Schedule 3: Timing of providers’ assessments Cross-cutting duties Section 22: Duties about freedom of expression and privacy
This section sets out the freedom of expression and privacy duties. This section applies in relation to user-to-user services (Section 33 contains similar provisions relating to search services). The term ‘freedom of expression’ is defined in section 236 and the definition is, where appropriate, aligned with that in the European Convention on Human Rights.
	All services
	Subsection (2) places a duty on providers of all regulated user-to-user services to have particular regard to the importance of protecting users’ legal rights to freedom of expression when deciding on and implementing safety measures to comply with their duties. Examples of measures that services could take to comply with this duty could include ensuring human moderators are adequately trained to assess contextual and linguistic nuance to prevent over-removal of content.
	Subsection (3) places a duty on providers of all regulated user-to-user services to have particular regard to the importance of protecting users from breaches of law concerning privacy when deciding on and implementing safety measures to comply with their duties. This encompasses breaches of existing statutory provisions in data protection legislation such as the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as well as common law rights such as those relating to private and confidential information. The regulator which enforces obligations which arise under data protection law is the Information Commissioner’s Office.
	Service providers can comply with their duties in subsections (2) and (3) by following measures in OFCOM’s codes of practice (see section 49(2)). Under paragraph 10 of Schedule 4, OFCOM are required to design recommended measures in light of the importance of protecting users’ rights to freedom of expression and protecting users’ privacy, and where appropriate, OFCOM should incorporate protections for the same. Where service providers take measures different from those set out in the codes of practice, they are also under an obligation to ensure that they have particular regard to the importance of freedom of expression and user privacy (see section 49(5)). OFCOM are obliged to consult with the Information Commissioner when preparing the codes of practice (see section 41(6)(g)).
	Category 1 services
	Subsection (4) requires providers of Category 1 services to carry out and publish an impact assessment on the impact that any steps which they have taken, or plan to take, to comply with their safety duties have, or will have, on users’ rights to freedom of expression and users’ privacy. They must also publish a statement specifying any positive steps they have taken to protect users’ rights to freedom of expression and privacy in response to this impact assessment (subsection (7)). Subsection (5) requires this impact assessment to consider the effect of their safety measures and policies on the availability and treatment of news publisher content and journalistic content.
	Subsection (8) clarifies that the use of "safety measures and policies" in this section refers to those designed to secure compliance with (a) section 10 (illegal content), (b) section 12(children’s online safety), (c) section 15 (user empowerment), (d) section 20 (content reporting), or (e) section 21 (complaints procedures).