UK law
Draft Data Protection Act 2018 (Qualifying Competent Authorities) Regulations 2025 published
The Draft Data Protection Act 2018 (Qualifying Competent Authorities) Regulations 2005 have been published. Sections 89 and 90 of the Data (Use and Access) Act (DUAA) amend the Data Protection Act 2018 (DPA) to enable joint processing between qualifying competent authorities and intelligence services, under Part 4 of the DPA. This enables the controllers, previously unable to process jointly, to process personal data within a single, common regime. The controls and safeguards under Part 4 of the DPA will apply to all such joint processing. Section 89(2) of the DUAA amends section 82 of the DPA, widening the scope of Part 4 of the DPA. Previously, Part 4 of the DPA only applied to processing by or on behalf of the intelligence services. As amended, section 82 also applies Part 4 of the DPA to the processing of personal data by a qualifying competent authority where the processing is the subject of a designation notice. Section 89(2) of the DUAA inserts new subsection (2A) into section 82 of the DPA, which grants a power to the Secretary of State to make regulations to specify and describe which competent authorities (as defined in section 30 of the DPA) are “qualifying competent authorities”, and so able to apply for or be issued with a designation notice. The Regulations specify and describe which competent authorities are “qualifying competent authorities” under the DPA. The qualifying competent authorities will be able to apply jointly with the intelligence services for a designation notice under section 82A of the DPA. The Secretary of State may give a notice designating processing of personal data by a qualifying competent authority where this is required to safeguard national security, and subject to compliance with application requirements in the DPA. Before making these Regulations, the Secretary of State consulted the ICO and such other persons as the Secretary of State considered appropriate.
ICO consults on a new chapter for the draft updated guidance on storage and access technologies
The ICO is consulting on a new chapter in its draft updated guidance on storage and access technologies (previously known as the “detailed cookies guidance”). This new chapter contains updates to the ICO’s guidance following the introduction of the Data (Use and Access) Act 2025. The ICO has added a new chapter “what are the exceptions?” to explain the exceptions to the prohibition on storing or accessing information on people’s devices. There are other minor changes throughout the guidance to reflect the updated rules. The ICO will finalise it following the second consultation on the new chapter. The consultation ends on 26 September 2025.
Select Committee to investigate children’s TV and video content
The Culture, Media and Sport Select Committee has launched a new inquiry which will explore the provision of children’s TV and video content in the UK and what can be done to ensure future generations continue to have access to high-quality British-made programming. Research from Ofcom shows a structural shift in the viewing habits of young people, with television viewing by children dropping and YouTube now the most used app or site by children of all ages, with 88% of 3 to 17-year-olds using it last year. The changing ways in which audience consume TV and video, has made it more challenging for public service broadcasters to make original TV content for children and for it to be found. This has a knock-on effect for those in the creative industries who want to make quality UK TV and video for children. The Culture, Media and Sport Select Committee inquiry will therefore examine how to ensure those making original high-quality content can continue and how it can be made easier to find it online. It will also explore issues relating to parental control of online content, the potential positive and negative effects of how children watch TV and video content on their health and development, and wider issues relating to the sector’s contribution to the economy and its importance to the UK’s cultural identity. This may be of interest to SCL lawyers with an interest in the gaming and media sectors.
Ofcom to speed up consumer dispute resolution
In November 2023, Ofcom launched a review of how effectively the current alternative dispute resolution system is working in the telecoms market. Following consultation it has decided to change its rules. Ofcom’s rules require communication providers to issue ADR letters, informing consumers of their right to access ADR, if a complaint has not been resolved eight weeks after it was first raised. It considered if this length of time remains right in today’s market. Between January 2022 and 2024, around 79% of complaints received by the biggest telecoms companies were resolved in less than a week, with 94% resolved within six weeks. For the roughly 700,000 consumers that had a complaint open at six weeks, only around one in five were able to get their issue resolved or referred to ADR before the current, eight-week threshold. Ofcom was concerned that a material number of consumers waited an additional two weeks, continuing to potentially incur harm or detriment, before being given access to ADR to get a resolution. It is now reducing the timeframe before consumers can access ADR from eight weeks to six. This aims to ensure the ADR system remains effective, and help consumers get their complaints resolved quickly. This change will come into effect from April 2026. Ofcom is also re-approving both Communications Ombudsman (formally known as Ombudsman Services) and the Communications and Internet Services Adjudication Scheme (CISAS) as ADR schemes for the telecoms sector. It carried out a review which found they are working well and continue to meet the statutory assessment criteria under the Communications Act.
EU law
Helsinki Statement on enhanced clarity, support and engagement
The European Data Protection Board (EDPB) has adopted a Statement on enhanced clarity, support and engagement. It outlines new initiatives to make GDPR compliance easier, in particular for micro, small and medium organisations, strengthen consistency and boost cross-regulatory cooperation. The EDPB will strengthen its dialogue with stakeholders, holding proactive and early engagement to identify areas where further support and clarification is required, and providing the opportunity for stakeholders to flag possible inconsistencies and give feedback. The EDPB will publicly report on the main outcomes of the public consultations. The EDPB will launch a series of direct and practical resources to simplify GDPR application. Among the measures agreed upon to ensure consistent GDPR interpretation and enforcement across Europe, EDPB members will make continuous efforts to align national and EDPB guidance. They will also develop common practices, methods, tools and common actions review guidelines to ensure their real-world effectiveness. The EDPB will also publish positions by regulators on priority issues to help organisations understand and act on regulatory expectations. The EDPB recognises the growing complexity of the digital regulatory landscape and has renewed its commitment to fostering structured cooperation with non-data protection regulators to address legal and practical challenges in cross-sectoral cases.
International: ICC reselected by ICANN to administer domain name dispute resolution
The Internet Corporation for Assigned Names and Numbers (ICANN) has reselected the International Chamber of Commerce (ICC) administer disputes related to the registration of new generic Top-Level Domains (gTLDs), that appear at the end of Internet domain names, such as “.org” or “.net”. ICANN is expected to open the application window for gTLD registrations in April 2026, giving third parties the opportunity to file objections against such registrations. The appointment covers both first instance and appeal proceedings, with the Centre currently updating its Expert Rules to include a new appendix on financial aspects of proceedings. Proceedings will result in a binding expert determination and will be administered by the ICC International Centre for ADR pursuant to its Expert Rules and the ICANN Applicant Guidebook, ICANN Dispute Resolution Procedure and ICANN Objection Appeals Procedure. The Centre is currently updating its Expert Rules with the creation of a dedicated appendix addressing the financial aspects of both first instance and appellate proceedings.
