The OSB’s “Spy Clause”

Hello all, and happy Thursday!  

Last week, the UK Parliament passed the Online Safety Bill, or OSB. 

You might have heard about the OSB before—businesses and privacy advocacy groups alike have raised concerns around some of the bill’s provisions. In fact, nearly 70 cybersecurity academics published an open letter regarding their concerns about the OSB back in July. 

For the most part, the OSB is intended to regulate content platforms by requiring the removal of illegal content and additional protections for children. It requires providers to: 

• Assess whether their service will be accessed by children, conduct risk assessments, and implement age verification mechanisms. 
• Ensure children do not access illegal content (e.g. terrorist material) as well as “harmful but lawful” content, that could cause physical or psychological harm to children. 
• Implement design choices and operational controls to minimize harm. 

The idea that content platforms need further regulation regarding the content that appears on them isn’t the controversial bit, however (though social media and messaging companies likely disagree); rather, it’s the OSB’s so-called “spy clause” that has everybody up in arms. 

Specifically, this clause permits British telecom regulators to force tech companies to scan all of their users for child abuse content—the issue here is that it also forces companies to scan messages and files that are end-to-end encrypted. In order to comply, businesses will need to build a backdoor into their encryption technology, providing access to ostensibly secure messaging services. 

 Nobody wants to enable the proliferation of content that could harm children, but nobody wants to sacrifice their privacy, either. Bills like this highlight a perennial question in data privacy: How do you balance safety with security and privacy?  

According to groups like the Electronic Frontiers Foundation, tech companies like Apple, and cybersecurity researchers, the OSB doesn’t quite strike the ideal balance. 

Best, 

Arlo 

Top Privacy Stories of the Week

UK-U.S. Data Bridge Becomes Law, Takes Effect 12 October 

Recently, the U.K. Secretary of State for Science, Innovation and Technology Michelle Donelan laid regulations in the U.K. Parliament, giving effect to a U.K.-U.S. Data Bridge, the UK equivalent of the EU-US Data Privacy Framework. With the Data Bridge, organizations in the U.K. will be able to transfer personal data to U.S. organizations without the need for further safeguards, such as international data transfer agreements. 

Read more 

Kenya's ODPC Issues KES9.375M in Data Protection Fines 

The Kenyan Data Protection Commissioner recently issued three penalties totaling KES 9,375,000 (~$63,000 USD) for alleged violations of the Data Protection Act. Each penalty concerns claims of nonconsensual uses of personal data. 

Read more 

UK Parliament Passes Controversial Online Safety Bill (OSB) 

The OSB—a children’s online safety bill—was recently passed by the UK parliament. Now, it only has to be given Royal Assent to be made effective, a stage which is mostly considered a formality. Controversially, the OSB allows the government to force companies to build technology that can scan messages regardless of encryption, undermining the privacy of conversations. 

Read more 

EU Data Governance Act Enters into Effect 

The Data Governance Act entered into application on 24 September 2023. The act aims to promote data sharing and trust among EU member nations through a variety of mechanisms, such as allowing data intermediaries to act as trustworthy partners in the data economy and the creation of a new “data altruism organization” category. 

Read more 

Osano Blog: What Is Quebec’s Law 25? 

On September 22nd, the majority of Law 25’s provisions went into effect. Quebec’s Law 25 provides individuals within the Canadian province with greater data privacy protections compared to Canada’s overall privacy law, PIPEDA. 

Read more 

If you’re interested in working at Osano, check out our Careers page!