Bronwen Morgan

Dear Clare Everett, Thank you for your letter and the accompanying Regulation 28 report following the investigation into the death of Bronwen Grace Morgan. I note that the report has also been sent to The Rt Hon Lucy Frazer KC MP, Secretary of State for Digital, Culture, Media and Sport and Ofcom. I am aware of this tragic case and my thoughts are with Bronwen’s family and friends during this incredibly difficult time. I am committed to ensuring that our services continue to learn from tragedies like this to ensure safe, compassionate and person-centred care. As you may be aware, the Welsh Government gave legislative consent for the UK Government to introduce provisions within the Online Safety Act which makes it a criminal offence to encourage or assist serious self-harm via online communications. The Act confers new powers on the Office of Communications (OFCOM) enabling them to act as the online safety regulator and is a positive step forward in strengthening our ability to limit access to harmful online content which promotes, encourages and/or assists in serious self-harm. The UK Government are now seeking further legislative consent from Welsh Government to introduce provisions within the Criminal Justice Bill which will broaden the scope of Section 184 of the Online Safety Act and make it a criminal offence to encourage or assist serious self-harm via online communication and other non-communicable methods (e.g. the passing of a blade). Welsh Government is currently considering the draft Bill and the UK Government’s request for consent. Welsh Government has a role to play in the implementation of the new provisions, in conjunction with UK Government implementation plans, to ensure that Welsh citizens, businesses and wider stakeholders are aware of, and ready for, the changes. As part of this Welsh Government will actively engage with, and contribute to, the three phases of Canolfan Cyswllt Cyntaf / First Point of Contact Centre: 0300 0604400 Bae Caerdydd • Cardiff Bay Gohebiaeth.Lynne.Neagle@llyw.cymru Caerdydd • Cardiff Correspondence.Lynne.Neagle@gov.wales CF99 1SN Rydym yn croesawu derbyn gohebiaeth yn Gymraeg. Byddwn yn ateb gohebiaeth a dderbynnir yn Gymraeg yn Gymraeg ac ni fydd gohebu yn Gymraeg yn arwain at oedi. We welcome receiving correspondence in Welsh. Any correspondence received in Welsh will be answered in Welsh and corresponding in Welsh will not lead to a delay in responding.

[Page 2] consultation to be launched by Ofcom as the regulator. We will also take more focussed steps to safely communicate with our communities and service providers to raise awareness of the new legislation. The Welsh Government is currently in the process of developing our new Suicide and Self- harm Strategy for Wales. The Strategy has already been the subject of pre-consultation exercises with key stakeholders and the draft Strategy is due to go out to public consultation next year setting out the proposed policy objectives we will be taking forward to deliver our over-arching vision for reducing self-harm and suicide in Wales. This will provide the policy context for more detailed discussions with our stakeholders on the actions that need to be taken forward in the short-medium term to tackle the causes of, and the responses to suicide and self-harm. Those actions will be detailed in an Action Plan which will be monitored and updated in light of progress, evidence and research. As part of that process we will specifically explore other opportunities to draw on lessons learned from tragic events like this and what further action we can take to prevent them from happening again.

Dear Mr Hughes, We write in response to the Regulation 28 report to Prevent Future Deaths, received 25thOctober 2023, which was issued to Ofcom following the death of Bronwen Morgan. We would like to offer our deepest condolences to Ms Morgan's family and loved ones, and to assure them that ensuring online services tackle harmful suicide content on their platforms is a key priority for Ofcom as we implement the Online Safety Act. L Response to Regulation 28 report following inquest into the death of Bronwen Morgan Below we set out our proposed actions in relation to the issues raised by your report, and the timetable for these actions. These actions are pursuant to the new duties and powers assigned to Ofcom by the Online Safety Act 2023 and relate to Ofcom's plans for implementation of the Act as the regulator for online safety. In particular, and where relevant to Ofcom's work, we have sought to address the following considerations raised in your report: The impact such access/avaiIability (to suicide and self-harm content) has upon those vulnerable individuals researching/contemplating acts of self-harm': please find below further information on Ofcom's publications on service's risk assessments and risk profiles. What action(s) may be taken to remove/limit/mitigate/educate such access/availability': please find below information regarding proposals for our illegal content Codes of Practice, and our plans to implement duties in relation to protection of children and user empowerment tools. The Online Safety Act 2023 The Online Safety Act 2023 ('the Act') received Royal Assent on 26 October 2023 and makes companies that operate a wide range of online services legally responsible for keeping people safer online. Among other things, the Act: Appoints Ofcom as the regulator for online safety and confers upon us a number of powers and duties (set out in detail below). Ofcom, Riverside House, 2a Southwark Bridge Road, London SEI 9HA Switchboard: 0300 123 3000 or 020 7981 3000

[Page 2] Applies to user-to-user services and search services.' Imposes a number of duties on those regulated services which focus on improving the systems and processes online services operate to ensure the safety of their users, rather than on the presence of individual pieces of content. Requires regulated services to assess the risks their services pose to users in relation to illegal content and content that is harmful to children, and take steps to mitigate and manage those risks. Requires Ofcom to issue a number of regulatory publications to help regulated services understand how they can comply with their legal duties. Requires Ofcom to publish resources to help companies assess, understand and manage risk. Ofcom will also produce Codes of Practice, setting out recommended measures services can take to comply with the relevant duties under the Act in order to mitigate the risk of harm. As explained further below, the duties on all regulated user-to-user services relating to protecting their users from illegal harms will require those services to understand and take steps to manage and mitigate the risks of users encountering illegal suicide content , or their services being used for the commission or facilitation of this offence. User-to-user services will also have to swiftly take down illegal suicide and (when the Act's newly created self-harm offence is brought into force) illegal self-harm content when it is identified. Where regulated services are likely to be accessed by children, they will also have to understand and take steps to prevent child users from encountering content that encourages, promotes or provides instructions for suicide or deliberate self-harm. There are also additional duties which apply to certain user-to-user services which will be 'categorised' based on user numbers and functionalities (these services will be known as 'Category 1 services'). These duties are designed to make these services more transparent and accountable to their users about the steps they take to protect them from harm; and enable adult users to have more control over the type of content they encounter, including by having access to tools to reduce their potential exposure to suicide and self-harm content. A set of separate duties apply to regulated search services. These duties focus on those services understanding the risks of harm and focus on services taking steps to minimise the risk of individuals encountering illegal content and content that is harmful to children in search results. Although the Act is now law, there are numerous procedural steps needed for new regime to be fully implemented, and these steps need to be completed before the regime's legal duties and enforcement powers come into force. These steps include, for example, services understanding and managing the risks of harm to their users and Parliament approving the final Codes of Practices. We explain our plans to implement the regime below. In the short-term, in advance of formal duties and powers coming into force, we are already encouraging in-scope service providers to take meaningful steps to improve safety on their In addition, online services that publish or display pornographic content will be subject to a more limited set of duties focused on requiring them to use highly effective age assurance to ensure that children are not normally able to encounter that pornographic content. In other words content that would 'amount to' an offence of assisting or encouraging suicide under s.2 of the Suicide Act 1961 or s. 13 of the Criminal Justice Act (Northern Ireland) 1966. There are similar duties on regulated search services which focus on those services understanding the risks of harm and focus on services taking steps to minimise the risk of individuals encountering illegal content and content that is harmful to children in search results.

[Page 3] platforms. To this end, we are committed to driving industry improvements by engaging with the largest and riskiest services via continuous 'regulatory supervision.' More information on our supervision regime can be found in our regulatory roadmap. it Ofcom’s implementation of the Online Safety Act To coincide with Royal Assent, we set out our approach to implementing the Act on our website - this included an implementation road map setting out our key phases of work over the next three years as set out above. We set out in summary below our intended plans for implementation, and in diagram form in Figure 1. This timeline shows our key milestones and documentation but is not a comprehensive guide to everything we will produce over the first three years of the regime. Figure 1: Ofcom's timeline for Online Safety implementation 2028 2024 OK Q3 04 2028 OS QI 04 2O2C Q5 Th*Onkn»B«totyAc(p**M* Otoomnn*>twiin*ga>h*nn»Cod«« md ubmtuloSoStoopfxowi Phu* 1: Illegal harm* Mrvk«* must ccxnoty wtth0v«M gutoanoa onaga v andCoda* tor pnxaccton wWIcanonfaga ofcNkkan a f □ r a r o n t m l v m a a a n t t t t t c a o N a n t i t o l o n ra g n O w t t o f o lc m M N to av n a fo * r fi p n o a m lg o u g k r ia a n o o h a y o o n n M nM « nn c p o o n rn t o o g rt raphic Oonaultattononguklanoaon pHXactionof woman andgkla (J OfcomnnaMaa* protection ofi CoUatandaubrnkatoSoSto. Phase 2: Child safety duties and pornography fttQfcter of CMggodMd PpriUment MT0CMpubMWCl CattQOrtPtd com* Into tore* »<> awl Phase 3: Duties on categorised services. Incl. transparency num oxnpty wtth clutto* The ootourad bar Indicate* the time period within which we expect the activity to take place Q Consultation Acttvttf that are dependent on Government and Parliament o Action* Ofcom will take G Statement
— Actions service* wm take Parliamentary approval Phase One: The first step in this was the publication of the Consultation: Protecting people from illegal harms online ('illegal harms consultation') on 9 November 2023. As part of this consultation, we published proposals for Codes of Practice which set out how services can comply with their illegal content duties in the Act? We also published draft Illegal Content Judgements Guidance on how services can identify illegal suicide and - if the offence is brought into force before we issue our final documents - illegal self-harm content. Phase Two: We also published our Consultation: Guidance for service providers publishing pornographic content on 5 December 2023, which includes draft guidance on age assurance and other duties for services providing pornographic content. This will be followed by a broader consultation on measures to protect children from encountering other harmful content in Spring
2024. Phase Three: Later in 2024, we will publish further consultations on additional duties on categorised services, which includes user empowerment measures that will apply to 'Category 1' services. As part of our preparatory work for implementation, we have been actively engaging with a range of expert stakeholders including government, law enforcement, and charities such as the Samaritans to 4It is not mandatory for services to implement all measures in our Codes of Practice. However, where Codes of Practice are not implemented in full, services are obliged to demonstrate the steps they have taken to achieve the same safety outcomes

[Page 4] develop our understanding, expertise and evidence base in relation to suicide and self-harm, and to ensure that we are aware of developing areas of risk. We have also been concentrating on growing our internal expertise in relation to this complex and important harms area. We will continue our programme of engagement with relevant experts as we consult on our initial proposals on how services can comply with their duties. Phase One: Ofcom’s illegal harms consultation: assessing risks The Act requires Ofcom to produce a register of risks for illegal harms, and guidance to assist services in conducting their own risk assessment. Our draft guidance sets out a four-step risk assessment process which we propose as the best way to ensure that a service's assessments meet their obligations. We are also consulting on our 'Risk Profiles', which set out an explanation of factors in service design and operation that increase risk of harm. Services will be required to take account of our Risk Profiles when conducting their risk assessments. The information contained in the Risk Profiles is sourced from Ofcom's own Register of Risk. For illegal suicide and self-harm content, we set out risk factors relating to: service type; user base; functionalities of the service; and recommender systems. We are using the consultation process to help us finalise this work. Ofcom’s illegal harms consultation: Codes of Practice The Act requires Ofcom to produce Codes of Practice setting out the measures that in-scope services may take to comply with their duties under the Act.' The Codes will recommend proportionate systems and processes across a number of areas, including: moderation, governance, and user complaints. While services are not required to implement all measures in our Codes of Practice, in the event that they choose not to take the steps recommended, they will need to be able to explain how their chosen approach allows them to be compliant with their legal duties. We published our illegal content Codes of Practice in draft form alongside our illegal harms consultation/ The proposed measures in our Codes of Practice would require services to, among other things: have a named person, who is accountable to the most senior governance body, for compliance with illegal content safety duties, and reporting and complaints duties; have in place effective and easy-to-find content reporting and complaint mechanisms, so that users that encounter illegal content (including illegal suicide and, if the offence is brought into force, self-harm content) can report it and see action taken; Section 41 of the Act f:Ofcom, 'Consultation: Protecting people from illegal harm online', November 2023. See: Volume 4: Hgw to m'ygatc the risk of illegal harms - the illegal Content Codes of Practice. Annex 7; Illegal Content Codes of Practice for user-to-usgr services and Annex 8: Illegal Content Codes of practice for search services.

[Page 5] in the case of medium or high-risk services that use algorithms to recommend content to users, measure the risk that changes to algorithms increase the chance of users' exposure to illegal content (including illegal suicide and self-harm content); in the case of user-to-user services: have in place content moderation systems or processes that are designed to take down known illegal content (including illegal suicide and self-harm content) swiftly; and in the case of search services: have systems and processes in place that are designed so that search content that is illegal content is deprioritised or deindexed for UK users. In addition, our draft Codes of Practice include a proposal that search services should provide crisis prevention information in response to search requests that contain general queries regarding suicide and queries seeking specific, practical or instructive information regarding suicide methods. This information should include a helpline and links to freely available supportive information provided by a reputable mental health or suicide prevention organisation. It should also be prominently displayed to users in the search results. Ofcom’s illegal harms consultation: Illegal Content Judgements Guidance Our illegal harms consultation includes a draft version of Ofcom's Illegal Content Judgements Guidance. This document provides guidance to in-scope services on how they may identify illegal content (content which may be reasonably inferred to amount to a relevant offence) including under Section 2 of the Suicide Act 1961. We are seeking further evidence and feedback from stakeholders on these proposals as part of our consultation. After Ofcom’s illegal harms consultation and statement Once we have completed our illegal harms consultation we are required to publish a statement setting out our response to issues raised by stakeholders, and our final policy decisions. Based upon previous experience of large regulatory publications, our current planning assumption is that we may issue the statement around one year from publication of the consultation - that is, in Autumn
2024. The Online Safety Act requires Ofcom to submit our Codes of Practice on illegal harms to the Secretary of State and to publish associated guidance within 18 months of Royal Assent. Once we issue our statement, services will have three months to undertake their illegal content risk assessments. At this point we will also submit the Codes of Practice to the Secretary of State, which, subject to their approval, are to be laid in Parliament for 40 days. Following approval by Parliament, the Codes will come into force 21 days after they have been issued. At this time the illegal harms safety duties become enforceable, and we can begin investigations and - following the conclusion of those - impose sanctions if we find that services are not compliant with these duties. Assuming Parliament immediately approves the Codes, we expect the duties to become enforceable around the end of 2024. TOfcom, 'Consultation: Protecting people from illegal harm online', November 2023. See: Volume 5: How to judge whether content is illegal or not? (illegal Content Judgements Guidance) and Arnex 10: Online Safety <ju dance.on Judgement for Illegal Content.

[Page 6] Phase Two: Phase Two will focus on child safety and include a consultation on protecting children, to be published in Spring of 2024. The consultation will include our proposals for: Draft guidance for services on carrying out their Children's Access Assessments Ofcom's analysis of the causes and impacts of harms to children Draft guidance on carrying out Children's Risk Assessments Draft Codes of Practice setting out recommended measures to protect children online. The Act also places requirements on services that are likely to be accessed by children to protect children from content which is legal but harmful to them. Services which are required to comply with the safety duties protecting children will be under a duty to operate a service using proportionate systems and processed designed to prevent children of any age from encountering 'primary priority content that is harmful to children'. Content which 'encourages, promotes or provides instructions for suicide' or 'for an act of deliberate self-injury' has been designated as 'primary priority content' under the Act. Regulated services will have three months to carry out Children's Access Assessments after we publish our final Guidance. If they conclude that they are likely to be accessed by children, then they will have to carry out Children's Risk Assessments. We intend to publish our final Guidance on Children's Access Assessments in early 2025. Our main statement on the Children's Safety Duties will follow in Spring 2025. This will allow services to complete their initial Children's Access Assessments and determine whether they need to comply with the children's safety duties, before the requirement to carry out Children's Risk Assessments comes into force. At that point (Spring 2025), relevant services will have three months to carry out a Children's Risk Assessment. At the same time, we will submit the children's Codes of Practice to the Secretary of State. Subject to the Secretary of State's approval, they will then be laid in Parliament for 40 days. Following approval by Parliament, the codes will come into force 21 days after they have been issued. At this time the child protection safety duties become enforceable, and we can begin investigations and impose sanctions for non-compliance. Assuming Parliament immediately approves the codes, we expect the duties to become enforceable in Summer 2025. Phase Three: Phase Three of online safety focuses on transparency, user empowerment, and other duties which will apply to Category 1 services. The user empowerment duties in particular will include a duty to include, to the extent that it is proportionate to do so, features which adult users may use or apply if they wish to increase their control over certain kinds of content including content which encourages, promotes or provides instructions for suicide or an act of deliberate self-injury. We plan to issue a Call for Evidence regarding our approach to phase three in early 2024. 'Category 1' refers to certain user-to-user services categorised based on user numbers and functionalities. Services in this category are subject to additional duties related to transparency, user empowerment and protection of democratic and journalistic content. 'Category 1 threshold conditions' are set the Secretary of State, with advice provided by Ofcom. Ofcom will then be responsible for designating services into categories according to these thresholds.

[Page 7] Regulation of Video Sharing Platforms In addition to our preparation for the implementation of the online safety regime, Ofcom has also been responsible for regulating UK-established video sharing platforms (VSPs) since November 2020. The scope of the VSP regime is much narrower than that of the Act, applying only to services that meet the definition of a VSP under Part 4B of the Communications Act 2003 and have the required connection with the UK and to protecting users from material included in videos only. We include a brief summary of the main provisions of the VSP regime which are potentially relevant to the broader points covered in the report. Under the VSP Framework, VSP providers are required to take safety measures as are appropriate to protect children (under 18s) from videos containing 'restricted material'. Importantly, they must also ensure that the measures they take are implemented effectively. 'Restricted material' includes material which might impair the physical, mental, or moral development of under 18s. The relevant legislation does not specify particular examples of such material. However, in our guidance for providers on measures to protect users, we state that VSPs should consider a range of harms, including self-injurious content which may cause physical harms, such as material promoting eating disorders, self-harm and suicide. It is for each VSP provider to decide what safety measures to take that are appropriate and proportionate for protecting children on their service from videos containing potentially harmful material. Where we have concerns about the measures a platform has in place, we will consider taking further action to push improved outcomes for children. This may include, where appropriate, targeted supervision or the use of enforcement powers. Our learnings under the VSP regime will help us prepare for the broader online safety regime.
iii. Conclusion Ofcom is acutely aware of the risks posed to UK users by illegal content which encourages or assists suicide and attempted suicide, and from legal content which encourages, promotes or provides instructions for suicide and self-harm - and the devastation caused to bereaved families. Government and Parliament have clearly signalled the importance of tackling such content by designating illegal suicide content as a priority offence and legal suicide content as primary priority content that is harmful to children, and our strategic priorities reflect this. As we have set out in our approach to implementing the Online Safety Act once the regime is in force, we expect change. Specifically, we anticipate implementation of the Act will ensure people in the UK are safer online by delivering four outcomes: stronger safety governance in online firms; online services designed and operated with safety in mind; choice for users so they can have meaningful control over their online experiences; and transparency regarding the safety measures services use, and the action Ofcom is taking to improve them, in order to build trust. We have set out that we will expect all in-scope services to have appropriate trust and safety measures tackling the full range of harms listed in the Act. In particular, we want to see wider See section 368S of the Communications Act 2003. A full list of notified services may be found on the Ofcom website: Notified video-star inp, platforms O*cnm- they include., amonR others, TixTok, Twitch and Snap

[Page 8] deployment and improvements in services' measures to address areas which pose the greatest risk to people, including suicide content, to protect UK users, especially children. We are committed to working with industry to ensure compliance with these duties, and to this end our draft illegal harms Codes of Practice include specific measures which we propose would allow services to meet their duties in an effective and proportionate manner. We will ensure that through consulting on our proposals we seek input and engagement with external experts. We will also work directly with services to promote compliance, including - where appropriate - through targeted supervision. Where we identify non-compliance, we will not hesitate to take enforcement action where appropriate to protect users from harm. We will have the powers to require non-compliant service providers to take remedial action and to impose financial penalties where necessary, as well as powers to seek business disruption measures in serious cases. Evidence included in reports from coroners and other experts will play an important role in our policy proposals and response as we implement the regime, and we will of course take the evidence in your report into account as we continue our policy development. We hope that this response provides helpful information about the significant steps Ofcom is taking as we continue to work through the implementation of the Act. If further information or clarification is required, we would be happy to provide this.