Ofcom discovers issuing Online Safety Act fines is easier than collecting them

Ofcom chiefs have acknowledged that most fines issued under the Online Safety Act (OSA) remain unpaid, highlighting limitations in the comms regulator's enforcement powers.

The regulator's director of enforcement, Suzanne Cater, told the House of Lords Communications and Digital Committee that although another payment arrived this week, "realistically the majority have not been paid." Ofcom has imposed fines totaling more than £7 million ($9.4 million) on 11 service providers under its OSA powers so far, but when asked, it refused to specify exactly how many have not paid, nor detail the payment that came in this week.

Oliver Griffiths, group director at Ofcom, said the regulator's enforcement action had primarily focused on smaller companies in the pornography industry.

Its largest fine under the OSA, for example, was the £1.4 million ($1.88 million) penalty imposed on 8579 LLC in February.

However, Ofcom plans to pursue larger companies, which Griffiths said should make difficulties collecting fines less pronounced.

"I think it looks acute at the moment," he told peers on Tuesday.

"I think over time, as we are fining the bigger companies, if they're in breach of the act, this will be less of an issue." Asked why it had not collected more of the fines, Ofcom officials pointed to the limits of its powers and the ways online platforms structure their businesses to evade enforcement.

Cater said the regulator was beginning to exercise its powers to hold senior managers personally liable in certain circumstances.

She acknowledged, however, that its business disruption powers have limits.

Ofcom cannot shut down a website globally, but it can ask a court to restrict access to one in the UK.

It first invoked that power in May, applying for an order against an unnamed suicide forum whose operator it had already fined £950,000 ($1.2 million).

Services do not escape the OSA merely by moving their operations and infrastructure overseas, as courts can order third parties such as ISPs to restrict UK access.

However, business disruption measures require continuing noncompliance with the OSA and cannot be used solely to recover an unpaid fine.

Griffiths said some services had complied after being fined but failed to pay the penalty, leaving Ofcom to pursue the debt separately – a potentially difficult process when a company has no UK assets.