Digital Regulatory Timeline
Welcome to Osborne Clarke's Digital Regulatory Timeline. This version was updated in January 2024 and we will make regular updates in the future, so please check back from time to time. This is indicative only, if you would like legal advice please do get in touch.
EU Accessibility Directive
This directive aims to increase the accessibility of a range of everyday products and services including e-commerce, public transport, banking services, computers, TVs and e-books. It will take effect via national law.
EU Accessibility Directive
Effective date
The EU Accessibility Directive was enacted in 2019 and required implementing legislation be issued at national level by the EU Member States by 29 June 2022. The national laws must come into force by 28 June 2025 at the latest.
Status
Fully in force. Member State national enacting legislation required.
National implementing legislation can be tracked from this page.
Full name
Directive (EU) 2019/882 of the European Parliament and of the Council of 17 April 2019 on the accessibility requirements for products and services, available here.
Who does it impact?
The directive and related national implementing legislation will impact on all businesses providing a range of "everyday" products and services, focused on digital technology. This includes:
· computers and operating systems
· smartphones, other communication devices and phone services
· TV equipment related to digital television services and access to audio-visual media services (AVMS)
· ATMs and payment terminals (e.g. card payment machines in supermarkets) and consumer banking services more generally
· e-readers and e-books
· ticketing and check-in machines, electronic tickets and all sources of information (including websites and apps) for air, bus, rail and waterborne transport services
· e-commerce
· emergency calls to the European emergency number 112
There are various carve-outs for content and services available through websites and apps that do not have to be accessible, including historic and archived content, and third party content that is not funded, developed or under the control of the entity providing it.
There are also important carve-outs where compliance would fundamentally alter the nature of the product or service or would impose a disproportionate burden on the provider. Careful consideration of these tests is necessary ahead of product or service launches or wider compliance reviews. It should be noted that for many businesses there are notification requirements before these carve-outs will apply.
What does it do?
The overarching intention of the EU Accessibility Directive is to enable people with disabilities or impairments to access these products and services on an equal basis with others.
Rather than specifying technical requirements, the directive identifies the particular features of the relevant products and services that must be accessible (set out in Annex I of the directive). The intention is that this approach allows for flexibility and innovation in how these requirements are actually met in practice.
The accessibility set out in Annex 1 depend on the product or service but include requirements such as providing information through more than one sensory channel (e.g. the option of an audio version of written text), ensuring content is presented in an understandable way; requirements for written content to be formatted in sufficient size fonts, with sufficient contrast and adjustable spacing. Products requiring fine motor control must offer alternative controls, and requirements for extensive reach or great strength should be avoided. The directive envisages the use of assistive technologies, as well as emphasising the need to respect privacy.
The directive sets out requirements on product manufacturers for technical documentation, self-assessment of compliance and a declaration of conformity with the accessibility requirements, as well as a CE marking to show compliance. Importers are required to place only compliant products on the market, and to check for compliance and the CE mark. Distributors must similarly check for compliance and not put non-compliant products on the market.
For services, compliance with the directive's accessibility requirements must be incorporated into how the services are designed and provided. Information about the service's accessibility compliance must be made available (and updated) for the lifetime of the service. Compliance must be reviewed and maintained, with disclosure obligations around non-compliance.
As noted, compliance is not required where it would fundamentally alter the basic nature of the product or service, or where it would create a disproportionate economic burden on the entity concerned. Where a business decides it falls within one of these carve-outs and so does not have to comply, it must document that assessment. In relation to services, the assessment must be renewed every 5 years, or when the service is altered, or when the national authority requests a reassessment.
The directive also requires Member States to set up national market surveillance authorities to oversee enforcement of the accessibility regime. Adequate enforcement powers must be given to the national authority, which should include provision for "effective, proportionate and dissuasive penalties", as well as remedial action to address non-compliance.
The need to implement national legislation and then allow time for businesses to achieve compliance (for which the directive allows three years) means that this 2019 legislation is taking some time to come into full effect. As noted, national implementation of this directive must take effect by 28 June 2025 at the latest. National implementing legislation can be tracked from this page.
Further materials
Webinar recording: European Accessibility Act: An introduction (19 March 2024)
Webinar recording: Digital Inclusion: Risks of not making your digital products accessible (18 April 2023)
View the full timeline content
Why 2050?
The Paris Agreement – agreed at COP 21 in December 2015 - commits its 190+ signatories to keeping a rise in global temperatures this century below 2 degrees Celsius above pre-industrial levels and to pursue efforts to limit the temperature increase even further to 1.5 degrees Celsius.
Following adoption of the Paris Agreement, the Intergovernmental Panel on Climate Change – the UN body set up to provide governments with scientific information that they can use to develop climate policies – reported, in October 2018, that if this target is to be met, emissions will need to be brought to net zero by the mid-century. So each signatory to the Paris Agreement has been submitting how it will contribute towards this aim – these are known as "nationally determined contributions". (the EU has submitted one paper that covers all the countries in the EU.) And then each signatory is taking the legal, regulatory and policy steps it needs to fulfil its commitments.
This timeline sets out the principle legal, regulatory and policy milestones towards that goal
EU Data Governance Act
Enacted in June 2022, the Data Governance Act seeks to increase sharing of public sector data, regulates data marketplaces, and creates the concept of data altruism for trusted sharing.
EU Data Governance Act
Effective date: The Data Governance Act applies from 24 September 2023, but businesses that were already providing data intermediary services on 23 June 2022 have until 24 September 2025 to comply with relevant data intermediary provisions
Status: Enacted. Mostly in force.
Full name: Regulation (EU) 2022/868 of 30 May 2022 on European data governance and amending Regulation (EU) 2018/1724 (Data Governance Act), available here.
Who does it impact?
The Data Governance Act (DGA) deals with three main areas of data sharing in the EU:
- data sharing by public authorities, creating a framework to facilitate the sharing of such data when it is protected under confidentiality obligations, intellectual property or data protection laws and hence falls outside the scope of the Open Data Directive.
- data-sharing through profit-making intermediaries, creating a new regulatory framework. These provisions will apply to: (i) data exchange services or platforms, (ii) services that enable individuals to control the sharing of their personal data, and (iii) so-called "data cooperatives" that support their members in exercising their rights with respect to data. Web browsers, email services, cloud storage, analytics or data sharing software are excluded, as are services used in a closed group such as those ensuring the functioning of Internet of Things (IoT) devices or objects.
- "data altruism" where data is shared by individuals without reward and via a not-for-profit organisation pursuing objectives in the general interest. A regulatory framework is created to ensure transparency and the rights of data subjects.
What does it do?
The DGA aims to create a new EU model for data sharing, with trusted frameworks and organisations to encourage sharing, but also regulates data-sharing organisations. Data governance in this context means rules, structures, processes and technical means to share and pool data.
Data sharing by public bodies
The DGA seeks to address the problem that some public data cannot be made open as it is protected by confidentiality, intellectual property rights or data privacy rules. Requirements are imposed on EU Member States to optimise the availability of data while protecting confidentiality and privacy, for example using technical means such as anonymisation, pseudonymisation or accessing data in secure data rooms. Exclusive data sharing arrangements are prohibited except in limited public interest situations. Other requirements include a maximum delay before answering a data access request, and the creation of a single information point by each Member State. The Commission will in turn create a searchable EU register of all information compiled by the national single information points.
Regulation of profit-making data intermediaries
The new data intermediary regulatory framework aims to grow private sector trust in opening up data by boosting the neutrality and transparency of data intermediaries. Data intermediaries are required to be neutral third parties, which do not monetise the data themselves by selling it to another business, or feeding it into their own products and services. Data intermediaries are required to act in the best interests of the data subjects. The DGA creates a full regulatory framework for data intermediation services, which will face the additional costs and burden of notification and compliance requirements. The EU Commission has, via an Implementing Regulation, introduced a logo for trusted "EU recognised data intermediary" organisations to differentiate recognised trusted services (i.e. those services that satisfy the compliance requirements of the DGA) from other services.
Member States may choose to legislate for "dissuasive financial penalties" for non-compliance. Data intermediaries must notify the national competent authority of their services, which will monitor compliance by the intermediary. As noted, existing data intermediaries in operation on 23 June 2022 have been given two years to September 2025 to bring their operations into compliance.
Data altruism
The DGA creates new legal structures and a regulatory framework for "data altruism". This will enable people and businesses to share their data voluntarily and without reward for a purpose in the public interest (for example, medical or environmental research). As with data intermediaries, the Commission has introduced a logo to differentiate a compliant "EU recognised data altruism organisation" from other services.
Data altruism organisations must be registered in a new EU public register of recognised data altruism organisations and the data altruism logo must be accompanied by a QR code with a link to that register. Data altruism organisations must be not-for-profit, pursuing stated objectives in the general interest and inviting data holders to contribute their data in pursuance of those objectives. They will not be able to use the pooled data for any other purposes. The DGA further requires independent functioning and functional separation from other activities, as well as requirements to safeguard transparency and data subjects' rights.
Further materials:
View the full timeline content
Why 2050?
The Paris Agreement – agreed at COP 21 in December 2015 - commits its 190+ signatories to keeping a rise in global temperatures this century below 2 degrees Celsius above pre-industrial levels and to pursue efforts to limit the temperature increase even further to 1.5 degrees Celsius.
Following adoption of the Paris Agreement, the Intergovernmental Panel on Climate Change – the UN body set up to provide governments with scientific information that they can use to develop climate policies – reported, in October 2018, that if this target is to be met, emissions will need to be brought to net zero by the mid-century. So each signatory to the Paris Agreement has been submitting how it will contribute towards this aim – these are known as "nationally determined contributions". (the EU has submitted one paper that covers all the countries in the EU.) And then each signatory is taking the legal, regulatory and policy steps it needs to fulfil its commitments.
This timeline sets out the principle legal, regulatory and policy milestones towards that goal
⭐ EU Digital Services Act
While the e-Commerce Directive remains the cornerstone of digital regulation, much has changed since its adoption over 20 years ago. The DSA builds on the e-Commerce Directive to address new challenges.
⭐ EU Digital Services Act
Effective date
Most in-scope service providers will need to comply from 17 February 2024.
Provisions enabling the designation of Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs) applied from 16 November 2022. The VLOPs and VLOSEs that were designated on 25 April 2023 had to comply by 25 August 2023.
Providers that are subsequently designated as VLOPs and VLOSEs by the European Commission will have four months from the Commission's notification of designation to comply with the extra obligations applicable to VLOPs and VLOSEs.
Status
In force.
Full name
Regulation (EU) 2022/2065 of 19 October 2022 on a Single Market for Digital Services and amending Directive 2000/31/EC (Digital Services Act), available here.
Who does it impact?
The Digital Services Act (DSA) broadly applies to all online intermediaries, irrespective of their place of establishment, that offer digital services or products to users in the EU.
It sets out a layered approach to regulation with requirements increasing cumulatively depending on the classification of the service provider:
· all intermediary service providers (e.g. hosting, caching or mere conduit services) must comply with requirements that apply to all online intermediaries depending on their functionality;
· "online platforms" must comply with the obligations for intermediary service providers and an additional layer of obligations;
· "online platforms allowing consumers to conclude distance contracts with traders" (e.g. online marketplaces) must comply with the obligations for intermediary service providers and online platforms, plus an additional layer of obligations specific to their functionality; and
· VLOPs and VLOSEs are subject to all of the foregoing (subject to functionality) and further obligations that are the most onerous.
VLOPs and VLOSEs are online platforms and online search engines with more than 45 million monthly active users and which are designated as a VLOP or VLOSE by the Commission.
Micro and small businesses are exempt from the requirements for online platforms and online marketplaces, unless they qualify as a VLOP or VLOSE.
What does it do?
The DSA aims to update the "rules of the internet", with the key principle that what is illegal offline should also be illegal online.
The DSA both preserves and updates the intermediary liability position set out in the e-Commerce Directive (e.g. the hosting defence). However, the range of requirements fundamentally changes the liability of online services in the EU with strict obligations for the supervision of illegal content online, as well as new rules on transparency, user safety and advertising accountability. It also includes detailed rules on features that must be incorporated into online platforms and marketplaces or included in user terms and conditions.
Illegal online content
The DSA preserves the liability defences under Articles 12-15 of the e-Commerce Directive (the "mere conduit" defence, the "caching" defence, the "hosting" defence and the "no obligation to monitor" provision). Clarity is added that these defences remain available even if the platform has voluntarily taken action to detect, identify and remove, or disable access to, illegal content.
However, notice and take down obligations on online platforms are strengthened. Platforms must put in place mechanisms for users to report illicit content (such as hate speech, terror propaganda, discrimination or counterfeit goods). Platforms must decide what to do about reported content in a timely, diligent and non-arbitrary manner, in order to continue to benefit from the hosting defence. Specified mechanisms to challenge content removal must be made available, including alternative dispute resolution. Online platforms must monitor for repeated submission of illegal content or unfounded complaints by particular users, and suspend their access.
Third party content monitors will be able to apply for "trusted flagger" status. Platforms must prioritise illegal content reports such individuals and bodies.
Transparency
General obligations will apply in relation to user safety, transparency, controls and information.
Annual reports are required from all intermediary service providers on their content moderation activity, with the required contents depending on the service provided. Hosting service providers must include information about illegal content notices and complaints received and action taken. These include provisions relating to content recommendations and online terms, and obligations relating to the publication and communication of information on the average monthly active recipients of the service. The European Commission has consulted on the mandatory templates for transparency reporting under the DSA and is analysing the feedback. The Commission has also launched the DSA Transparency Database which is a publicly accessible database of "statements of reasons" which online platforms must submit to the Commission setting out their reasons for making content moderation decisions (with the exception of micro and small enterprises).
Websites must not be designed and organised in away that deceives or manipulates users – so-called "dark patterns" – but must be designed in a user-friendly and age-appropriate way to make sure users can make informed decisions.
Online marketplaces
The DSA introduces traceability provisions for online marketplaces. These include a "know-your-trader" obligation, requiring online marketplaces that allow B2C sales to conduct due diligence on traders prior to allowing them to use the platform.
Platforms must be designed to facilitate compliance with traders' legal obligations such as e-commerce and product safety requirements. The illegal content take down provisions are to facilitate the removal of illegal or counterfeit products, and platforms have obligations to contact consumers who have purchased those products.
Advertising accountability
Specific transparency obligations will apply to online advertising. It must be clear to users whether a displayed item is an advertisement and from whom it originates. Information about the main parameters used to decide to whom it will be displayed will be essential in this context.
VLOPs and VLOSEs
VLOPs and VLOSEs are designated by the Commission. The first tranche of designations (17 VLOPs and 2 VLOSEs) were made on 25 April 2023. Platforms and search engines will need to report on the number of users at least every 6 months. Obligations on VLOPs and VLOSEs apply from four months after their designation as such.
An additional layer of obligations are imposed on VLOPs and VLOSEs. They must diligently monitor and mitigate systemic risks including their service being used for the dissemination of illegal content; the impact of their service on human rights; and the risk of their service negatively affecting civic discourse, electoral processes, public security, gender-based violence, the protection of public health and minors and individuals' physical and mental well-being. The European Commission's guidelines on mitigating against systemic risks in relation to electoral processes were published in the EU's Official Journal on 26 April 2024. The guidelines aim to support VLOPs and VLOSEs with their compliance obligations under Article 35 of the DSA (mitigation of risks) and with other obligations relevant to elections. As well as mitigation measures, the guidelines cover best practices before, during and after electoral events.
VLOPs and VLOSEs will also have to implement strict processes towards regular risk assessments, produce reports of action regarding content moderation and will be obliged to conduct external annual audits. They will have to disclose their parameters for recommender systems and provide for at least one recommender system which does not involve profiling. In addition, the EU Commission as well as the Member States could have access to their algorithms.
On 22 February 2024, the delegated regulation on independent audits under the DSA also entered into force. Article 37 of the DSA requires VLOPs and VLOSEs to undergo annual independent audits to assess compliance with the DSA and any commitments made pursuant to codes of conduct and crisis protocols that have been adopted. The delegated act provides a framework to guide VLOPs and VLOSEs when preparing audits. It also provides mandatory templates for auditors to use when completing an audit report, as well as mandatory templates for the VLOPs and VLOSEs to use when completing their audit implementation reports.
The Commission has launched a DSA whistleblower tool which allows individuals with inside information to report harmful practices by VLOPs and VLOSEs that are potentially in breach of the DSA, anonymously if preferred.
Enforcement
Each Member State must designate one or more competent authorities as responsible for the application and enforcement of the DSA in its jurisdiction, and each Member State must designate one of these as a "Digital Services Coordinator." The Digital Services Coordinators in different territories can work together on matters covered by the DSA. They make up a European Board for Digital Services, chaired by the European Commission, which works as an independent advisory group to enforce the DSA. Enforcement in relation to VLOPS and VLOSEs is exclusively reserved to the EU Commission. Fines of up to 6% of global annual turnover could be levied for breaches. The Commission has opened infringement procedures against six member states which either did not designate their Digital Services Coordinator by the 17 February 2024 deadline (Estonia, Poland and Slovakia), or have not yet granted them full powers to carry out their duties under the DSA (Cyprus, Czechia and Portugal).
The European Commission has already been proactive in sending requests for information to various platforms concerning their compliance with their DSA obligations. It has also opened formal proceedings against some platforms following preliminary investigations and requests for information.
Further materials
https://www.osborneclarke.com/insights/eu-gets-one-step-closer-adopting-digital-services-act
https://www.osborneclarke.com/insights/rethinking-regulation-data-driven-digital-platforms
View the full timeline content
Why 2050?
The Paris Agreement – agreed at COP 21 in December 2015 - commits its 190+ signatories to keeping a rise in global temperatures this century below 2 degrees Celsius above pre-industrial levels and to pursue efforts to limit the temperature increase even further to 1.5 degrees Celsius.
Following adoption of the Paris Agreement, the Intergovernmental Panel on Climate Change – the UN body set up to provide governments with scientific information that they can use to develop climate policies – reported, in October 2018, that if this target is to be met, emissions will need to be brought to net zero by the mid-century. So each signatory to the Paris Agreement has been submitting how it will contribute towards this aim – these are known as "nationally determined contributions". (the EU has submitted one paper that covers all the countries in the EU.) And then each signatory is taking the legal, regulatory and policy steps it needs to fulfil its commitments.
This timeline sets out the principle legal, regulatory and policy milestones towards that goal
EU Digital Markets Act
This new legislation is aimed at boosting competition in EU digital markets, with new rules aimed at online "gatekeepers"; that is, players that determine how other companies interact with the users of digital platforms.
EU Digital Markets Act
Effective date
The first group of gatekeepers designated under the DMA have had to comply with its obligations since 6 March 2024. The European Commission is conducting several probes into DMA compliance and whether further companies and services should be designated.
Status
Enacted. Fully in force.
Full name
Regulation (EU) 2022/1925 of 14 September 2022 on contestable and fair markets in the digital sector (Digital Markets Act), available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R1925
Who does it impact?
The DMA is aimed at digital businesses offering a core platform service, with significant scale and reach within the EU – these firms will be designated as "gatekeepers".
A "core platform service" includes online intermediation services; online search engines; online social networking services; video-sharing platform services; number-independent interpersonal communication services; operating systems; cloud computing services; and certain advertising services so far as they are provided by a provider of any of the core platform services.
A "gatekeeper" is a "core platform service provider" which has a significant impact on the internal market, whose platform enables business users to access customers and enjoys an entrenched and durable position (meaning at least three years). While there is some nuance in this designation, there will be a presumption that a provider will satisfy the designation test if it:
• generates an annual revenue of €7.5 billion or more in the last three years, or has an average market capitalisation of at least €75 billion in the last financial year in the EEA and provides a core platform services in three member states; and
• has more than 45 million monthly EU end users or more than 10,000 yearly active EU business users a year, and
• these thresholds have both been met in each of the last three financial years.
The first companies designated as gatekeepers are Alphabet, Amazon, Apple, ByteDance, Meta and Microsoft in relation to the following core platform services:
• Social Networks: TikTok, Facebook, Instagram, LinkedIn;
• Online Intermediation Services: Google Maps, Google Play, Google Shopping, Amazon Marketplace, App Store, Meta Marketplace;
• Advertising: Google, Amazon, Meta
• Number Independent Communication Services: WhatsApp, Messenger;
• Video Sharing: YouTube;
• Search: Google Search;
• Browser: Chrome, Safari;
• Operating System: Android, IOS and Windows PC.
Challenges have been lodged in relation to some of these designations.
Additionally, Booking.com and X (formerly Twitter) have notified the Commission that they meet the quantitative criteria for being designated as gatekeepers and ByteDance has submitted a further notification that TikTok Ads potentially meets the DMA thresholds. The Commission has 45 working days to decide whether these services should be formally designated.
The Commission held workshops on gatekeeper compliance with the DMA from 18-26 March. Following this, it launched investigations into potential non-compliance by some of the gatekeepers. The Commission has signalled its intention to complete these investigations by 24 March 2025
What does it do?
The first limb is a set of rules that will apply only to "gatekeepers", comprising a list of dos and don'ts for these providers, designed to address perceived competitive imbalances arising from the gatekeeper's position in the market.
Examples of obligations on gatekeepers include:
• Allowing third parties to inter-operate with the gatekeeper's own service in certain specific situations.
• Allowing business users to access data that they generate in their use of the gatekeeper's platform.
• Providing companies advertising on their platform with the tools and information necessary for advertisers and publishers to carry out their own independent verification of their advertisements hosted by the gatekeeper.
• Allowing business users to promote their offer and conclude contracts with their customers outside the gatekeeper's platform.
Examples of prohibited behaviour include:
• Self-preferencing – treating services and products offered by the gatekeeper itself more favourably in ranking than similar services or products offered by third parties on the gatekeeper's platform.
• Preventing consumers from linking up to businesses outside their platforms.
• Preventing users from un-installing any pre-installed software or app.
The second limb is market investigation powers that will enable the European Commission to conduct an investigation to consider: whether a core platform provider should be designated as gatekeeper; where there has been systematic non-compliance; and whether services should be added to the list of core platform services. It will also enable the Commission to detect unfair or new practices that have not been adequately addressed by the DMA. When a gatekeeper intends to buy a company providing core platform services, any other services in the digital sector or which enable the collection of data, they may need to inform and seek approval from the Commission. The Commission is using this power immediately, with market investigations into iPad OS, iMessage, Bing, Edge and Microsoft Advertising. Apple has challenged the opening of the market investigation into iMessage. With the exception of the investigation into iPad OS, all of these have determined that the service concerned is not a core platform service.
Failure to comply with the rules could lead to fines of up to 10% of global turnover, and, in the case of systematic infringements, structural remedies.
Further materials
View the full timeline content
Why 2050?
The Paris Agreement – agreed at COP 21 in December 2015 - commits its 190+ signatories to keeping a rise in global temperatures this century below 2 degrees Celsius above pre-industrial levels and to pursue efforts to limit the temperature increase even further to 1.5 degrees Celsius.
Following adoption of the Paris Agreement, the Intergovernmental Panel on Climate Change – the UN body set up to provide governments with scientific information that they can use to develop climate policies – reported, in October 2018, that if this target is to be met, emissions will need to be brought to net zero by the mid-century. So each signatory to the Paris Agreement has been submitting how it will contribute towards this aim – these are known as "nationally determined contributions". (the EU has submitted one paper that covers all the countries in the EU.) And then each signatory is taking the legal, regulatory and policy steps it needs to fulfil its commitments.
This timeline sets out the principle legal, regulatory and policy milestones towards that goal
⭐ UK Product Security and Telecommunications Infrastructure Act 2022
Part 1 creates a new regulatory scheme in relation to cybersecurity for connected consumer products. Secondary legislation sets out technical requirements. This affects products already on sale/available.
⭐ UK Product Security and Telecommunications Infrastructure Act 2022
Effective date
Secondary legislation giving effect to the connectable products part of the Act came into force on 29 April 2024
Status
Enacted.
Full name
UK Product Security and Telecommunications Infrastructure Act 2022, available here.
The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023 that gives effect to the connectable products provisions are available here.
Who does it impact?
Manufacturers of connectable products (Product Security) and telecoms network operators, infrastructure provides and site providers (Telecommunications Infrastructure). This affects products already on sale/available.
What does it do?
Part 1 of The Product Security and Telecommunications Infrastructure Act 2022 ('PSTIA 2022') sets out powers for UK Government Ministers to specify security requirements relating to relevant connectable products (a product which is internet or network connectable).
On 14 September 2023 the Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023 were introduced under the PSTIA 2022. They came into force on 29 April 2024. The obligations imposed on manufacturers of connectable/digital products include:
· Restricting the use of default passwords;
· Providing information to consumers on how to report security issues; and
· Providing information on minimum periods for which devices will receive security updates.
In addition, businesses may face liability where cybersecurity vulnerabilities lead to the loss or corruption of consumer data.
The PSTIA also imposes obligations on manufacturers, importers and distributors to not make products available in the UK unless accompanied by a statement of compliance with applicable security conditions.
The PSTIA 2022 leaves room for further delegated legislation to introduce additional obligations, and clarifications of business responsibilities.
The Office for Products Safety and Standards (OPSS) has published guidance for businesses that need to be complying with the new requirements. See the link to the February Regulatory Outlook for more.
Additional guidance was added on 23 April 2024 specifying that the product's statement of compliance (SoC) must be "accompanied" by the product itself, and defines the SoC as a "document". However, the terms "document" and "accompany" are not clearly defined in the PSTIA 2022 and so businesses must determine how they will comply with these requirements for their individual products.
The additional guidance also mentions that further regulations will be introduced to exempt certain categories of products from the regime, an example being automotive vehicles. In the meantime, those products will still be in scope of the regime during the period between when the relevant provisions came into effect (29th April) and when these exemptions come into effect. Unfortunately, the guidance does not provide a specific timeframe for this period. However as the OPSS will be enforcing pragmatically and proportionately, it will take into account the exemptions when considering products.
For more on the practical steps to comply with the new regime, please see the link to our Eating Compliance for Breakfast webinar.
Further materials
Products | UK Regulatory Outlook February 2024 - Osborne Clarke | Osborne Clarke
View the full timeline content
Why 2050?
The Paris Agreement – agreed at COP 21 in December 2015 - commits its 190+ signatories to keeping a rise in global temperatures this century below 2 degrees Celsius above pre-industrial levels and to pursue efforts to limit the temperature increase even further to 1.5 degrees Celsius.
Following adoption of the Paris Agreement, the Intergovernmental Panel on Climate Change – the UN body set up to provide governments with scientific information that they can use to develop climate policies – reported, in October 2018, that if this target is to be met, emissions will need to be brought to net zero by the mid-century. So each signatory to the Paris Agreement has been submitting how it will contribute towards this aim – these are known as "nationally determined contributions". (the EU has submitted one paper that covers all the countries in the EU.) And then each signatory is taking the legal, regulatory and policy steps it needs to fulfil its commitments.
This timeline sets out the principle legal, regulatory and policy milestones towards that goal
EU NIS 2 Directive
This directive updates existing EU legislation on security of network and information systems (NIS 1), and requires organisations that provide essential or important services to strengthen their cyber security defences.
EU NIS 2 Directive
Effective date
The Directive entered into force on 16 January 2023. EU Member States have until 17 October 2024 to transpose its measures into national law.
Status
Fully in force. Member State national enacting legislation required.
Full name
Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, available here.
Who does it impact?
The NIS 2 Directive updates earlier EU legislation in this area. It significantly extends the list of sectors within the scope of the regulation and provides more information on the entities that are subject to its cybersecurity requirements. The scope of the directive is set out in detail, intended to remove inconsistencies in scope between the implementing legislation enacted at Member State level for the NIS 1 Directive.
The Directive will apply to all businesses operating within the broad sectors listed in Annex I or II which qualify as a "medium" enterprise or larger (i.e. employing 50 people or more, and with either annual turnover over €10 million or a balance sheet exceeding €10 million).
However, the carve-out for smaller business will not apply where they are in the sectors listed in Annex I or II and they are, more specifically:
· providers of public electronic communications networks or services;
· trust service providers;
· top-level domain name registries and domain name system service providers:
· a sole national provider of essential societal or economic services;
· a service provider with a significant impact on public safety, security, or health;
· a service provider which could generate significant systemic risk;
· a critical entity with importance at national or regional level; or
· a public administration entity.
The Directive also applies to entities of all sizes listed under the Critical Entities Resilience Directive and those that provide domain name registration services.
The Directive does not apply to public administration entities that carry out activities in certain areas including national security, public security, defence, or law enforcement. Member States may also exempt specific entities in the above areas.
Annex I covers energy, transport, banking and financial market infrastructure, healthcare, water and sewage, digital infrastructure and certain business-to-business information and communications technology services.
Annex II includes postal and courier services, waste management, some types of manufacturing and digital platform providers for online market places, search engines and social networks.
The scope of this legislation is detailed and the above is a summary only.
What does it do?
Cybersecurity measures
The regulation introduces a set of mandatory measures that each entity must address to prevent cybersecurity incidents. This includes policies on risk analysis and information system security, cyber hygiene practices, cybersecurity training, and multi-factor and continuous authentication solutions.
Responsibility of management bodies
To ensure that organisations are aware of their NIS2 obligations and acquire knowledge on cybersecurity risk prevention, management bodies are required to attend training sessions and to pass this information and knowledge on to their employees.
Enforcement measures
Member States must implement effective, proportionate, and dissuasive sanctions. Fines for non-compliance can reach 2% of the organization's annual turnover or €10 million − whichever is greater – for essential entities, and up to 1.4% of the organisation's annual turnover or €7 million for important entities.
Reporting obligations and timelines
The new directive clarifies the scope of reporting obligations with more specific provisions regarding the reporting process, content, and timelines. In particular, entities affected by an incident that has a signification impact on provision of their services must submit an initial assessment of the incident to their computer security incident response team (CSIRT) or, where applicable, to the competent authority within 24 hours of becoming aware of the incident. A final update must be provided within a month of the initial notification.
Use of artificial intelligence
One of the most novel aspects of this directive is the requirement for Member States to promote the use of innovative technologies, including artificial intelligence, to improve the detection and prevention of cyber-attacks, which would allow for a more efficient and effective allocation of resources to combat these threats.
Member States must legislate for appropriate measures to implement the directive in place by 17 October 2024.
Further materials
What EU businesses need to know about NIS2 and cybersecurity compliance
NIS 2 Directive: a key update for cybersecurity in the EU
UK and global cyber threats require robust supply chain risk management
View the full timeline content
Why 2050?
The Paris Agreement – agreed at COP 21 in December 2015 - commits its 190+ signatories to keeping a rise in global temperatures this century below 2 degrees Celsius above pre-industrial levels and to pursue efforts to limit the temperature increase even further to 1.5 degrees Celsius.
Following adoption of the Paris Agreement, the Intergovernmental Panel on Climate Change – the UN body set up to provide governments with scientific information that they can use to develop climate policies – reported, in October 2018, that if this target is to be met, emissions will need to be brought to net zero by the mid-century. So each signatory to the Paris Agreement has been submitting how it will contribute towards this aim – these are known as "nationally determined contributions". (the EU has submitted one paper that covers all the countries in the EU.) And then each signatory is taking the legal, regulatory and policy steps it needs to fulfil its commitments.
This timeline sets out the principle legal, regulatory and policy milestones towards that goal
EU General Product Safety Regulation
This regulation contains sweeping reforms to the EU product safety regime, including new provisions and updates to address new technologies and online sales channels.
EU General Product Safety Regulation
Effective date
13 December 2024
Status
Became law on 10 May 2023 but has an 18 month transition period until 13 December 2024.
Full name
Regulation (EU) 2023/988 of 10 May 2023 on general product safety, available here.
Who does it impact?
Anyone placing consumer products on the market in the EU.
What does it do?
The regulation contains sweeping reforms which will significantly change the way that both modern and traditional products are produced, supplied and monitored across the EU. It raises the requirements of safety and adds sophistication in terms of compliance obligations for all non-food products and the businesses involved in manufacturing and supplying them to end users.
The GPSR also adopts an improved definition for a "product" and includes new factors to take into account when assessing safety, so that the EU's product safety regime adequately addresses modern technologies.
The GPSR makes clear that connected devices are considered to be products within its scope and will be subject to the general safety requirement. In addition, when assessing whether a product is safe, economic operators will have to take into account the effect that other products might have on their product, its cybersecurity features, and any evolving, learning and predictive functionalities of the product.
In addition, the GPSR seeks to address the increasing digitalisation of supply chains, in particular the growth of e-commerce, and places a number of obligations on online marketplaces, such as:
· cooperation with market surveillance authorities if they detect a dangerous product on their platform, including directly contacting affected consumers who bought through their platform in the event of a product recall;
· ensuring there is a single point of contact in charge of product safety;
· requiring contact and traceability information to be displayed alongside listings and any relevant product identifiers, warnings or safety information;
· requiring steps to be taken to identify dangerous products made available on its online marketplace; and
· requiring non-compliant traders to be suspended from their platforms.
Market surveillance authorities will also be able to order online platforms to remove dangerous products from their platforms or to disable access to them.
Further materials
European Parliament publishes amendments to EU Product Safety Regulation - Osborne Clarke
Sweeping reforms proposed to EU product regulation - Osborne Clarke
View the full timeline content
Why 2050?
The Paris Agreement – agreed at COP 21 in December 2015 - commits its 190+ signatories to keeping a rise in global temperatures this century below 2 degrees Celsius above pre-industrial levels and to pursue efforts to limit the temperature increase even further to 1.5 degrees Celsius.
Following adoption of the Paris Agreement, the Intergovernmental Panel on Climate Change – the UN body set up to provide governments with scientific information that they can use to develop climate policies – reported, in October 2018, that if this target is to be met, emissions will need to be brought to net zero by the mid-century. So each signatory to the Paris Agreement has been submitting how it will contribute towards this aim – these are known as "nationally determined contributions". (the EU has submitted one paper that covers all the countries in the EU.) And then each signatory is taking the legal, regulatory and policy steps it needs to fulfil its commitments.
This timeline sets out the principle legal, regulatory and policy milestones towards that goal
⭐ UK Online Safety Act 2023
This Act introduces a new regulatory regime which imposes various statutory duties on online content-sharing platforms, to restrict both illegal content and content which, while not illegal, may cause harm to child users.
⭐ UK Online Safety Act 2023
Effective date
The Online Safety Act received Royal Assent on 26 October 2023, although much of the Act is not in force yet as secondary legislation and regulatory guidance from Ofcom needs to be issued before its various provisions come into effect. The Online Safety Act 2023 (Commencement No. 2) Regulations 2023 and the Online Safety Act 2023 (Commencement No. 3) Regulations 2024 have brought into force some of Ofcom's powers and certain new offences, but the main duties relating to protecting online users from harmful content are not yet in force. The Online Safety (List of Overseas Regulators) Regulations 2024 (SI 2024/100) have also been made and published together with an explanatory memorandum. The Regulations outline overseas regulators with whom the UK online safety regulator, Ofcom, may co-operate, as set out in section 114 of the 2023 Act.
The Online Safety Act 2023 (Pre-existing Part 4B Services Assessment Start Day) Regulations 2024, which come into force on 22 May 2024, specify the "assessment start day" as 2 September 2024 for Video-Sharing Platforms (VSPs). From this day, or the date that Ofcom publishes the relevant guidance (whichever is the latest), VSPs will be subject to the requirement to complete assessments set out in the Act's sections 9 (illegal content risk assessment duties), 11 (children's risk assessment duties), 14 (assessment duties: user empowerment) and 35 (children's access assessments). VSPs will have three months from the relevant start day to complete the assessments.
Status
Enacted, partially in force
Full name
Online Safety Act 2023, available here.
Who does it impact?
Businesses whose services facilitate the sharing of user generated content or user interactions, particularly social media, messaging services, search and online advertising. The Act regulates those offering services to UK users, regardless of the service provider's location.
What does it do?
The Act aims to protect children and to deal with illegal online content. It was initially proposed that measures on "legal but harmful" content would also be included but these have now been removed from the Act except in the case of certain harmful content hosted on services likely to be accessed by children. The Act seeks to strike a balance between ensuring safe online interactions for children and adult users, and freedom of speech.
In order to ensure that the online safety regime is flexible and "future proof", a number of issues are to be dealt with in secondary legislation, and by codes of practice and guidance to be developed by the designated regulator, Ofcom.
Ofcom has devised a consultation process to inform its codes of practice and guidance, which comprises four major consultations together with various sub-consultations, on numerous aspects of the new regime. The process began in November 2023, with a consultation on draft codes of practice and guidance on illegal harms duties, which closed on 23 February 2024. Ofcom then published a consultation on specific duties for service providers that display or publish pornographic content on their online services, which closed on 5 March 2024.
Ofcom has published a call for evidence to inform its further consultation on draft codes of practice and guidance, which it expects to publish in early 2025, on the additional duties that will apply to "categorised services" under the Act. The Act introduces a system categorising some regulated online services, based on their key characteristics and whether they meet certain numerical thresholds, as category 1, 2A or 2B services. The call for evidence closes on 20 May 2024.
Ofcom has also published its advice to the government on setting the numerical thresholds for categorised services, which was sent to the Secretary of State on 29 February 2024. Based on this advice, the Secretary of State will set out the thresholds in secondary legislation and Ofcom will, once it has assessed the services against the final thresholds, publish a register of categorised services, as well as a list of emerging category 1 services.
Ofcom has indicated that its next call for evidence on online safety covering additional duties for categorised services will be published in March 2024.
The whole consultation process comprises four major consultations over 2024 and 2025.
The Act is intended to create a "triple shield" of protection for users. Service providers must remove illegal content, remove content in breach of their own terms and conditions, and give adults more choice over what to engage with.
The Act grants Ofcom extensive investigatory and enforcement powers. Services which breach their obligations under the Act can be liable for fines of up to £18 million or 10% of their global turnover (whichever is larger). Companies (and in certain circumstances their senior managers) may also be criminally liable for breaches.
Key provisions under the Act include:
· duties on regulated services to protect all users from illegal content;
· duties on regulated services to protect child users from certain types of legal but harmful content;
· various duties to empower users to control their exposure to harmful content;
· duties to protect free speech and fundamental rights;
· duties to protect consumers from fraudulent advertising;
· powers for Ofcom to launch investigations and issue enforcement notices (which may include monetary penalties) for breaches of the duties;
· powers for Ofcom to require regulated services to use technology to proactively identify and remove content relating to terrorism or child abuse;
· new communications offences and other offences relating to online behaviour.
Further materials
The UK Online Safety Act: Top 10 takeaways for online service providers
UK Online Safety Act: Ofcom launches its first consultation on illegal harms
UK's Online Safety Act is a seismic regulatory shift for service providers
View the full timeline content
Why 2050?
The Paris Agreement – agreed at COP 21 in December 2015 - commits its 190+ signatories to keeping a rise in global temperatures this century below 2 degrees Celsius above pre-industrial levels and to pursue efforts to limit the temperature increase even further to 1.5 degrees Celsius.
Following adoption of the Paris Agreement, the Intergovernmental Panel on Climate Change – the UN body set up to provide governments with scientific information that they can use to develop climate policies – reported, in October 2018, that if this target is to be met, emissions will need to be brought to net zero by the mid-century. So each signatory to the Paris Agreement has been submitting how it will contribute towards this aim – these are known as "nationally determined contributions". (the EU has submitted one paper that covers all the countries in the EU.) And then each signatory is taking the legal, regulatory and policy steps it needs to fulfil its commitments.
This timeline sets out the principle legal, regulatory and policy milestones towards that goal
⭐ UK AI White Paper consultation
The UK government does not plan new law around AI but has issued high level principles and guidance to steer how existing regulators should use their existing powers to deal with AI.
⭐ UK AI White Paper consultation
Effective date
The consultation closed on 21 June 2023. The government's response was published on 6 February 2024.
Status
In the policy formation stage
Full name
"A pro-innovation approach to AI regulation" (March 2023)
https://www.gov.uk/government/publications/ai-regulation-a-pro-innovation-approach
Response to consultation (February 2024):
https://assets.publishing.service.gov.uk/media/65c1e41663a23d000dc8224f/a-pro-innovation-approach-to-ai-regulation-amended-governement-response-print-ready.pdf
Who does it impact?
All businesses where their development, supply or use of AI falls within the scope of existing UK law and regulation.
What does it do?
Overview
The UK government's white paper on artificial intelligence (AI) regulation sets out the UK's policy approach to regulating AI. Essentially, the government confirmed its approach in the consultation response of February 2024. It does not plan new law in this area, but has issued "high-level principles" to guide existing regulators in dealing with AI within the scope of their existing powers and jurisdiction. Its intention is that such an approach will be agile and proportionate.
The white paper's definition of AI identifies it by its key characteristics of being "adaptive" and "autonomous". There is no reference to particular types or classifications of AI (in contrast to the prohibited and high-risk categories of the EU's AI Act), but focuses on machine learning and deep learning systems that are trained and can infer patterns across data. The white paper anticipates that regulators will expand on this loose definition with a more detailed interpretation in their area as needed.
The government will monitor and evaluate the emerging regulatory landscape around AI, identifying any gaps in regulatory coverage and supporting coordination and collaboration between the regulators.
Five overarching "high level principles" will shape regulatory policy and enforcement:
· safety, security and robustness;
· appropriate transparency and explainability;
· fairness;
· accountability and governance; and
· contestability and redress.
New "initial" guidance has been published to support regulators, with expansions of the guidance planned for later in 2024.
The consultation response has confirmed that these principles will not be on a statutory footing, unless it proves necessary in the future.
Regulators' strategic approaches to AI
Various economic and sector regulators were directed to publish their AI strategy by 30 April 2024. The reports on their respective strategic approaches are available here. The length, level of detail and depth of content varies widely between the reports with some regulators (such as the Competition and Markets Authority) having already undertaken significant work in this field and others (such as Ofgem) apparently still in the early stages of building their capacity and understanding around AI.
We understand that these reports will feed into a "gap analysis" by the government of the various regulatory frameworks that will need to deal with AI.
One area where there is a known regulatory gap is in relation to AI and the workforce. Although regulators such as the Equality and Human Rights Commission are often active in relation to workers rights, there is no regulator overseeing employment law overall. By contrast, AI systems deployed in relation to aspects of the employment lifecycle from recruitment to work allocation to employee appraisal are listed as "high risk" under the EU's AI Act. Perhaps in recognition of that lacuna, the UK government has issued guidelines on the use of AI in recruitment (available here).
Other initiatives
The government has progressed its plan to create a central government function to support the regulation of AI by existing regulators, including ensuring coherence across the regulatory landscape, monitoring how the proposed approach develops in practice and economy-wide horizon-scanning for emerging trends and opportunities around AI. The Office for AI has been folded into the relevant policy unit within the Department for Science, Innovation and Technology (DSIT). A minister with responsibility for AI has designated been within each government department.
No action is currently planned in relation to addressing the acknowledged lack of clarity around liability in the AI supply chain.
The consultation response discusses how the challenge of highly capable general purpose AI should be addressed but again elects not to legislate in the near term.
The AI and Digital Hub
The white paper confirmed that a sand box would be created to support AI innovation, which has since been launched as the AI and Digital Hub. This is a multi-regulator sand box, coordinated by the Digital Regulators Cooperation Forum (DRCF) (led by the Competition and Markets Authority, the Information Commissioner's Office, Ofcom and the Financial Conduct Authority). It offers free informal advice to businesses on how regulation (across the remits of the four DRCF regulators) applies to their innovative digital or AI projects and is initially a one year pilot.
The DRCF plans to respond on eligibility within 5 working days and, for eligible queries, to give an answer on the substance in 8 weeks. Advice is not legally binding and carries no endorsement or certification of compliance.
Further materials
What does the UK's white paper on AI propose and will it work?
What is the latest on the UK government's approach to regulating AI?
View the full timeline content
Why 2050?
The Paris Agreement – agreed at COP 21 in December 2015 - commits its 190+ signatories to keeping a rise in global temperatures this century below 2 degrees Celsius above pre-industrial levels and to pursue efforts to limit the temperature increase even further to 1.5 degrees Celsius.
Following adoption of the Paris Agreement, the Intergovernmental Panel on Climate Change – the UN body set up to provide governments with scientific information that they can use to develop climate policies – reported, in October 2018, that if this target is to be met, emissions will need to be brought to net zero by the mid-century. So each signatory to the Paris Agreement has been submitting how it will contribute towards this aim – these are known as "nationally determined contributions". (the EU has submitted one paper that covers all the countries in the EU.) And then each signatory is taking the legal, regulatory and policy steps it needs to fulfil its commitments.
This timeline sets out the principle legal, regulatory and policy milestones towards that goal
EU Data Act
The Data Act creates a new framework for sharing data for the private and public sector, including creating new rights of access to IoT data and facilitating switching between cloud providers.
EU Data Act
Effective date
The legislation was published in the EU Official Journal on 22 December 2023 and entered into law on 11 January 2024.
It will become fully applicable on 12 September 2025, except for:
• the obligation to design connected products and services so that data is accessible, which will be applicable 32 months after the legislation becomes law (on 12 September 2026); and
• the provisions on contractual terms and conditions in private sector data contracts, which will not be applicable until 12 September 2027 in relation to contracts concluded on or before 12 September 2025, provided that the contract in question is of indefinite duration or is due to expire at least 10 years from 11 January 2024.
Status
Enacted. Not yet in force.
Full name
Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on harmonised rules on fair access to and use of data (Data Act). The final text (published in the EU Official Journal on 22 December 2023) is available here.
Who does it impact?
The Data Act is wide-ranging legislation that will impact on a corresponding wide range of businesses and individuals, including:
• Those providing or using connected products and services that collect data about the product or service, or activity of the user;
• Those making data available to data recipients in the EU, and the recipients;
• Public sector bodies and EU institutions wanting access to business data for exceptional need;
• Providers of cloud data processing services proving those services to EU customers; and
• Parties using smart contracts.
What does it do?
The Data Act is intended to boost the availability of data to support a vibrant data economy in the EU. It will have a significant impact on some businesses. It will operate to extend data regulation far beyond the current focus on personal data and data privacy. The intention is to open up access to data, particularly Internet of Things (IoT) and machine-generated data, which is often controlled by the entity that gathered it, and is inaccessible to the entity whose activities generated it. The provisions of the Data Act will be without prejudice to the General Data Protection Regulation regime, privacy rights and rights to confidentiality of communications, all of which must be complied with in acting on the requirements in the Data Act.
Access to data from connected devices
Currently, contractual terms and conditions typically decide whether or not data collected by IoT systems, industrial systems and other connected devices can be accessed by the business or person whose activities have generated the data – the user. It is not unusual that the collected data is held by the device or service provider and is not accessible by the user.
The Data Act will create an obligation to design connected products and related services so that data that they collect is available to the user. Users will be entitled to access the data free of charge and potentially in real time. Data must either be directly accessible from the device or readily available without delay.
Users will, moreover, be able to pass the data to a third party (which may be the data holder’s competitor) or instruct the data holder to do so; data holders can only pass user data to a third party on the instructions of the relevant user. The Data Act will impose restrictions on how the third party can use the received data.
These provisions include measures designed to prevent valuable trade secrets from being revealed, and to ensure that these rights are not used to find out information about the offerings of a competitor. They also include measures to prevent unfair contractual terms and conditions being imposed on users by data holders. Data holders are able to impose a non-discriminatory, reasonable fee for providing access (which can include a margin) in business-to-business relationships. Where data is being provided to an SME, the fee must not exceed the costs incurred in making the data available.
Contractual terms and conditions relating to private sector data
In relation to contracts between businesses that contain data-related obligations more generally, the Data Act outlaws terms and conditions that deviate grossly from good commercial practice, contrary to good faith and fair dealing, if imposed unilaterally. Within that prohibition, it sets out various specifically blacklisted contractual terms, which will be unenforceable.
Access to data for public bodies
The Data Act makes provision for public sector bodies to gain access to private sector data where they can demonstrate an exceptional need to use the data to carry out statutory duties in the public interest. This might be to deal with a public emergency, or to fulfil a task required by law where there is no other way to obtain the data in question. These provisions do not apply to criminal or administrative investigations or enforcement.
Switching between cloud services providers
The Data Act seeks to remove perceived obstacles to switching between cloud services providers, or from a cloud service to on-premise infrastructure, or from a single cloud provider to multi-provider services. This part of the Data Act includes provisions concerning the contractual terms dealing with switching or data portability, which must be possible without undue delay, with reasonable assistance, acting to maintain business continuity, and ensuring security, particularly data security. It provides for maximum time limits and detailed information requirements. Service providers are required, more generally, to make information readily available about switching and porting methods, as well as formats including standards and open interoperability specifications. The Data Act imposes a general duty of good faith on all parties involved to make switching effective, timely and to ensure continuity of service.
Prevention of unlawful access and transfer of cloud-based data
A further limb of the Data Act is to require cloud service providers to prevent international and non-EU governments from accessing or transferring non-personal data held in the EU, where it would be in breach of EU or Member State law.
Interoperability of data, data sharing mechanisms and cloud services
To ensure that data access rights are not undermined by technical compatibility problems, the Data Act creates obligations around interoperability for data and data-sharing mechanisms. It requires transparency around key aspects and features of datasets, data structures, and access mechanisms (such as application programming interfaces). Provision is made for standards to be developed in relation to these requirements.
The Data Act also imposes interoperability requirements between cloud services, again providing for open interoperability specifications and harmonised standards to support switching and portability, as well as parallel processing.
Smart contracts for data sharing
Finally, the Data Act covers smart contracts used for executing a data-sharing arrangement (but not smart contracts with other functions). It lays down requirements for robustness and access control, safe termination and interruption (a "kill switch"), data archiving and continuity, as well as measures to ensure consistency with the terms of the contract that the smart contract is executing. Provision is made for standards to be developed to meet these requirements. Smart contracts must be self-assessed for conformity and a declaration of EU conformity made.
Enforcement
The Data Act will be enforced at Member State level by an appointed regulator. This could be an extension of jurisdiction for an existing regulator, or a new one could be created. Powers for Member State regulators can include sanctions.
Further materials
EU Data Act proposal: Commission plans comprehensive right to data access
What are the implications of the EU Data Act for smart contract operators?
View the full timeline content
Why 2050?
The Paris Agreement – agreed at COP 21 in December 2015 - commits its 190+ signatories to keeping a rise in global temperatures this century below 2 degrees Celsius above pre-industrial levels and to pursue efforts to limit the temperature increase even further to 1.5 degrees Celsius.
Following adoption of the Paris Agreement, the Intergovernmental Panel on Climate Change – the UN body set up to provide governments with scientific information that they can use to develop climate policies – reported, in October 2018, that if this target is to be met, emissions will need to be brought to net zero by the mid-century. So each signatory to the Paris Agreement has been submitting how it will contribute towards this aim – these are known as "nationally determined contributions". (the EU has submitted one paper that covers all the countries in the EU.) And then each signatory is taking the legal, regulatory and policy steps it needs to fulfil its commitments.
This timeline sets out the principle legal, regulatory and policy milestones towards that goal
⭐ EU Digital Operational Resilience Act (DORA)
This regulation introduces rules on digital operational resilience to tackle cyber risks and harmonise IT requirements for firms in the financial services sector, and those supplying relevant services to them.
⭐ EU Digital Operational Resilience Act (DORA)
Effective date
DORA was enacted on 16 January 2023 and will apply from 17 January 2025.
Status
Enacted. Not yet in force
Full name
Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector, available here.
Who does it impact?
DORA will apply to a broad range of financial entities regulated in the European Economic Area (EEA), including banks, payment and e-money institutions, investment firms, fund managers, and cryptoasset service providers.
The rules will also catch third-party service providers of information and communications technology (ICT), including providers of cloud computing services, software, data analytics, and data centres, where the European authorities will designate them as "critical".
What does it do?
Firms within the scope of DORA must be able to withstand, respond to and recover from ICT incidents. Important requirements for firms will include:
• Having internal governance and control frameworks that allow them to manage ICT risks effectively and prudently
• Having a robust and well-documented ICT risk management framework in place that allows them to address ICT risks quickly and comprehensively
• Reporting major ICT-related incidents to the relevant regulator
• Regularly carrying out digital operational resilience testing, including a range of assessments, methodologies, practices and tools
• Managing ICT third-party risk within their ICT risk management framework
As noted, DORA entered into force on 16 January 2023 and will apply from 17 January 2025.
Under DORA, the European Supervisory Authorities (being the European Banking Authority (EBA), European Insurance and Occupational Pensions Authority (EIOPA) and European Securities and Markets Authority (ESMA) (together the ESAs)) will develop 13 Regulatory Technical Standards (RTS) and Implementation Technical Standards (ITS) setting out details and guidance on key provisions and requirements within DORA. Financial entitles must be fully compliant with and implement these standards in their ICT systems by 17 January 2025.
On 17 January 2024, the ESAs published the first set of joint draft technical standards on:
• RTS on ICT risk management framework;
• RTS on the criteria for classifying ICT-related incidents;
• RTS on ICT services policies supporting the critical or important functions provided by third party ICT providers; and
• ITS setting out the templates to be maintained by financial entities in relation to contractual arrangements with third party service providers.
The first batch of final draft technical standards were adopted by EU Commission in February and March 2024. The implementing and delegated acts can be tracked from this page.
The second batch of draft technical standards were published in December 2023 for consultation on:
• RTS and ITS on the content, timelines, and templates for incident reporting;
• Guidelines on aggregated costs and losses from major incidents;
• RTS on the subcontracting of critical or important functions;
• RTS on the harmonisation of oversight activities;
• Guidelines on cooperation of oversight activities between the ESAs and competent authorities; and
• RTS on thread-led penetration testing.
The ESAs are expected to submit these to the EU Commission and issue the guidelines by 17 July 2024.
Further materials
EU financial services firms face tougher cybersecurity rules in two years
DORA – New EU cybersecurity law for Crypto
UK and global cyber threats require robust supply chain risk management
View the full timeline content
Why 2050?
The Paris Agreement – agreed at COP 21 in December 2015 - commits its 190+ signatories to keeping a rise in global temperatures this century below 2 degrees Celsius above pre-industrial levels and to pursue efforts to limit the temperature increase even further to 1.5 degrees Celsius.
Following adoption of the Paris Agreement, the Intergovernmental Panel on Climate Change – the UN body set up to provide governments with scientific information that they can use to develop climate policies – reported, in October 2018, that if this target is to be met, emissions will need to be brought to net zero by the mid-century. So each signatory to the Paris Agreement has been submitting how it will contribute towards this aim – these are known as "nationally determined contributions". (the EU has submitted one paper that covers all the countries in the EU.) And then each signatory is taking the legal, regulatory and policy steps it needs to fulfil its commitments.
This timeline sets out the principle legal, regulatory and policy milestones towards that goal
OECD/G20 Two Pillar solution to address the taxation of the digitalised economy
This is an agreement between over 130 members of the OECD to implement a two-pillar solution to address the tax challenges arising from the digitalisation of the economy.
OECD/G20 Two Pillar solution to address the taxation of the digitalised economy
Effective date
1 January 2024 for certain elements of Pillar Two in the UK (the "Multinational top-up tax" and "Domestic top-up tax") and not earlier than 1 January 2025 (for the "undertaxed profits rule"). Implementation of Pillar One is still awaited in the UK.
Status
The main provisions for the implementation of Pillar Two are enacted but regulations are awaited to confirm the effective date (and further details of) the undertaxed profits rule (although this is not expected earlier than 1 January 2025). Implementation of Pillar One is still awaited.
Full name
See the provisions dealing with "Multinational top-up tax", "Domestic top-up tax" and "Undertaxed profits tax" in Parts 3 and 4 of Finance (No.2) Act 2023, available here.
Who does it impact?
All industries impacted by digitalisation with certain exceptions (e.g. financial services) but focussed on large multinational businesses (MNEs).
What does it do?
Agreement has been reached with over 130 members of the OECD/G20 Inclusive Framework to implement a two-pillar solution to address the tax challenges arising from the digitalisation of the economy.
Implementation of Pillar One is still some way off. It will be implemented by way of a multilateral convention (published in October 2023), and will not come into force until the multilateral convention has been ratified by a critical mass of countries. The introduction of Pillar One will be coordinated with the removal of all Digital Services Taxes and other relevant similar measures already implemented in jurisdictions.
The OECD framework for Pillar Two will operate on a country-by-country basis, with implementation dates varying between countries. The UK has enacted primary legislation in the Finance (No.2) Act 2023 to implement certain elements of Pillar Two in the UK from 1 January 2024 and other elements (which will be brought into force by regulations) which are not expected to be in force earlier than 1 January 2025.
The proposal is split into two pillars:
(i) Pillar One - this involves a partial reallocation of taxing rights over the profits of the largest and most profitable MNEs (those with revenues exceeding EUR20 billion and profitability greater than 10%) to the jurisdictions where consumers are located. So, it is about where they pay tax. It is hoped that this will resolve longstanding concerns that the international corporate tax framework has not kept pace with the digital economy and how highly digitalised businesses generate value from the active interaction with their users. Under the proposal, 25% of an MNE's "residual profit" above 10% of revenue would be allocated according to a key to recognise sustained and significant involvement in a market irrespective of physical local presence.
(ii) Pillar Two - sets a new minimum corporate tax rate of 15% for large MNEs (those with a combined group turnover of more than EUR750 million) on global profits and provides a new set of rules known as the global anti-base erosion (GloBE) rules which will expand taxing rights of jurisdictions to achieve the global minimum tax rate worldwide to apply to group profits. If a jurisdiction does not adequately tax profits, then other jurisdictions, in particular shareholder jurisdiction or source jurisdictions, can seek to tax such profits.
View the full timeline content
Why 2050?
The Paris Agreement – agreed at COP 21 in December 2015 - commits its 190+ signatories to keeping a rise in global temperatures this century below 2 degrees Celsius above pre-industrial levels and to pursue efforts to limit the temperature increase even further to 1.5 degrees Celsius.
Following adoption of the Paris Agreement, the Intergovernmental Panel on Climate Change – the UN body set up to provide governments with scientific information that they can use to develop climate policies – reported, in October 2018, that if this target is to be met, emissions will need to be brought to net zero by the mid-century. So each signatory to the Paris Agreement has been submitting how it will contribute towards this aim – these are known as "nationally determined contributions". (the EU has submitted one paper that covers all the countries in the EU.) And then each signatory is taking the legal, regulatory and policy steps it needs to fulfil its commitments.
This timeline sets out the principle legal, regulatory and policy milestones towards that goal
UK Platform Operators (Due Diligence and Reporting Requirements) Regulations 2023
These regulations introduce new standardised rules for collecting, reporting information about sellers and their income from digital platform activities to tax authorities and exchanging information between tax authorities.
UK Platform Operators (Due Diligence and Reporting Requirements) Regulations 2023
Effective date
1 January 2024 in the UK (with the first reports due by 31 January 2025)
Status
Regulations enacted (and came into force on 1 January 2024)
Full name
The Platform Operators (Due Diligence and Reporting Requirements) Regulations 2023, available here.
Who does it impact?
All online platforms and those who sell through them.
The UK's implementing regulations include two categories of "Excluded Platform Operators" which are platform operators whose entire business model is such that the platform operator either:
· does not allow sellers to derive a profit from the consideration, or
· has no "reportable sellers".
In each case, the platform operator may only rely on this exemption if it gives notice to HMRC in the form and manner specified in directions given by the HMRC.
What does it do?
These rules introduce new standardised rules for collecting and reporting relevant information about sellers of goods and relevant services – currently personal services (including the provision of transportation and delivery services), and the rental of immoveable property – and their income from digital platform activities to tax authorities and exchanging information between tax authorities. Under the rules platforms must:
· collect certain details about their sellers, including information to accurately identify: who the seller is; where they are based; how much they have earned on the platform over an annual period
· verify the seller’s information to ensure it is accurate
· report the information, including the seller’s income, to the tax authority annually by 31 January
· provide that information to sellers, to help them complete their tax returns.
There are penalties for non-compliance and Tax authorities will exchange the information with the tax authority in which the seller is resident (or rental property is located) to ensure local tax compliance.
View the full timeline content
Why 2050?
The Paris Agreement – agreed at COP 21 in December 2015 - commits its 190+ signatories to keeping a rise in global temperatures this century below 2 degrees Celsius above pre-industrial levels and to pursue efforts to limit the temperature increase even further to 1.5 degrees Celsius.
Following adoption of the Paris Agreement, the Intergovernmental Panel on Climate Change – the UN body set up to provide governments with scientific information that they can use to develop climate policies – reported, in October 2018, that if this target is to be met, emissions will need to be brought to net zero by the mid-century. So each signatory to the Paris Agreement has been submitting how it will contribute towards this aim – these are known as "nationally determined contributions". (the EU has submitted one paper that covers all the countries in the EU.) And then each signatory is taking the legal, regulatory and policy steps it needs to fulfil its commitments.
This timeline sets out the principle legal, regulatory and policy milestones towards that goal
⭐ EU Artificial Intelligence Act
This regulation creates a risk-based tiered regulatory regime for AI tools. High risk tools are banned outright or subject to an onerous compliance regime. Additional provisions will apply to general-purpose AI.
⭐ EU Artificial Intelligence Act
Effective date
The text of the AI Act was formally adopted by the European Parliament on 13 March, with a corrigendum adopted in April. Member State ministers sitting as the Council of the EU are expected to adopt the legislation later in May (date unknown).
It will become law 20 days after its publication in the Official Journal – currently predicted to be in late May or early June 2024.
The provisions of the AI Act will come into force progressively over the next few years:
• The prohibitions on specified categories of banned AI, as well as the general provisions dealing with scope and definitions, will come into force after six months – late 2024.
• The provisions on general-purpose AI, as well as the notification, governance, penalties and confidentiality provisions, will come into force after 12 months – summer 2025.
• Most other provisions will come into force after 2 years, including the rules for high risk models defined in Annex III – summer 2026.
• Rules for high risk AI contained in systems or products that are already subject to EU product safety legislation, as listed in Annex I, (see below) will come into force after 3 years – summer 2027.
Status
In the legislative process
Full name
Proposal for a Regulation laying down harmonised rules on Artificial Intelligence (Artificial Intelligence Act).
The version of the text adopted by the European Parliament on 13 March and incorporating the corrigendum of April is available here.
Who does it impact?
The AIA will apply to all those who provide, deploy, import or distribute AI systems in the EU across all sectors. It will apply to non-EU providers who place AI systems on the market in the EU or put them into service in the EU, and also providers and deployers of AI systems located outside the EU, but where the output of the AI system is used in the EU.
What does it do?
Definition of AI
The AIA defines AI as "a machine-based system designed to operate with varying levels of autonomy, that may exhibit adaptiveness after deployment and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments".
A risk-based approach
The AIA takes a risk-based approach, with the regulatory framework depending on both the level of risk created by an AI application, and the nature of the regulated entity's role. AI deemed high risk is regulated more strictly, as are those who create and distribute AI systems, who are regulated more strictly than organisations which deploy systems created by third parties. In addition, the AIA creates a regulatory framework for general-purpose AI.
"Risk" is assessed in the AIA by reference to both harm to health and safety, and harm to fundamental human rights and is a combination of the probability of occurrence of harm and the severity of that harm.
The proposed tiers of AIA regulation are prohibited AI, high risk AI, transparency requirements for certain forms of AI, and unregulated AI. Two further but distinct tiers apply to general-purpose AI.
Prohibited AI
Some uses of AI are considered to pose such a significant risk to health and safety or fundamental rights that they should be banned. Banned applications include:
• AI systems that use subliminal, manipulative or deceptive techniques intended to distort someone's behaviour materially by impairing their decision to make an informed decision and so causing them to take a decision that they would not otherwise have taken, causing significant harm;
• AI that exploits vulnerabilities such as age, disability, social or economic circumstances in order to distort their behaviour, causing significant harm;
• social scoring based on behaviour or personal characteristics where the scoring results in detrimental treatment of the person in question in a social context unrelated to the context in which the scoring data was originally generated or collected, or which is unjustified or disproportionate;
• AI systems used to predict the likelihood of a person committing a criminal offence, based solely on profiling that person or an assessment of their personality traits;
• AI systems that create or expand facial recognition databases through untargeted web-scraping of the internet or CCTV footage;
• emotion inference systems used in the workplace or educational settings unless for medical or safety reasons;
• biometric categorisation around sensitive characteristics (including race, political views, trade union memberships, religious or philosophical beliefs, sex life or sexual orientation); and
• real time remote facial recognition systems used in publicly accessible spaces for law enforcement, with exceptions.
High risk AI
Some AI applications are considered to pose a potentially high risk to health and safety or to fundamental rights, but not to the point that they should be prohibited. These high risk systems fall into two broad categories.
Firstly, AI will be classified as "high risk" for AIA purposes where it is used in safety systems or in products that are already subject to EU product safety legislation, including transport, other vehicles or machinery, and products such as toys, personal protective equipment and medical devices (the Annex I high risk categories).
Secondly, there is a list of specified "high risk" AI systems (in Annex III to the AIA). The detail of this list includes:
• permitted remote biometric identification systems (excluding systems solely used to confirm someone's identity);
• AI used for biometric categorisation based on sensitive or protected attributes or characteristics;
• emotion recognition systems;
• AI systems used as safety components in critical physical and digital infrastructure;
• AI systems used in an educational or vocational context, including determining access to training institutions, learning evaluation systems, educational needs appraisal systems, and systems used to monitor behaviour during exams;
• workplace AI systems for recruitment, applications appraisal, awarding and terminating employment contracts, task allocation and performance appraisal;
• assessment of eligibility for public benefits and services;
• credit checks (excluding fraud prevention systems);
• systems used to assess risk and set prices for life and health insurance
• systems for the despatch or prioritisation of emergency services; and
• various uses in law enforcement, immigration, asylum, judicial and democratic processes.
However, high risk regulation will not apply to AI falling in the Annex III categories where "it does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision making". This will be an issue for self-assessment. Where there is no such actual risk, the system will not have to comply with the AIA high risk regulatory regime.
Onerous compliance obligations are proposed for high risk AI systems concerning an "continuous, iterative" risk management system for the full lifecycle of the AI system. Compliance will require meeting the AIA requirements for technical documentation, record-keeping, transparency, human oversight, accuracy, robustness, and cybersecurity.
In addition, the AIA will impose extensive obligations concerning the governance and curation of data used to train, validate and test high risk AI. The focus is on ensuring that such data sets are relevant, sufficiently representative and, to the best extent possible, reasonably free of errors and complete in view of the intended purposes. The data should have "appropriate statistical properties", including as regards the people in relation to whom the AI system will be used. Data sets must reflect, to the extent appropriate for their intended use, the "specific geographical, contextual, behavioural or functional setting" within which the AI system will be used.
The burden of high risk AI compliance will apply in different ways to businesses at different points in the AI supply chain – providers (developers and businesses who have had AI developed for them to put onto the market), product manufacturers whose products incorporate AI, importers, distributors and deployers.
Lower risk AI
Some lower risk AI, outside the high risk regime, will nevertheless be subject to obligations, mainly relating to transparency. The prime concern is that users must be aware that they are interacting with an AI system, if it was not obvious from the circumstances and context. These provisions will apply to:
• chatbots and other systems that interact directly with individuals;
• systems producing synthetic audio, image, video or text content, which must be marked as having been artificially generated or manipulated;
• emotion recognition systems;
• biometric categorisation systems;
• deep fakes, and other images/video/audio content that have been created or manipulated by AI (with exceptions for "evidently artistic, creative, satirical, fictional or analogous works"); and
• systems producing text intended to inform the public on matters of public interest, which must disclose that it has been artificially generated or manipulated.
Other AI
For AI systems that do not fall within any of the above categories, the AIA provides for codes of conduct and encourages voluntary adherence to some of the regulatory obligations which apply to the high risk categories. Codes of practice may also cover wider issues such as sustainability, accessibility, stakeholder participation in development and diversity in system-design teams.
"General-purpose AI"
Since the AIA was first proposed in 2021, foundation AI systems have emerged as a significant slice of the AI ecosystem. They do not fit readily within the AIA tiers because they perform a specific function (translation, text generation, image generation etc) that can be put to many different applications with differing levels of risk.
The AI Act creates two layers of regulation for "general-purpose AI" models: one universal set of obligations for general-purpose AI models and a set of additional obligations for general-purpose AI models with systemic risk.
General-purpose AI will include foundation models and some generative AI models. They are defined as models that are "trained with a large amount of data using self-supervision at scale, that displays significant generality and is capable of competently performing a wide range of distinct tasks regardless of the way the model is placed on the market and that can be integrated into a variety of downstream systems or applications", with an exception for AI models used for research, development or prototyping.
A general-purpose AI will be classified as having "systemic risk" if:
• it has "high-impact capabilities" – i.e. it matches or exceed the capabilities of the most advanced existing general-purpose AI) and
• it is designated as a general-purpose model with systemic risk by the Commission.
The largest, state of the art AI models are expected to fall within this category.
The universal obligations for all general-purpose AI apply in addition to the core risk-based tiers of AIA regulation. Providers of all general-purpose AI models will be required to meet various transparency obligations (including information about the training data and in respect of copyright), which are intended to support downstream providers using the model in their AI system to comply with their own AI Act obligations.
General-purpose AI models with systemic risk are subject to a second tier of obligations. These will include model evaluation and adversarial testing, assessment and mitigation of systemic risk, monitoring and reporting on serious incidents, adequate cybersecurity, and monitoring and reporting on energy consumption.
Regulatory bodies and enforcement regime
As regards enforcement, the AIA will require Member States to appoint national level AI regulators which will be given extensive powers to investigate possible non-compliance, with powers to impose fines.
In addition, the "AI Office" has been created within the Commission to centralise monitoring of general-purpose AI models, lead on interaction with the scientific community and in international discussions on AI. It will also support the Commission in developing guidance, standards, codes of practice, codes of conduct, and in relation to investigations, testing and enforcement of AI systems. The AI Office will play a key role in governance across the national AI regulatory bodies appointed in Member States. The Commission's decision establishing the AI Office entered into force on 21 February 2024.
Coordination and coherence of the AI Act regime will be the responsibility of an AI Board, separate to the Commission's AI Office and comprising representatives from Member States.
Regulatory fines are in three tiers:
• up to the higher of 7 per cent of worldwide turnover or €35 million for breach of the prohibition provisions;
• up to the higher of 3 per cent of worldwide turnover or €15 million for breach of other substantive provisions (including compliance with the high risk AI regime, the low risk transparency regime, and the general-purpose AI provisions); and
• up to the higher of 1.5% of worldwide turnover or €7.5 million for supplying incorrect, incomplete or misleading information.
As noted above, deadlines for compliance will be staggered.
Further materials
European Commission proposes new regulatory framework for artificial intelligence | Osborne Clarke
What is the latest on international, EU and UK initiatives to regulate artificial intelligence?
The EU's AI Act: what do we know so far about the agreed text?
View the full timeline content
Why 2050?
The Paris Agreement – agreed at COP 21 in December 2015 - commits its 190+ signatories to keeping a rise in global temperatures this century below 2 degrees Celsius above pre-industrial levels and to pursue efforts to limit the temperature increase even further to 1.5 degrees Celsius.
Following adoption of the Paris Agreement, the Intergovernmental Panel on Climate Change – the UN body set up to provide governments with scientific information that they can use to develop climate policies – reported, in October 2018, that if this target is to be met, emissions will need to be brought to net zero by the mid-century. So each signatory to the Paris Agreement has been submitting how it will contribute towards this aim – these are known as "nationally determined contributions". (the EU has submitted one paper that covers all the countries in the EU.) And then each signatory is taking the legal, regulatory and policy steps it needs to fulfil its commitments.
This timeline sets out the principle legal, regulatory and policy milestones towards that goal
EU Cyber Resilience Act
This regulation will impose cybersecurity requirements for digital products and ancillary services throughout their lifecycle, requiring conformity assessments and a CE mark.
EU Cyber Resilience Act
Effective date
The text of the EU Cyber Resilience Act was formally adopted by the European Parliament on 12 March 2024. The text will now need to be formally adopted by EU national ministers sitting as the Council of the EU. It is anticipated that the Council will adopt the Act in April.
Once adopted by both institutions, it will be published in the Official Journal, after which it will enter into force 20 days later. Once in force, manufacturers will have 36 months to prepare for compliance with the rules - likely to be summer 2027.
Status
In the legislative process
Full name
Proposal for a Regulation on horizontal cybersecurity requirements for products with digital elements, available here.
The version that was adopted by the Parliament on 12 March 2024 is available here.
Who does it impact?
Manufacturers of products with digital elements (software and hardware products)
What does it do?
The Act will introduce cyber security requirements for products with digital elements which aims to protect consumers and businesses from products with inadequate security features. The Act will require manufacturers to ensure that the cybersecurity of their products is in conformity with minimum technical requirements, from the design and development phase, and throughout the whole life cycle of the product. This could include carrying out mandatory security assessments.
Certain types of products with digital elements deemed safety critical will be subject to stricter conformity assessment procedures, reflecting the increased cybersecurity risks they present.
The proposal also introduces transparency requirements, by requiring manufacturers to disclose certain cyber security aspects to consumers.
The Regulation will apply to all products that are connected either directly or indirectly to another device or network, with some exceptions such as medical devices, aviation or cars.
When the proposed regulation enters into force, software and products connected to the internet will be required to apply the CE mark to indicate they comply with the applicable standards.
In addition, the European common criteria-based cybersecurity certification scheme, developed under the EU Cybersecurity Act, which will apply on a voluntary basis to all information and communication technologies products within the EU, has recently been adopted. See the Products section of the February Regulatory Outlook for more.
Further materials
How is EU cybersecurity law affecting IoT product design? - Osborne Clarke
Products | UK Regulatory Outlook March 2024 - Osborne Clarke
Products | UK Regulatory Outlook February 2024 - Osborne Clarke
View the full timeline content
Why 2050?
The Paris Agreement – agreed at COP 21 in December 2015 - commits its 190+ signatories to keeping a rise in global temperatures this century below 2 degrees Celsius above pre-industrial levels and to pursue efforts to limit the temperature increase even further to 1.5 degrees Celsius.
Following adoption of the Paris Agreement, the Intergovernmental Panel on Climate Change – the UN body set up to provide governments with scientific information that they can use to develop climate policies – reported, in October 2018, that if this target is to be met, emissions will need to be brought to net zero by the mid-century. So each signatory to the Paris Agreement has been submitting how it will contribute towards this aim – these are known as "nationally determined contributions". (the EU has submitted one paper that covers all the countries in the EU.) And then each signatory is taking the legal, regulatory and policy steps it needs to fulfil its commitments.
This timeline sets out the principle legal, regulatory and policy milestones towards that goal
UK Digital Markets, Competition and Consumers Bill (competition aspects)
This bill creates new powers for the CMA to regulate digital market platforms with "significant market status", with individual reviews and bespoke codes of conduct. It also updates aspects of competition law.
UK Digital Markets, Competition and Consumers Bill (competition aspects)
Effective date
The Bill is expected to become law in spring 2024. The timeframe for when it comes into force is not yet known.
Status
In the legislative process. The House of Lords is currently considering changes made to its amendments by the House of Commons. The Lords are expected to agree. The bill will then go forward for Royal Assent, which is expected in May 2024.
Full name
Digital Markets, Competition and Consumers Bill, latest text available here.
Who does it impact?
The new regime is intended to apply to businesses that hold substantial and entrenched power in digital markets. Firms that meet certain cumulative thresholds will be in scope:
• A UK nexus test (that is, have a sufficient connection to the UK in a particular digital activity);
• A revenue test; and
• An activity test (that is, conduct a digital activity, or digital activities, that fall within the scope of the regime).
The legislation will only apply to firms meeting those thresholds that have been designated by the Digital Markets Unit (DMU), a specialist unit within the Competition and Markets Authority (CMA), as having strategic market status (SMS) following an SMS investigation. The legislation will potentially impact any businesses operating in digital markets by changing the regulatory overlay of rights and obligations in these markets.
What does it do?
The UK's Digital Markets, Competition and Consumer Bill will introduce new statutory powers for the DMU to regulate powerful digital firms. The DMU will remain an administrative unit within the CMA, rather than being designated as a separate regulator.
The Bill concerns digital activities, defined as services provided over the internet or digital content, whether paid-for or free of charge. CMA jurisdiction will require a link to the UK.
A business will not be designated with SMS unless it meets the financial threshold of £1 billion in UK group turnover or £25 billion global group turnover in a relevant 12 month period.
The DMU may designate a business as having SMS following an SMS investigation. The investigation will consider whether the business has substantial and entrenched market power, with a forward-looking analysis at least 5 years into the future. It will also assess whether the business has a position of strategic significance in relation to the digital activity in question, whether by its size or scale, the reliance by others on its services, or the influence that it can exert on others as a consequence of its position. Designations will last for 5 years and the designation process will include public consultation and liaison with other regulators.
The DMU may create bespoke a code of conduct for each SMS business with a view to ensuring fair dealing, open choices (which may require enhanced data portability and interoperability of services), and trust and transparency.
The CMA is given extensive powers of investigation and enforcement, including fines of up to 10% of global turnover and wide-ranging remedies. In addition to SMS investigations and enforcement, the CMA may also make a "pro-competition intervention" to deal with an adverse effect on competition in a digital market. It will have the same powers as it currently enjoys to take remedial action as following a market investigation, including the power to order divestments and break-ups.
The Bill makes various amendments to the existing merger control regime including specific changes for digital markets. The new provisions are intended to ensure that mergers with a "transaction value" above £25 million are reported to the CMA (where otherwise they might fall below the notification threshold).
The proposed regulatory regime will:
• Allow the DMU to designate firms that have a substantial, entrenched and strategic position in certain digital activities with "Strategic Market Status (SMS)".
• Make firms with SMS subject to a new code of conduct, designed to achieve statutory objectives of fair trading, open choices and trust and transparency.
• Allow the DMU to use pro-competitive interventions. It is anticipated that the DMU will have powers to flexibly design pro-competitive interventions.
• Make changes to the existing merger control regime. This will make notification of mergers, acquisitions and the creation of joint-ventures by SMS firms mandatory where the total consideration is at least £25 million and the transaction will result in the SMS firm crossing certain share/voting rights thresholds The Bill also proposes changes to the notification thresholds for all mergers, including a new "transaction value" threshold of £100 million. There is also a requirement to notify mergers where either party has a 33% or more share of supply and a UK turnover of £350 million. This is designed to capture "killer acquisitions" that would otherwise slip under the CMA's radar.
• The Bill gives extraterritorial effect to the UK prohibition against anti-competitive agreements for agreements which are likely to have an immediate, substantial and foreseeable effect on trade within the UK, including agreements that are not implemented or intended to be implemented in the UK. Additionally the Bill will give the CMA power to issue fines to overseas companies for failure to comply with an information request.
• Makes provision in relation to the issue of litigation funding for opt-out cases heard before the Competition Appeal Tribunal.
• Give the CMA power) that to impose fines for breaches of competition orders and undertakings.
The appeal standard for decisions taken under the Bill has received significant parliamentary attention. The House of Commons has recently reinstated provision for appeals against penalties under the Bill to be considered on the merits of the case (not on judicial review principles, as the House of Lords had proposed).
Further materials
Overview video: https://youtu.be/HuHLFokwYO4
Video on merger control changes: https://youtu.be/9EnmQAscmx0
View the full timeline content
Why 2050?
The Paris Agreement – agreed at COP 21 in December 2015 - commits its 190+ signatories to keeping a rise in global temperatures this century below 2 degrees Celsius above pre-industrial levels and to pursue efforts to limit the temperature increase even further to 1.5 degrees Celsius.
Following adoption of the Paris Agreement, the Intergovernmental Panel on Climate Change – the UN body set up to provide governments with scientific information that they can use to develop climate policies – reported, in October 2018, that if this target is to be met, emissions will need to be brought to net zero by the mid-century. So each signatory to the Paris Agreement has been submitting how it will contribute towards this aim – these are known as "nationally determined contributions". (the EU has submitted one paper that covers all the countries in the EU.) And then each signatory is taking the legal, regulatory and policy steps it needs to fulfil its commitments.
This timeline sets out the principle legal, regulatory and policy milestones towards that goal
⭐ EU AI Liability Directive
This directive helps parties bring a claim in relation to harm caused by an AI tool, by making it easier to obtain information and by altering the burden of proof.
⭐ EU AI Liability Directive
Effective date
The directive is currently in the EU legislative process although will need to be revived after the European Parliament election in June 2024. Once enacted, it will then need to be implemented by national legislation in each of the EU Member States, typically within two years. It is therefore not likely to be in full force and effect for a number of years.
Status
In the legislative process; will require domestic legislation at Member State level.
This directive will not be enacted before the European Parliament elections in June 2024. A new Commission will be appointed by the new Parliament after the elections, taking office on 1 November 2024. One of its early tasks will be to decide which unfinished legislation to withdraw and which to continue. Whether to pursue the AI liability directive will be part of that decision-making process: we consider it likely that the directive will be revived and enacted, likely to be during the course of 2025.
Full name
Directive of the European Parliament and of the Council on adapting non-contractual civil liability rules to artificial intelligence (AI Liability Directive), available at:
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52022PC0496&qid=1696345247480
Who does it impact?
The directive will impact on businesses and individuals bringing or defending private actions for non-contractual damages in relation to artificial intelligence (AI). It will (once implemented at national level) change civil litigation rules in EU Member States on access to evidence and the burden of proof for some AI damages claims.
What does it do?
The EU AI Liability Directive is intended to reduce perceived difficulties in claiming non-contractual damages for harm caused by AI.
The proposal sits alongside the proposed EU AI Act and wider reforms to EU product liability legislation. Some AI systems will fall under the EU's product liability regime, a strict liability regime that does not require proof of fault. Where they do not, damages for harm are likely to take the form of a non-contractual claim that requires the claimant to prove the defendant's fault and a causation link between the fault and the harm suffered.
The complexities of AI systems can make it difficult to unravel why harm has been caused, whether there was fault, and whether the fault flowed through to the harm caused. Claimants often suffer from an asymmetry of information – the defendant knows more about what has happened than they do – which can be even greater in relation to claims about an AI system, particularly in civil law systems without common law-style disclosure obligations. The AI liability directive seeks to address these difficulties with two changes to standard civil litigation procedure in EU Member States for AI claims.
Access to information
First, a new right of access to information is proposed for claimants seeking compensation in relation to an AI system classified as "high risk" under the AI Act. Under the proposals in the directive, the claimant must first make "all proportionate attempts" to obtain information from the defendant. If that is unsuccessful and if the claimant can show they have a plausible claim for damages, the claimant will be able to ask the court to order disclosure of "relevant evidence" from the defendant.
"Relevant evidence" is not currently defined, but could feasibly include some or all of the extensive compliance and technical documentation required for high-risk systems under the AI Act. It could also potentially extend to data sets used for training, validating or testing AI systems and even to the content of mandatory logs that AI providers must maintain for traceability purposes.
Moreover, the directive proposes that failure to comply with a disclosure order will trigger a rebuttable presumption of non-compliance with a duty of care by the defendant – aiding the claimant in proving fault.
Presumption of causality
Secondly, the directive proposes creating a "presumption of causality". "National courts shall presume … the causal link between the fault of the defendant and the output produced by the AI system" where the claimant shows that all of the following requirements are met:
· The defendant is in breach of a duty of care under national or EU law – the required "fault". The scope of what might constitute a relevant duty of care for these purposes is not defined, although for providers and users of high-risk AI systems, provisions of the AI Act that would constitute relevant breaches for liability purposes are clearly listed. As noted above, if the defendant has failed to comply with a disclosure order, the claimant benefits from a rebuttable presumption as to the defendant's fault; and
· It is reasonably likely from the circumstances in which the harm occurred that the defendant's fault has influenced the output or lack of output of the AI system in question. The burden of proof on the claimant is reduced from having to prove this point to the required standard (for example, that it is more likely than not), to having to show only that it is reasonably likely; and
· The output or lack of output of the AI system gave rise to the harm suffered.
The proposal is not as simple as a reversal of the burden of proof: the claimant still needs to demonstrate these three elements.
In relation to high-risk AI systems, the directive proposes that the defendant will be shielded from the presumption of causality where it can demonstrate that the claimant has access to sufficient evidence and expertise to prove the causal link.
For AI systems that are not high risk, the presumption will apply only where the court considers that it would be excessively difficult for the claimant to prove the causal link.
Finally, the proposal is that the presumption will apply to AI systems that are put into use by a non-professional user only if they have materially interfered with the conditions of operation of the AI system or where they were required and able to determine the conditions of operation of the AI system but failed to do so.
More generally, the presumption of causality will be rebuttable, shifting the burden of proof onto the defendant to show that there is no causal link between the fault and the AI output; for example, by showing that the AI system could not have caused the harm in question.
There is an intentional interplay between this directive and the EU's draft AI Act that will link non-compliance with the AI Act regulatory regime to increased exposure to damages actions.
Compliance period
Once enacted at EU level, the principles in the directive will then need to be implemented at national level. This is known as the transposition period and usually lasts two years. This two-stage approach reflects the extensive differences in detail between the civil litigation rules of different EU Member States. It enables each jurisdiction to enact harmonised changes but adapted as needed to fit into their national civil litigation regimes.
As currently drafted, the new rules would only apply to harm that occurs after the transposition period, without retrospective effect.
Further materials
View the full timeline content
Why 2050?
The Paris Agreement – agreed at COP 21 in December 2015 - commits its 190+ signatories to keeping a rise in global temperatures this century below 2 degrees Celsius above pre-industrial levels and to pursue efforts to limit the temperature increase even further to 1.5 degrees Celsius.
Following adoption of the Paris Agreement, the Intergovernmental Panel on Climate Change – the UN body set up to provide governments with scientific information that they can use to develop climate policies – reported, in October 2018, that if this target is to be met, emissions will need to be brought to net zero by the mid-century. So each signatory to the Paris Agreement has been submitting how it will contribute towards this aim – these are known as "nationally determined contributions". (the EU has submitted one paper that covers all the countries in the EU.) And then each signatory is taking the legal, regulatory and policy steps it needs to fulfil its commitments.
This timeline sets out the principle legal, regulatory and policy milestones towards that goal
UK Digital Markets, Competition and Consumers Bill (consumer aspects)
This bill updates consumer law. It includes changes to rules for consumer subscriptions. It also strengthens the CMA's enforcement and fining powers.
UK Digital Markets, Competition and Consumers Bill (consumer aspects)
Effective date
The Bill is expected to become law in spring 2024. The timeframe for when it comes into force is not yet known.
Status
In the legislative process. The House of Lords is currently considering changes made to its amendments by the House of Commons. The Commons accepted amendments relating to fake reviews, drip pricing and subscription contracts, but rejected amendments in relation to secondary ticketing websites. The Lords are expected to agree. The bill will then go forward for Royal Assent, which is expected in May 2024.
Full name
Digital Markets, Competition and Consumers Bill, latest text available here.
Who does it impact?
Broadly speaking, the bill will impact all consumer-related businesses since it not only applies to all consumer contracts but also in circumstances where consumers are targeted. The bill includes a significant overhaul of the laws relating to subscription contracts – as such, providers of subscription services are likely to be particularly impacted.
What does it do?
The Government has said that the bill aims to enhance consumer regulations so they “work better” for the UK – this includes protecting consumers by strengthening the enforcement of consumer protection law (including by giving the Competition and Markets Authority (CMA) significant new powers and the prospect of significant fines) and introducing new consumer rights, including by tackling "subscription traps" and the proliferation of fake reviews.
Commercial practices that are always considered unfair
The bill repeals and reinstates existing consumer protection for unfair trading regulations. In addition to various minor changes, it amends and supplements the list of commercial practices that are always considered unfair, to reflect the fact that consumers and traders increasingly interact online (resulting in wider application).
In line with its response to the outcome of its consultation (January 2024) in response to improving consumer transparency, various activities relating to the submission, commission or publication of fake reviews were added to the list of banned commercial practices in Schedule 19 on 30 April 2024. The bill was also amended to provide that a trader must set out the total price of a product, including any mandatory fees, taxes and charges that apply rather than drip-feeding in these amounts during the transaction process.
In addition, the bill amends some definitions, including “average consumer” “commercial practice” and “transactional decision” and expands the definition of "vulnerable consumers".
Power to amend the list of unfair commercial practices
The Secretary of State will also have the power to amend the bill in various ways including:
• adding, amending or removing blacklisted offences;
• giving consumers additional rights of redress; and
• adding, amending or removing information that must be included in an invitation to purchase.
Subscription contracts
The bill will give new rights to consumers and impose new obligations on providers in respect of subscription contracts. In summary, the proposals include:
• providing consumers with clearer pre-contractual information (the bill sets out the "key" and "full" information a business must give);
• offering a cooling-off period both when the customer enters into the contract as well as a new "renewal cooling-off period";
• strict time limits on providing consumers with reminders before (a) a free trial or low-cost introductory offer comes to an end and converts into a paid or more costly subscription; and (b) a contract auto-renews and commences a new term. Such reminders need to include the date and length of renewal, the current price and the price following renewal, and any notice period and other requirements for cancelling auto-renewal;
• ensuring consumers can easily exit contracts in a straightforward, cost-effective and timely way (ideally in one click, i.e. via a cancellation button);
• providing end-of-contract notice to consumers who have cancelled; and
• if the consumer signed up online, obtaining express consent that the contract will impose payments.
Enforcement
The bill significantly enhances the CMA’s role in enforcing consumer protection laws, giving the CMA the power to levy civil fines of up to £300,000 or 10% of annual global turnover (whichever is higher) for breach of all consumer law (not just as updated by the bill). The bill also allows the CMA to directly investigate suspected infringements and practices that may harm the collective interests of consumers in the UK, and issue enforcement notices without going to court first.
Further materials
New UK legislation envisages powerful digital markets regime and significant reform to consumer law
Overview video: https://youtu.be/HuHLFokwYO4
Video on dark patterns: https://youtu.be/FhNAJYT1Xxg
Video on subscription law changes: https://youtu.be/3D0yDatHHG0
View the full timeline content
Why 2050?
The Paris Agreement – agreed at COP 21 in December 2015 - commits its 190+ signatories to keeping a rise in global temperatures this century below 2 degrees Celsius above pre-industrial levels and to pursue efforts to limit the temperature increase even further to 1.5 degrees Celsius.
Following adoption of the Paris Agreement, the Intergovernmental Panel on Climate Change – the UN body set up to provide governments with scientific information that they can use to develop climate policies – reported, in October 2018, that if this target is to be met, emissions will need to be brought to net zero by the mid-century. So each signatory to the Paris Agreement has been submitting how it will contribute towards this aim – these are known as "nationally determined contributions". (the EU has submitted one paper that covers all the countries in the EU.) And then each signatory is taking the legal, regulatory and policy steps it needs to fulfil its commitments.
This timeline sets out the principle legal, regulatory and policy milestones towards that goal
⭐ EU Revised Product Liability Directive
This directive seeks to update product liability rules to include digital products (including software as a service (SaaS)/free standing software), services and platforms. It will require implementation at Member State level.
⭐ EU Revised Product Liability Directive
Effective date
The European Parliament formally adopted the new Product Liability Directive on 12 March 2024. The Council now needs to adopt the directive formally, after which it will be published in the EU Official Journal and come into force after 20 days. Member states will be required to transpose the directive into national law within 24 months after the directive becomes law.
There is no further compliance period for businesses once the national implementing laws are in place so products will need to be compliant from summer 2026.
Status
In the legislative process
Full name
Proposal for a Directive on liability for defective products, available here.
The version that was adopted by the Parliament on 12 March 2024 is available here.
Who does it impact?
Anyone placing products on the EU market.
What does it do?
This directive will provide easier access to compensation for consumers who suffer damage from defective products and includes amendments relating to the directive's scope, treatment of psychological damage, and allocation of liability regarding software manufacturers.
The update to the existing product liability framework, dating from 1985, will:
• Update definitions and scope to resolve inconsistences and legal uncertainty, notably regarding the meaning of the term "product". The legislation also amends the scope of the potentially liable parties (to include companies that substantially modify products, providers of software and providers of digital services).
• Modernise liability rules for digital or connected products. The revised PLD will allow compensation for damages when connected products are made unsafe by software updates, when AI or digital services cause damage, when manufacturers fail to address cybersecurity vulnerabilities and where defective products cause a loss or corruption of data.
• Ensure that there is always a business in the EU (i.e. a manufacturer, importer or authorised representative) that can be held liable for a product, even if the product was not purchased in the EU.
• Change rules on disclosure of evidence and the burden of proof. Manufacturers will be required to disclose evidence where a defective product has caused damage, and in complex cases where it is considered excessively difficult for a claimant to prove that a product is defective, the burden of proof will be switched to the defendant entity.
• Consumers will also be able to seek compensation for non-material losses such as medically recognised damage to psychological health.
Our recently published infographic on product liability reform in the EU and UK sets out some of the key changes and practical actions businesses should be considering. For example, in regards to claimants having enhanced rights over disclosure under the revised EU PLD, businesses should ensure disclosable materials are fit for purpose, including: design files; evidence of safety testing in design phase; and policies on vigilance and corrective actions. See the infographic for more.
Further materials
Products | UK Regulatory Outlook March 2024 - Osborne Clarke
View the full timeline content
Why 2050?
The Paris Agreement – agreed at COP 21 in December 2015 - commits its 190+ signatories to keeping a rise in global temperatures this century below 2 degrees Celsius above pre-industrial levels and to pursue efforts to limit the temperature increase even further to 1.5 degrees Celsius.
Following adoption of the Paris Agreement, the Intergovernmental Panel on Climate Change – the UN body set up to provide governments with scientific information that they can use to develop climate policies – reported, in October 2018, that if this target is to be met, emissions will need to be brought to net zero by the mid-century. So each signatory to the Paris Agreement has been submitting how it will contribute towards this aim – these are known as "nationally determined contributions". (the EU has submitted one paper that covers all the countries in the EU.) And then each signatory is taking the legal, regulatory and policy steps it needs to fulfil its commitments.
This timeline sets out the principle legal, regulatory and policy milestones towards that goal
UK Data Protection and Digital Information Bill (data protection aspects)
Part 1 of this bill makes post-Brexit changes to GDPR-based UK data protection law, aimed at reducing the administrative burden on businesses, enabling innovation and reforming the ICO.
UK Data Protection and Digital Information Bill (data protection aspects)
Effective date
The Bill is expected to be enacted during 2024. The date on which the data protection aspects will come into force remains to be confirmed.
Status
In the legislative process
Full name
UK Data Protection and Digital Information Bill, available here.
Who does it impact?
Part 1 of the Data Protection and Digital Information Bill (DPDI Bill) amends the existing regulatory regime around personal data. As such, it potentially impacts on any organisation or person who controls or processes personal data in the UK, or who processes personal data relating to UK data subjects (whether or not it does so in the UK). Substantially all UK businesses (and many international businesses operating in the UK market) are subject to the UK data protection regime to some extent.
What does it do?
The data protection provisions in the DPDI Bill do not set up a new data protection regulation regime for the UK, but amend and adapt the existing one contained in the UK General Data Protection Regulation (UK GDPR) (restated as UK law after Brexit) and the Data Protection Act 2018 (DPA 2018).
There were two iterations of the DPDI Bill in the parliamentary session that ended in autumn 2023 and then a swathe of significant amendments were made when the bill was reintroduced into the new session of Parliament in November 2023.
Nevertheless, the overall impact as regards the core regulatory regime for personal data is considered to be an evolution of the existing regime, rather than a revolution. The scope for significant change is constrained by the desire to maintain "adequacy status" with the EU GDPR regime. Having adequacy status means that data can flow more easily from the EU to the UK.
The main changes to personal data regulation in the DPDI Bill include :
• Adjustments to the definition of personal data, intended to make it clearer when data is anonymous and therefore outside the scope of the legislation, as well as to ensure consistency of interpretation between the UK GDPR and DPA 2018.
• Addition of a new lawful ground for processing where necessary for a "recognised legitimate interest", including national security, public safety, emergency response, criminal investigation and prosecution or safeguarding vulnerable people. When relying on that lawful ground, the controller will not be required to balance its legitimate interests against the data subject's interests, rights and freedoms.
• Clarification of the lawful grounds for processing on the basis of international law (as opposed to domestic (UK) law).
• Changes to the grounds for refusing a data subject access request, intended to make it easier to refuse where the system is being abused. Further amendments would embed the proviso that searching in response to a data request should be reasonable and proportionate.
• Changes to the provisions on automated decision-making that will reframe it as a requirement for safeguards to be in place, rather than a prohibition with exceptions. More stringent provisions will continue to apply where an automated decision is based entirely or partly on special categories of personal data. This change potentially facilitates greater use of automated decision-making through artificial intelligence.
• Changes to the (arguably) more administrative requirements of the UK GDPR. The DPDI Bill will only require controllers and processors to maintain records of processing where such processing is likely to result in a high risk to the rights and freedoms of individuals. The DPDI Bill will also replace the requirement to appoint a Data Protection Officer with a requirement to appoint a "senior responsible individual"; that person no longer needs to be independent of senior management. Data processing impact assessments (DPIAs) will be replaced with an "assessment of high risk processing". Overseas organisations that are caught by the UK GDPR will no longer need to appoint a UK representative.
• Amendments to the requirements around international data transfers intended to consolidate and clarify.
• Amendments to the Privacy and Electronic (EC Directive) Regulations 2003 (PECR), including in relation to direct marketing, cookies (and similar tracking technologies) and enforcement.
• Reform of the Information Commissioner's Office to form the Information Commission, creating a principle objective and general duties, with new scope for the Secretary of State to issue a statement of strategic priorities for data that the commissioner would be required to have regard to. Procedures around the issue and authorisation of codes have been amended to enable the secretary of state to comment and for those comments to be considered by the commissioner.
• New amendments were added by the government in November 2023 to authorise the gathering of information for social security purposes, in particular to tackle benefits fraud. This will include power to require personal data from banks and other financial institutions.
• Amendments to the Online Safety Act 2023 to require social media companies to retain personal data about a child who has died.
Further materials
https://www.osborneclarke.com/insights/uk-government-reignites-data-protection-reform
View the full timeline content
Why 2050?
The Paris Agreement – agreed at COP 21 in December 2015 - commits its 190+ signatories to keeping a rise in global temperatures this century below 2 degrees Celsius above pre-industrial levels and to pursue efforts to limit the temperature increase even further to 1.5 degrees Celsius.
Following adoption of the Paris Agreement, the Intergovernmental Panel on Climate Change – the UN body set up to provide governments with scientific information that they can use to develop climate policies – reported, in October 2018, that if this target is to be met, emissions will need to be brought to net zero by the mid-century. So each signatory to the Paris Agreement has been submitting how it will contribute towards this aim – these are known as "nationally determined contributions". (the EU has submitted one paper that covers all the countries in the EU.) And then each signatory is taking the legal, regulatory and policy steps it needs to fulfil its commitments.
This timeline sets out the principle legal, regulatory and policy milestones towards that goal
⭐ EU European Digital Identity Framework Regulation
This regulation aims to create an EU-wide framework for trusted and secure digital identities that can be used across the EU, including control of personal data.
⭐ EU European Digital Identity Framework Regulation
Effective date
On 30 April 2024, the regulation was published in the Official Journal of the EU and will enter into force 20 days later, i.e. on 20 May 2024. Member States are required to make a digital identify wallet available to their citizens by 20 May 2026.
Status
In the legislative process. An implementing regulation will also be required, setting out full technical specifications. This will be issued by the Commission and is expected to be enacted 6 months after this regulation.
Full name
Regulation (EU) 2024/1183 of the European Parliament and of the Council of 11 April 2024 amending Regulation (EU) No910/2014 as regards establishing the European Digital Identity Framework.
The final text (published in the EU Official Journal on 30 April 2024) is available here.
Who does it impact?
This legislation will update and amend the existing digital identity regime in the EU. It will affect all EU citizens, who will be able to have an EU digital identity wallet to prove their identity, to hold other documents such as qualification certificates, bank cards or tickets, and to access public and private services. Wallets will be available to prove the identity of natural and legal persons, and of natural persons representing a natural or legal person. The legislation will also impact on the providers of digital identity services, and be relevant to businesses to which the wallet is presented.
What does it do?
This new legislation will amend existing EU rules around digital identity to create the European Identity Framework, known as eIDAS. The concept is for a digital wallet – for example an app on phones – that will stand as proof of the person's identity and can also be used to store and prove other "formal" attributes such as qualifications, certificates, a driving licence, medical prescriptions, and other variations on someone's status and entitlements.
Key points include:
• Wallets will not be compulsory and there will be no discrimination where someone does not have a wallet. They will not replace national ID cards.
• They will be issued at Member State level but will be valid across the EU due to the harmonised legal basis and standards for their issue. They can be issued by the Member State directly, under mandate from a Member State or independently of the Member State but formally recognised by it.
• Wallets will be free of charge. They will also carry the ability to apply an electronic signature, although Member States will be able to prevent free-of-charge use of the wallet for e-signatures for professional purposes.
• Electronic attestations of attributes issued by the body responsible for its authenticity will have the same legal status as an attestation from that body in paper format.
• The regulation includes provisions to ensure that there is a high degree of confidence in the proof of identity provided by the wallet. It includes detailed procedures to be followed in the event of a cybersecurity breach in relation to wallets or the systems that support them.
• The legislation is technology-neutral. The source code for application software components will be open source, although certain elements (not installed on user devices) may be kept confidential.
• The eIDAS framework will be based on a common technical architecture with common standards and harmonised security requirements, building on existing cybersecurity regulatory requirements. This will ensure interoperability of wallets across the EU and regardless of the issuer.
• Member States will be required to provide record matching services across borders.
• Wallet holders will have full control over their data via a "privacy dashboard" and will be able to use the wallet to prove, for example, their age without revealing wider information about their identity beyond what is needed. Wallet providers will not control the data contained in the wallet. Dashboards will contain a log of all transactions where the wallet has been used, and support data portability for the user. Entities that have provided attestations held in the wallet will not be able to track or monitor the wallet holder's activities without their express consent.
• Businesses designated as "very large online platforms" (VLOPs) under the EU's Digital Services Act will be obliged to accept the wallet as proof of identity for users accessing their services.
• Parties seeking to rely on eIDAS wallets for the provision of public or private services will need to register, with the Member State where they are established, their details and how they will be relying on wallets. They must reveal themselves to the wallet holder, although the holder can provide only a pseudonym where their actual identity is not needed for the service in question. The legislation will also establish a legal framework for electronic signatures (which can be administered using an eIDAS wallet), electronic seals, electronic time stamps, electronic documents, electronic registered delivery services, certificate services for website authentication, electronic archiving, electronic attestation of attributes, electronic signature and seal creation devices, and electronic ledgers.
Further materials
The European Commission's Q&A on this regulation is available here.
View the full timeline content
Why 2050?
The Paris Agreement – agreed at COP 21 in December 2015 - commits its 190+ signatories to keeping a rise in global temperatures this century below 2 degrees Celsius above pre-industrial levels and to pursue efforts to limit the temperature increase even further to 1.5 degrees Celsius.
Following adoption of the Paris Agreement, the Intergovernmental Panel on Climate Change – the UN body set up to provide governments with scientific information that they can use to develop climate policies – reported, in October 2018, that if this target is to be met, emissions will need to be brought to net zero by the mid-century. So each signatory to the Paris Agreement has been submitting how it will contribute towards this aim – these are known as "nationally determined contributions". (the EU has submitted one paper that covers all the countries in the EU.) And then each signatory is taking the legal, regulatory and policy steps it needs to fulfil its commitments.
This timeline sets out the principle legal, regulatory and policy milestones towards that goal
UK Data Protection and Digital Information Bill (digital identity aspects)
Part 2 of this bill creates a new regulatory regime for digital verification services (DVS), intended to make it easier, cheaper and more secure for people to prove their identity and other attributes.
UK Data Protection and Digital Information Bill (digital identity aspects)
Effective date
The Bill is expected to be enacted during 2024. The date on which the digital identify aspects will come into force remains to be confirmed.
Status
In the legislative process
Full name
UK Data Protection and Digital Information Bill, available here.
Who does it impact?
Part 2 of the Data Protection and Digital Information Bill (DPDI Bill) will be the UK’s first legislative framework to regulate private organisations providing digital identity verification services. The digital identity aspects of the Bill will mainly affect:
· organisations which currently have a need to verify the identity of customers; and
· organisations which offer digital verification services (DVS) to any extent via the Internet.
What does it do?
This part of the DPDI Bill provides for a new regulatory regime for DVS (which intersects with data protection laws).
If the Bill proceeds in its current form,
· individuals would apply to use the DVS, including creating a reusable digital identity that could then be shared in whole or in part with organisations requiring such information; and
· there will be an "information gateway" for data protection purposes – this would allow public authorities to disclose personal information relating to a specific individual to an accredited provider where that individual has requested it, subject to certain conditions.
The Secretary of State will be able to set fees for approval of DVS providers, and to remove them from the DVS register where necessary.
The DVS trust framework (i.e. rulebook for DVS providers)
The Bill includes a requirement for the Secretary of State for DCMS to prepare and publish the "DVS trust framework", i.e. a document setting out the core rules concerning the provision of DVS (known as the main code). In preparing the DVS trust framework, the Secretary of State must consult the UK's data protection authority (the Information Commissioner) and such other persons as the Secretary of State thinks appropriate.
At least every 12 months, the Secretary of State must review the trust framework document, undertaking the same consultation process. It can then decide whether to republish a revised version of the framework. The framework can set different rules for different types of DVS, including different conditions for approval or designation of DVS providers for different purposes. Each version of the framework must specify the time it comes into force, which must not be a time earlier than the time it is published.
The Secretary of State will be able to issue supplementary codes, or to approve a supplementary code drawn up by another body. These provisions are intended to enable rules to be set to address sector-specific requirements, in addition to the core rules in the main code.
Other Secretary of State obligations
Under the Bill's current proposals, the Secretary of State will also:
· be under an obligation to establish and maintain a register of persons providing DVS; to be listed on the register, DVS providers would need to satisfy certain criteria, including holding a certificate issued by an accredited conformity assessment body; and
· have the power to issue DVS "trust marks", which can only be used by organisations that are registered on the DVS register.
View the full timeline content
Why 2050?
The Paris Agreement – agreed at COP 21 in December 2015 - commits its 190+ signatories to keeping a rise in global temperatures this century below 2 degrees Celsius above pre-industrial levels and to pursue efforts to limit the temperature increase even further to 1.5 degrees Celsius.
Following adoption of the Paris Agreement, the Intergovernmental Panel on Climate Change – the UN body set up to provide governments with scientific information that they can use to develop climate policies – reported, in October 2018, that if this target is to be met, emissions will need to be brought to net zero by the mid-century. So each signatory to the Paris Agreement has been submitting how it will contribute towards this aim – these are known as "nationally determined contributions". (the EU has submitted one paper that covers all the countries in the EU.) And then each signatory is taking the legal, regulatory and policy steps it needs to fulfil its commitments.
This timeline sets out the principle legal, regulatory and policy milestones towards that goal
⭐ UK Data Protection and Digital Information Bill (smart data aspects)
Part 3 of this bill enables the creation of "smart data" schemes, sector by sector. Secure sharing of customer data at the customer's request is intended to power innovation and generate consumer benefits.
⭐ UK Data Protection and Digital Information Bill (smart data aspects)
Effective date
The Bill is expected to be enacted during 2024. The smart data aspects must be brought into effect by secondary legislation.
In November 2023, the government consulted on "Open Communications – a Smart Data scheme for the UK telecoms market" (focused on broadband and mobile phone services) in preparation for the first such set of delegated legislation, and is currently analysing the feedback.
In April 2024, the government published its smart data roadmap setting out how it intends to set up smart data schemes on a sector-by-sector basis.
Status
In the legislative process. Secondary legislation will be needed.
Full name
UK Data Protection and Digital Information Bill, available here.
Who does it impact?
This part of the Data Protection and Digital Information Bill (DPDI Bill) concerns the secure sharing of customer data with third parties at the customer's request. The scope of the DPDI Bill itself is potentially very wide but it delegates legislative power to the government to implement smart data schemes in particular areas. The impact of these new enhanced portability rights for customers is expected to be gradual.
The legislation will apply to all businesses operating in the UK.
However, although these provisions are general in scope, certain sectors are likely to feel their impact earlier than others:
• in the Financial Services sector, where legislation to enable open banking has been in place since 2018, the Financial Conduct Authority, Payment Systems Regulator and the Competition and Markets Authority are now working together to design and oversee the next phase of open banking, as it evolves and expands into open finance. In addition, legislation enacted in 2022 set out the framework for pensions dashboards, enabling people to access information about their pensions online in a single place. In March 2023, the deadline for pension providers and schemes to complete connections to the pensions dashboard was pushed back to October 2026;
• Ofcom has consulted on an "Open Communications" scheme for the Telecoms sector, focused on the provision of broadband and mobile services for consumers and businesses; it is currently analysing feedback from this consultation; and
• in January 2024, the government consulted on an open data scheme and ongoing monitoring function for road fuel prices. The consultation, which sought views on the best way to design and implement the open data scheme, closed on 12 March 2024 and the government is currently analysing the feedback. The government has said that following Royal Assent of the Bill and the conclusion of the consultation process, it will lay the necessary regulations to establish the open data scheme for fuel prices.
In April 2024, the Department for Business and Trade published its smart data roadmap, setting out how the government will implement smart data schemes in the following sectors:
- Banking;
- Finance;
- Energy and road fuels;
- Telecoms;
- Transport;
- Retail; and
- Home buying
Each sector will progress through four stages of implementation: identification, consultation, design and implementation. Currently, most of the sectors are at the identification or consultation stages, with the exception of banking, which is at the implementation stage (the Open Banking scheme having been established in 2017)
What does it do?
The intention of the "smart data" provisions in the DPDI Bill is to create enhanced data portability between suppliers, service providers, customers and third parties to rebalance the information asymmetry between suppliers and customers. For example, smart data flows might make it easier for customers to compare offerings, or to see all of their accounts on a single dashboard. It is also hoped that these new data flows will foster the emergence of new services (as was seen in the Financial Services sector with the open banking initiative).
Part 3 of the DPDI Bill concerns smart data. Key definitions include:
• "Business data", which concerns information about the products, services or digital content supplied or available to the customer.
• "Customer data", which includes information that is specific to the customer concerning the products, services or digital content. This might include the prices or terms and conditions of supply, how the products, services or digital content are used and how they perform, or data intrinsic to them such as customer transaction data in the context of banking services. Customers are individual consumers or categories of businesses to be defined – likely to be small and medium enterprises.
• "Trader", which is the entity that provides the products, services or digital content to the customer, in the course of a business.
• "Data holder", which is the trader or the entity that processes the data in the course of a business.
The Bill does not contain substantive provisions, but creates powers for the government (in practice, likely to be the Department for Science, Innovation and Technology) to issue implementing legislation for smart data schemes.
The smart data scheme is based on an obligation on data holders to provide customer data (or make it accessible) to the customer, at their request, or to a third party who is authorised by the customer, either at the customer's request or at the authorised third party's request. Regulations may also include anti-avoidance mechanisms, putting obligations on the data holder to make sure that customer data is produced, collected or retained so that it is available for access. Customers may also be given a right to rectification (beyond the existing rectification right in relation to personal data).
Separately, the DPDI Bill will give the government powers to make regulations about business data. These can be combined with the customer data powers or used separately. The powers will enable secondary legislation requiring a data holder to publish information or make it available to a customer of the trader that the information relates to, or another person to be specified in the regulation, which could include a public authority. The provisions are intended to create flexibility in the structure of smart data schemes – for example, a public authority could operate a data hub.
Both sets of powers include supplemental provisions including:
• specifying when a data request should be refused by the data holder;
• creating requirements around authorisation of third parties to receive data or take actions;
• detailing how customer data or business data should be provided, such as how many times it can be requested, or how long it should be available, or the manner in which it should be accessed (such as via a dashboard or an API (application programming interface) etc);
• providing for standards and protocols for data sharing interfaces; and
• requirements around transparency, complaints mechanisms and dispute resolution.
The Bill includes powers to create a decision-maker about aspects of the smart data scheme, such as deciding whether requirements for authorisation are met, or monitoring for compliance, and sets out the scope of powers that a decision-maker can be given. It also includes provision for creating "interface bodies" that might establish facilities or a service to provide, publish or process consumer or business data, or maintain or manage an interface or set standards in relation to interfaces.
Provisions regarding enforcement will enable the government to appoint one or more public bodies as the enforcer or joint enforcers of a smart data scheme, and to give the body powers of investigation, enforcement and financial sanctions. Criminal offences can be included in the enforcement regime. Fees may be authorised under a smart data scheme, as can levies on participants to fund the scheme.
Further materials
Dipping into Data | Beyond privacy – a new era for UK and EU data regulation (webinar recording)
View the full timeline content
Why 2050?
The Paris Agreement – agreed at COP 21 in December 2015 - commits its 190+ signatories to keeping a rise in global temperatures this century below 2 degrees Celsius above pre-industrial levels and to pursue efforts to limit the temperature increase even further to 1.5 degrees Celsius.
Following adoption of the Paris Agreement, the Intergovernmental Panel on Climate Change – the UN body set up to provide governments with scientific information that they can use to develop climate policies – reported, in October 2018, that if this target is to be met, emissions will need to be brought to net zero by the mid-century. So each signatory to the Paris Agreement has been submitting how it will contribute towards this aim – these are known as "nationally determined contributions". (the EU has submitted one paper that covers all the countries in the EU.) And then each signatory is taking the legal, regulatory and policy steps it needs to fulfil its commitments.
This timeline sets out the principle legal, regulatory and policy milestones towards that goal
UK Media Bill
The Media Bill proposes an overhaul of the UK legal framework for public service broadcasting, video on demand, streaming and internet radio, and the digital platforms and devices used to access those services.
UK Media Bill
Effective date
Estimated Q4 2024
Status
In the legislative process. The bill is currently at Committee Stage in the House of Lords. having completed its passage through the House of Commons.
Full name
Media Bill, available here.
Who does it impact?
Broadcasters (public service and commercial)
Video-on-demand and streaming service providers
TV selection services, such as smart TV, set-top-box, streaming stick and pay TV platform providers, as well as the associated software providers.
Voice-activated smart speakers and other radio selection services
Radio station operators
Sports rights holders
What does it do?
The primary aims of the bill are to: (i) promote UK public service broadcaster (PSB) content and national radio stations; (ii) protect UK audiences and stimulate local content production; (iii) redress the perceived imbalance between the influence of global streaming platforms as compared to UK-based media services. The bill overhauls the traditional scope of UK on-demand law by extending Ofcom's jurisdiction to non-UK services; and (iv) specifically regulate larger digital content selection platforms and smart devices regarding prominence and access to internet-delivered TV and radio services.
Key reforms include:
· Digital prominence: The bill sets out a framework for PSB prominence on digital TV platforms.
· VoD regime overhaul: The bill creates a new category of regulated on-demand service, the "Tier 1" service. These are either: (i) PSB services used to fulfil a public service remit, other than those operated by the BBC; or (ii) any other UK or non-UK VoD services designated (by name or by definition) in secondary legislation.The scope of this second limb is undefined, but the expectation is that this will catch services with a large UK audience and which make available "TV-like" content or smaller services if evidence emerges of potential harm. These services will be required to comply with new stringent content and accessibility obligations.
· New public service broadcaster (PSB) remit: The bill sets out a new, flexible remit for PSBs and allows them to contribute towards that remit via a range of audiovisual services, including digital VoD platforms. The bill also amends certain commissioning and broadcasting quota obligations.
· Listed events: The aim of the regime is to ensure that key live sporting events of national interest are widely available and free-to-air for UK audiences. The bill clarifies that only PSB linear services will qualify to bid for the rights to show listed events.
· Radio selection services: The bill recognises the growth in voice-activated devices and their potential power in determining listening choices. The largest of these platforms will be obliged to enable access to UK-licensed internet radio stations without charging any fee and without those platforms overlaying the stations with any third party content, including ads. The station operators would also be given the freedom to select their desired means of delivery, for example, via a specific station-operated app or aggregator.
On 26 February 2024, Ofcom published its roadmap for implementing the bill in which it explains its "high-level plan" for putting the bill into practice once it becomes law. Ofcom has cautioned that its approach may change as Parliamentary scrutiny of the bill continues and that the dates outlined are indicative only. Ofcom's implementation timetable for the bill assumes that it will receive Royal Assent by the summer, with its provisions brought into force and necessary secondary legislation subsequently laid before Parliament. Ofcom aims to consult on the new regime "as soon as possible". Given the complexity of implementation, the full programme, including the development of new codes of practice and guidance, will take place in phases over the next two years.
Further materials
UK Media Bill Hub: https://www.osborneclarke.com/insights/topics/uk-media-bill/location/uk
Media Matters Podcast (Media Bill Series): https://www.osborneclarke.com/insights/media-matters-podcast-series
View the full timeline content
Why 2050?
The Paris Agreement – agreed at COP 21 in December 2015 - commits its 190+ signatories to keeping a rise in global temperatures this century below 2 degrees Celsius above pre-industrial levels and to pursue efforts to limit the temperature increase even further to 1.5 degrees Celsius.
Following adoption of the Paris Agreement, the Intergovernmental Panel on Climate Change – the UN body set up to provide governments with scientific information that they can use to develop climate policies – reported, in October 2018, that if this target is to be met, emissions will need to be brought to net zero by the mid-century. So each signatory to the Paris Agreement has been submitting how it will contribute towards this aim – these are known as "nationally determined contributions". (the EU has submitted one paper that covers all the countries in the EU.) And then each signatory is taking the legal, regulatory and policy steps it needs to fulfil its commitments.
This timeline sets out the principle legal, regulatory and policy milestones towards that goal
⭐ EU Platform Workers Directive
This directive concerns workers who source work through digital platforms. As well as clarifying employment rights, it addresses the fairness, transparency and accountability of algorithmic management of platform workers.
⭐ EU Platform Workers Directive
Effective date
The text of the Platform Workers Directive was formally adopted by the European Parliament on 24 April. However, technical legal and linguistic checks on the text had not been completed and the necessary corrigendum was not ready in sufficient time before the European Parliament elections in June. The corrigendum will have to be accepted in autumn 2024 by the new European Parliament.
Once the corrections have been adopted, the text will pass to the Council of the EU for formal adoption at first reading. This will also now be in the autumn.
The provisions in the directive will then require implementation through national level legislation, to be issued by Member States.
The national laws must take effect no more than two years after the directive comes into force – likely to be late 2026, although legislation may be enacted more quickly in some Member States.
Status
In the legislative process. Member State national implementing legislation required.
Full name
Proposal for a Directive of the European Parliament and of the Council on improving working conditions in platform work. The Commission's original 2021 proposal is available here.
The amended text that has been finalised at political level is available here.
Who does it impact?
The directive applies to all workers performing platform work within the EU (and therefore to their "employers"). The contractual relationship of the worker does not have to be with the recipient of the service but could be with the platform or with an intermediary.
It also applies to all digital labour platforms organising platform work to be performed in the EU, regardless of the place of establishment of the platform. The key point is where the work will be performed, not where the platform is based.
A "digital labour platform" is defined as meeting all of the following requirements:
• The platform is provided at distance via electronic means, such as a website or app;
• It is provided at the request of the recipient of the service ;
• It involves the organisation of remunerated work, irrespective of whether the work is remote or in a specified location; and
• It involves the use of automated monitoring or decision-making systems (algorithmic management systems).
Platforms that are designed to enable the exploitation or sharing of assets (such as short term rental accommodation) or to enable the non-commercial resale of goods are expressly excluded from this definition. The requirement that the worker is remunerated means that platforms for organising the activities of volunteers are also excluded from scope.
What does it do?
NB: the focus of this resource is digital regulation so wider aspects of this legislation are out of scope. The directive includes provisions on the correct determination of a platform worker's employment status (including a rebuttable presumption of employment status unless the digital platform can prove that a worker is, in fact, genuinely self-employed), and on transparency around platform work including disclosure of data to relevant authorities.
Chapter III of the directive sets out provisions regarding the algorithmic management of platform workers, where functions that might historically have been taken by human managers are automated.
The directive focuses on automated monitoring systems and automated decision-making systems, both of which operate "through electronic means" and may collect data. Monitoring systems are those which are used for, or support, monitoring, supervising or evaluating someone's work. Decision-making systems are those which take decisions that "significantly affect persons performing platform work". This may include decisions concerning recruitment, allocation of work and working time, remuneration, access to training or promotion, and their contractual status.
The directive seeks to address concerns that workers may not have information about what data is being collected about them, and how it is evaluated. The reasons behind decisions taken by the systems may not be clear, or explainable, and there may be limited or no avenues for challenge, redress or rectification. In relation to personal data, it makes supplemental provisions that will apply over and above the General Data Protection Regulation (GDPR) framework.
Prohibited activities
The directive requires Member States to outlaw the following functions from being performed by automated monitoring or decision-making systems:
• Processing personal data on the "emotional or psychological state" or the platform worker;
• Processing personal data in relation to private conversations;
• Collecting personal data when the platform worker is not working or making themselves available for platform work;
• Collecting personal data to predict or identify trade union activity by a platform worker;
• Processing personal data to infer protected characteristics about the worker (such as race, sexuality, religion or disabilities), or their migration status, physical or mental health or trade union membership; and
• Processing personal data in order to use biometric profiling to identify the worker by reference to a database of biometric information about individuals.
These provisions will apply from the start of the recruitment process. In addition, the directive provides that any decision to restrict, suspend or terminate the contractual relationship or account of a platform worker (or similarly detrimental decisions) must be taken by a human being.
Data protection impact assessments
The directive clarifies that automated processing personal data of a platform worker for monitoring or decision-making will be high risk under the provisions of the GDPR and so will require a data protection impact assessment (DPIA). Digital labour platforms acting as data controllers must seek the views of the platform workers concerned and their representatives. DPIAs must be provided to worker representatives.
Transparency and redress
Digital labour platforms must disclose the use of algorithmic systems to platform workers, their representatives and relevant authorities. This should include information about:
• All the types of decisions that will be taken by the algorithmic systems on the platform (not just those with significant effect (which makes the obligation significantly more onerous than that under GDPR));
• Whether monitoring systems are being used, what data they collect, what actions they monitor, supervise or evaluate, what the aim of these monitoring activities is and how the system achieves it, and who will receive the processed data from the system;
• Whether automated decision-making systems are being used, what decisions they will take or support, what data or parameters are relevant to those decisions and how the behaviour of the platform worker influences them;
• How decisions to restrict, suspend or terminate the account of a platform worker or to refuse payment will be taken, as well as how decisions will be taken on their contractual status.
The required information about algorithmic systems must be provided in writing, in clear and plain language. It must be provided on the worker's first day, or ahead of any changes, or on request. It must also be provided in relation to systems used for recruitment and selection to the person going through that process.
Platform workers will have a right to portability of their data from one digital labour platform to another.
The directive creates obligations around human oversight of algorithmic systems. These include a review at least every two years of the impact of the systems, including on working conditions and on equality of treatment of workers. Where a high risk of discrimination is identified, the system must be modified or no longer used.
Digital labour platforms must have sufficient human resources to implement oversight of the impact of individual decisions, with appropriately competent and trained staff able to overrise automated decisions. Such staff must be protected from dismissal or disciplinary measures for exercising these functions.
Platform workers will have a right to an oral or written explanation in clear and plain language of decisions taken or supported by an algorithmic system, with the option of discussing the decision with a human. The explanation must be in writing for certain decisions, including the restriction, suspension or termination of a platform worker's account, a refusal to pay the worker, or any decision regarding the worker's contractual status.
Workers will have a right to request a review of decisions taken by the algorithmic systems, to a written response within two weeks, to rectification of the decision if it infringes their rights, or to compensation if the error cannot be rectified.
Health and safety
The directive highlights that algorithmic management of workers can cause the intensification of work, which in turn can impact on safety and on the mental and physical health of platform workers. It requires digital labour platforms to evaluate such risks and take preventative and protective measures.
Further materials
View the full timeline content
Why 2050?
The Paris Agreement – agreed at COP 21 in December 2015 - commits its 190+ signatories to keeping a rise in global temperatures this century below 2 degrees Celsius above pre-industrial levels and to pursue efforts to limit the temperature increase even further to 1.5 degrees Celsius.
Following adoption of the Paris Agreement, the Intergovernmental Panel on Climate Change – the UN body set up to provide governments with scientific information that they can use to develop climate policies – reported, in October 2018, that if this target is to be met, emissions will need to be brought to net zero by the mid-century. So each signatory to the Paris Agreement has been submitting how it will contribute towards this aim – these are known as "nationally determined contributions". (the EU has submitted one paper that covers all the countries in the EU.) And then each signatory is taking the legal, regulatory and policy steps it needs to fulfil its commitments.
This timeline sets out the principle legal, regulatory and policy milestones towards that goal
⭐ EU European Media Freedom Act
The European Media Freedom Act establishes a regulatory framework for media services in the EU, introducing measures to protect journalists, and strengthen media pluralism and editorial independence.
⭐ EU European Media Freedom Act
Effective date
On 17 April 2024, the Act was published in the Official Journal of the EU. It entered into force 20 days later, on 7 May 2024.
It will generally apply from 8 August 2025 with some exceptions.
For example, provisions in relation to the right of recipients of media services to plurality of editorially independent media content will apply from 8 November 2024.
Some provisions will apply from 8 February 2025: national regulatory authorities will assume their powers, provisions relating to the establishment of the new European Board for Media Services and amendments to the Audiovisual Media Services Directive (AVMSD), as well as provisions in respect of rights to editorial freedom and independence of media service providers, will also apply at this time.
Status
Enacted.
Full name
Regulation (EU) 2024/1083 of the European Parliament and of the Council of 11 April 2024 establishing a common framework for media services in the internal market and amending Directive 2010/13/EU(European Media Freedom Act).
The final text (published in the EU Official Journal on 17 April 2024) is available here.
Who does it impact?
The European Media Freedom Act (EMFA) builds on the revised Audio visual Media Services Directive (AVMSD) and broadens its scope by bringing radio and newspapers publishers into its remit.
EMFA will apply to all "media service providers" (MSPs) (an entity providing a media service and who has editorial responsibility for the content on that service) that target audiences in the EU, whether the provider is established in the EU or not. It will therefore apply to:
· television and radio broadcasters;
· video on-demand providers;
· audio podcast providers;
· newspaper publishers (online and offline); and
· video-sharing platforms, including Very Large Online Platforms (VLOPs) (as defined in the Digital Services Act), that exercise editorial control.
What does it do?
The EMFA provides a legal framework setting out both rights and duties for MSPs and recipients of media services in the EU. Key points include:
· Recipients of media services in the EU have a right to receive a plurality of news and current affairs content that is produced with editorial freedom. Member States must respect this right.
· Member States must respect the editorial freedom and independence of MSPs and are banned from interfering or influencing in any way the editorial policies and decisions made by MSPs.
· Journalists are protected from being forced to disclose their sources or confidential communications through sanctions, inspection, detention, surveillance, etc. Surveillance measures will only be allowed where there is "an overriding reason of public interest" and they must be proportionate. Such measures will also first have to be authorised by a judicial authority.
· Safeguards for public service media providers so that they can provide impartial and independent media services.
· Transparency requirements for MSPs: to provide their legal names, information on the identity of their shareholders by whom they are possibly influenced, and the total annual amount of state advertising they receive. MSPs providing news and current affairs content must also take measures to guarantee the independence of editorial decisions.
· The establishment of a new, independent, European Board for Media Services (replacing the European Regulators Group for Audiovisual Media Services under the AVMSD) composed of representatives from national regulatory authorities (NRAs) and assisted by a Commission secretariat.
· A framework for co-operation amongst national regulatory authorities overseen by the Board.
· Provisions in relation to VLOPs, intended to protect freedom of expression. Except in relation to obligations under the Digital Services Act to protect minors and to assess and mitigate against systemic risks, if a VLOP decides to remove or restrict access to a MSP's content from their platform on the grounds that the content is incompatible with its terms and conditions, it must first provide the MSP with a statement of reasons as to why it wants to take that action. The MSP then has 24 hours within which to reply, although that can be shortened in a crisis situation. If the VLOP still decides to remove or restrict access to the content it must tell the MSP without undue delay. If the VLOP repeatedly restricts or removes media content without sufficient grounds, it must engage in "meaningful and effective dialogue" with the MSP, on its request, to find an "amicable solution" within a reasonable timeframe. The MSP has the right to request an opinion from the Board on the outcome of that dialogue, including making recommendations to the VLOP. The Board then has to inform the Commission. The Board also has to regularly organise structured dialogues between VLOPs and MSPs to discuss best practices for content moderation and monitor actions taken to protect society from harmful content, including disinformation and foreign manipulation and interference. These provisions have been the subject of much discussion, especially amongst those concerned with fighting disinformation who think that the provisions amount to a "media exemption" which will allow false and misleading content to proliferate online, and those who fear that the provisions could in fact increase restriction of MSP content thereby harming freedom of the press.
· Obligations on Member States to establish a system, run by the NRAs, to assess "media market concentrations" that could have a significant impact on media pluralism and editorial independence. This is distinct from competition law assessments and rules on merger control. The Board is also obliged to provide an opinion (which the NRA must take "utmost account" of) and can, if no assessment takes place, draw up an opinion on its own initiative if it considers the concentration is likely to affect the functioning of the internal market for media services.
· Rights for users to be able to easily change the configuration, including default settings, of devices or user interfaces that control or manage access to media services so that they can customise the offering to suit their preferences. Manufacturers must include this functionality in their devices and interfaces by design.
· Requirements for providers of audience measurement systems to provide free of charge to MSPs, advertisers and authorised third parties, information on their methodologies and to have their systems audited annually.
· Rules on transparency and proportionality in relation to the allocation of public funds for state advertising and supply or service contracts. State advertising must be distributed broadly across MSPs.
View the full timeline content
Why 2050?
The Paris Agreement – agreed at COP 21 in December 2015 - commits its 190+ signatories to keeping a rise in global temperatures this century below 2 degrees Celsius above pre-industrial levels and to pursue efforts to limit the temperature increase even further to 1.5 degrees Celsius.
Following adoption of the Paris Agreement, the Intergovernmental Panel on Climate Change – the UN body set up to provide governments with scientific information that they can use to develop climate policies – reported, in October 2018, that if this target is to be met, emissions will need to be brought to net zero by the mid-century. So each signatory to the Paris Agreement has been submitting how it will contribute towards this aim – these are known as "nationally determined contributions". (the EU has submitted one paper that covers all the countries in the EU.) And then each signatory is taking the legal, regulatory and policy steps it needs to fulfil its commitments.
This timeline sets out the principle legal, regulatory and policy milestones towards that goal
⭐ EU Regulation on cross-border GDPR enforcement
This new regulation will supplement the EU General Data Protection Regulation with harmonised procedures for the cross-border enforcement of the GDPR, in order to create consistency and improve cooperation and efficiency.
⭐ EU Regulation on cross-border GDPR enforcement
Effective date
The European Parliament and Council of the EU are each currently discussing their position on the Commissions' proposed legislation. In April 2024, the European Parliament adopted its negotiating position on the proposed legislation, making various amendments to the original Commission proposal, including to strengthen the provisions on joint case files, standardise rules on procedural deadlines and clarify the rules on amicable settlements.
After the European Parliament elections in June 2024, it will be for the new Commission, appointed by the new Parliament, to decide which unfinished legislation to withdraw and which to continue. Assuming this legislation is revived, the Parliament can resume its work. We estimate that this will not become law before 2025.
The Commission proposes that the provisions of the regulation should take effect immediately it becomes law (which will be 20 days after it is published in the EU's Official Journal). The European Parliament has proposed that the regulation will apply one year after its entry into force.
Status
In the legislative process
Full name
Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679, available here.
Who does it impact?
This new regulation will impact on all those involved in cross-border enforcement of the EU's General Data Protection Regulation (GDPR), including the national data protection authorities (DPAs), the parties under investigation and any parties making a compliant about cross-border GDPR compliance to a DPA.
What does it do?
The regulation adds new procedural rules for the cross-border enforcement mechanisms set out in Chapter VII of the GDPR. It does not introduce new procedures but clarifies the existing GDPR framework. Because GDPR enforcement is decentralised to Member State level, cross-border enforcement within the EU is relatively common – for example where a data subject lodges a complaint about a data controller or processor located in a different Member State.
The European Commission's review of the application of the GDPR indicated that cross-border enforcement and dispute resolution under the GDPR mechanisms was being hampered by differences in administrative procedures and interpretation of the GDPR at national level. The regulation therefore aims to create a harmonised, common set of rules for cross-border GDPR matters.
The proposed regulation will create harmonised rules in relation to various aspects of cross-border enforcement of the GDPR:
· Complaints, including a prescribed form on which to submit a cross-border complaint under Article 77 GDPR, and a required procedure for full or partial rejection of a complaint. Where the complaint is adopted and an investigation follows, the regulation will create a harmonised set of rights for complainants to receive information and provide their views at various stages of the cross-border investigation and decision-making process. The proposed regulation also deals with amicable settlement of complaints, and issues such as translation.
· Rights of those under investigation, ensuring that the rights of defence are observed consistently by DPAs in different Member States. The new rules clarify the parties' right to be heard at specific stages of the investigation, as well as setting out requirements around the matter file to be maintained by the investigating DPA, the parties' rights of access to the file, and confidentiality.
· Co-operation and dispute resolution between DPAs, providing for clear mechanisms and procedures by which DPAs can share views and information at an early stage in a cross-border investigation, as well as requirements on the lead DPA to share its preliminary assessment of the case. The proposed regulation also includes mechanisms to resolve differences on key issues in the case at an early stage. Where disputes arise, provision is made for the European Data Protection Board (EDPB) to adopt an urgent binding decision on the disputed issue, so that the lead DPA can then progress the matter without further delay. The new rules will also include directions as to how DPAs should submit their reasoned objections on a disputed issue, and as to the role of all those involved – the lead DPA, other DPAs and the EDPB.
The new rules do not impact on the provisions of the GDPR concerning the rights of data subjects, the obligations of data controllers or processors, or on the lawful grounds for data processing. They will also not impact on enforcement where there is no cross-border aspect.
View the full timeline content
Why 2050?
The Paris Agreement – agreed at COP 21 in December 2015 - commits its 190+ signatories to keeping a rise in global temperatures this century below 2 degrees Celsius above pre-industrial levels and to pursue efforts to limit the temperature increase even further to 1.5 degrees Celsius.
Following adoption of the Paris Agreement, the Intergovernmental Panel on Climate Change – the UN body set up to provide governments with scientific information that they can use to develop climate policies – reported, in October 2018, that if this target is to be met, emissions will need to be brought to net zero by the mid-century. So each signatory to the Paris Agreement has been submitting how it will contribute towards this aim – these are known as "nationally determined contributions". (the EU has submitted one paper that covers all the countries in the EU.) And then each signatory is taking the legal, regulatory and policy steps it needs to fulfil its commitments.
This timeline sets out the principle legal, regulatory and policy milestones towards that goal
UK Product Safety Reform
Proposals have been put forward as part of the UK Product Safety Review to overhaul existing product regulation and, in particular, to introduce obligations on online marketplaces.
UK Product Safety Reform
Effective date
Unknown – we are awaiting the Government Response to the consultation.
Status
In the policy formation stage. The consultation closed on 24 October 2023. The government is currently analysing the consultation responses.
Full name
TBC
Who does it impact?
Anyone placing products on the market in the UK.
What does it do?
The UK Government published the Product Safety Review on 2 August 2023, proposing reforms to the UK product regulatory framework. The government ran a consultation to gauge the views of stakeholders to inform its development and design the details of the reforms. This consultation closed on 24 October 2023.
Under the Product Safety Review, the UK government is seeking to move away from what it views as the multiplicity of sector/product-based regulation, replacing this with a more streamlined approach. Rather than setting out prescriptive requirements for different product types, the new approach proposes to be risk-based, where product safety requirements are determined in connection with the hazard presented by the product. Product-specific regulation will only be used where strictly necessary. This is a significant departure from the historic EU position.
In addition, the government proposes to make the following changes relevant to digital services and products:
· Voluntary e-labelling – introduction of e-labelling to display certain markings and compliance information. This is rather limited in scope, applying only to products with integrated screens or products designed for use with a screen. However, the government has recently announced plans to introduce digital labelling for a wider scope of products, see our February Regulatory Outlook for more.
· Requiring online marketplaces to exercise due care and remove unsafe product listings.
· Obliging online marketplaces to have a compliance function established in the UK.
· Online marketplaces will have to collect information about third-party sellers for high-risk products.
· Online marketplaces will be under an obligation to gather their own information about products and sellers which could indicate a product is unsafe.
· Strengthening consumer information online as part of online product listings to support informed purchasing decisions. This may include displaying warnings to consumers, details of the checks carried out by the seller and a clear, prominent indication of whether the product has been listed by a third-party seller.
Further materials
Products| UK Regulatory Outlook September 2023 - Osborne Clarke | Osborne Clarke
Products| UK Regulatory Outlook February 2024 - Osborne Clarke | Osborne Clarke
View the full timeline content
Why 2050?
The Paris Agreement – agreed at COP 21 in December 2015 - commits its 190+ signatories to keeping a rise in global temperatures this century below 2 degrees Celsius above pre-industrial levels and to pursue efforts to limit the temperature increase even further to 1.5 degrees Celsius.
Following adoption of the Paris Agreement, the Intergovernmental Panel on Climate Change – the UN body set up to provide governments with scientific information that they can use to develop climate policies – reported, in October 2018, that if this target is to be met, emissions will need to be brought to net zero by the mid-century. So each signatory to the Paris Agreement has been submitting how it will contribute towards this aim – these are known as "nationally determined contributions". (the EU has submitted one paper that covers all the countries in the EU.) And then each signatory is taking the legal, regulatory and policy steps it needs to fulfil its commitments.
This timeline sets out the principle legal, regulatory and policy milestones towards that goal
UK Security of Network and Information Systems Regulations
Following a consultation in 2022, the government announced its intention to update the NIS Regulations 2018 to improve the UK’s cyber resilience. Draft legislation is still awaited.
UK Security of Network and Information Systems Regulations
Effective date
TBC
Status
In the policy formation stage
Full name
New legislation to update The Network and Information Systems Regulations 2018 (SI 2028/506) (the NIS Regulations) has not yet been issued. The current version of the regulations is available here.
Who does it impact?
The NIS Regulations introduced legal measures to boost the cybersecurity and physical and environmental resilience of network and information systems that are critical for the provision of digital services and essential services in the UK. They apply to two groups of organisations – "operators of essential services" and "relevant digital service providers".
The proposed updates to the NIS Regulations include bringing managed service providers into the scope of the regulations with the aim of keeping digital supply chains secure.
What does it do?
Following a consultation in early 2022, the government announced on 30 November 2022 that the UK's NIS Regulations will be strengthened to further protect essential services against digital threats, such as cyber attacks.
The NIS Regulations aim to improve the cybersecurity of critical service providers. The changes will include bringing managed security providers into the scope of the NIS Regulations, introducing improved reporting obligations, giving government flexibility to adapt the regulations in the future to ensure they remain effective, and provide the Information Commissioners Office (ICO) with the ability to take a more risk-based approach to regulation.
These updates to the NIS regulations will be made as soon as parliamentary time allows.
Further materials
Cyber security | UK Regulatory Outlook January 2023 - Osborne Clarke | Osborne Clarke
UK and global cyber threats require robust supply chain risk management
View the full timeline content
Why 2050?
The Paris Agreement – agreed at COP 21 in December 2015 - commits its 190+ signatories to keeping a rise in global temperatures this century below 2 degrees Celsius above pre-industrial levels and to pursue efforts to limit the temperature increase even further to 1.5 degrees Celsius.
Following adoption of the Paris Agreement, the Intergovernmental Panel on Climate Change – the UN body set up to provide governments with scientific information that they can use to develop climate policies – reported, in October 2018, that if this target is to be met, emissions will need to be brought to net zero by the mid-century. So each signatory to the Paris Agreement has been submitting how it will contribute towards this aim – these are known as "nationally determined contributions". (the EU has submitted one paper that covers all the countries in the EU.) And then each signatory is taking the legal, regulatory and policy steps it needs to fulfil its commitments.
This timeline sets out the principle legal, regulatory and policy milestones towards that goal
