EXPLANATORY STATEMENT
Issued by the Australian Communications and Media Authority
Restricted Access Systems Declaration 2014
Broadcasting Services Act 1997
Purpose
The Restricted Access Systems Declaration 2014 (the Declaration) has been made by the Australian Communications and Media Authority (the ACMA) to replace the Restricted Access Systems Declaration 2007 (the 2007 Declaration).
Legislative provisions
Clause 14 of Schedule 7 of the Broadcasting Services Act 1992 (the Act) requires the ACMA to develop a restricted access systems declaration (RAS Declaration) to regulate access to MA15+ content and R18+ content provided by a content service that is delivered via the internet and via mobile networks.
As defined in clause 15 of Schedule 7, R18+ content and MA15+ content is content (other than content that consists of an eligible electronic publication) that:
- is classified as R18+ or MA15+; or
- has not been classified, but if it were to be classified, there is a substantial likelihood that the content would be classified as R18+ or MA15+.
Under clause 20 of Schedule 7, R18+ content and MA15+ content provided for a fee is prohibited content if it is not subject to a restricted access system.
Under subclause 14(2) of Schedule 7, the ACMA may make different provision with respect to R18+ content and MA15+ content.
The purpose of a RAS Declaration is not to prevent access to age restricted content (whether it is user-generated content or otherwise) via any platform, but to seek to ensure that:
- access is limited to persons 15 years and over in the case of MA15+ content and, to persons 18 years and over in the case of R18+ content; and
- that the methods used for limiting this access meet a minimum standard.
In making the Declaration, ACMA must have regard to the following matters specified in subclause 14(4) of Schedule 7:
(a) the objective of protecting children from exposure to content that is unsuitable for children; and
(b) the objective of protecting children who have not reached 15 years from exposure to content that is unsuitable for children who have not reached 15 years; and
(c) such other matters (if any) as the ACMA considers relevant.
Other relevant matters include the regulatory policy considerations under subsection 4(3AA) to the Act which, in summary, are:
- to address public interest considerations while not imposing unnecessary financial and administrative burdens on industry; and
- to accommodate technological change; and
- to encourage the development of technologies and services.
Under subclause 14(5) of Schedule 7, ACMA must ensure that a RAS Declaration is in force at all times after the commencement of Schedule 7.
Under Schedule 7, the obligation to have in place a restricted access system in relation to particular content applies to designated content/hosting service providers who provide a content service that has an Australian connection, where the content (excluding “eligible electronic publications”) is:
- MA 15+ content that is provided for a fee by means of a content service which operates on a commercial basis; or
- R 18+ content.
In clause 2 of Schedule 7, a “designated content/hosting service provider” is defined as a person who provides a designated content/hosting service. A designated content/hosting service is defined as being a hosting service (which is defined in clause 4), a live content service (which is defined in clause 2), a links service (which is defined in clause 2) or a commercial content service (which is defined in clause 2).
In clause 3 of Schedule 7, a content service or hosting service has an “Australian connection” if any of the content is hosted in Australia, or, in the case of a live content service, the content is provided from Australia.
Background
In the context of the Government’s 2014 deregulation agenda, the 2007 Declaration was identified as a legislative instrument where unnecessary regulatory burden could be reduced. Following consultation with industry, the ACMA has prepared the Declaration which imposes a less prescriptive approach to the regulation of access to MA15+ content and R18+ content that is delivered via the internet and via mobile networks.
Operation
In summary, the Declaration specifies the minimum requirements of an access-control system for MA15+ content and R18+ content delivered via the internet and via mobile networks. Different requirements exist for the different classification levels.
For MA15+ content, an access-control system must:
- require an application for access to the content; and
- require a declaration from the applicant that they are over 15 years of age; and
- provide warnings as to the nature of the content; and
- provide safety information for parents and guardians on how to control access to the content; and
- limit access to the content, which may include the use of a PIN or some other means.
For R18+ content (or for R18+ and MA15+ content), an access-control system must:
- require an application for access to the content; and
- require content service providers to take reasonable steps to verify an applicant is at least 18 years of age; and
- provide warnings as to the nature of the content; and
- provide safety information for parents and guardians on how to control access to the content;
- incorporate reasonable steps to confirm that an applicant is at least 18 years of age; and
- limit access to the content, which may include the use of a PIN or some other means.
Each of these matters must be in place for an access-control system to be compliant.
Public Consultation
In formulating the Declaration, the ACMA undertook a two phase consultation process. The first phase involved the publication of a discussion paper on 10 June 2014, which invited feedback on the 2007 Declaration and suggestions for the content of a replacement RAS Declaration. The release of the discussion paper was accompanied by a media release, and correspondence with targeted industry partners. Five submissions were received from industry participants and other interested parties (the Australian Subscription Television and Radio Association, the Interactive Games and Entertainment Association, Telstra, the Australian Interactive Media Industry Association / Digital Policy Group and the Australian Sex Party) .
The submissions were all supportive of developing a RAS Declaration that was less prescriptive in its requirements than in the 2007 Declaration, allowing flexibility for industry in implementing access systems. There were several key issues identified by respondents:
- the difficulty in proving the age of an applicant online;
- the method or methods of access restriction outlined in a RAS Declaration must allow industry the flexibility to develop access-control systems appropriate to their business models; and
- the RAS Declaration should not be too prescriptive of internal procedures that industry should follow. Such procedures would more appropriately be set out in an industry code, or determined by their business model.
All issues raised in submissions were considered and subsequently informed the content of a draft RAS Declaration, which was released for public and industry consultation on 21 September 2014.
Three submissions were received at the end of the consultation period, from Australian Subscription Television and Radio Association, the Interactive Games and Entertainment Association and Telstra. The submissions were generally supportive of the proposed changes to the 2007 Declaration. A common theme through all submissions was a desire to remove differentiation between fee based and non-fee based content at the 18+ classification, in regard to evidence of age requirements.
The feedback received as part of the second consultation period was considered in the drafting of the Declaration.
Regulation Impact Statement
The Office of Best Practice Regulation (OBPR) has determined that the regulatory changes in the Declaration are minor in nature and has therefore verified that no further regulatory impact analysis is required – OBPR reference number 17596 (verification provided 11 September 2014).
Notes on sections
The provisions of the Declaration are described in Attachment 1.
Statement of Compatibility with Human Rights
Subsection 9(1) of the Human Rights (Parliamentary Scrutiny) Act 2011 requires the rule maker in relation to a legislative instrument to which section 42 (disallowance) of the Legislative Instruments Act 2003 applies to cause a statement of compatibility to be prepared in respect of that legislative instrument.
This statement has been prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.
The Declaration is compatible with the human rights and freedoms recognised or declared in the international instruments listed in Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.
Human Rights Implications
The Declaration engages the right to freedom of expression
Under the International Covenant on Civil and Political Rights, everyone is entitled to the right of freedom of expression, including the ‘freedom to seek, receive and impart information and ideas of all kinds, regardless of frontiers, either orally, in writing or in print, in the form of art, or through any other media’ (see Article 19).
The Declaration engages the right to freedom of information as it concerns seeking and receiving information through accessing online content. While the Declaration may restrict the freedom to receive information, it does so in a proportionate manner, in accordance with clear legislative and policy intent of protecting children from exposure to content that is unsuitable for children (refer Schedule 7 of the Act).
The Declaration is therefore consistent with Article 19 of the International Covenant on Civil and Political Rights, in that the obligation imposed by the Declaration, insofar as it may limit access to certain online content, reflects Parliament’s intention of protecting children from exposure to unsuitable content.
Conclusion
The Declaration is compatible with human rights and to the extent that it may limit human rights those limitations are reasonable, necessary and proportionate.
Attachment 1
NOTES ON SECTIONS
PART 1 PRELIMINARY
Section 1 - Name of Declaration
Section 1 provides for the citation of the Declaration as the Restricted Access Systems Declaration 2014.
Section 2 – Commencement
Section 2 provides that the Declaration commences on 1 January 2015.
Section 3 – Revocation
This section revokes the Restricted Access Systems Declaration 2007.
Section 4 – Definitions
Subsection 3(1) defines the terms used in the Declaration. Subsection 3(2) refers to terms that have the same meaning in the Declaration as in Schedule 7 to the Act.
Section 5 – Purpose of Declaration
Subsection 5(1) notes that under subclause 14(1) of Schedule 7, the ACMA may declare that a specified access-control system is a restricted access system in relation to content for the purposes of Schedule 7.
Subsection 5(2) provides that the Declaration declares specified access-control systems to be restricted access systems in relation to content for the purposes of Schedule 7.
PART 2 MA15+ CONTENT
Section 6 – Minimum requirements of an access-control system – MA15+ content
Subsection 6(1) sets out the minimum requirements that an access-control system must include if it is to be considered a specified access-control system for commercial MA15+ content. This is done by reference to the obligations in sections 7 to 9.
Section 7 – Applying for access to MA15+ content
Under section 7, an access-control system must require an applicant seeking access to MA15+ content to apply for access either in writing, in electronic form or orally. This means that an applicant must take proactive steps to initiate the service (‘opt-in’).
The applicant must also provide a declaration, in writing or in electronic form, that they are 15 years or over.
Section 8 – Provision of warnings
The access-control system must provide warnings about the nature of the MA15+ content that is being accessed and must provide safety information about how a parent or guardian may control access to such content by persons under 15.
This is consistent with the objectives of Government’s policy to enhance online safety for children, which aims to ensure parents and guardians have access to online safety information and advice to assist them in managing their family’s online experience.
Section 9 – Limiting access
Section 9 describes the instances in which an access-control system may provide access to MA15+ content.
Under subsection 9(1)(a), an access-control system must not provide access to MA15+ content unless an applicant has:
- applied for access (‘opted-in’); and
- made a declaration that they are over 15 years of age; and
- been provided with warning and safety information.
Under paragraph 9(1)(b) an access-control system may provide access to MA15+ content when an applicant has been provided with a PIN or some other means of limiting access by other people, by which the access-control system can verify that the applicant has:
- previously applied for access (‘opted-in’); and
- made a declaration that they are over 15 years of age; and
- been provided with warning and safety information.
The phrase "other means of limiting access” is to be read broadly and may include any method a designated content/hosting service provider designs that allows an access-control system to uniquely recognise the applicant in question.
Under paragraph 9(2) an access-control system may provide access to MA15+ content if an applicant has previously submitted a declaration to the designated/hosting service provider (or to a person acting on behalf of the provider). The declaration is not required to have been made in relation to an application for access to MA15+ content. For example, a designated content/hosting service provider may have the capacity to cross check other instances where a person may have declared their age, as in situations where age details are declared for the establishment of an account.
In the circumstances contemplated under subsection 9(2), the access-control system must ensure that the applicant is provided with warnings and safety information on the first occasion on which they attempt to access MA 15+ content. For the purpose of subsection 9(2), a definition of “providing the content” is provided at subsection 9(3).
PART 3 R18+ CONTENT
Section 10 – Minimum requirements of an access-control system – R18+ content
Subsection 10(1) sets out the minimum requirements that an access-control system must include if it is to be considered a specified access-control system for R18+ content, or MA15+ and R18+ content. The inclusion of the category for “R18+ and MA15+ content” is intended to capture the situations where a designated content/hosting provider may want to use one access-control system for both MA15+ and R18+ content. This is done by reference to the obligations in sections 11 to 14.
Section 11 – Applying for access to R18+ content
Under section 11, an access-control system must require an applicant seeking access to R18+ content, or to R 18+ content and MA 15+ content, to apply for access either in writing, in electronic form or orally. This means that an applicant must take proactive steps to initiate the service (‘opt-in’).
The applicant must also provide a declaration, in writing or in electronic form, that they are 18 years or over.
Section 12 – Provision of warnings
The access-control system must provide warnings about the nature of R18+ content that is being accessed and must provide safety information about how a parent or guardian may control access to such content by persons under 18.
This is consistent with the Government’s policy to enhance online safety for children, which aims to ensure parents and guardians have access to online safety information and advice to assist them in managing their family’s online experience.
Section 13 – Confirmation of age
Section 13 requires that, in providing access to R18+ content, providers must do more than simply accept a declaration of age. An access control system should include an additional step to confirm that the applicant is at least 18 years of age. The subsection is not prescriptive in this regard, and there is scope for providers to consider a range of age-confirmation methods.
Reasonable steps may be established by transaction type – use of a credit card where content is fee-based, for instance. Other reasonable steps might link the application process to an already-validated age-restricted platform, allow provision of other identity related information, or allow applicants to use a token generated during another age confirmation process.
In determining what reasonable steps may be required when confirming age, consideration should be given to the type of service, and the type of content, the target audience for the service, as well as whether additional functionality, such as parental controls, are employed.
The flexibility in approach provides content service providers with the ability to develop platform specific solutions that accord with their business practice, while continuing to give effect to the policy objective that persons under 18 years old cannot access R18+ content. The flexibility recognises that new methods of age confirmation may be developed in the future, and allows industry to adopt new technological solutions as they become available.
Section 14 – Limiting access
Section 14 describes the instances in which an access-control system may provide
access to R18+ content, or to R18+ content and MA15+ content.
Under paragraph 14(1)(a), an access-control system must not provide access to R18+ content, or to R18+ and MA15+ content, unless:
- the applicant has applied for access (‘opted-in’); and
- the applicant has been provided with warning and safety information; and
- the access-control system has confirmed that the applicant is 18 years or over.
Under paragraph 14(1)(b) an access-control system may provide access to R18+ content, or to R18+ and MA15+ content, when an applicant has been provided with a PIN or some other means of limiting access, by which the access-control system can verify that the applicant:
- has previously applied for access (‘opted-in’);
- had their age confirmed by the access-control system; and
- been provided with warning and safety information.
The phrase “other means of limiting access” is to be interpreted broadly and may include any method a designated content/hosting service provider designs that allows an access-control system to uniquely recognise the applicant in question.
Under subsection 14(2) an access-control system may provide access to R18+ content, or to R18+ and MA15+ content, if an applicant has previously submitted evidence that the person is at least 18 years of age to the designated/hosting service provider (or to a person acting on behalf of the provider). The submission of proof of age is not required to have been made in relation to the particular application for access to content, however the proof of age provided on an earlier occasion must be sufficient to satisfy the requirement that reasonable steps be taken to confirm that an applicant is at least 18 years of age. For example, a designated content/hosting service provider may have the capacity to cross check other instances where a person may have submitted proof of age as in situations where age and identification are submitted for the establishment of an account.
In these circumstances, the access-control system must ensure that the applicant is provided with warnings and safety information on the first occasion on which they attempt to access R18+ content, or R18+ and MA15+ content. For the purpose of subsection 14(2), a definition of “providing the content” is provided at subclause 14(3).