On 19 September, the Department for Science, Innovation and Technology (DSIT) announced in a press release that it is to launch a pilot advisory service next year, called the DRCF AI and Digital Hub.

This service will be operated by members of the Digital Regulation Cooperation Forum (DRCF), made up of the Information Commissioner’s Office (ICO), the Office of Communications (Ofcom), the Competition and Markets Authority (CMA) and the Financial Conduct Authority (FCA).

The DRCF AI and Digital Hub will provide businesses with tailored advice and support regarding how to meet requirements across multiple regulatory regimes. The DSIT anticipates that this service will expedite the process of getting new products and innovations to market, in a safe and responsible manner.

As such, the launch of the DRCF AI and Digital Hub will likely be welcome news for businesses across the UK, providing companies and innovators with the tools to navigate a challenging and multi-layered regulatory environment.

Continue Reading DRCF to launch AI and Digital Hub regulatory advice pilot in 2024

Further to the joint announcement in June by UK Secretary of State for Science, Innovation, and Technology and the US Commerce Secretary of their intention to create a UK-US data bridge (please see our blog for further details), the UK government has passed a Regulation establishing a UK-US data bridge. The data bridge comes in the form of an extension to the EU-US Data Bridge Privacy Framework (the DPF) and will come into force on 12 October.

Continue Reading UK government announces a UK data bridge with the US

On 11 September 2023, the UK’s Department for Science, Innovation, and Technology (DSIT), published the draft Data Protection (Fundamental Rights and Freedoms) (Amendment) Regulations 2023 (DP Regulations), which seek to amend the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 (DPA 2018).

Continue Reading DSIT publishes draft amendments to the UK GDPR and DPA 2018

On 12 September 2023, the UK Information Commissioner and the Chief Executive of the National Cyber Security Centre (NCSC), signed a joint Memorandum of Understanding (MoU), which establishes how the NCSC and the Information Commissioner’s Office (ICO) will cooperate. The NCSC is the technical authority in the UK that provides standards and guidance to organisations on cyber security. The ICO is responsible for providing guidance and enforcement of the data protection rules in the UK, including the obligation of organisations to apply security measures around personal data.

Continue Reading Boosting digital resilience – The UK Information Commissioner and NCSC CEO sign Memorandum of Understanding

On August 18, 2023, the Fourth Circuit decertified approximately 20 million putative class action claims arising out of a 2018 data breach involving Marriott Hotels. See here. The Fourth Circuit reversed the district court’s certification and required it to consider in the first instance whether all of the putative plaintiffs waived their claims by signing class action waivers when they registered to be part of the Starwood Preferred Guest Program (“SPG”). The SPG waiver specifically stated that “Any disputes arising out of or related to the SPG Program or the[] SPG Program Terms will be handled individually without any class action ….”

Continue Reading Fourth Circuit Decision Highlights Class Action Waivers for Data Breaches are Alive and Well

The House of Commons Committee on Science, Innovation and Technology (the Committee), embarked on an inquiry in October 2022 to assess the impact of artificial intelligence (AI) on various sectors, AI regulation, and the UK Government’s AI governance proposals. The resulting interim report, published on 31 August 2023, offers valuable insights, particularly from a legal standpoint, on the challenges and approaches related to AI governance in the UK.

Continue Reading AI, a Double-Edged Sword: Recommendations from the Committee’s Interim Report on AI

On 9 August 2023, the Information Commissioner’s Office (ICO) and the Competition and Markets Authority (CMA) published a joint position paper on Harmful Design in Digital Markets (Harmful Designs Paper) that urges businesses to stop using harmful website designs that exploit customers by encouraging them to provide more personal data than necessary. The regulators are calling for businesses to embrace fair and transparent practices, providing users with increased control over their data, and warning that failure to comply could lead to formal enforcement actions.

The Concerning Landscape: Tricky Design Practices

The position paper centres on the way information regarding choice and consent is presented to customers, known as “Online Choice Architecture” (OCA). The ICO and CMA have raised red flags website design practices that compromise user privacy and manipulate their choices. Some examples of harmful designs include:

  1. Harmful Nudges and Sludge: Subtle manipulations that steer users away from privacy-friendly choices. For example, prioritizing one option to be significantly quicker than a time-consuming alternative. The ICO emphasizes that this may infringe upon the “fairness” and “transparency” principles of the GDPR, potentially rendering the collected consent legally non-compliant.
  2. Confirmshaming: Design elements that pressure users into specific choices, such as requesting customer details and consent for marketing in exchange for a discount. The ICO notes that consent obtained through this method might not be considered truly “freely given”. A specific example of this, as recently highlighted by an IOC representative, is failing to include a “reject all” button on cookie consent banners (see here for our blog on this).
  3. Biased Framing: Presenting choices in a manner that steers users toward certain outcomes, heavily favoring one option while downplaying risks. This approach prevents users from making informed decisions.
  4. Bundled Consent: Forcing users to accept multiple services simultaneously, such as cookies, marketing, and account settings, with the provision that individual consents can be adjusted later in account settings.
  5. Default Settings: Designing interfaces that prioritize certain choices as default, influencing user decisions and making it unclear how to choose different options.

Meeting Regulators Expectations

In the Harmful Designs Paper, the ICO and CMA suggest that the primary focus for website design is a user-centred approach that empowers individuals to make well-informed choices and feel in control. Before launching any website, companies are advised to rigorously test and refine their designs and to adhere to the fundamental principles of data protection, consumer rights, and fair competition.

Looking Ahead: Education and Enforcement

As part of their mission, the CMA will expand its Rip Off Tip Off campaign that encourages consumers to report deceitful online sales tactics. This educational initiative aims to raise awareness among users and encourage them to report misleading practices. Simultaneously, the ICO will continue to enforce data protection rights, particularly for vulnerable individuals at risk of harm. With the CMA and ICO focussed on website design and fairness to consumers, it is likely that there will be increased enforcement. The ICO and CMA expect that the position paper will drive businesses to revaluate their website practices to make sure they are compliant with the current laws.

Takeaway
If companies are unsure about whether their website contains harmful designs that don’t respect the fundamental principles of data protection, consumer rights or fair competition, it’s time to think about carrying out an assessment of website design and its operation.

The Summer 2023 Edition of the quarterly IT & Data Protection Newsletter by Reed Smith Germany has just been released:

English version
German version

Continue Reading Get your Update on IT & Data Protection Law in our Germany Newsletter (Summer 2023 Edition)

On July 26, 2023, the U.S. Securities and Exchange Commission (“SEC”) adopted new rules specifying enhanced disclosure regarding cybersecurity risk management, strategy governance, and incident disclosure. The SEC first proposed new cybersecurity rules back in March 2022. The agency’s comments to the final rule suggest greater disclosure and improved consistency of disclosures will benefit investors. Several of the key aspects of the final rules are outlined below, and ultimately will probably be navigable for organizations with meaningful incident response and evaluation experience as well as robust risk management programs which already include and evaluate cybersecurity.

Continue Reading SEC Issues Final Cybersecurity Rules Enhancing and Modifying Disclosure Requirements: Companies will want to Measure Twice and Cut Once

Please click here to access the source post from our Global Regulatory Enforcement Law Blog.

In this blog, the authors delve into a significant decision by the German Federal Cartel Office (FCO) four years ago, accusing a major technology company of abusive behavior due to alleged violations of the General Data Protection Regulation (GDPR). Recently, the European Court of Justice (ECJ) upheld the FCO’s decision, affirming that a GDPR breach can be considered part of a dominance abuse case depending on the specific circumstances (decision of 4 July 2023, C-252/21).

The FCO’s intervention targeted the company’s data gathering and processing practices, with claims that users were denied the option to opt-out of personalized advertising. Deeming this an exploitative abuse of the company’s dominant market position under German competition law, the FCO ordered changes to the company’s terms and conditions. Following an appeal by the technology company to the Higher Regional Court of Düsseldorf, the case is ongoing, and the ECJ’s recent ruling clarified that competition authorities can legitimately consider GDPR violations while examining cases of abuse of dominance, particularly in the digital economy where access to personal data significantly impacts competition dynamics. The ECJ emphasized the importance of cooperation between competition authorities and GDPR supervisory bodies to ensure consistent enforcement and effective application of data protection regulations in competition law. This ruling strengthens the FCO’s position in enforcing competition law within the digital landscape and sheds light on the intricate relationship between competition law and data protection regulations in addressing dominance abuse cases in the modern era.