Age Assurance (Minimum Standards) Bill [HL]

1 Age assurance systems

(1)

Any age assurance system, operated in relation to an online or digital service or product used by consumers or operated in the United Kingdom, must meet the minimum standards as set out in section 2 .

(2)

This section applies to all age assurance systems whether operated by the provider of an online or digital service or product, or by the provider’s agent, and irrespective of the system’s size, nature or approach.

2 Minimum standards

(1)

Within the period of 6 months beginning with the day on which this Act is passed, the Office of Communications ("Ofcom") must publish minimum standards for age assurance systems.

(2)

The minimum standards must ensure that any age assurance system—

(a)

protects the privacy of users in accordance with applicable laws, including the data protection laws and obligations under the treaties set out at paragraph (k) ;

(b)

is proportionate having regard to the risks arising from the product or service and to the purpose of the age assurance system;

(c)

offers functionality appropriate to the capacity and age of a child who might use the service;

(d)

is secure, does not expose users or their data to unauthorised disclosure or security breaches, and does not use data gathered for the purposes of the age assurance system for any other purpose;

(e)

provides appropriate mechanisms and remedies for users to challenge or change decisions if their age is wrongly identified;

(f)

is accessible and inclusive to users with protected characteristics;

(g)

does not unduly restrict access of children to services to which they should reasonably have access, for example, news, health and education services;

(h)

provides sufficient and meaningful information for a user to understand its operation, in a format and language that they can be reasonably expected to understand, including if they are a child;

(i)

is effective in assuring the actual age or age range of a user as required;

(j)

does not rely solely on users to provide accurate information;

(k)

is compatible with—

(i)

data protection legislation within the meaning of the Data Protection Act 2018 (see section 3 of that Act), in particular the principle that the minimum amount of data necessary is collected,

(ii)

the requirements of the Age Appropriate Design Code issued under section 123 of the Data Protection Act 2018 (age-appropriate design code),

(iii)

the Human Rights Act 1998,

(iv)

the Equality Act 2010, and

(v)

the United Nations Convention on the Rights of the Child and general comment No. 25 (2021) on children’s rights in relation to the digital environment.

3 Enforcement

(1)

Within the period of 6 months beginning with the day on which this Act is passed, the Secretary of State must by regulations made by statutory instrument make provision granting Ofcom powers to enforce this Act.

(2)

Regulations under subsection (1) must provide equivalent enforcement powers to those granted to the Information Commissioner in Part 6 of the Data Protection Act 2018 (enforcement).

(3)

A statutory instrument containing regulations under this section may not be made unless a draft of the instrument has been laid before and approved by a resolution of each House of Parliament.

4 Definitions

In this Act—

“a child” means any person under the age of 18;

“age assurance system” means any system or feature which purports to estimate or verify the age or age range of a user, for a part or all of its service;

“protected characteristics” has the meaning given in section 4 of the Equality Act 2010 (the protected characteristics).

5 Extent, commencement and short title

(1)

This Act extends to England and Wales, Scotland and Northern Ireland.

(2)

Section 1 comes into force at the end of the period of 6 months beginning with the day on which this Act is passed.

(3)

The other provisions of this Act come into force on the day on which it is passed.

(4)

This Act may be cited as the Age Assurance (Minimum Standards) Act 2021.