At the State opening of Parliament on 7 November 2023, King Charles set out the Government’s priorities for the coming Parliamentary Session. Highlights include:

Digital Markets, Competition and Consumers Bill (“DMCC”)

Data Protection and Digital Information Bill (previously known as the Data Protection and Digital Information (No. 2) Bill) (“DPDI”)

Football Governance Bill

The DMCC was originally introduced to Parliament in April 2023 but did not complete the legislative process so is carried over to the current Parliamentary session.

The DMCC proposes several provisions to strengthen competition and consumer law in the UK. On the competition side, for example, the DMCC proposes to address what the Government considers to be the far-reaching powers of a small number of tech companies. The Competition and Markets Authority (“CMA“) would be able to designate certain firms as having Strategic Market Status (“SMS“) in the UK where they meet specific market turnover thresholds and certain other conditions such as having entrenched market power and a position of strategic significance in respect of a digital activity. Firms designated as having SMS will be subject to specific rules tailored by the CMS to the firm (e.g. preventing tying or bundling) and pro competition interventions enabling the CMA to implement measures that address the root causes of entrenched market power that stem from factors other than conduct (e.g. harms flowing from network effects). Such interventions could include requiring the undertaking to facilitate interoperability, data mobility etc. Penalties for breach will include fines of up to 10% of global turnover.

On the consumer side, the DMCC proposes, amongst other things, to revoke the Consumer Protection from Unfair Trading Regulations 2008 and to restate those Regulations within the DMCC. In September 2023, the Government consulted on whether changes to UK law should be made via the DMCC to address unfair commercial practices associated with drip pricing (where consumers are shown an initial price for a product or service online and additional fees (e.g. booking or delivery fees) are shown only later during the checkout process) and fake online reviews.

To address what are sometimes referred to as “subscription traps”, the DMCC proposes a number of requirements for traders including in relation to pre-contract information, reminder notices, cancellation periods and allowing consumers to exit the subscription contract in a single communication and without having to take any steps which are not reasonably necessary.

The DMCC will now proceed to the report stage and third reading in the House of Commons.

For more information, click here.

Back to Top

The DPDI was originally published in March 2023 but did not complete the legislative process, so is carried over to the current Parliamentary session.

The Government states that the DPDI seizes the post-Brexit opportunity to create a new UK data rights regime. Proposed changes to the existing regime include:

• Extending the right to use cookies without consent (currently limited to cases when cookies are strictly necessary) to, for example, collecting data for statistical analysis and for the improvement of a service or website. It will still be necessary to give users comprehensive information and a right to opt out.
• Examples of legitimate interest processing would include processing for direct marketing purposes, intra group transmission for internal administration purposes, and processing necessary to ensure the security of a network and information systems. In each case, the data controller would still need to weigh its interests against the data subject’s interests, rights and freedoms. That weighing test would not be required where you can show that the processing is “necessary” for one of the “recognised legitimate interests”, including processing necessary for national security, public security and defence, emergencies, detecting, investigating or preventing crime, safeguarding vulnerable individuals and democratic engagement.
• A requirement that records of processing would only need to be kept for processing likely to result in a high risk to the rights and freedoms of data subjects.
• Replacing the requirement for data processing impact assessments with a requirement to implement “an assessment of high-risk processing”.
• Permitting automated decision-making with safeguards, particularly in respect of the use of special categories of personal data.
• Permitting profiling subject to the same safeguards as automated decision-making when a significant decision is taken about a person with no meaningful human involvement.
• Extending the types of entities permitted to process personal data for the purposes of scientific research, to include those that carry out scientific research whether publicly or privately and whether carried out as a commercial or non-commercial activity.
• Replacing the “manifestly unfounded and excessive” test with a “vexatious and excessive” test for refusing and charging for a data subject access request.
• Accepting existing international data transfer mechanisms to share personal data overseas if they are compliant with current UK law. Otherwise, organisations would have to assess the risks involved in using mechanisms such as the ICO’s International Data Transfer Agreement or Addendum.
• Changing the adequacy decisions test to whether the country concerned has a “not materially lower” standard of protection for personal data. Under GDPR, the standard is an “adequate level” of protection which is interpreted as “essentially equivalent”.
• Removing the requirement for data controllers not established in UK to appoint a data protection representative in UK.
• Removing the requirement for Data Protection Officers but, for high risk processing, there would be a requirement to designate a senior responsible individual to be accountable, who must be part of senior management, not independent of it.

The DPDI would also increase fines for nuisance calls and texts (under The Privacy and Electronic Communications (EC Directive) Regulations 2003) and would establish a framework for trusted and secure digital verifications services, allowing people to prove their ID digitally if they want to.

The DPDI will proceed to the report stage and third reading in the House of Commons on a date to be announced.

For more information, click here.

Back to Top

King Charles announced that new legislation will be brought forward to address the governance of football clubs. Over the last year, the Government has raised concerns over the current state of English football club financing, corporate governance and self-regulation, and the risks posed by breakaway competitions like the European Super League.

In its White Paper in February 2023, the government proposed new regulation focused on protecting the financial stability of football clubs, to be administered and enforced by a new independent regulator to be funded by a levy imposed on football clubs. The regulator would have three primary duties – club sustainability, systemic sustainability, and cultural heritage – and three secondary duties – domestic competition, international competitiveness and investment. All clubs in the top five tiers of the English football pyramid would need a licence to operate. The legislation would establish four threshold conditions for the licence – appropriate financial resources, suitable owners, fan interests and approved competitions – and the regulator would set out detailed licence conditions for each club, proportionate to the club’s circumstances, under each of the conditions.  On corporate governance, the government proposes to publish a Football Club Corporate Governance Code and clubs would be required to report annually on compliance.  There would also be new owners’ and directors’ tests to measure fitness and propriety, source of wealth and, in the case of club owners, suitable financial plans. The regulator would monitor and enforce the licence conditions. It is also proposed that the regulator would have targeted powers to intervene in financial distributions by the clubs (e.g. broadcast revenues) if football-led solutions do not work.

In September 2023, the government published a summary of responses to these proposals and its own response to the key themes raised. Most respondents agreed with the need for reform and welcomed the proposed new regulator. The government restated its position that the evidence shows that many clubs are in a financially precarious state and a number have gone out of business. As to the need for a new regulator, the government has stated its view that an existing football governing body would not be sufficiently independent from club influence to act as regulator. However, the new regulator would collaborate with existing bodies and may delegate certain responsibilities to them. To avoid concerns of over-regulation, the government confirmed that the regulator would have a tightly defined scope focused on financial sustainability, and that its approach to regulation would be targeted, proportionate and risk-based.

More detail on regulatory powers, definitions, thresholds and processes will be set out in the draft legislation.

For more information, click here.