"Our submission suggested that Ofcom should consider whether the provider may violate the laws of a third country in complying with a technology notice. There is no such requirement in the Act, and it was not mentioned in Ofcom’s guidance. The guidance did note that a technology notice will only be imposed in relation to the operation of a service in the UK or as it affects UK users of the service. But there are serious concerns over whether an accredited technology could target only UK users on a global communications service without sweeping in the communications of users in other countries (and thus triggering a potential conflict of laws). We advised that a requirement should be added to the guidance that Ofcom should consider conflicting liabilities on the service provider before issuing a notice. In response, Ofcom amended the guidance to state that it will consider a potential conflict with foreign law, so long as such a conflict is raised by the provider.
This is an issue which I think has been overlooked in much of the commentary (academic and policy) on this power and similar proposed powers debated in the EU child sexual abuse regulation. Most of the services that are within scope of technology notices (and the proposed EU ‘detection orders’) are global services. I expect it would be technically difficult, not to mention costly, for these service providers to figure out how to scan the communications of only UK users. Further, how are we identifying a ‘UK user’—someone who is in the UK, a UK citizen, a UK resident, etc? Limiting the interception or scanning of communications to UK users may play politically, but in practice, it seems infeasible."
https://issuesincybercrimelaw.substack.com/p/uk-digital-surveillance-through-platform
#UK #Ofcom #OnlineSafetyAct #OSA #DigitalSurveillance #Privacy