Data (Use and Access) Act 2025

124 Retention of information by providers of internet services in connection with death of child U.K.

(1) The Online Safety Act 2023 is amended as follows.

(2) In section 100 (power to require information)—

(a) omit subsection (7);

(b) after subsection (8) insert—

“(8A) The power to give a notice conferred by subsection (1) does not include power to require processing of personal data that would contravene the data protection legislation (but in determining whether processing of personal data would do so, the duty imposed by the notice is to be taken into account).”

(3) In section 101 (information in connection with investigation into death of child)—

(a) before subsection (1) insert—

“(A1) Subsection (C1) applies if a senior coroner (in England and Wales), a procurator fiscal (in Scotland) or a coroner (in Northern Ireland) (“the investigating authority”)—

(a) notifies OFCOM that they are conducting an investigation in connection with the death of a child, and

(b) provides OFCOM with the details in subsection (B1).

(B1) The details are—

(a) the name of the child who has died,

(b) the child’s date of birth,

(c) any email addresses used by the child (so far as the investigating authority knows), and

(d) if any regulated service has been brought to the attention of the investigating authority as being of interest in connection with the child’s death, the name of the service.

(C1) Where this subsection applies, OFCOM—

(a) must give a notice to the provider of a service within subsection (E1) requiring the provider to ensure the retention of information relating to the use of the service by the child who has died, and

(b) may give a notice to any other relevant person requiring the person to ensure the retention of information relating to the use of a service within subsection (E1) by that child.

(D1) The references in subsection (C1) to ensuring the retention of information relating to the child’s use of a service include taking all reasonable steps, without delay, to prevent the deletion of such information by the routine operation of systems or processes.

(E1) A service is within this subsection if it is—

(a) a regulated service of a kind described in regulations made by the Secretary of State, or

(b) a regulated service notified to OFCOM by the investigating authority as described in subsection (B1)(d).

(F1) A notice under subsection (C1) may require information described in that subsection to be retained only if it is information—

(a) of a kind which OFCOM have power to require under a notice under subsection (1) (see, in particular, subsection (2)(a) to (d)), or

(b) which a person might need to retain to enable the person to provide information in response to a notice under subsection (1) (if such a notice were given).

(G1) OFCOM must share with the investigating authority any information they receive in response to requirements mentioned in section 102(5A)(d) that are included in a notice under subsection (C1).”;

(b) in subsection (3), for “power conferred by subsection (1) includes” substitute “powers conferred by this section include”;

(c) after subsection (5) insert—

“(5A) The powers to give a notice conferred by this section do not include power to require processing of personal data that would contravene the data protection legislation (but in determining whether processing of personal data would do so, the duty imposed by the notice is to be taken into account).”

(4) In section 102 (information notices)—

(a) in subsection (1), for “101(1)” substitute “101(C1) or (1)”;

(b) in subsection (3)—

(i) after “information notice” insert “under section 100(1) or 101(1)”;

(ii) omit the “and” at the end of paragraph (c);

(iii) after paragraph (c) insert—

“(ca) specify when the information must be provided (which may be on or by a specified date, within a specified period, or at specified intervals), and”;

(c) omit subsection (4);

(d) after subsection (5) insert—

“(5A) An information notice under section 101(C1) must—

(a) specify or describe the information to be retained,

(b) specify why OFCOM require the information to be retained,

(c) require the information to be retained for the period of one year beginning with the date of the notice,

(d) require the person to whom the notice is given—

(i) if the child to whom the notice relates used the service in question, to notify OFCOM by a specified date of steps taken to ensure the retention of information;

(ii) if the child did not use the service, or the person does not hold any information of the kind required, to notify OFCOM of that fact by a specified date, and

(e) contain information about the consequences of not complying with the notice.

(5B) If OFCOM give an information notice to a person under section 101(C1), they may, in response to information received from the investigating authority, extend the period for which the person is required to retain information by a maximum period of six months.

(5C) The power conferred by subsection (5B) is exercisable—

(a) by giving the person a notice varying the notice under section 101(C1) and stating the further period for which information must be retained and the reason for the extension;

(b) any number of times.”;

(e) after subsection (9) insert—

“(9A) OFCOM must cancel an information notice under section 101(C1) by notice to the person to whom it was given if advised by the investigating authority that the information in question no longer needs to be retained.”;

(f) in subsection (10), after the definition of “information” insert—

• ““the investigating authority” has the same meaning as in section 101;”.

(5) In section 109 (offences in connection with information notices)—

(a) in subsection (2)(b), for “all reasonable steps” substitute “all of the steps that it was reasonable, and reasonably practicable, to take”;

(b) after subsection (6) insert—

“(6A) A person who is given an information notice under section 101(C1) commits an offence if—

(a) the person deletes or alters, or causes or permits the deletion or alteration of, any information required by the notice to be retained, and

(b) the person’s intention was to prevent the information being available, or (as the case may be) to prevent it being available in unaltered form, for the purposes of any official investigation into the death of the child to whom the notice relates.

(6B) For the purposes of subsection (6A) information has been deleted if it is irrecoverable (however that occurred).”

(6) In section 110 (senior managers’ liability: information offences)—

(a) after subsection (6) insert—

“(6A) An individual named as a senior manager of an entity commits an offence if—

(a) the entity commits an offence under section 109(6A) (deletion etc of information), and

(b) the individual has failed to take all reasonable steps to prevent that offence being committed.”;

(b) in subsection (7), for “or (6)” substitute “, (6) or (6A)”.

(7) In section 113 (penalties for information offences), in subsection (2)—

(a) for “(4) or (5)” substitute “(4), (5) or (6A)”;

(b) for “(5) or (6)” substitute “(5), (6) or (6A)”.

(8) In section 114 (co-operation and disclosure of information: overseas regulators), in subsection (7), omit the definition of “the data protection legislation”.

(9) In section 225 (Parliamentary procedure for regulations), in subsection (10), after paragraph (c) insert—

“(ca) regulations under section 101(E1)(a),”.

(10) In section 236(1) (interpretation)—

(a) after the definition of “country” insert—

• ““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3(9) of that Act);”;

(b) in the definition of “information notice”, for “101(1)” substitute “101(C1) or (1)”.

(11) In section 237 (index of defined terms), after the entry for “CSEA content” insert—

“the data protection legislation

section 236”.

Commencement Information

I1 S. 124 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)