Making the paper tiger roar?
Senior manager accountability is likely to be built into the Online Safety Bill. There’s much to welcome.
Unless he gives way to a significant backbench rebellion, in the next 48 hours Rishi Sunak is likely to face the first parliamentary defeat of his premiership.
At the time of writing, almost 50 Tory MPs are backing an amendment that would hold senior managers personally liable for breaches of the child safety duty. Where there is evidence of connivance or neglect, this would be subject to criminal sanctions.
Here’s why the next 48 hours matter.
Making the case for senior manager accountability
In early 2019, I worked with Herbert Smith Freehills to develop a detailed regulatory proposal, published for NSPCC. For the first time, this proposal called for the regulatory regime to be supported by senior manager liability, including criminal sanctions.
At the time of writing the proposal, I have to confess some uncertainty about whether criminal sanctions were the right approach. In a period when calls for statutory regulation were being readily caricatured, not least when coming from the children’s sector, I initially wondered whether this proposal was tactically wise.
However, the more we explored the building blocks of effective compliance in other regulated markets look like, it became abundantly clear that senior manager accountability was a prerequisite.
Nothing else would drive the significant culture change that’s required, nor adequately focus minds at the C-suite level.
Why is personal accountability needed?
If the Online Safety Bill is to succeed, Ofcom must have suitably broad enforcement powers and be able to hold non-compliant sites to account.
While the Government initially was open to senior manager liability, by late 2019 the then Secretary of State Oliver Dowden had been successfully lobbied by the tech industry and these proposals were quietly dropped.
In the Government’s response to its own White Paper, this decision was explained with some surprising candour – the tech industry had argued this would weaken the UK’s economic competitiveness and could make the UK a less attractive place to invest.
While the Government did commit to much steeper financial penalties than originally envisaged, the deterrence value they carry seemed questionable. The largest tech companies have tens of billions sitting in the bank as ‘cash to hand’. In this context, the impact of fines is likely to be blunted, with limited impact at best on the commercial decisions of either the management team or shareholders.
In any event, investigations and appeals can be lengthy, and by the time proceedings are concluded business models may have shifted, with fines and legal proceedings simply ‘priced in’ as a way of doing business.
Based on the experience of other regulated sectors - principally financial services - there is a compelling case for both corporate and senior manager liability. In extensive conversations with financial services providers and regulators, it became clear that it was personal accountability that drove compliance and resulted in significant cultural change in the years following the 2008 financial crash.
It seems difficult to determine that any other form of enforcement mechanism could effectively incentivise behaviour change in large companies where business models and commercial decisions might otherwise continue to put children and vulnerable users at risk.
This includes the heavily triangulated proposal to introduce senior manager liability in respect of a failure to cooperate with the regulator. As the Bill has been drafted, senior managers could be wholly negligent in their running of a social media platform, but as long as they cooperate with the regulator in any subsequent investigation, they would be immune from any personal liability for their shortcomings.
What’s been the reaction from those opposed?
As the Parliamentary rebellion has gathered momentum in the last few days, there has been a pronounced response from industry, both publicly and perhaps more interestingly behind the scenes. Senior tech figures have been quick to describe the proposals as ‘hostage laws’, that will somehow pave a way for authoritarian governments around the world to follow suit.
Frankly, this smacks of tech exceptionalism of the worst possible kind - precisely the type of tech exceptionalism that resulted in products being designed and developed by an overarching tech libertarian worldview in the first place, in which safety concerns and the need of more vulnerable users have too often languished near the bottom of the pile.
Others have argued that the proposals will inevitably result in overzealous content moderation, resulting in a chilling effect on free expression. Some tech libertarian campaigners are attempting to whip up fear that any measures would not be implemented proportionately, raising the spectre that the organiser of the village chat room could end up on the wrong side of the law.
Both these positions seemingly disregard Ofcom’s ability to introduce and oversee a proportionate, risk-based regime. Many are the same voices that have repeatedly tried to whip up fears among small and medium sized companies, falsely warning them of costly regulatory burdens that a regulator focused on proportionality would never actually insist upon.
And to revisit that old canard that introducing senior manager liability would result in companies choosing to walk away from the UK market, or choose to prioritise other countries for investment? Those tired old lobbying positions should have been retired years ago, and UK lawmakers should have the confidence to recognise that the UK is one of the largest markets for the global tech giants.
Tech exceptionalism is not an excuse not to introduce a rigorous product safety regime. While tech companies may look on with dismay, the reality is that senior manager accountability is already a standard feature of UK regulation and criminal law - with senior managers personally accountable for systemic failures that result in significant harm to users.
The introduction of senior manager liability is neither a regulatory nor legal first - it is the logical extension of regulatory best practice and UK jurisprudence.
What should happen next?
It seems almost inevitable that the Government will have to concede, in order to see off a potential defeat on Tuesday night, with backbench rebels making clear that criminal accountability is a red line for them.
If this results in the Government committing to bring forward its own amendment in the Lords, this will be a significant breakthrough - but it also provides an opportunity to address the reasonable concerns expressed by supporters of strong online safety legislation, including the former Secretary of State Jeremy Wright, who has concerns about how the rebel amendment has been drafted.
Personally, I’d like to see the Government accept the principle of senior manager accountability backed up by criminal sanctions, but with provisions closer to the model originally proposed by the pre-legislative scrutiny committee – whereby online services would have to appoint a designated Safety Controller with responsibility for ensuring that the safety duties are met.
It will also be important that the Senior Manager Regime is extended to cover the illegal content safety duty, not only the child safety provisions covering harmful content set out in section 11 (as the rebel amendment currently proposes.)
While the rebel amendment will provide much needed senior manager liability for protecting children from harmful content, perhaps counterintuitively it wouldn’t extend to cover the systemic duty to address the distribution or dissemination of child sexual abuse material or grooming (covered in section 9.) If the Government agrees to fold, it should logically extend the Senior Manager regime to address the most egregious of criminal activity – child abuse material and terrorist content.
The result will be a well-designed systemic approach, in which senior managers are held liable for systemic safety processes rather than the direct regulation of speech, and which enables the UK Government to more convincingly dust off its ambition for the Online Safety Bill to be world-leading.