) if—

(1)        (a) the photograph or film was taken in a place to which the public or a section of the public had or were permitted to have access (whether on payment or otherwise),

(b) (B) had no reasonable expectation of privacy from the photograph or film being taken (this is determined by reference to the circumstances that the person sharing the film or photo reasonably believes to have existed at the time it was taken), and

(c) (B) was, or (A) reasonably believes that (B) was, in the intimate state voluntarily.

(2)         (a) the photograph or film had, or (A) reasonably believes that the photograph or film had, been previously publicly shared, and

(b) B had, or (A) reasonably believes that B had, consented to the previous sharing.

(3)     (a) (B) is a person under 16,

(b) (B) lacks, or (A) reasonably believes that B lacks, capacity to consent to the sharing of the photograph or film, and

(c) the photograph or film is shared—

(i) with a healthcare professional acting in that capacity, or

(ii) otherwise in connection with the care or treatment of (B) by a healthcare professional.

(4) A person who shares a photograph or film which shows, or appears to show, a child in an intimate state does not commit an offence under section 66B(1) if the photograph or film is of a kind ordinarily shared between family and friends.

(5) A person who threatens to share a photograph or film which shows, or appears to show, another person in an intimate state does not commit an offence under section 66B(4) if, by reason of this section, the person would not commit an offence under section 66B(1), (2) or (3) by sharing the photograph or film in the circumstances conveyed by the threat.

 

Conclusion

The Act is a complex piece of ambitious legislation with criminal offences forming only a small, but important, part. The government’s intention in relation to these new offences is clear, namely that “it will be easier to convict someone who shares intimate images without consent and new laws will further criminalise the non-consensual sharing of intimate deepfakes. The change in laws will make it easier to charge abusers who share intimate images and put more offenders behind bars and better protect the public.”

The clear message is that those corporates within the scope of the Act need compliance programmes in place to ensure the online safety of children and other internet users. If they do not, there is a real risk of investigation, fines and reputational damage.

The Act also means that enforcement agencies will be able to act swiftly in relation to those offences as soon as the law comes into force, rather than wait for secondary legislation to be drafted and pass through its own Parliamentary journey.  

Further Information

Should you have any questions about any of the issues covered in this blog, please contact Úna Campbell, Nicola Finnerty, Phil Taylor or another member of our Criminal Law team.

About the authors

Nicola Finnerty is a Partner in our Criminal Litigation team and a leading expert in white collar and business crime, proceeds of crime & asset forfeiture. Over the last 25 years she has been involved in many of the most high-profile, complex criminal and regulatory investigations and prosecutions, both in the UK and in matters which span multiple jurisdictions.

Úna Campbell is a legal apprentice in the Criminal Litigation team at Kingsley Napley. Úna’s is currently in her fourth year at the University of Law, London, where she is working towards a Level 7 Solicitor Apprenticeship. Her apprenticeship at Kingsley Napley has enabled her to work across a range of disciplines and she is now greatly enjoying her work within the criminal litigation practice.