Part 7: Other provision about use of, or access to, data Retention of information by providers of internet services Section 124: Retention of information by providers of internet services in connection with death of child
Subsection (1) of section 124 amends the Online Safety Act 2023 (OSA 2023), to include a provision on the retention of information by internet service providers in cases involving the death of a child.
	Subsection (2) removes the signpost in section 100(7) of the OSA 2023 to section 103 of that Act and inserts new subsection (8A) after subsection 8. Subsection (8A) confirms that an information notice issued under section 100(1) must not require or authorise processing of information which could contravene the data protection legislation (as defined in section 236(1) of the OSA 2023).
	Subsection (3)(a) amends section 101 of the OSA 2023 to create a new kind of information notice. It inserts new subsection (C1) creating a duty for OFCOM to issue an information notice to a provider of a service which falls within new subsection (E1) requiring the recipient to ensure retention of information relating to the use of the service by a child who has died.
	New subsection (C1) also gives OFCOM the power to issue a notice to a "relevant person" as defined in section 101(7) of the OSA 2023 in order to ensure the retention of information relating to the use of a service within subsection (E1). This may include, for example, ex- providers of the service where relevant.
	New subsection (A1) sets out the circumstances in which the duty or power to issue an information notice under new subsection (C1) applies. It also defines the term "investigating authority" as the senior coroner (in England and Wales), a procurator fiscal (in Scotland) or a coroner (in Northern Ireland).
	New subsection (B1) sets out the details which the investigating authority needs to provide to OFCOM in order for subsection (C1) to apply. This includes information which will assist recipients of these information notices in identifying the relevant data and the details of any regulated service which has been brought to the investigating authority’s attention as being of interest in connection with the child’s death.
	New subsection (D1) clarifies that the requirement to ensure the retention of information under a notice issued under subsection (C1) involves actively taking reasonable and timely steps to prevent the deletion of such information. This includes preventing both intentional deletion and potential deletion through routine systems or processes.
	New subsection (E1) sets out the two ways in which a regulated service falls within scope of the new information notice provision; either it falls under a regulated service type defined by the Secretary of State in regulations, or it is a regulated service specifically notified to OFCOM by the investigating authority as per new subsection (B1)(d).
	New subsection (F1) sets out the type of information that must be retained under the new information notice. The information must either fall within the kind of information which OFCOM can access under its existing powers under section 101(1) of the OSA 2023 or be the kind that a person might need to retain in order to respond to a notice under subsection (1) in future.
	Subsection 3(b) of section 124 makes a consequential amendment to section 101(3) of the OSA 2023, making it clear that the new provisions inserted by subsection 3(a) include a power to obtain or generate information.
	Subsection 3(c) inserts new subsection (5A) confirming that an information notice issued under section 101(C1) must not require processing of information which could contravene the data protection legislation (as defined in section 236(1) of the OSA 2023.
	Subsection (4) amends section 102(1) of the OSA 2023, bringing notices issued under subsection 101(C1) within the definition of an "information notice" for the purposes of the OSA 2023, and subsection (10)(b) amends the corresponding definition in section 236(1) to reflect this change. This means other provisions in the OSA 2023 relating to "information notices", including enforcement provisions, will also apply to notices issued under new subsection (C1).
	Subsection (4)(b) amends section 102(3) of the OSA 2023 to clarify that the requirements regarding information which must be included in information notices currently set out in section 102(3) only apply to information notices issued under sections 100(1) and 101(1) of the OSA 2023. It also adds the requirement for OFCOM to specify when the information covered by such a notice must be provided. It then omits subsection 102(4) as that is now addressed in new 102(3)(ca).
	Subsection (4)(d) inserts new subsections (5A) to (5C) into section 102. New subsection (5A) outlines specific requirements for information notices issued under new section 101(C1).
	New subsection (5B) gives OFCOM the power to extend the duration for which a person is obligated to retain information if they have been issued an information notice under section 101(C1). The period can only be extended in response to information received from the investigating authority. The period can only be extended by a maximum of six months at a time.
	New subsection (5C) explains how OFCOM can exercise the power granted in subsection (5B). They can do so by issuing a notice to the person who received the initial information notice under section 101(C1). This notice specifies the further period for information retention and provides the reason for the extension. Importantly, there is no limit on how many times OFCOM can use this power.
	Subsection (4)(e) of section 124 introduces a new subsection (9A) into section 102 which requires OFCOM to cancel an information notice under new subsection 101(C1) if the investigating authority advises OFCOM that the information specified in an information notice under section 101(C1) is no longer necessary to be retained. This cancellation is communicated through a notice to the person who initially received the information notice.
	Subsection (4)(f) amends section 102(10), adding a definition of the term "the investigating authority", clarifying that it has the same meaning as defined in section 101.
	Subsection (5) makes amendments to section 109 (offences in connection with information notices). These amendments introduce new subsections (6A) and (6B) to section 109.
	Subsection (6A) establishes an offence: if a person, who has been issued an information notice under section 101(C1), deletes or alters information required to be retained, and their intention is to prevent the information's availability for an official investigation into the death of the child, they commit an offence. Subsection (6B) clarifies that information is considered deleted if it is irrecoverable, regardless of how it occurred.
	Subsection (6) amends section 110 (senior managers’ liability: information offences), introducing a new subsection (6A) to section 110. It establishes an offence for an individual named as a senior manager of an entity if the entity commits an offence under section 109(6A), and the individual fails to take all reasonable steps to prevent that offence. Section 109(7) is amended to reflect the inclusion of the new offence under new subsection (6A).
	Subsection (7) amends section 113(2) (penalties for information offences) to include the new offences in section 109(6A) and section 110(6A).
	Subsection (8) omits the definition of data protection legislation currently in section 114 of the OSA 2023, and subsection (10)(a) moves that definition to section 236(1). Subsection (11) then amends section 237 (index of defined terms) to include the definition of data protection legislation now in section 236.
	Subsection (9) amends section 225 (Parliamentary procedure for regulations) to confirm that the regulations made by the Secretary of State under new section 101(E1) are subject to the negative procedure.