Legal News

The new labour regulator The new labour regulator, formed by merging three separate existing enforcement bodies, will be empowered to provide guidance and support to staff taking legal action against their employers and to issue penalties to repay underpaid workers more quickly overall than pursuing an employment tribunal case themselves, Justin Madders told MPs. The agency will also be able to reclaim enforcement expenses from employers it successfully prosecutes, though this measure will be consulted on. ' We believe it is a key principle that, where wrongdoing occurs, the wrongdoer contributes towards the taxpayer’s costs of upholding the law,' Labour MP Madders said in the House of Commons......

On 11 March 2025, lawmakers voiced worries over clauses on EU– UK data adequacy in the bill and pressed for a 'crucial' fix. Speaking at a conference on 12 March 2025, Bryant said they would complete the legislation and aimed to have it on the statute book by Easter, or within a fortnight after. He acknowledged the Data ( Use and Access) Bill was probably two or three years out of date and should have been addressed sooner. The UK is now on its third bid to overhaul its post‑ Brexit data protection regime, yet he remained 'very hopeful' the bill will satisfy EU data adequacy requirements. Bryant noted the UK has already held talks with leaders at the European Commission. Back in December 2024, the EU’s executive initiated its review of the adequacy decision that underpins substantial data transfers between the EU and the...

In this issue: Data protection AML, CTF and counter-proliferation financing Cybersecurity Other Risk and Compliance updates this week Question of the week Daily and weekly news alerts Trackers New and updated content Data protection UK Data ( Use and Access) Bill: initial government revisions on accuracy checks and open banking MLex reported that, on 4 March 2025, the UK government introduced changes to the Data ( Use and Access) Bill progressing through Parliament, with the thrust aimed at supporting economic growth across digital services and open banking. One revision overturns a lawmakers’ amendment that would have required the technology minister to evaluate whether public authorities are consistently verifying the personal data they collect and share for digital verification services. The other measure hands the UK financial regulator authority to supervise and set rules for the open banking...

In a letter dated 10 March 2025, the Financial Conduct Authority ( FCA) and the Information Commissioner’s Office said they also plan to convene industry leaders to explore obstacles stopping financial services firms from adopting AI. According to FCA chief executive Nikhil Rathi and Information Commissioner Jon Edwards, a recent FCA and Bank of England survey revealed that companies and trade associations harbour worries about embracing these fast-changing technologies. They noted with interest that respondents identified data protection and the consumer duty as among the top three regulatory barriers to rolling out AI across the sector, based on the survey responses cited by Rathi and Edwards. ‘ These findings appear to demonstrate a......

What is the failure to prevent fraud offence? The FTPF offence arises where a large organisation gains from fraud carried out by its associated persons. The entity may incur liability if an associated person commits a specified fraud offence intending to benefit the organisation, whether that benefit is obtained directly or indirectly. A 'large organisation' is defined by reference to three size tests; it qualifies if at least two are met: (1) more than 250 employees (2) more than £36m turnover (3) more than £18m in total assets An 'associated person' broadly includes anyone who provides services for or on behalf of the relevant organisation, such as officers, directors, employees and agents, together with subsidiaries and employees of subsidiaries. Under the new offence, an organisation can be liable—and face an unlimited fine—for a wide range of fraud offences, including fraudulent...

These revisions form part of the government’s bid to remove changes inserted into the Bill by peers in the House of Lords, Parliament’s upper revising chamber. Addressing the issue of public authorities, the Minister of State for Media, Tourism and Creative Industries, Chris Bryant, explained that the Bill is meant to establish a trust framework setting rules for the nation’s digital verification services, rather than dictating how public bodies handle data. He added that existing data protection law already obliges public authorities to ensure personal data they process is accurate and, where necessary, kept current. Consequently, the government could not proceed with the amendment, Bryant told MPs on a House of Commons committee examining the Bill. The Bill began its parliamentary examination in the House of Lords, where changes were made in late 2024 and early 2025 by...

See Q& A: Is it possible for a firm supervised for anti-money laundering purposes to share information with another professional who is supervised for AML purposes, in the context of potentially submitting a suspicious activity report to the National Crime Agency? Sections 339ZB to 339ZG of the Proceeds of Crime Act 2002 ( POCA 2002) address how suspicious activity is handled within the regulated sector as follows: POCA 2002, s 339ZB permits voluntary disclosures and disclosures made by an individual working in a regulated sector business to another person in a regulated sector business, or to the National Crime Agency ( NCA), where requested by the NCA or by that other regulated sector person POCA 2002, s 339ZC describes the type of information a disclosure request must include and provides for the necessary...

On 6 March 2025, the European Banking Authority ( EBA), in draft advice to the European Commission on how to operate the AML regime, observed that enforcement by national supervisors is inconsistent. It put forward a set of common indicators to judge the gravity of breaches. The authority also explained that the proposed regulatory technical standards, which sit alongside the core AML rules, would oblige regulators to rate each infringement within one of four tiers, arranged by increasing seriousness......

Employment Rights Bill, As Amended ( Amendment Paper), 5 March 2025 Employment Rights Bill— Stages What are the implications? The Amendment Paper sets out the amendments lodged by 5 March 2025 for consideration at the report stage. There are no immediate consequences because it is still uncertain which of these proposals—if any—will be approved and trigger revisions to the ERB, although government-backed amendments remain more likely to pass. The consolidated schedule within the Amendment Paper also contains previously tabled, non-government amendments that we covered in our earlier News Analysis: Employment Rights Bill—non-government proposed amendments. The government’s suggested changes, many stemming from conclusions reached in its consultation responses, provide practitioners with an early indication of adjustments that are expected to filter into this key item of employment legislation. As a result, close monitoring of the debate remains advisable for all employment law...

In this issue: Data protection Sanctions AML, CTF & counter-proliferation financing Daily and weekly news alerts Trackers New and updated content Data protection Deepseek AI— What is it and what do legal teams need to know about it? Deep Seek, a China-based company, has created Deep Seek AI, a sophisticated artificial intelligence model. Its stated aim is to push the frontiers of AI to deliver solutions that strengthen businesses and enhance human capability, and to ensure advanced AI is accessible, ethical and impactful. Founded in 2023, the company swiftly rose to prominence through its free, open-source language models. Most recently it unveiled two leading models: V3, for broad applications such as conversational AI, and R1, focused on reasoning-heavy tasks like programming and maths problems. R1 has attracted substantial media attention by offering cost-efficient AI compared with top US models....

Long-trailed changes appended to the Crime and Policing Bill 2025, laid before Parliament by Home Secretary Yvette Cooper on 25 February 2025, aim to broaden corporate criminal liability and fortify investigations to recoup the assets of fraudsters. The draft law would likewise curb the financial risks borne by enforcers in litigation. Here, Law360 flags three aspects of the government’s new Bill you may have overlooked. Corporate criminal liability widens The centrepiece for white-collar specialists is a plan to extend the spectrum of offences for which a corporate body can face criminal liability when they are committed by senior managers. After years of prosecutorial frustration, the Economic Crime and Corporate Transparency Act 2023 ( ECCTA 2023) overhauled the legal test, allowing authorities such as the Serious Fraud Office ( SFO) to hold companies liable for economic offences carried out by their senior managers. These fresh...

The government plans to issue the next assessment of the UK’s money laundering and terrorist financing threats before year-end. It may offer a revealing snapshot of the present landscape. Under the Money Laundering, Terrorist Financing and Transfer of Funds ( Information on the Payer) Regulations 2017, HM Treasury and the Home Office must produce periodic joint reports on the money laundering and terrorist financing dangers within the UK. No fixed timetable governs compilation or release, yet both departments are obliged to keep their assessment of risk current. The most recent edition appeared in 2020. At that time, increasing reliance on cash-intensive enterprises to conceal the proceeds of crime was highlighted as a concern, together with the emerging issue of cryptocurrencies being used for money laundering. There is no set calendar for their production and publication; however, both institutions must ensure their...

Jim Harra, who leads HM Revenue and Customs ( HMRC), wrote in a letter to lawmakers on the UK’s Treasury Select Committee stating that last year recorded the highest number of inquiries opened into suspected sanctions breaches. Twenty-seven of these were connected to potential Russian breaches, Harra noted. Those totals contrast with 2023, when 22 cases were opened, with 20 of them linked to Russia. In 2021, no criminal sanctions cases were initiated, the letter added. HMRC oversees the enforcement of sanctions breaches associated with the import and export of goods, according to his correspondence......

What is the Deepseek AI model? Deep Seek AI is a cutting-edge artificial intelligence system built by Deep Seek, a company based in China. The organisation’s mission centres on stretching the limits of AI to deliver tools that empower enterprises and elevate human capability, while keeping advanced AI accessible, ethical and meaningful. Established in 2023, Deep Seek rose swiftly through the AI ranks by releasing free, open-source language models. Most recently it unveiled two high-end models: V3, aimed at broad use cases such as chat-style applications, and R1, tailored for reasoning-heavy work, including programming and maths challenges. R1 has drawn notable media interest by offering cost-conscious AI performance when set against leading US counterparts. Why is it having a big impact on technology markets around the world? Deep Seek AI is reshaping global tech markets largely through its cost efficiency. Reports suggest the company trained its system for...

Deep Seek has been asked to explain how it protects the data of UK residents, the ICO has told MLex. The ICO is now also among a widening group of jurisdictions scrutinising the Chinese artificial intelligence ( AI) developer, with several renewing their enquiries after the company revised its privacy policy in what appears to be an effort to meet elements of data-protection legislation. The watchdog confirmed to MLex that it has 'written to Deep Seek, requesting information on its approach to data protection for UK residents', a spokesperson said......

Risk & Compliance weekly highlights—20 February 2025 In this issue: Risk & Compliance forecast Data protection and AI Financial sanctions AML, CTF & counter-proliferation financing Other Risk & Compliance updates this week Daily and weekly news alerts New and updated content Risk & Compliance forecast New Risk & Compliance forecast as at 18 February 2025 Our latest Risk & Compliance forecast (dated 18 February 2025) is now available. This edition covers, among other matters: (1) the ICO’s intention to introduce a Data Essentials training and assurance programme for SME’s; (2) the JMLSG’s consultation on proposed amendments to Part I of its Guidance; (3) the forthcoming FATF Plenary on 19–21 February 2025; and (4) our refreshed and expanded fraud risk management materials. See News Analysis: New Risk & Compliance forecast as at 18 February 2025. Data protection and AI EDPB adopts...

New Risk & Compliance forecast as at 18 February 2025 Our Risk and Compliance forecast, current as at 18 February 2025, maps forthcoming regulatory shifts relevant to risk and compliance, helping you plan for developments that may affect your organisation. It merits a thorough read, though we highlight a few priority items below. New items we’re tracking this month Data Essentials training and assurance programme for SMEs — The ICO intends to introduce a Data Essentials training and assurance programme for SMEs in 2025–26. See: Data protection, AI and cyber security. JMLSG consultation on revisions to Part I of its Guidance — The Joint Money Laundering Steering Group has launched a consultation on proposed updates to Part I of its Guidance, closing on 28 March 2025......

Key elements of the AI system definition Given the wide variety of AI systems, the guidance cannot offer a complete list. Each system must be evaluated on its own particular characteristics. The EU AI Act adopts a lifecycle-oriented approach and characterises an AI system as: a machine-based system designed to operate with differing degrees of autonomy that may show adaptability after deployment and, for explicit or implicit aims infers from the inputs it receives how to generate outputs such as predictions, content, recommendations, or decisions that can affect physical or virtual environments This seven-part definition spans two main stages: pre-deployment (building phase) and post-deployment (use phase). The seven elements need not be present throughout both stages; some may appear only at one point. The following offers a brief summary of each of the seven points listed...

The Bill’s principal aims, as signalled by its long title, are to create an independent Office of the Whistleblower ( OWB) and to safeguard both whistleblowers and the practice of whistleblowing. The OWB would be empowered to set, oversee and enforce minimum standards for managing whistleblowing matters. This would encompass establishing protocols for handling protected disclosures, providing independent disclosure and advice services, undertaking whistleblowing investigations, and directing redress for any detriment suffered by whistleblowers. Should the OWB be established, it would represent a substantial shift for organisations in how whistleblowing is addressed, notably by offering individuals the option to report concerns to an independent third-party body with investigatory powers. To understand the Bill’s impetus, how we have reached this point, the case for changing perceptions of whistleblowing, and the treatment of whistleblowers and the response to their reports, it is useful first to...

In this issue: Data protection Financial sanctions Cybersecurity Other Risk & Compliance updates this week Daily and weekly news alerts Trackers New and updated content Data protection The Information Commissioner’s Office ( ICO) has issued its definitive guidance on retaining employment records. Aimed at employers processing personal information, it supports compliance with the General Data Protection Regulation and the Data Protection Act 2018. Replacing the version consulted on in 2023, the final guidance was published on 5 February 2025. The ICO advises reading it alongside its broader employment and data protection materials. See: LNB News 11/02/2025 50. The ICO has also refreshed its response to the Data ( Use and Access) ( DUA) Bill after the Bill’s passage through the House of Lords, discussing amendments made at Lords stage and commenting on key areas of...