An Overview of the Online Safety Bill 2024

Introduction

Following our previous Legal Update, the Online Safety Bill 2024 (“Bill“), which aims to promote online safety in Malaysia by way of regulating harmful content and imposing duties on online service providers, has been passed by the upper house of the Malaysian Parliament (i.e. the Senate) on 16 December 2024. The Bill is currently awaiting Royal Assent and publication in the Federal Gazette before it becomes law and will come into operation on a date appointed by the Minister of Communications (“Minister“).

This Update aims to provide an overview of the key requirements introduced by the Bill and how to stay ahead of the upcoming regulatory changes.

Key Requirements

The key requirements introduced by the Bill are briefly examined below.

Scope of application

The Bill will apply to licensed network service providers (NSPs), applications service providers (ASPs), and Content applications service providers (CASPs) under the Communications and Multimedia Act 1998 (collectively, “Service Providers“), specifically where the Service Providers provide applications services and content applications services which utilise the internet. It will not extend to a private messaging feature of any applications service or content applications service.

The Bill notably has extraterritorial effect, and will be under the regulatory purview of the Minister and is to be enforced by the Malaysian Communications and Multimedia Commission (“MCMC“).

Regulated content

The Bill regulates two main types of content – “harmful content” and “priority harmful content”, the latter being a subset of “harmful content” that is subject to more stringent control under the Bill.

Under the Bill, “harmful content” refers to the following specific types of content:

1. Content on child sexual abuse material as provided for under section 4 of the Sexual Offences against Children Act 2017 [Act 792];
2. Content on financial fraud;
3. Obscene content including content that may give rise to a feeling of disgust due to lewd portrayal which may offend a person’s manner on decency and modesty;
4. Indecent content including content which is profane in nature, improper and against generally accepted behavior or culture;
5. Content that may cause harassment, distress, fear or alarm by way of threatening, abusive or insulting words or communication or act;
6. Content that may incite violence or terrorism;
7. Content that may induce a child to cause harm to himself;
8. Content that may promote feelings of ill-will or hostility amongst the public at large or may disturb public tranquility; and
9. Content that promotes the use or sale of dangerous drugs.

Notes:

• For the purposes of paragraph 2, content that promotes awareness or education relating to financial fraud is not content on financial fraud.
• For the purposes of paragraph 3 and 4, content that portrays private parts for education, scientific or medical purposes is not an obscene or indecent content.
• For the purposes of paragraph 9, content that promotes awareness or education relating to drug abuse is not content that promotes the use or sale of dangerous drugs.

“Priority harmful content” is defined as the first two types of harmful content listed and italicised above, namely (i) content involving child sexual abuse material, and (ii) content related to financial fraud.

Duties of Service Providers

The Bill imposes the following key obligations / requirements on Service Providers:

1. implementing measures to mitigate risk of exposure to harmful content;
2. issuing guidelines to users;
3. enabling users to manage online safety;
4. making available a mechanism for reporting of harmful content;
5. making available a mechanism for user assistance;
6. protecting online safety of child users;
7. establishing a mechanism to make prioritised harmful content inaccessible; and
8. preparing and making available an Online Safety Plan.

MCMC may impose a financial penalty of up to RM10 million on Service Providers for non-compliance with any of the above-mentioned duties.

Reporting mechanism to Service Providers

Under the Bill, a reporting mechanism shall be implemented by the Service Provider to allow a user to report any content that the user believes is harmful content to the Service Provider. When a user report is received, the following process should be engaged:

1. If a report contains content that is deemed to be frivolous, vexatious, made in bad faith, trivial, or has already been reported by another user, the report shall be dismissed by the Service Provider.
   
   
2. Conversely, if any content reported by a user is not dismissed, different processes in relation to restriction of access will apply, depending on whether it is “priority harmful content” or “harmful content”.
   
   
3. If the Service Provider determines, on reasonable grounds, that the content is either “priority harmful content” or “harmful content”, such content must be made permanently inaccessible on its service to all users.
   
   
4. MCMC is empowered to issue a written instruction to a Service Provider to restrict access to the content if the Service Provider fails to restrict said access where required. A failure to comply with such written instruction is an offence and may result in a financial penalty of up to RM1 million and a further fine of up to RM100,000 for every day or part of a day during which the offence continues after conviction.
   
   
5. Any decision made by the Service Provider in relation to the content must be notified in writing to the user who made the report.

Reporting mechanism to MCMC

A user may also make a report to MCMC, as summarised below:

1. If a report relates to content that is deemed to be frivolous, vexatious, made in bad faith, trivial, or has already been reported by another user, the report shall be dismissed by MCMC.
   
   
2. If MCMC determines, on reasonable grounds, that the content is “priority harmful content” or “harmful content”, MCMC shall issue a written instruction to the Service Provider requiring such content to be made permanently inaccessible on its service to all users. A failure to comply with such written instruction is an offence and may result in a financial penalty of up to RM1 million and a further fine of up to RM100,000 for every day or part of a day during which the offence continues after conviction.
   
   
3. The action taken by the Service Provider pursuant to the written instruction shall be notified in writing by the Service Provider to both MCMC and the user who communicated the “priority harmful content” or “harmful content”.

Establishment of an Online Safety Committee

An online safety committee consisting of, among others, the Minister, the police, other relevant ministries, and the Service Providers, shall be established to advise and provide recommendations to MCMC on all matters relating to online safety.

Undertaking, notice of non-compliance, and review by MCMC

Service Providers may provide an undertaking to MCMC prior to the issuance of a notice of non-compliance by MCMC. If MCMC has reasonable grounds to believe that a Service Provider has failed to comply with its duties under the Bill, a notice of non-compliance will be issued to the Service Provider. The Service Provider may pay the stipulated fines, or request for a review to be conducted by MCMC (which is appealable to the Online Safety Appeal Tribunal).

Establishment of an Online Safety Appeal Tribunal

Any person aggrieved (including a user who made a report to one or more Service Providers) by the written instructions, determinations, directions or decisions made by MCMC, may appeal against such written instructions, determinations, directions or decisions to the Online Safety Appeal Tribunal.

Judicial review process

Subject to exhaustion of all statutory remedies, a person aggrieved or whose interest is adversely affected by a decision or other action of the Minister or MCMC may apply to the High Court for judicial review.

Enforcement powers under the Bill

Various enforcement powers including the power to investigate, search, obtain access to computerised data, forfeit, as well as to preserve and disclose communications data and information, are provided for under the Bill.

Concluding Remarks

Service Providers are encouraged to stay abreast of the forthcoming and developing regulatory changes and take the necessary steps in preparation of the potential obligations imposed on them by reviewing their existing policies and practices on online safety and content regulation in order to ensure that they are in line with the requirements of the Bill.

We trust the above provides a useful overview of the Bill and an informative update on the latest developments in the online regulatory landscape in Malaysia. Should you require any assistance or clarification in relation to the above, or any matter relating to technology, media and telecommunications; and data protection, feel free to contact us at your convenience.