Online Safety Act 2023: Part 10

Critically assess the impact of the communications offences introduced under Part 10 (sections 179-191) of the Online Safety Act 2023

King Henry VIII would probably have enjoyed internet dating. In 15^th century England, royal marriages were brokered through lengthy diplomatic negotiations considering political ties, potential foreign aid as well as the dowry that a woman might bring into marital property.[1] Generally communication during courtship or betrothal was often limited or non-existent due to geographical and time constraints.[2]  In most cases, prospective spouses never even seen each other prior to betrothal- Henry took the pre-caution of commission portraits of potential brides during negotiations.[3] Nevertheless, the marriage process was lengthy, difficult and- in Henry’s case- often disappointing. In contrasts, today in the UK, computers and internet are present in nearly every home. [4]  Social media facilitates connection between people near and far, the exchange of photos, messages and more all with a swipe- no portrait commissioning, carrier pigeons or beheadings required.  Instant communication is now more accessible than clean water or electricity. [5]

The Online Safety Act 2023 consolidated and modernised existing communications offences such as false or threatening communications intended to cause harm or distress. For example, under the Malicious Communications Act 1988 it had been an offence to send electronic communications to another which were threatening or false (known or believed to be false) with the intention to cause ‘distress or anxiety’.[1] Under MCA 1988 S1, offending communications had to be sent “to another” relying on receipt of the offending message. However, social media users are able to post threatening or knowingly false messages on web pages accessible to the public without “sending” it to a person. These offences could not be easily dealt with as these were not sent to “another person” they were simply posted.[2] This lack of clarity was highlighted by the cases such as Rex v BLC, where it was initially found that an online post was not sufficient to satisfy the test of ‘sending to another’ only for this decision was overturned on appeal.[3]

The harm of false and threatening communications could be also further inflamed by co-ordinated campaigns with many other users to target individuals with both ‘trolling’ and ‘cybermobbing’ common on many online platforms.[4] In 2018, the ‘sender’ could not be identified in over 20% of malicious communications offences.[5] These issues prevalent in online communications and the inadequacy of existing legislation was brought to the surface during the COVID-19 pandemic.[6]  In the face of the closure of many workplaces and ‘third spaces’ people naturally gravitated to spending more time online leading to a surge of false and threatening online communications both aimed at  various public figures and swapped between private individuals. False and threatening online aimed at women and those from a minority demographic surged disproportionately.[7] In R v McGregor, during lockdowna woman falsely claimed to be pregnant then falsely claimed to give birth to baby with ill-health whilst knowingly sending her former partner a pro-longed campaign of false information through instant messaging with the intention to cause distress and anxiety.[8] This trend in rising malicious communications catalysed the need to address the lack of clarity under MCA 1988.

Convictions for sending threatening communications under MCA 1988 S11(ii) were rare- it’s been highlighted this could be due to a tendency to convict under S1(1)I of “grossly offensive”.[9] On the other hand, prosecutions for “false claims” were more popular with 2623 prosecutions brought in 2017.[10] The lack of clarity around application of the language in MCA 1988 contributed to the risk of time-consuming and costly prosecutions and subsequent appeals.  The Online Safety Act 2023 expanded on the offence of sending false or threatening messages[11] most significantly by stepping away from the MCA 1988 of requiring the offending message to be ‘received’. Now, the offence is complete upon ‘sending’ rather than ‘receipt’ of the message which both assists with offences ‘posted’ on social media and attempts to send offending messages which are intended to be posted or delivered but fail due to technical errors or platform restrictions. OSA 2023 also addressed the issue of “under-criminalised” sentencing particularly for threatening communications by increasing sentences from a maximum of 2 years and/or a fine to up to 5 years and/or a fine. [12] Sentences for false information carry a lesser sentence of 6 month and/or a fine.[13]

Another area OSA 2023 modernised was the sharing of intimate images without consent or ‘revenge porn’ which had become increasingly prevalent.[14] In 2015 new legislation attempted to address sharing or the threat of sharing ‘sexual photographs’:[15] However, the pursuer was required to establish the mens rea of intent to cause distress which could be challenging where defenders claimed the intent was only ‘for fun’ or that the victim had consented. Existing legislation also failed to deal with the threat of disclosing intimate images.[16] OSA 2023 makes it an offence to make intimate photographs or film available to other persons[17] without the requirement to prove the intent to cause distress. However, there is criticism that it does not go far enough to address key issues such sharing altered images using ‘photoshopping’ or ‘deepfakes’- this missed opportunity was later taken in the introduction of Data (Use and Access) Act 2025 S138 which made it an offence to create or request “  creation of, purported intimate image of adult”.

The Online Safety Act 2023 Part 10 also introduced specific offences including:

Under MCA 1988 S1(1)b it was an offence for a person to send electronic communications to another person which are gross or indecent in nature with the intention to cause distress or anxiety. However, this was consideredd insufficient to addres the issue of ‘cyber-flashing’ where one individual shares unsolicited images or videos of their genitals. OSA 2023 created the specific offence of send photographs or film of genitals with the intention to cause alarm, distress or humiliation. [18] The first conviction of this new offence occurred merely weeks later after an individual was prosecuted for ‘cyber-flashing’ a child and adult.   A sentence of 52 weeks imprisonment was applied for the cyberflashing offences.[19] This sentence was delivered only four days after the offence itself took place which received praise for an uncharacteristically swift sentence- it should be noted that without the specific offence under OSA 2023, this process may have been less swift.[20] Since introduction the offence has also been reclassified as a priority offence.[21]

Other offences were introduced to address harmful online conduct such as ‘epilepsy trolling’ and the encouragement of self-harm. Epilepsy trolling was recognised after an eight-year old called Zach began fund-raising for the Epilepsy Society through Twitter their feed was flooded with images and flashing GIFs intended to trigger epilepsy- which some viewers did experience.[22] Another troubling behaviour which emerged in recent years which was individuals, often vulnerable, being encouraged to self-harm. Neither of these offences were adequately addressed by by existing legislation. Under OSA 2023, the offence of intentionally ‘encouraging or assisting serious self-harm’[23] was introduced S184 with ‘epilepsy trolling’ addressed in S183.

Impact & Next Steps

Historical legal protections have existed aimed at protecting the public from harmful communications. However, these laws were weighed against the qualified right to freedom of expression[1] and the balance was skewed with harmful communications generally under- criminalised with the same laws over-criminalising other generally harmless conduct.[2] In the ever-evolving online environment, offences were being carried out with new methods, devices and means. Existing legislation had been written using language with outdated communication types in mind which could ill-fitting to harmful online communications particularly social media posts.  At introduction, OSA 2003 was described as “heralding a new era for internet safety”[3] In modernising existing offences such as false and threatening communications improvement has been incremental.[4] Whilst increased sentencing powers are more suitable their use has been limited, in part, due to overlap in offences and powers with well-established legislation.[5] However, the value of reform in requirement to for messages be ‘sent’ rather than ‘received’ should not be overlooked as it is more suited to address modern trends of malicious communications in the online environment; as a conduct offence rather than a harm offence it is also more likely to easily facilitate conviction. The most significant contribution of the offences introduced under the Online Safety Act Part 10 can be found in the criminalisation of harmful conduct popularised by the connectivity of the internet and social media such as ‘epilepsy trolling’ and ‘cyber-flashing’. As the online environment expands and new risks materialise it is likely that the Online Safety Act will also expand to capture new variations of harmful conduct which will inevitably materialise in this space.