Legal News

The Code joins an expanding roster of UK cybersecurity measures, including: the Code of Practice for Software Vendors the Cyber Governance Code of Practice the Consumer Io T Code of Practice the Product Security and Telecommunications Infrastructure Act 2022 the Code of Practice for app store operators and app developers It also sits within a broader UK cybersecurity strategy that features a new UK Cyber Security and Resilience Bill and likely updates to the Network and Information Systems Regulations 2018, with the prospect of further legislation—for example, the recent consultation on ransomware payments. Background to the Code The UK Government acknowledged that software must be secure by design (a term familiar to those versed in data protection law) and that stakeholders across the AI supply chain need certainty on baseline security expectations. Developed by the Department for Science,...

The ICO stresses it has acted swiftly in step with rapid advances in generative AI. Demonstrating this agility, it opened a consultation series in January 2024 focused on generative AI and data protection. Its aim was to set out how organisations might build and implement generative AI while meeting UK data protection duties, especially those in the United Kingdom General Data Protection Regulation, Assimilated Regulation ( EU) 2016/679 ( UK GDPR). The ICO highlighted that adherence to the data protection framework is paramount when using generative AI, as such models are commonly trained on vast volumes of personal data. The consultation raised worries about insufficient transparency over how personal information is used within generative AI, which in turn creates the risk that data protection rights could be undermined......

The Opinion arose from a referral by the Irish Data Protection Commission ( DPC) under Article 64(2) of the EU General Data Protection Regulation, Regulation ( EU) 2016/679 (the EU GDPR). Article 62(4) allows any EU data protection authority ( DPA) to put questions to the EDPB that are of general relevance or have implications across more than one EU Member State, with the aim of enhancing harmonisation and clarity on such matters. Over the past twelve months in particular, DPAs have been wrestling with AI, and the DPC—acting as lead DPA for many of the world’s largest technology companies—has frequently led on the most urgent issues. While EDPB Opinions, akin to guidelines, do not have binding legal force, they will strongly shape how DPAs proceed; accordingly, we should expect the Opinion’s principles to appear in national guidance and...

Here, Law360 looks at why justices upheld Khan's designation and other takeaways from the Court of Appeal's 24 January 2025 judgment. The Office of Financial Sanctions Implementation ( OFSI) licensing route — designed to allow designated people to cover essentials like water and power — was overwhelmed to the point that, the Court of Appeal heard, Anzhelika Khan spent months waiting for official clearance simply to buy food for herself and her children. Delivering a scathing assessment, the judges observed that Khan could have faced prosecution for the mere act of eating. The court concluded that the government had given scant consideration to how those subject to an OFSI asset freeze were meant to get by without breaking the law. “ It is striking that the judges condemned this regime as profoundly inhumane, effectively forcing a mother to choose between obeying the law and...

Risk & Compliance weekly highlights—30 January 2025 In this issue: Data protection Financial sanctions AML, CTF & counter-proliferation financing Fraud Daily and weekly news alerts Trackers New and updated content Data protection ICO launches strategy to tackle online tracking compliance in UK The Information Commissioner’s Office ( ICO) has unveiled a wide‑ranging plan to improve adherence to online tracking rules across the UK’s digital environment. Its remit now extends from the leading 200 to the top 1,000 UK websites, with the goal of giving users genuine control over how their personal data is tracked. The programme features fresh guidance on ‘consent or pay’ approaches, intended action on compliance within apps and connected TVs, and probes into data management platforms across the adtech ecosystem. This guidance explains how to meet data protection law, concentrating on power imbalance, suitable fees,...

‘ We will produce a single set of rules…for those developing or using AI products to make it easier for them to innovate and invest responsibly while safeguarding people's information rights’ He noted, reading from his letter. He argued that a statutory AI code of practice would offer greater regulatory certainty to companies seeking to invest in AI. He also cited an estimate that AI could contribute £47bn to the UK economy each year. In late December 2024, Prime Minister Keir Starmer wrote to a host of regulators requesting a set of five pro-growth proposals, and the Information Commissioner's Office ( ICO) replied with seven in total......

The developer’s privacy notice states that all user information is transmitted to China, where it is retained indefinitely, and it makes no reference to European data protection law or any lawful basis for processing personal data. Although the model’s apparently strong performance on a modest training budget has depressed the share prices of US technology companies, consumer organisations in Europe have begun contacting Italy’s Data Protection Authority ( DPA), noted for proactively challenging Open AI two years ago over comparable issues linked to the launch of Chat GPT. The user terms for the Deep Seek generative AI application, jointly controlled by two Chinese companies, present multiple concerns for authorities responsible for enforcing the EU’s General Data Protection Regulation, Regulation ( EU) 2016/679 ( EU GDOR). All personal data is stored on servers located in China. Transfers will be “in...

The guide has formed part of the FCA’s Handbook of Rules and Guidance since 2011, and the FCA is keen to keep it a practical source for firms, both now and in future. The aim of the revisions is to help businesses grasp the regulator’s expectations, judge whether their financial crime systems and controls are adequate, and remedy any issues uncovered during that review. As its title implies, the guide offers guidance only, not binding rules. It sets out clear, overarching direction on what a rounded, holistic approach to compliance should look like, followed by chapter-by-chapter detail closely aligned to specific financial crime prevention legislation and regulatory expectations. Key changes Sanctions systems and controls Following Russia’s invasion of Ukraine, the FCA carried out wide-ranging reviews of firms’ sanctions systems and controls, and has revised the relevant chapter to capture those insights. Respondents welcomed...

Maximilian Schrems v Meta Platforms Ireland Ltd , Case C-446/21 What are the practical implications of this case? The ruling in Schrems v Meta Platforms Ireland arrives 14 months after the Court of Justice, in Meta vs Bundeskartellamt ( Case C‑252/21), concluded that merely accessing a site or app does not, in itself, make a user’s personal data manifestly public—thereby eliminating reliance by a social network on Article 9(1)(e) of Regulation ( EU) 2016/679, the General Data Protection Regulation ( EU GDPR). Schrems v Meta Platforms Ireland narrows the scope for processing special category data on social platforms and offers significant clarification on handling data that has been manifestly made public (and where explicit consent is invoked). Notably, it emphasises the nexus between a person issuing a public statement—which can render particular information manifestly public—and a platform’s deployment of pixels and cookies to track online...

Risk & Compliance weekly highlights—23 January 2025 In this issue this week: Risk & Compliance forecast Data protection Financial crime prevention Other Risk & Compliance updates this week Daily and weekly news alerts New and updated content Risk & Compliance forecast New Risk & Compliance forecast as at 21 January 2025 Our latest Risk & Compliance forecast, dated 21 January 2025, has been released and is now live for readers. This edition covers, among other topics: (1) draft ICO guidance on technologies for storage and access, and how to disclose information safely; (2) the launch of a consultation proposing measures to tackle the threat of ransomware; (3) the first reading of a Private Members’ Bill to create an independent Office of the Whistleblower to safeguard whistleblowers and whistleblowing, and (4) ICO statements on expectations for several pieces of guidance to be...

New Risk & Compliance forecast as at 21 January 2025 Our Risk and Compliance forecast dated 21 January 2025 monitors forthcoming regulatory developments affecting risk & compliance, helping you to prepare in good time for any shifts that could impact your organisation and plan the necessary responses. Please read it closely; however, we’ve highlighted a few matters that should already be on your radar below for ease of reference. New items we’re tracking this month ICO draft guidance on storage and access technologies— In late December 2024, the ICO opened a consultation on draft guidance explaining how data protection law (including PECR 2003, SI 2003/2426) applies to storage and access tools such as fingerprinting. This consultation ends on 14 March 2025. See: Data protection, AI and cybersecurity. Ransomware— The government has issued a consultation setting out proposals to address the ransomware threat, including plans for...

On 17 January 2025, the High Court authorised an order for the white-collar anti-fraud authority, marking the first occasion the SFO has attempted to exercise a power brought in seven years earlier to pursue the contaminated wealth and holdings of corrupt elites in practical application to date. Yet instead of deploying the order to chase oligarchs' holdings, the SFO used it to obtain financial details concerning a property owned by Timothy Schools' former wife in order to inform ongoing inquiries. The lawyer received a 14-year sentence in 2022, having been found guilty of fraud for siphoning off millions of pounds earmarked for a legal aid fund improperly. The SFO considers this the first instance of a UWO being pursued post-conviction to restrain potentially tainted assets and compel accounts of the provenance of the property and acquisition. Securing the order...

Background to OTSI guidance Following Russia’s assault on Ukraine in February 2022, the UK brought in trade sanctions covering a broad spectrum of goods, technology and services. Although direct commerce between the UK and Russia has fallen markedly since these measures were imposed, Russia has continued attempting to source such items indirectly, often via intricate supply chains. This trend has heightened the exposure of UK businesses to sanctions circumvention and the diversion of products to Russia. The methods used to sidestep restrictions are diverse and evolve rapidly, including fabricated end-use details, routed shipments, and the involvement of professional sanctions evasion networks. Participants across supply chains must recognise the diversion threats created by Russia’s procurement activity in this changed environment. Among other provisions, UK trade sanctions bar the export from the UK of sanctioned items to, or for use in, Russia, even where those items are first...

Key trends shaping corporate ethics and compliance landscape in 2025 Stakeholder expectations often conflict From ESG criteria and supply chain disclosures to the priorities of a millennial workforce, alongside activist investors and consumers, pressure is mounting for companies to behave ethically and with social responsibility — not merely to meet legal requirements, but to mirror the wider values of customers, staff, investors and other stakeholders. Yet consensus on what counts as 'ethical' or 'socially responsible' is scarce. Consider the ongoing Carter v Southwest Airlines Co case before the US Court of Appeals for the Fifth Circuit, pitting the airline against a flight attendant over her social media posts about abortion. At its core lies the clash between an employee's right to voice deeply held views and an employer's aim to preserve workplace civility. Across issues spanning abortion, immigration, global warming and diversity, employees, investors and...

Risk & Compliance weekly highlights—16 January 2025 In this issue: Financial sanctions Cybersecurity Other Risk & Compliance updates this week Daily and weekly news alerts Trackers New and updated content Financial sanctions FCDO announces new sanctions on Russian oil giants In concert with the United States, the Foreign, Commonwealth & Development Office has unveiled sweeping measures against Gazprom Neft and PJSC Surgutneftegas. Brought in under the Russia ( Sanctions) ( EU Exit) Regulations 2019, SI 2019/855, the restrictions hit firms pumping more than one million barrels a day, worth around £23bn a year. The objective is to curtail the oil income that underpins Russia’s campaign in Ukraine; such revenues made up about a quarter of Russia’s 2023 budget. The move builds on sanctions already placed on 93 ships in Russia’s shadow fleet, underscoring the UK’s resolve to keep up pressure on the...

BBC World Service cited tests which it claimed showed that 17 products, largely own-brand lines, were likely to include Chinese tomatoes. The supermarkets offering these goods have challenged the BBC’s conclusions. The findings were also showcased in the BBC Panorama episode, ‘ What’s on Your Supermarket Shelves? The Dark Side of the Tomato Trade.’ The investigation reported that China produces about a third of the world’s tomatoes—principally from the Xinjiang region—where production is, it alleged, connected to forced labour involving Uyghurs and other predominantly Muslim minorities. Chinese officials reject assertions of coercion in the tomato industry and contend that workers’ rights are protected by law. This raises complex issues for UK grocers stocking such items, who may find themselves within the scope of the Proceeds of Crime Act 2002 ( POCA 2002) as a...

Prosecuting oligarchs Prosecuting oligarchs is only one gauge of how effective Britain’s sanctions regime has been, which has made their lives ‘more difficult in the UK’, according to Celestino Calabrese, the deputy head of illicit finance at the National Crime Agency ( NCA). Action for sanctions breaches has taken time to bite, notably, yet curbs on finance have stripped oligarchs of wealth and mobility while stopping their facilitators from moving assets beyond the authorities’ reach, Calabrese told Law360 in an interview. Britain’s success in tracing holdings and securing cooperation from the regulated sector overall is ‘why there seems to be a relatively low level of criminal enforcement activity’. As a result, indeed, it is ‘extremely difficult for designated parties to circumvent financial sanctions controls’, Calabrese said. ‘ The people that we’re looking at are very serious, and they’re looking at us and what we’re doing’, here, he...

In this issue: Financial sanctions Other financial crime Other Risk & Compliance updates this week Daily and weekly news alerts Trackers New and updated content Financial sanctions HM Treasury announces amendment to OFSI General Licence INT/2022/1280876 HM Treasury has confirmed that General Licence INT/2022/1280876 has been revised to add Permission 5.3A. Under this clause, distributions on VTB Bank PJSC’s claim must first be reduced by the value of any VTB Capital plc assets that are the subject of VTB Bank PJSC enforcement action, together with the VTB Group Receivables. It also bars the payment of statutory interest for any period when distributions are withheld as a result of these deductions. This change follows a series of earlier amendments to the licence, which has been in force since 1 March 2022 and concerns financial sanctions relating to VTB Bank and its...

Elsewhere, a Chinese woman accused of washing bitcoin faces trial, while former Barclays chief Jes Staley plans to contest his prohibition imposed by the Financial Conduct Authority ( FCA). And the Serious Fraud Office ( SFO) will finish the year still resisting ENRC's claim for £240m in damages over the agency’s mishandled investigation into the mining group affair. Here, Law360 surveys these matters alongside other corporate crime cases to monitor in the year ahead. SRA v Dentons, round two The Solicitors Regulation Authority ( SRA) intends to contest findings that Dentons’ anti-money laundering shortcomings did not amount to professional misconduct, a ruling delivered in June 2025 instead. At an appeal listed for 29 January 2025 in the High Court, the legal regulator will seek to overturn the Solicitors Disciplinary Tribunal’s dismissal of its case alleging Dentons UK and Middle East LLP breached...

In other developments, two ex-executives were partly cleared of bribery allegations and the Serious Fraud Office ( SFO) struck an eleventh-hour deal with Eurasian Natural Resources Corp ( ENRC). A judge also delivered a scathing judgment, concluding a once-favoured investment scheme was nothing more than a £250m Ponzi operation. Law360 sets out the standout corporate crime and civil fraud matters from the last year. Assange walks free after plea In June 2024, Julian Assange flew to Australia as a free man after admitting a conspiracy charge brought by the US Department of Justice ( DOJ), drawing a line under his ten-year fight to resist extradition to America. The unexpected resolution followed covert talks and a surprise private bail appearance in London. A session before a US federal judge in the Northern Mariana Islands, in the Pacific Ocean, capped a frenetic week. The pact halted the DOJ’s...