Here we are again for another junior tech lawyer briefing (in two minutes!)
First, regulatory actions.
The UK Information Commissioner’s Office has fined outsourcing company Capita £14 million under the UK GDPR. This relates to the March 2023 data breach that affected more than six million people. The ICO found Capita had weak controls for privileged accounts and lacked proper Privileged Access Management, which the regulator described as a fundamental failure of cybersecurity governance.
Meanwhile, the European Commission has launched a targeted consultation on how to define an AI system under the EU AI Act and how to interpret the Act’s bans on certain high-risk AI practices. This is aimed at clarifying scope before full enforcement begins next year.
Next, a little bit of legal updates.
The UK Upper Tribunal has issued an important judgment in the Clearview AI case. The ruling clarifies that both the EU and UK GDPRs can apply to companies outside the UK when they monitor the behaviour of people in the UK. This could extend data protection obligations to AI-enabled services operating abroad.
Separately, a UK antitrust tribunal dismissed a class action against several rail operators. The claim alleged abuse of market dominance over ticket sales, but the tribunal found there was no concealment of cheaper ticket options.
In industry news, OpenAI has raised $6.6 billion in a major funding round, valuing the company at about $157 billion. The round was led by Thrive Capital with participation from Microsoft and Nvidia, signalling continued strong investor confidence in advanced AI development.
Finally, in cybersecurity, the Capita fine serves as a strong reminder that regulators are paying close attention to basic access control measures and governance around privileged accounts. It reinforces the expectation that organisations must maintain robust identity and access management systems as part of their data protection compliance.
Leave a Reply