UK law
Government publishes revised UK digital identity and attributes trust framework
The UK government has published a gamma version of the UK digital identity and attributes trust framework. The trust framework is a set of rules for an organisation to follow if they want to have their service certified as a trustworthy digital verification service (DVS). A DVS is a service that enables people to digitally prove who they are, information about themselves or their eligibility to do something. The trust framework aims to make it easier and more secure for people to use these services.
CMA clears Vodafone / Three merger, subject to legally binding commitments
The Competition and Markets Authority has decided that Vodafone’s merger with Three should be allowed to proceed if both companies sign binding commitments to invest billions to roll out a combined 5G network across the UK. The network commitment would be supported by shorter term customer protections which would require the merged company to cap certain mobile tariffs and offer preset contractual terms to mobile virtual network operators, for a period of three years. In September, the independent inquiry group leading the in-depth Phase 2 investigation of the merger provisionally found it could lead to higher prices for customers and less advantageous terms for virtual network providers (which depend on networks like those provided by Vodafone and Three to supply their own retail customers). Since publishing those findings, the group has explored how its concerns might be resolved and in November published a remedies working paper which included a range of potential remedy options. The group has since analysed responses to the working paper and closely engaged with respondents. The group has also sought further input from Ofcom. In its final decision, the group has confirmed it is now satisfied that the proposed network commitment, supported by shorter term protections for both retail and wholesale customers, resolve its competition concerns.
Annual report of the Biometrics and Surveillance Camera Commissioner laid in Parliament
The Biometrics and Surveillance Camera Commissioner’s annual report for 2023 to 2024 has been laid in Parliament. The report sets out the observations of the Commissioner in relation to his responsibilities for overseeing police use of DNA and fingerprints in England, Wales and Northern Ireland, and for encouraging the proper use of public space surveillance cameras.
Competition Appeal Tribunal (Amendment) Rules 2024 made
The Competition Appeal Tribunal (Amendment) Rules 2024 SI 2024/1233 have been made. They amend the Competition Appeal Tribunal Rules 2015, SI 2015/1648, to enable Part 3 of the CAT Rules to apply to applications to review certain decisions of and appeals of penalties imposed by, the CMA under its digital markets and competition functions under the Digital Markets, Competition and Consumers Act 2024. These Rules come into force on 1 January 2025.
Enterprise Act 2002 (Mergers and Market Investigations) (Determination of Control and Turnover for Penalties) Regulations 2024 made
The Enterprise Act 2002 (Mergers and Market Investigations) (Determination of Control and Turnover for Penalties) Regulations 2024 SI 2024/1236 have been made. They set out how the CMA will calculate turnover for the purposes of the enforcement of competition law. They also set out the circumstances in which a person is considered to have control over an enterprise. These Regulations come into force on 1 January 2025.
Competition Act 1998 (Determination of Turnover for Penalties) Regulations 2024 SI 2024/1235 made
The Competition Act 1998 (Determination of Turnover for Penalties) Regulations 2024 SI 2024/1235 have been made and establish rules for calculating an undertaking’s turnover under sections 35B(4) and 40A(3A) of the Competition Act 1998. They come into force on 1 January 2025.
Online Advertising Taskforce issues progress report
The Online Advertising Taskforce was set up to bring together government and the advertising sector to work in collaboration to address illegal harms and the protection of children in relation to online advertising. It has issued a report which says that during its first year it has provided a valuable forum to help raise standards, promote initiatives and best practice and share research and evidence about online harms that impact the online advertising sector. The report provides an overview of the Taskforce and its progress to date, focusing on the work of six industry-led working groups and their planned next steps.
Government publishes regulations and guidance for advertising restrictions for less healthy food or drink on television and online
The Advertising (Less Healthy Food Definitions and Exemptions) Regulations 2024 were laid before Parliament on 3 December 2024 and will come into force UK-wide on 1 October 2025. They include a 9pm watershed for less healthy food or drink advertising on TV, including all on-demand programme services (ODPS) and internet protocol television (IPTV) services under the jurisdiction of the UK, and therefore regulated by Ofcom; and a total restriction on paid-for advertising of less healthy food or drink online, including non-Ofcom regulated ODPS and IPTV. Alongside the regulations, the government has published its final guidance.
Draft Communications Act 2003 (Disclosure of Information) Order 2024 laid
This draft Order will extend the circumstances in which information with respect to a particular business obtained by Ofcom if it exercises a power under the Communications Act 2003 (the 2003 Act), the Broadcasting Act 1990, the Broadcasting Act 1996 or the Online Safety Act 2023 (the 2023 Act) may be disclosed. Section 393(2)(b) of the 2003 Act provides that the restrictions on disclosing such information imposed by section 393(1) do not apply to any disclosure of information which is made to facilitate the carrying out by any relevant person of any relevant function. Relevant persons are described in section 393(3). Relevant functions are described in section 393(4). Article 2 specifies any function under the 2023 Act as a relevant function under section 393(4) of the 2003 Act.
Ofcom publishes its proposed Plan of Work for 2025/26
Ofcom is the UK’s converged communications regulator and Ofcom works with industries that have technology at their heart. These are sectors that have driven significant innovation and economic growth over many decades. It says that its approach to regulation has sought to foster and support growth and disruption, and that it believes that competition for ideas as well as markets is the right way to achieve sustainable outcomes. It has a role to play in the evolution of both networks and services, from making spectrum available for satellite and mobile broadband, to helping people live safer lives in an online world with AI and AI-generated content. Its Plan sets out the work that it will do in 2025/26 to make communications work for everyone, and how it will deliver. The consultation on the Plan ends on 29 January 2025.
HMRC issues guidance for tax reporting rules for digital platforms
HMRC has published its lists of partner jurisdictions and reportable jurisdictions for the tax reporting rules for digital platforms. These are in the Platform Operators (Due Diligence and Reporting Requirements) Regulations 2023 (SI 2023/817) and implement the OECD’s model tax reporting rules for digital platforms in the UK.
EU law
Council adopts new laws to strengthen cybersecurity capacities in the EU
To strengthen the EU’s solidarity and capacities to detect, prepare for and respond to cybersecurity threats and incidents, the Council of the EU has adopted two new laws as part of the cyber security legislative “package”: the Cyber solidarity Act and a targeted amendment to the Cybersecurity Act. Following their signature by the presidents of the Council and of the European Parliament, both legislative acts will be published in the EU’s Official Journal in the coming weeks and enter into force 20 days later.
EDPB calls for coherence of digital legislation with the GDPR
The European Data Protection Board has adopted a statement on the second report of the European Commission on the application of the GDPR. The EDPB welcomes the reports from the European Commission and the Fundamental Rights Agency. Importantly, the EDPB emphasises the importance of legal certainty and coherence of digital legislation with the GDPR and notes ongoing initiatives to clarify the enforcement interplay of the GDPR with the AI Act, the EU Data Strategy and the Digital Services Package. In addition, the EDPB has announced it will increase the production of content for non-experts, small and medium-sized enterprises and other groups. Finally, the Board highlights the genuine need for additional financial and human resources to help regulators and the EDPB deal with increasingly complex challenges and additional competences.
European Commission opens consultations on implementing regulations for EUDI Wallets
The European Commission has published several public consultations on implementing acts relating to Regulation (EU) 910/2014 (eIDAS Regulation), as amended by Regulation (EU) 2024/1183 (European Digital Identity Regulation or EUDI Regulation). The EUDI Regulation builds on, amends and expands the eIDAS Regulation and most importantly introduces an EU-wide framework for European Digital Identity (EUDI) Wallet as well as several other new trust services.
