Legal News

The European Union’s executive body intends to reduce the administrative burden by drafting a single, wide‑ranging law that ‘draws from numerous dossiers to curb bureaucracy, to lighten reporting obligations’, the Commission President told assembled journalists during a press conference. Von der Leyen’s statement followed a meeting of EU heads of state and government held on 8 November 2024 in Budapest, where they......

Risk & Compliance weekly highlights—7 November 2024 In this issue: Data Protection Financial Sanctions Other financial crime Other Risk & Compliance updates this week Question of the week Lex Talk®Risk & Compliance: a Lexis®Nexis community Daily and weekly news alerts Trackers New and updated content Data Protection EDPB adopts report on first review of EU- US Data Privacy Framework The European Data Protection Board has approved a report from its initial review of the EU– US Data Privacy Framework. It commends progress on implementing the DPF, while urging active supervision of DPF‑certified organisations and clearer guidance on cross‑border transfer obligations. The Board recognises that the redress mechanism is in place, but seeks close observation of how it works in practice and of safeguards grounded in necessity and proportionality. It advises that the EU– US adequacy decision be...

The SFO disclosed via a Freedom of Information Act request that it had spent £16m over a decade probing ENRC, before abandoning the prosecution in 2023 due to a lack of admissible evidence. Since 2016, the agency has further paid £12m to external lawyers, including Eversheds Sutherland LLP, on civil proceedings as it defended the original decision to commence the criminal inquiry. An SFO spokesperson on 6 November 2024 said the expenditure reflected a lengthy, complex investigation that pursued every reasonable lead, alongside a robust defence of ENRC’s claims following the launch of the probe. The figures were posted on the SFO’s website on 31 October 2024. However, ENRC’s sought damages in the civil action could yet surpass those sums. ENRC, the mining giant at the centre of the probe, was investigated for ten years, with the SFO stressing that...

Equality ( Race and Ethnicity) Bill In October, the Labour government reignited its longstanding goal to require employers to disclose pay disparities across racial groups, resurrecting a plan shelved by the Conservatives as unworkable. The draft Equality ( Race and Ethnicity) Bill would compel organisations with over 250 employees to publish ethnicity and disability pay gaps, mirroring gender reporting. It will need further regulations and likely will not arrive until the latter part of Labour’s five-year term. Lawyers warn this sweeping framework will pose fresh tests for employers: from methods for gathering and submitting data to government, to managing employee and stakeholder reactions to the process—and to any disparities exposed. Many had anticipated ethnicity reporting would come first, as some major employers already gather those figures voluntarily. Yet even ethnicity reporting—more familiar than the uncharted task of calculating disability gaps—is far more...

See Q& A: Does preparing a deed of surrender amount to a reserved legal activity? If it does, can a solicitor employed by a non‑authorised organisation draft such a deed? Reserved legal activities Under section 13 of the Legal Services Act 2007 ( LSA 2007), only certain persons may undertake reserved legal activities: authorised by an approved legal services regulator identified in LSA 2007, Sch 4; or exempt under LSA 2007, Sch 3, which provides tailored exemptions for each reserved legal activity; or (pursuant to transitional provisions still in force) non‑commercial bodies, eg not‑for‑profit organisations and trade unions The reserved activities are listed in LSA 2007, s 12, and the scope of each is defined in LSA 2007, Sch 2......

In this issue: Data protection Financial sanctions AML, CTF & counter-proliferation financing Other financial crime Other Risk & Compliance updates this week Daily and weekly news alerts Trackers New and updated content Data protection Expansive Data ( Use and Access) Bill introduced to Parliament The Data ( Use and Access) Bill was brought before the House of Lords on 23 October 2024, commencing its passage through Parliament. Backed by the Department for Science, Innovation & Technology, the legislation is designed to spur economic growth and enhance public services, with forecasts suggesting roughly a £10bn contribution to the UK economy over a decade. Insights are provided by Victoria Hordern, partner at Taylor Wessing LLP, Kuan Hon, Of Counsel at Dentons, and Dan Whitehead, Counsel at Hogan Lovells International LLP. See: LNB News 24/10/2024 63. Global privacy bodies issue joint...

In December 2023, OTSI was set up as a new government body within the Department for Business and Trade ( DBT), tasked with civil enforcement of certain trade sanctions connected to UK services and overseas trade with a UK nexus. On 10 October 2024, the UK government formally launched OTSI, mandating it to reinforce sanctions enforcement and assist businesses with compliance. Trade sanctions cover restrictive measures relating to: the movement of goods the transfer of technology the provision of services Breaching trade sanctions is also a criminal offence, with enforcement by HM Revenue and Customs ( HMRC). This article examines OTSI’s principal civil enforcement powers under the new legislation, how it will work alongside other law enforcement authorities, and the potential effect on the UK’s interwoven sanctions landscape. We also consider a distinct difference between OTSI and HMRC in how they may pursue trade...

Risk & Compliance weekly highlights—24 October 2024 In this issue: Data protection and cyber security Financial sanctions AML, CTF & counter-proliferation financing Other financial crime Other Risk & Compliance updates this week Question of the week Daily and weekly news alerts Trackers New and updated content Latest Q& A Data protection and cyber security EAC outlines proposals on the future of UK- EU data adequacy The House of Lords European Affairs Committee ( EAC) has sent a letter to the Secretary of State for Science, Innovation and Technology, capturing the Committee’s key findings and recommendations arising from its inquiry into UK- EU data adequacy. See: LNB News 22/10/2024 111. NCSC publishes advice on communicating during a cyber security incident The National Cyber Security Centre ( NCSC) has issued guidance for organisations on managing...

Practical delivery remains daunting, highlighted by the European Commission’s plan to push back by 12 months the commencement of the European Union Deforestation Regulation, allowing businesses extra time to ready themselves for its granular legal due diligence obligations. The range of moving parts companies must weigh includes: the EU Corporate Sustainability Due Diligence Directive, or CSDDD, which took effect at the end of July the significant ruling on supply chain oversight issued by the Court of Appeal in World Uyghur Congress v National Crime Agency in late June, and recent corporate supply chain shortcomings that have undermined trust and re-emphasised established benchmarks such as the UK’s Modern Slavery Act 2015 Alongside more enduring soft law, reference points include the Organisation for Economic Co-operation and Development Guidelines for Multinational Enterprises and the United Nations Guiding Principles on Business and Human Rights. Viewed together, these shifts underline the need to...

Whistleblowing ( Reporting and Disruption of Fraud and Wrongdoing) Bill At a launch on 21 October 2024, lawyers, parliament and a retired judge backed the new Whistleblowing ( Reporting and Disruption of Fraud and Wrongdoing) Bill, asserting that, if passed, it would enhance protections for whistleblowers throughout the UK. Whistleblowers UK, the non-profit supporting the Bill, said it would create a government office for whistleblowers, headed by a commissioner appointed by the secretary of state. The office would have wide-ranging powers to: set, monitor and enforce standards seek information carry out investigations impose fines for retaliation Victoria Mc Cloud, a retired judge and director of Whistleblowers UK, said the UK is waking up and recognises that urgent steps are needed, with cross-party support in both the Lords and Commons, to bring the Whistleblowing Bill into law. A copy of the...

See Q& A: Are sanctioned persons entitled to receive interest on sums owed to them that accrue during the period in which they are sanctioned? Do the sanctions affect the statute of limitations? Are sanctioned persons entitled to receive interest on sums owed to them that accrue during the period in which they are sanctioned? UK financial sanctions commonly include asset freezes. These measures bar any handling of a designated person’s frozen funds or economic resources, prevent making funds available to them, and prohibit attempts to sidestep these restrictions—see Practice Note: Understanding the financial sanctions regime. Defined offences capture dealing with a designated person’s funds and providing funds to them—see Practice Note Financial sanctions—offences. Where a breach of this kind is committed by a firm authorised under Part 4A of the Financial Services and Markets Act 2000 ( FSMA 2000), there will be...

The Association for Financial Markets in Europe ( AFME) flagged ambiguities in the FCA’s consultation that closed on 18 October 2024. The watchdog has suggested revising its guidance to clearly state that politically exposed persons in the UK— PEPs, including parliamentarians and senior public figures—ought to be seen as lower risk. In its submission, AFME said it remains unclear what degree of enhanced due diligence the FCA intends to bring in and apply—the extra background checks that UK subsidiaries or branches of international firms must conduct on domestic PEPs. The FCA’s premise is that UK institutions should regard domestic PEPs as lower risk by default. AFME sought explicit confirmation that this rule would not apply to UK subsidiaries within international groups in cases......

In this issue: Risk & Compliance forecast Data protection Financial sanctions Other financial crime Other Risk & Compliance updates this week Daily and weekly news alerts New and updated content Risk & Compliance forecast New Risk & Compliance forecast as at 15 October 2024 Our latest Risk & Compliance forecast, dated 15 October 2024, has been released. This edition covers, among other matters: (1) ICO notices signalling forthcoming fresh and revised guidance on data security and cyber security; (2) the release of the Employment Rights Bill 2024; (3) the Department for Science, Innovation and Technology’s confirmation that the Cyber Security and Resilience Bill will be brought before Parliament in 2025; and (4) confirmation that the Office of Trade Sanctions Implementation is operational. See News Analysis: New Risk & Compliance forecast as at 15 October 2024. Data...

The Worker Protection ( Amendment to Equality Act 2010) Act 2023 Coming into force on 26 October 2024, this Act requires employers to take ‘reasonable steps’ to prevent sexual harassment or face a 25% uplift in employment tribunal awards. It also hands the Equality and Human Rights Commission ( EHRC) new powers to step in where employers breach that duty. On 10 October 2024, the government signalled, through the Employment Rights Bill, an intention to raise the bar to ‘all reasonable steps’. Lawyers say Labour has set such a demanding threshold that few employers would risk relying on it as a defence. That reform is not anticipated to apply until 2026 at the earliest. Even so, EHRC guidance published in September 2024 confirms that employers will be judged against a tougher benchmark than many had expected. The regulator has also warned it stands ready to act...

New Risk & Compliance forecast as at 15 October 2024 Our latest Risk and Compliance forecast dated 15 October 2024 charts proposed regulatory developments relevant to risk and compliance, enabling you to prepare for any forthcoming changes that could affect your organisation. Please read it carefully and in full; however, we have set out a few highlights that ought to be on your radar below. New items we’re tracking this month Anonymisation, pseudonymisation and encryption—the Information Commissioner’s Office ( ICO) anticipates publishing new and updated guidance on encryption in winter 2024, and on anonymisation and pseudonymisation in spring 2025. See: Data protection, AI and cyber security Cloud computing—the ICO announced it would update guidance on cloud computing in winter 2025......

The Economic Crime and Corporate Transparency Act 2023 ( ECCTA 2023) Enacted a year ago, ECCTA 2023 contains a clause requiring large companies to put in place ‘reasonable procedures’ to protect against prosecution for failing to prevent fraud. This aligns with the UK’s Bribery Act, under which organisations can face action for failing to prevent bribery. The provision has not yet taken effect, as the UK is awaiting the publication of guidance explaining the changes. The regime will commence no earlier than six months after that guidance is released. That guidance was originally due to be published in June 2024......

The UK Treasury is currently examining numerous alleged breaches of Russian oil sanctions introduced after the invasion of Ukraine more than two years ago. The move follows fears that firms are skirting measures intended to suppress Russia’s oil earnings. The UK’s Treasury, which is responsible for ensuring the enforcement of sanctions, has confirmed it has launched 37 inquiries into suspected violations linked to an oil price cap. It is understood these investigations are not confined to UK companies alone, but also extend to cases with a UK nexus, rather than relating specifically to domestic businesses only in scope overall......

Why is vendor lock-in a particular problem in contracts for AI systems? The extent of this concern depends on the type of AI solution and the risk profile. When a standard, out-of-the-box model is deployed without bespoke elements, customers may experience less lock-in, as comparable alternatives are likely available on similar terms. However, where a bespoke model has been built for a customer, the significant effort and expense invested in training the underlying model on that customer’s data makes changing supplier complex, and there is no assurance another provider’s AI will produce equivalent results, even if trained on the same data. In addition, growing layers of internal governance and procurement procedures for AI can mean internal sign-offs add further delay to any move, making a switch less attractive unless the incumbent provider’s system is not performing as...

Risk & Compliance weekly highlights—10 October 2024 In this issue: Data protection Financial sanctions Other financial crime Daily and weekly news alerts Trackers New and updated content Data protection First report on the functioning of the EU- US DPF published The European Commission has issued an assessment of how the adequacy decision for the EU– US DPF is operating, a framework that supports transfers of personal data from the EU to the United States. It concludes that US authorities have implemented all essential elements, including safeguards limiting US intelligence access to data to what is necessary and proportionate for national security, alongside an independent redress mechanism. The review also urges the US and EU authorities to produce joint guidance on key DPF obligations and to make fuller use of the framework’s tools for monitoring participating companies’ compliance. See: LNB News...

The FCA’s biggest fine of 2024 so far signals its expectation that financial crime controls at a scaling business must mirror the organisation’s size and complexity—something lawyers say did not occur at Starling. ‘ Starling’s case is a cautionary tale for those with ambitious plans to expand,’ said James Alleyne, legal director at Kingsley Napley LLP. ‘ Breakneck growth can be commercially tempting, but if it comes at the cost of compliance, firms put themselves and their customers at needless risk and can find themselves in difficulty with the regulator.’ Alleyne points to Starling’s breach of a voluntary requirement, or VREQ, as a particularly notable element of the matter. A VREQ is where a firm voluntarily asks the FCA to restrict aspects of its business activities. Practitioners often treat the “voluntary” tag as a euphemism for “voluntary or else”, although it is...