ICO Issues Updated Guidance On Direct Marketing

The General Data Protection Regulation ("GDPR") will enter into force 25 May 2018, and will provide new general data protection standards.

The UK's Information Commissioner's Office has completed its supervision of major AI foundation model developers, revealing significant gaps in data protection practices and setting new expectations for legitimate interests assessments, transparency, and special category data handling. The regulator has now turned its attention to agentic AI systems, warning that autonomy is not an excuse for poor compliance and launching a call for evidence that will shape future regulatory guidance.

Explore comprehensive legal insights and expert commentary across diverse practice areas and industries. Access thought leadership through written articles and podcast discussions that address current legal developments and emerging trends.

The UK Information Commissioner's Office has finalized its guidance on storage and access technologies, expanding compliance requirements beyond traditional cookies to include tracking pixels, device fingerprinting, and web storage. Organizations must now navigate stricter consent standards and three new narrow exceptions introduced by the Data (Use and Access) Act 2025, while facing significantly increased enforcement penalties of up to £17.5 million or 4% of annual worldwide turnover.

From 2 August 2026, the EU AI Act requires businesses to disclose when people are interacting with AI systems, mark synthetic content for detection, label deepfakes, and inform individuals...

On 30 September 2026, the Information Commissioner's Office formally becomes the Information Commission. It is the most significant structural change to the UK's data protection regulator in its history, and yet, many organisations are wondering what practical implications this change will have. Here's what you need to know.

The European Data Protection Board has published draft guidelines proposing a fundamental shift in GDPR enforcement: a presumption that fines should be imposed for non-minor infringements, with a deliberately low bar for establishing negligence. Organizations will need to demonstrate robust compliance programs and documented decision-making to potentially avoid penalties, as regulators move from asking "should we fine?" to "can we justify not fining?"

The Data (Use and Access) Act 2025 (the DUAA) officially became law in June 2025, with a phased enforcement model under which different provisions take effect at different times.

The European Commission has announced that EU AI Act transparency rules take effect August 2, 2026, requiring chatbots to identify themselves, deepfakes to be labeled, and AI-generated content to be marked. Organizations must assess whether their AI systems trigger disclosure, labeling, or content-marking requirements, with limited exceptions and penalties reaching €15 million or 3% of global turnover for noncompliance.

In the digital age, data privacy is a critical concern for businesses and individuals alike. A key element of any organisation's data protection strategy is its privacy policy.

The Code is voluntary, but it will likely become an important reference point for demonstrating compliance with Article 50 of the AI Act.

The Ninth Circuit Court of Appeals vacated a preliminary injunction against Perplexity AI, determining that when an AI agent acts at a user's direction, it is the user—not the AI company—who "accesses" computer systems under federal and California computer fraud statutes. This landmark appellate decision addresses how existing computer-access laws apply to agentic artificial intelligence and has significant implications...

The New York Stock Exchange and Nasdaq are implementing overnight trading sessions starting December 6, 2026, extending the trading day to nearly 23 hours by compressing the daily pause to just one hour. While this evolution toward continuous trading introduces new considerations for corporate actions, disclosure timing, and deal execution, the practical impact varies significantly between NYSE-listed companies,

China's Supreme People's Court has issued comprehensive judicial rules addressing artificial intelligence disputes, establishing frameworks for product liability, intellectual property rights, and data protection. These landmark opinions provide critical guidance for global companies navigating AI-related legal risks in China's evolving regulatory landscape.

The Ninth Circuit has ruled that health plan participants whose confidential information was disclosed without authorization have standing to sue in federal court, even without showing financial loss or future harm. This decision, which departs from the risk-based approach many courts have applied since TransUnion, relies on the centuries-old action for breach of confidence and could have significant implications for companies' privacy commitments and data-sharing practices.

Mexico's comprehensive anti-money laundering framework has undergone a sweeping transformation through Acuerdo 115/2026, introducing mandatory risk-based methodologies, enhanced client due diligence protocols, and automated monitoring requirements. With implementation deadlines beginning March 1, 2027, obligated parties conducting vulnerable activities face compressed timelines to overhaul their compliance infrastructure while navigating heightened enforcement risks and stricter beneficial ownership thresho

The European Commission has initiated infringement procedures against 20 EU Member States for failing to transpose the EmpCo Directive by the March 27, 2026 deadline. This directive aims to combat greenwashing by requiring substantiation of environmental claims and third-party certification for sustainability labels, with full implementation expected by September 27, 2026.

The Illinois Holocaust Museum & Education Center (IHMEC) held a third program as part of its Jones Day Foundation Community Series, a special series of educational events

The European Commission has proposed replacing the EU's three core procurement directives with a single, directly applicable Regulation that would fundamentally reshape how companies compete for public contracts across Member States. The reform introduces mandatory quality criteria thresholds, embeds ESG considerations as evaluation factors, and establishes new security and European-preference provisions that could restrict participation based on ownership, supply chain exposure, and strategic dependencies.

A federal court has struck down New York's Climate Change Superfund Act, which sought to recover $75 billion from fossil fuel companies based on historical emissions. The ruling found the Act preempted by the Clean Air Act, marking the first judicial decision on state climate superfund legislation and establishing that EPA's rescission of the endangerment finding does not alter preemption analysis.