Navigating the Law: Online Safety
As our lives become increasingly digital, the boundaries between privacy, reputation, and security are growing harder to manage. In this conversation, reputation lawyer Hanna Basha and criminal defence specialist Mark Jones, both Partners at Payne Hicks Beach, take us through the legal landscape of digital risk, from everyday oversharing and phishing scams to blackmail, deepfakes, and protecting children online. What the law can do, where it falls short, and what every woman should know before something goes wrong. What we share, whether casually, professionally or without much thought, can reveal far more than we intend and in some cases leave us more exposed than we realise.
A decade ago, digital risk was largely treated as an IT problem. Something for the tech team to handle, contained behind screens and firewalls, separate from the business of living. That framing has not survived contact with reality. As Hanna Basha, a partner in the reputation team at Payne Hicks Beach, puts it: the speed at which information now travels has changed everything. What once moved at the pace of a print cycle can now circle the world in minutes. And once it moves, it is very difficult to stop.
The Risks People Underestimate
Oversharing is the starting point for almost every vulnerability. Not just the obvious kind, where someone posts more than they should, but the structural kind, where people fail to understand the cumulative effect of what they put out there. A school photograph here, a Strava route there, a house tour on Instagram. Individually, each seems harmless. Together, they become a roadmap.
Mark recalls a case involving a private equity executive whose daily run was logged on Strava at the same time each morning. His wife posted the school drop-off. Their home address was visible in various background details. A group of burglars assembled the picture and acted on it. No single piece of information gave them everything. The combination did.
"You're not thinking about it when you upload your Strava run every day, that you're actually telling people where you are. You're just trying to look fit and healthy."
Mark Jones, Payne Hicks Beach
Beyond social media, the connected home introduces risks that are far less visible. Smart cameras, thermostats, robot vacuum cleaners with cameras embedded in them, baby monitors, all of these devices represent potential back doors into a home network. The companies that build them are generally thinking about convenience, not adversarial use. Parents using video monitors to check on sleeping children are not thinking about who else might be watching.
There is also the question of overconfidence in security measures. Auto-generated passwords feel thorough. Regular software updates feel like due diligence. Neither is sufficient on its own. Hanna frames it simply: security needs to go further than the defaults, and it takes active thought to get there.
Where the Law Enters
The legal landscape around digital harm is, in Hanna's words, not perfect and far from it. There is no single body of online law. The Online Safety Act has introduced an important regulatory framework, with Ofcom acting as the overseer of internet safety obligations on platforms. But most of the legal tools being used to address digital harm are older laws, defamation, privacy, data protection, harassment, blackmail, being applied to new contexts.
Mark's work tends to sit at the criminal end: offences that have always existed but now play out online. Blackmail. Indecent images. Harassment. Stalking. The conduct is familiar; the medium is new. Hanna works the civil side, seeking injunctions, pursuing takedown orders, bringing claims for misuse of private information. In practice, many cases involve both dimensions at once, which is why the two work together as often as they do.
The concept that comes up repeatedly in conversation is the civil-criminal crossover. Blackmail is a good illustration. When someone threatens to release private images or recordings, that is a criminal matter. But stopping those images from reaching the public domain is a civil one. Getting an emergency injunction, identifying where material is being held, pursuing takedown requests across multiple platforms in multiple jurisdictions: this is concurrent work, happening in parallel, often at speed and often at weekends.
Doxing, though not a formal legal term, is another area where the law has to improvise. The behaviour involves the exposure and weaponisation of personal information, sometimes accurate, sometimes fabricated, but the remedies available depend on what exactly is being done: defamation if the content is false, harassment or stalking if the conduct is persistent, privacy claims if genuinely private material has been exposed. The law reaches for the nearest available tool rather than one designed for the purpose.
When Something Goes Wrong: The Question of Timing
Time is the currency that matters most in these situations. If private images are published online, the window between first publication and meaningful containment is often measured in hours, not days. Social media companies are improving at responding to takedown requests, Hanna notes, but if material has been live for twenty-four or seventy-two hours it can already have spread far beyond the original post. Getting in early is not just advisable; it is often the difference between a manageable situation and one that cannot be contained.
Both lawyers are clear that there is no formula for when to escalate from managing something yourself to seeking advice. Mark's answer is to trust instinct. If blocking someone or asking them to remove content produces unease rather than resolution, that feeling is probably telling you something. Hanna adds a practical note: calling for an initial conversation costs nothing and is usually clarifying. They see this kind of situation constantly and can quickly assess whether legal action is warranted or whether a lighter response is appropriate.
What they caution against is a knee-jerk reaction in either direction. Escalating immediately can inflame a situation that would otherwise resolve itself. Doing nothing can allow it to metastasise. The other risk, which Mark raises with particular emphasis, is that the way people gather evidence in these situations can create legal problems of its own. Recording phone calls without consent, downloading WhatsApp messages without proper authority, these acts can complicate a later criminal complaint or civil case. The person who starts as the victim can inadvertently become someone who has also done something wrong.
Children and the Digital Generation
Mark has been in practice for more than twenty years, and the change he describes in what arrives at his door is stark. Children are now the subjects and perpetrators of online harm in ways that would have been almost inconceivable when he started. What used to happen in playgrounds, visible to teachers, subject to adult supervision, has migrated online and become invisible. Unless a child chooses to share what is happening, parents may have no idea.
The range of harms is wide. Cyberbullying. Deepfakes. Images shared without consent among peer groups. Grooming by adults who exploit the anonymity and informality of messaging platforms. A 2024 study estimated that over three hundred million children globally were either sexually exploited online or the subjects of indecent images in a single year. That number centres the scale of what is at stake.
Hanna is candid about the inadequacy of current structures. Safeguarding, education and criminal law have not yet caught up with a generation that has grown up entirely digital. Some situations that should escalate quickly do not. Others that need careful handling get reported immediately, which can have serious unintended consequences.
One scenario both lawyers have encountered more than once: a parent, convinced their child is the victim, makes a complaint to the school or the police, only to discover that their child was the perpetrator. Children, when confronted in high-pressure circumstances, do not always tell the truth. Knowing your child, and knowing whether you need to gather more information before acting, matters enormously.
If your child tells you something is wrong online
If there is immediate danger, call the police. If there is not, take a breath before acting. Gather information from your child in as supportive a way as possible. Think carefully about how to preserve evidence rather than deleting or blocking immediately. Do not record calls or download messages without proper advice. Consider speaking to a specialist before making a formal report. The person who makes the complaint is not always the victim.
The practical heart of the advice on children is education, beginning at home, and continuing as children move through adolescence. The same conversations that adults should be having about what they share online, about who has access to it, about what could go wrong if it reaches the wrong person, are conversations that teenagers need to be having too. Not in a way that produces paralysis or anxiety, but as second nature, in the same register as road safety or financial literacy.
The Deepfake Horizon
Both lawyers identify AI as the defining emerging risk. Not in the abstract, speculative sense, but in terms of cases that are already happening. Last year a finance executive transferred twenty-five million dollars after a video call that appeared to show his colleagues and CFO. Every person on that call was a deepfake. Oprah Winfrey, Nigel Lawson and others have had their likenesses used in fraudulent product endorsements without their knowledge or consent.
The deeper problem Hanna identifies is evidentiary: as it becomes possible to fabricate convincing audio and video, the reliability of documents and recordings as proof breaks down. Courts and legal processes depend on the credibility of evidence. A legal landscape in which any recording might be a fabrication, any photograph a construction, creates a challenge that the law has not yet worked out how to answer.
Mark adds the issue of AI hallucination as a risk in its own right. Lawyers have already submitted briefs citing cases that do not exist, generated by AI tools that produce plausible-sounding references. Individuals running personal queries through AI tools receive confident, wrongly attributed information. The rule that applies to everything in the digital world applies here too: do not take things at face value.
The Practical Audit: Where to Start
The most useful note the conversation ends on is a simple, actionable one. Both lawyers recommend treating your online presence as something that requires periodic review, not as a one-time setup but as what Hanna calls online hygiene, a regular check that sits alongside other security and privacy habits.
Your basic digital audit
Open a browser in incognito or private mode. Search your full name in quotation marks. Then add your location. Then try your maiden name and any nicknames.
Check what comes up on aggregator sites such as Spokeo and Whitepages, which pull together publicly available information. Free searches give a useful starting point.
List the accounts you actually use. Identify any that are dormant. Old accounts with saved passwords are a soft target for identity theft.
Review your privacy settings across active social media profiles. Think about who can actually see what you post.
Consider the zones of your life you are comfortable sharing publicly. Professional information may be appropriate. Details about your children, home address, family movements, or personal relationships carry different risks.
Extend this thinking to your network. What are friends and family sharing about you? A dinner party photograph in someone's home can reveal location, company, and valuables, whether or not that was the intention.
Repeat this review annually, or when your circumstances change significantly.
The final point both experts return to is balance. For most people, most of the time, online life does not produce the kind of severe harms that Mark and Hanna spend their working days addressing. The risk is real, but it is not reason for paralysis. It is reason for awareness, for a small shift in how you think before you post, and for knowing that when something does go wrong, there are steps available and people who can help you take them.
If something does not sit right with you, trust that instinct. And if you need a sense check, pick up the phone.
Authored with:
Hanna Basha, Partner | Payne Hicks Beach T: 020 7465 4371 E: hbasha@phb.co.uk
Mark Jones, Partner | Payne Hicks Beach T: 020 7693 5875 E: mjones@phb.co.uk