Schedule 11: Categories of regulated user-to-user services and regulated search services: regulations Information power and information notices Section 100: Power to require information
Subsection (1) gives OFCOM the power to require the provision by a person within the categories listed in subsection (5) of information OFCOM require in order to discharge their online safety functions. For instance, OFCOM could use this power to require a relevant service provider to share a risk assessment in order to understand how that provider was identifying risks. OFCOM must issue an information notice (in accordance with section 102) in order to exercise this power.
	Subsection (3) makes clear that the power conferred by subsection (1) gives OFCOM the power to require certain providers (those specified in paragraphs (a) to (d) of subsection (5)) to take steps to allow a person authorised by OFCOM to view remotely specific types of information.
	The power under subsection (3) will allow persons authorised by OFCOM to observe the carrying out of empirical tests, which are a standard method for understanding algorithms and which involve taking a test dataset, running it through an algorithmic system, and observing the output. Under section 102(5) a provider must be given at least seven days to comply with a notice which requires the taking of steps in relation to remote viewing under subsection (3).
	When exercising the power under subsection (3), Ofcom is only permitted to do so for the purpose of exercising their online safety functions, and is unable to use this power for any purpose other than the viewing of specific types of information. For example, Ofcom may exercise this power for the purposes of assessing compliance with the online safety duties. Given that the power only exists for the purpose of viewing information, OFCOM is unable to directly control the service when exercising this power, nor could they use it to require companies providing infrastructure services to create the means to weaken or circumvent cybersecurity measures.
	In observing tests under subsection (3), where an appropriate test server is available OFCOM may seek to observe a test using that test server. If a test server is unavailable, OFCOM may request a test using the server that is used to deliver the ‘live’ service, but they would only be able to view such a test and any data processing would need to comply with data protection law. OFCOM would generally expect to require a service to use a test dataset. OFCOM may request either that the service uses a test dataset provided by OFCOM, or the service uses its own test dataset, when performing a test. Which approach is taken will depend on the circumstances.
	Subsection (4) places a legal requirement on OFCOM to exercise the subsection (1) power in a way that is proportionate. That means that Ofcom will need to consider how necessary it is for Ofcom to obtain the information before deciding whether to exercise the power. Any technical and operational limitations on viewing information, including the use of cybersecurity measures such as encryption may also be relevant to Ofcom’s decision as to whether and when to exercise this power.