Contact | Search |

Category: Insights

Data protection update

Posted on by admin

This update includes key developments such as the ICO-HMG memorandum on data protection, new provisions under the Data (Use and Access) Act, guidance on international data transfers and age assurance, and significant enforcement actions like fines for unsolicited marketing, misuse of biometric data, and breaches involving children’s data, alongside global concerns over AI and high-profile investigations.

General updates

  • On 8 January, the Information Commissioner’s Office and His Majesty’s UK Government (HMG) signed a Memorandum of Understanding (MOU) to formalise their shared commitment to improving data protection standards which includes appointing a Government Chief Data Officer to oversee data protection risks and compliance across HMG departments and key governance boards, such as the Transformation Board and Government Security Board, will monitor data protection risks and progress.
  • On 3 February, the ICO opened formal investigations into X Internet Unlimited Company (XIUC) and X.AI LLC (X.AI) covering their processing of personal data in relation to the Grok artificial intelligence system and its potential to produce harmful sexualised image and video content.
  • On 5 February, most of the remaining data protection provisions of the Data (Use and Access) Act have come into force, except for the requirement for organisations to have a complaints procedure which is due to commence on 19 June 2026 and some ICO governance provisions which will follow at a later date. Such provisions now in force include only having to carryout, a “reasonable and proportionate” search in response to data subject access requests and the maximum fine issued under the Privacy and Electronic Communications Regulations is no longer £500,000 but, now matches the GDPR of up to £17.5 million or 4% of global turnover (whichever the greater).
  • On 23 February, privacy regulators from around the world issued a joint statement addressing mounting concerns over artificial intelligence (AI) systems that create realistic images and videos of identifiable individuals without their consent.
  • On 11 February 2026, the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) issued a joint opinion on the European Commission’s Digital Omnibus Regulation proposal, which seeks to streamline digital regulations, reduce administrative burdens, and enhance competitiveness across the EU. The EDPB and EDPS strongly oppose proposed changes to the definition of personal data, warning that they could narrow its scope, weaken privacy protections, and create legal uncertainty.
  • On 25 April, John Edwards, the UK’s Information Commissioner, announced that he has temporarily stepped back from his role as the ICO conducts an independent investigation into unspecified “HR matters.” Edwards, who has held the position since January 2022, announced his cooperation with the inquiry in a LinkedIn post.

Latest guidance

  • On 15 January 2026, the Information Commissioner’s Office released updated guidance on international transfers of personal data under the UK GDPR. Key updates include: a three-step test for restricted transfers and explanations on roles and responsibilities, particularly for complex, multi-layered transfer scenarios. The regulators back several provisions aimed at reducing administrative burdens, including raising thresholds for mandatory data breach notifications and extending deadlines for reporting.
  • On 12 March 2026, the UK’s data protection regulator, the Information Commissioner’s Office has published an open letter to social media and video-sharing platforms operating in the UK calling on them to urgently strengthen their age assurance measures.
  • On 25 March 2026, Ofcom and the Information Commissioner’s Office released a joint statement outlining regulatory expectations for age assurance measures under the Online Safety Act and UK data protection laws. The statement aims to help online services protect children from harmful content and data risks while ensuring compliance with both legal frameworks.
  • On 31 March, the ICO called on businesses to review their use of automated decision-making in recruitment to ensure compliance with data protection laws and to protect jobseekers from unfair or biased outcomes.
  • On 29 April 2026, the Information Commissioner’s Office (ICO) released its finalised guidance on Storage and Access Technologies alongside an update on its online tracking strategy. This guidance addresses the application of the Privacy and Electronic Communications Regulations and, where relevant, the UK GDPR to technologies such as cookies, tracking pixels, device fingerprinting, and similar tools. It incorporates updates following two consultations and amendments introduced by the Data (Use and Access) Act 2025.
  • On 14 April 2026, the European Data Protection Board announced a new Data Protection Impact Assessment template to simplify compliance with the General Data Protection Regulation and promote consistency across Europe.

Latest enforcement action

  • On 15 January, the Information Commissioner’s Office fined Allay Claims Ltd £120,000 for sending over 4 million unsolicited marketing SMS messages between February 2023 and February 2024. These messages promoted PPI tax refund services and were sent without valid consent or compliance with the ‘soft opt-in’ exemption. Allay argued that recipients were existing customers who had engaged with the company in 2019 and signed terms of engagement, which it believed satisfied the ‘soft opt-in’ exemption. However, aggravating circumstances included Allay was previously investigated by the ICO in 2020 for PECR breaches and despite the investigation and complaints, Allay failed to suspend its marketing activities, resulting in further complaints. The distress caused to recipients, as unsolicited marketing is intrusive and can lead to financial harm, particularly in the context of PPI tax refund services, which often involve high fees and hidden charges.
  • On 2 January, The President of the Personal Data Protection Office (Poland’s data protection authority) imposed a fine of PLN 978,128 (approximately €232,379) on T. S.A. for the failure to ensure the independence of the Data Protection Officer (DPO) and the absence of measures to prevent conflicts of interest in the DPO’s role. The DPO of T. S.A. simultaneously held a managerial role (Director V.) and other positions within the company. The company’s history of GDPR violations was considered an aggravating factor, as it demonstrated ongoing compliance challenges. The company resolved the identified issues by restructuring the DPO’s role before the administrative proceedings concluded. This led to a 40% reduction in the fine.
  • On 29 January, the Italian Data Protection Authority (GPDP) fined e-Campus Online University €50,000 for unlawfully using facial recognition technology to verify student attendance during a teacher qualification course. The university processed biometric data without a valid legal basis, relying on invalid consent while failing to conduct a proper Data Protection Impact Assessment (DPIA) before implementation. The GPDP highlighted several violations of GDPR, including unnecessary data retention, lack of alternatives for students, and the power imbalance inherent in requiring biometric data for course participation. While the university cooperated with the investigation and ceased using the system, the fine reflected the serious nature of processing sensitive biometric data and the large number of students affected.
  • On 13 February, the ICO and Ofcom responded to an open letter from approx. 20 MPs urging the ICO to investigate Tattle Life for potential breaches of data protection laws after the death of a social media influencer’s 16 year old daughter.
  • The ICO confirmed it has an ongoing investigation into Tattle Life, examining its compliance with data protection laws. These include obligations to process personal data lawfully, transparently, and fairly, and to address user requests for data rectification or erasure. While the ICO does not have the authority to shut down websites, it can issue enforcement notices to ensure compliance if data protection violations are identified.
  • On 19 February, the ICO won its appeal in a landmark case against DSG Retail Limited. The dispute originated from a 2020 ICO fine of £500,000 imposed on DSG after a cyber-attack compromised the personal data of at least 14 million individuals. Despite appeals by DSG to the First-tier Tribunal and Upper Tribunal, the ICO sought further clarification on a critical point of data protection law by appealing to the CoA in 2024. The court clarified that this duty applies even if the stolen data cannot directly identify individuals, recognising the broader harm caused by cyber-attacks.
  • On 3 February, the ICO reprimanded Staines Health Group for sending excessive medical details about a terminally ill patient to their insurance company, Vitality. A patient at the NHS GP surgery was diagnosed with a terminal illness and made a claim to their insurer. The insurer, on behalf of the patient, subsequently requested that five years of medical history be sent to the patient to review, before being sent to the insurer in order to progress the claim. But, instead of five years of medical history being sent to the patient, Staines Health Group sent 23 years of medical records direct to the insurer. The patient believed the excessive disclosure of unnecessary medical records led to a reduction in the payout of their claim.
  • On 3 February, the ICO issued a monetary penalty of £100,000 to TMAC Ltd for making calls promoting alarm systems and monitoring services to individuals registered with the Telephone Preference Service.
  • On 4 February, the ICO issued a Penalty Notice to MediaLab.AI, Inc. fining it £247,590 for UK GDPR breaches relating to children’s data and the absence of a DPIA. The ICO found unlawful processing of under-13s’ data without valid parental consent and a failure to complete a DPIA for high-risk processing affecting under-18s during 27 September 2021 to 30 September 2025.
  • On 23 February 2026, the ICO issued a Penalty Notice to Reddit, Inc of £14,472,500 for UK GDPR breaches involving children’s personal data and failure to complete a DPIA.

The AI-enabled threat landscape: real world lessons from lawyers, PR and cybersecurity experts

Posted on by admin

In collaboration with Sodali & Co and LevelBlue, we have produced a new report offering vital insights into AI-driven cybercrime. Designed for non-technical executives and board members, it highlights key threats, practical talking points, and actionable steps to support discussions with risk, legal, and cyber security teams.

AI is transforming the cyber threat landscape, enabling faster, cheaper and more personalised attacks while lowering the entry barrier for malicious actors. These risks pose significant financial, operational and reputational challenges for businesses.

Download the full report here

EU AI Act Transparency Obligations: latest developments and key obligations

Posted on by admin

A core requirement imposed by the EU AI Act (the Act) is in respect of transparency obligations for the AI systems used.

The majority of the Act is expected to come into force on 2 August 2026. The European Parliament, however, has agreed a proposal that would delay the obligations imposed in respect of high risk AI systems. The remaining provisions of the Act remain largely unaffected, and businesses should operate on that basis, noting that breaching these obligations can result in a fine of up to EUR 15 million or 3% of their total worldwide annual turnover for the preceding financial year (whichever is higher).

The Act raised a number of questions around how companies would comply with their transparency obligations. This led to the creation of a draft code of practice (the “Code of Practice on Marking and Labelling of AI-generated content” (the Code)), integrating feedback from hundreds of participants and observers including industry, academia and other stakeholders.

The Code of Practice on marking and labelling of AI-generated content

The second draft of the Code was published on 3 March 2026 and a final version is expected by June 2026. The Code is subject to further amendments, but sets out four key requirements to demonstrate compliance:

  1. multi-layered marking through metadata embedding, imperceptible watermarking, or fingerprinting/logging;
  2. providers having to offer a free interface or publicly available tool enabling users and third parties to verify whether content is AI-generated;
  3. technical solutions for marking and detection must be effective and reliable; and
  4. continuous testing and improvement to keep pace with real-world developments.

The transparency obligations

The Code is underpinned by the underlying transparency obligations in the Act.

The extent of these obligations is influenced by different factors such as whether the AI system is classified as limited or high risk; and whether you are a deployer or provider.

For limited risk AI systems:

If you are a provider

A ‘provider’ is a company, individual, public authority, agency or body that: (a) develops, or procures the development of an AI system or general-purpose AI model; and (b) places it on the market or puts it into service under its own name or trademark. In other words, this applies to those who set out to create, or procure the creation of an AI system.

Providers of limited risk AI systems must comply with three core transparency requirements.

  1. AI systems must be designed to inform individuals that they are engaging with an AI system;
  2. Providers must ensure that outputs are marked in a machine-readable format and are detectable as artificially generated or manipulated; and
  3. Technical solutions employed must be effective, interoperable, robust and reliable.

The question of how providers can satisfy these requirements has been a recurring area of discussion, such that the European Commission has stepped in to provide guidance via the voluntary code of practice on the transparency of AI-generated content. We discuss this in further detail below.

If you are a deployer

In contrast, a ‘deployer’ is a company, individual, public authority, agency or body using an AI system under its authority, except where the AI system is used in a personal non-professional activity.

Given that deployers are effectively users with little to no control over the AI system, they are subject to much fewer disclosure requirements. The Act only imposes obligations on deployers of three specific types of AI systems:

  1. emotion recognition or biometric categorisation systems;
  2. deepfakes, where the system generates or manipulates image, audio or video content; or
  3. systems generating or manipulating text published to inform the public on matters of public interest.

For high risk AI systems:

If you are a provider

Unsurprisingly, the Act imposes the most obligations for this category. In general, it will include requirements for providers to supply instructions for safe use and information about accuracy, robustness, and cybersecurity. Individuals overseeing such systems must be suitably qualified to understand the system’s capacities and limitations, with various recordkeeping and risk management protocols.

If you are a deployer

Similar to above, deployers face fewer but a broader set of obligations reflective of the higher risk AI system. These include the implementation of specific governance, monitoring, transparency and impact assessment requirements. The key obligations can be grouped under two headings:

Operational obligations

The deployer must implement appropriate measures to ensure the high-risk AI system is used in accordance with the relevant instructions for use, that input data is relevant and sufficiently representative for the intended purpose of the system, and monitor its operation in order to be able to inform the provider in the event it identifies any risks or serious incidents.

Control and risk management obligations

A deployer must conduct a fundamental rights impact assessment (FRIA) before deploying the system, assign human oversight to individuals with the necessary competence, train and regularly monitor the AI system for risks, and keep the logs of the AI system in an automatic and documented manner for at least six months.

Future outlook

The trajectory is unmistakable: the Act positions transparency as a core principle, which is going to impact design choices, user interfaces and governance processes. Organisations will be expected to comply with the Code and the underlying transparency obligations that underpin it.

Companies leveraging AI along their supply chain should therefore prioritise embedding and documenting transparency measures that can withstand both regulatory and legal scrutiny, while ensuring alignment with wider IP governance and strategic commercial decisions.

For more information the EU AI Act and the Code and how they might impact your business, contact Sacha Wilson and Jacky Lai.

Unfair contract terms in consumer contracts: new draft guidance from the CMA

Posted on by admin

If you deal with consumers, then you need to know how consumer law applies to your contract terms and notices.

Ten years on from the introduction of the Consumer Rights Act 2015 (the CRA), the Competition and Markets Authority (the CMA) is revising its current guidance on unfair contract terms.

The draft guidance is aimed at making the guidance more accessible, helping businesses better understand and comply with the CRA. The consultation closed on 19 March 2026. Once finalised, it will replace the existing guidance on unfair contract terms.

Which terms are unfair?

Contract terms are unfair if they tilt the rights and responsibilities excessively in favour of the supplier. The law currently uses a ‘fairness test’ by looking at the words in the contract, taking into consideration what is being sold, how a term relates to other terms in the contract, and all the circumstances at the time the term was agreed.

Certain terms and notices giving rise to particular concerns are ‘blacklisted’ and deemed as unsuitable for use with consumers. These include terms that exclude or restrict liability for death or personal injury resulting from negligence, a consumer’s statutory rights and any associated remedies. Blacklisted terms are never enforceable against a consumer.

What are the key changes in the draft guidance?

Enhanced CMA enforcement powers under the DMCC:

The updated guidance integrates the Digital Markets, Competition and Consumer Act 2024 (the DMCC), enabling the CMA to impose penalties without going to court for businesses that use prohibited, non-transparent or unfair terms or notices. Fines may be up to 10% of a company’s global turnover or £300,000 (whichever is higher).

Transparency – more than words:

Transparency now covers not just the content itself, but also its presentation by requiring clear fonts and headings that follow a logical structure, supported by explanation of terms which may be complex or challenging to understand.

Fairness and consumer behaviour:

The requirement of ‘good faith’ should include a behavioural dimension. Suppliers must consider consumer psychology and avoid exploiting consumer biases — for instance, consumers’ tendency not to read standard terms thoroughly, or to underestimate future costs such as renewal or termination fees. Campaigns emphasising quick benefits, such as a free trial, while using tactics to minimise attention as to future costs will face greater scrutiny. Automatic renewal of subscriptions are also specifically noted as an area of concern, with the DMCC’s new subscription provisions (to enter into force no later than August 2026) adding further obligations.

The role of advertising:

Advertising is explicitly incorporated into the fairness assessment, requiring consistency between terms and marketing claims. Small print which removes or curtails more prominent claims, failing to highlight key terms during the marketing process, or inconsistency between marketing claims and the contract terms could give rise to an unfair commercial practices. Statements made by a supplier that a consumer is likely to see may also be treated as terms of the contract.

Exclusions and variations to the contract:

Vague language such as “liability is excluded so far as the law permits” will not remedy an unfair clause; and terms allowing a supplier to vary terms such as changing the description or price of the services or goods may now be deemed unfair should they be overly wide in scope or result in changes that may be unexpected to the customer.

What are the key takeaways for consumer businesses?

The draft guidance makes clear that unfair, onerous or significantly unbalanced terms will be closely scrutinised. Suppliers should ensure that lines of communication with customers are clear, transparent and user-friendly to understand.

Contract terms should similarly be reviewed to make sure that they strike a reasonable balance without prejudicing consumers by including reasonable protections around cancellation or refund rights.

For more information on how the new guidance will impact your consumer contracts, contact Sacha Wilson and Jacky Lai.

Government IT contracts: how to challenge the procurement process

Posted on by admin

If your business enters into contracts with public sector entities for the provision of IT or related services, you will be familiar with the public sector tender and procurement processes. But are you familiar with what can be done to challenge the outcome of those processes?

Whether it is an issue with the application of the scoring criteria, or how the process has been conducted, your business may have the ability to challenge contract awards.

However, in order to do so effectively, your business will need to move quickly and ensure that it deploys the various legal tools available to it strategically.

What is the relevant legislation?

In 2025, the Procurement Act 2023 (the Act) came into force. This represented the most significant development to UK public procurement laws for over 30 years, replacing the well-established EU-founded regime under the Public Contracts Regulations 2015 (the PCR).

How long do you have to bring a claim?

The period during which a legal claim can be brought under the Act is very short and remains largely unchanged from the PCR. In summary:

  • If you are a supplier seeking to challenge an award, the period to bring a claim is just 30 days from when they knew, or ought reasonably to have known, of the circumstances giving rise to the claim. However, this may be extended for up to three months where the court considers there is a good reason to do so.
  • If you are supplier seeking to set aside a contract that has been entered into, the period to bring a claim is 30 days from the date it knew or ought to have known of the circumstances giving rise to a claim with a long stop date of 6 months from the date the contract was entered into.

However, the parties can enter into a standstill agreement which, in effect, extends the limitation period, allowing the parties an opportunity to resolve the dispute.

Can you prevent the authority from entering into a contract with another supplier whilst you challenge the decision?

Under the previous regime, contracting authorities were required to observe a 10-day waiting period following the issue of a ‘standstill letter’ to all tendering suppliers before entering into a contract with the preferred supplier. Claims issued prior to contract execution would trigger an automatic suspension of the procurement process.

The Act reduces the standstill period from 10 to eight working days, with the period now triggered by the contract award notice instead of the issue of a standstill letter. Claimants are no longer entitled to the benefit of automatic suspension up until the date of contract execution. This is a significant shift from the previous position and impacts upon strategic considerations.

What information do you have about the decision-making process?

There are various ways you can find out more about the decision-making process. One of them is that contracting authorities must publish a Contract Award Notice on a central digital platform, and an assessment summary to each supplier that submitted an assessed tender.

The assessment summary must include: (a) the scores awarded for each criterion; (b) an explanation of those scores; and (c) in respect of unsuccessful suppliers, the reasons why the contract was not awarded to them, together with the corresponding information at (a) and (b) for the successful tender.

The enhanced disclosure requirements are a positive development for suppliers looking for substantive grounds on which to base a potential challenge.

What remedies can you obtain when challenging an award?

In many cases, compromise solutions are reached with the relevant authority without a claim needing to be issued. However, if you do pursue a claim, the remedies available remain mostly unchanged from the previous regime. There are two main categories:

Pre-contractual remedies:

Where a contract has been awarded but not yet executed, a successful challenge may result in the court granting one of the following orders:

  • an order setting aside the relevant decision or action (including the decision to award the contract);
  • an order requiring the contracting authority to take specified action (such as reconsidering a decision previously made);
  • an order for damages (which may be granted in addition to any other order, and has historically encompassed lost profits arising from the breach and/or wasted bid costs); or
  • such other order as the court considers appropriate.

Post-contractual remedies:

Where the awarded contract has been executed, the available remedies are limited to damages and/or an order setting aside the contract (subject to certain conditions in the Act).

What does this mean for suppliers?

If you are concerned about a procurement decision, then given the short timeframes for challenge, it is critical to seek legal advice at the earliest possible opportunity to allow your advisors time to evaluate the claim and devise and deploy the optimum strategy.

The Act’s emphasis on transparency, creating a level playing field and the introduction of new obligations on contracting authorities, expands the scope for potential challenges.

You will however need to navigate the reduced standstill period, which now runs for 8 working days from the contract award notice, and the fact that automatic suspension is no longer available until the date of contract execution.

If you would like to find out more about how to make procurement challenges, contact Lizzie Williams and Jacky Lai.

Workplace stress claims: Howard Hymanson’s expert perspective on stress in the workplace and employee wellbeing

Posted on by Anna Weeden

“The obligation on employers to ensure a safe system of work applies equally to protecting someone’s mental health as it does their physical health.”

Partner and co-head of our employment practice Howard Hymanson has been featured today in the latest episode of The Charlène Gisèle Show.

Charlene’s podcast is aimed at successful professionals wanting to achieve their career goals without the stress. As a former lawyer turned executive coach, Charlène aims to guide individuals to a balanced career without sacrificing success.

In this episode, Howard shares his insights on workplace stress from navigating stress claims and discrimination to addressing burnout and fostering healthier workplace cultures. Howard, who is a leading expert on stress at work compensation claims and mental health in the workplace, provides his perspective which lies at the intersection of employment law and wellbeing.

The full episode can be watched here.

Branded Content: Navigating the New World

Posted on by Anna Weeden

With traditional commissions remaining hard to come by, producers are increasingly seeking branded content as an alternative ‘holy grail’ to getting their shows funded. But what exactly is it? And how does having a brand onboard interplay with broadcasters’ duties to the public?

ISN’T IT JUST THE SAME AS SPONSORSHIP?

Advertiser Funded Programming (AFP), means programmes created with the input of a brand – often financial but it can also be creative too. Branded content on the other hand, usually means programmes created by producers for a brand where the brand effectively acts as commissioner. Increasingly, the term “branded content” is used colloquially in the TV industry to mean either.

Crucially, AFP for traditional TV is where the brand buys into the existing editorial integrity of the programme and is looking to reach consumers by aligning with the programme’s existing values. As Jon Willers of The Development Network puts it, “branded content for Channel 4 must feel like something they would commission anyway”. In other words, the branding is complementary, or supplementary, to the story being told. Of course, there is branded content which starts with the brand and works backwards, but again, the final product isn’t intended to look and feel like an advert.

The key difference between AFP and sponsorship is that usually with AFP, there is a deeper relationship with the programme makers (the producer and broadcaster) and the programme itself. The Branded Content Marketing Association describes it as “any means by which an advertiser can have a deeper relationship with programming product beyond traditional media activity”. This definition requires a funding relationship with the programme or series that goes beyond sponsorship because the funding goes directly into production. Effectively, it is programming that wouldn’t exist without the brand partner. Sponsors, on the other hand, rely on the right programme being available, and only then are they able to secure sponsorship on it.

WHO OWNS THE IP?

Typically, in AFP, brands do not take a share of the intellectual property rights in the programme as they perceive the value of the partnership to lie in the exposure and reach it provides for their brand. This is good news for producers as it leaves them free to exploit the format and the like, subject to any terms agreed with the broadcaster. However, this position may be changing, at least in the digital space, as brands get savvier to the potential upside in owning a share of the IP-pie. Some might even be interested in a share of net revenues from producers’ exploitation of the programme on the secondary market after the initial broadcast. With negotiations wide open, it’s all to play for.  For public service broadcaster (PSB) deals, though, under the Terms of Trade, the producer must remain the owner of the IP in the shows (which means that certain brands who are entering the AFP space for the first time may need to have their expectations managed).

HOW DOES BRANDED CONTENT WORK FOR THE PSBS WITHIN THE OFCOM RULES?

The BBC has historically shied away from any type of brand involvement in its shows, primarily due to restrictions on its funding and operational framework. The BBC is funded by the licence fee, which is public money provided by Parliament. It is prohibited from using these funds for services that are wholly or partly financed through advertisements, sponsorship, or other alternative funding methods, unless prior written approval is granted by the Secretary of State. This restriction ensures that the BBC remains independent and free from commercial influence, maintaining its public service remit. That being said, commercial arms of the BBC do engage in brand-funded content, like BBC StoryWorks which commissions branded content for the non-UK market.

The other PSBs however, have previously engaged in a fair level of AFPs, but the last few years has seen  a huge rise as the climate for fully funding their shows remains challenging. A good example is Cooking With the Stars in partnership with Marks & Spencer; DNA Journey with Ancestry; and John and Lisa Down-Under with Trailfinders.

However, the PSBs fall under the jurisdiction of Ofcom, meaning any branded-funded content they show needs to comply with the Ofcom Broadcasting Code (the Ofcom Code).

PRODUCT PLACEMENT UNDER THE OFCOM CODE

Product placement involves the inclusion of a product, service or trade mark within a programme in return for payment or other consideration.

Product placement is permitted in certain types of programmes, such as films, TV series’, entertainment shows, and sports programmes, provided it complies with the rules set out in Section 9 of the Ofcom Code. These rules require that product placement does not compromise editorial independence, is not unduly promotional and is clearly signalled to viewers through a universal product placement logo displayed at the start, end and after advertising breaks in the programme. This means that whilst certain brands may want to have control over how their products are featured in content, the extent to which they can do so is limited under the Ofcom Code meaning their expectations need to be managed accordingly.

SPONSORSHIP UNDER THE OFCOM CODE

Under the Ofcom Code, the sponsor may not influence the editorial content of the programme. The sponsorship must be clearly identified and there must be a clear distinction between editorial content and advertising to maintain transparency and consumer protection. Whilst we said above that AFP and sponsorship are not the same, the sponsorship rules in the Ofcom Code may well still apply to brand-funded content.

SO, WHAT DOES THIS MEAN?

In short, setting aside the BBC (which is subject to additional restrictions) branded content for the PSBs is permitted provided producers successfully navigate and adhere to the standards and transparency requirements of the Ofcom Code.

WHAT ABOUT STREAMING PLATFORMS?

For the PSBs’ digital offerings, like Channel 4, BBC iPlayer and ITVX, the regulatory landscape is currently different than for their PSB main channel counterparts, as the Ofcom Code itself does not apply. The same is true for streamers like Netflix and Amazon Prime. Instead, VOD services are currently regulated by the ODPS (On-Demand Programme Services) Rules which impose alternative broadcast standards. Whilst the ODPS Rules on sponsorship and product placement are broadly similar to the Ofcom Code, they are slightly lighter with regards to how VOD services are allowed to implement them. For example, under the Ofcom Code, product placement must be editorially justified and signalled with a ‘PP’ logo. That being said,  the ODPS Rules for signalling requirements must only ensure that viewers are adequately informed about product placement – there is  no strict format requirement. This means an ODPS would be able to use its end credits to disclose a promotional consideration.

The Media Act 2024, now in force, gave Ofcom the power to create a new Ofcom code which will apply to Tier 1 Video On-Demand (VOD) services (the VOD Code), This  would cover the PSBs’ VOD offerings as well as independent streaming services like Netflix, Amazon Prime and Disney+ etc. Will this tighten up the rules on branded content in the online space? Based on current thinking, the new Ofcom code will not focus on these areas meaning ODPS will continue to be governed by the existing ODPS Rules.

HOW ABOUT YOUTUBE, INSTAGRAM AND TIKTOK?

YouTube is the home of long-form branded content; Instagram and TikTok are the home of short-form branded content and clips. Brands and producers make use of all of them as part of a cohesive, multi-platform branded strategy.  

Crucially, none of the above Ofcom or ODPS Rules currently apply to YouTube, TikTok or Instagram. A recent Government announcement has confirmed that video-sharing platforms like YouTube, will not in and of themselves be designated as Tier 1 VOD (though some individual channels on YouTube with a high number of subscribers, like the PSB’s own YouTube channels, may be caught).

Instead, branded content on these types of platforms is subject to the CAP Code. This is a separate set of rules governed by the Advertising Standards Authority which states that, where a brand has editorial control, there must be clear labelling to allow viewers to easily recognise the content as an advert, and messages should not be conveyed surreptitiously. On social media sites, influencers must use clear labels like “#ad” to ensure transparency where they are posting a brand-funded video.

WHAT NEXT FOR BRANDED CONTENT?

Branded Content shows no sign of waning. Whilst the regulatory landscape continues to evolve, producers, broadcasters and brands remain set on navigating the rules and reaping the benefits that collaboration between traditional TV indies and brands can bring.

We are experts in advising on both sides of the fence as well as advising on deals with broadcasters where there is brand involvement. Our advice ranges from deal-making and structuring, contract drafting, negotiation and advice on the regulatory regime. If you are a TV production company, agency or a brand working on a branded content or AFP project, please get in touch.

UK Government holds off on immediate AI Copyright reform

Posted on by Dea Dragashi

The Government has published its much-anticipated Report on Copyright and Artificial Intelligence, which follows a consultation that ran from 17 December 2024 to 25 February 2025.

The consultation received 11,520 responses from a broad range of stakeholders, including creators, rights holders, and AI developers, with widely different sentiments on how the future of copyright law should be shaped to accommodate AI.

The report is not a statement on the Government’s plans to reform the law but instead signals that it will continue to consider the questions raised by AI for stakeholders in the UK, including those in the creative industries. The conclusion of the report is that there is little the Government can do without further investigation: it identifies limited consensus amongst stakeholders and notes that the international and technological pictures are sufficiently fast moving that legislating at this stage would be premature. This is similar to the conclusion that the Government reached after its prior consultation on AI (launched in 2022).

Although the report is inconclusive on what the future will look like, the fact that the Government has no plans to pursue a broad-brush text and data mining exception (TDM) in the near future is a win for IP rights holders and the creative industries more broadly. The detailed analysis provided by the Government also gives some insight on the direction of travel and will assist in any action that those impacted by AI may want to take to shape the future of copyright law in the UK:

The Government believes that rights holders should be “fairly remunerated” for the value added to the AI supply chain but, for now, there will be no new copyright exception for AI training:

The Government has ditched its previous preferred approach of a broad TDM exception with an opt-out mechanism. This is following strong opposition from the creative sector. The Government plans to gather further evidence and monitor developments before deciding whether and how to act. Rather than legislative intervention, the Government’s immediate focus is on developing best practice around transparency of training inputs, which it sees as a prerequisite for both rights enforcement and a functioning licensing market. The Government aims to test commercial models for licensing as part of the “Creative Content Exchange” announced last year, and plans to launch its operational pilot platform by Summer 2026.

The report also offers a summary of the alternatives to a broad TDM exception, which were put forward by industry respondents to the consultation. These include a “focused exception” to copyright that would support commercial science and research (an extension of the existing non-commercial research exception), or a public interest exception that would permit AI tools to ingest copyright content for the purposes of detecting harm. The Government is clear that any exception would only apply to material that had been lawfully accessed (i.e., not pirated) and suggested that – if such an exception were to be brought into law – it might include a statutory remuneration model for rightsholders.

Computer-generated works protection likely to be scrapped:

The Government states that its preferred approach would be to remove copyright protection for wholly computer-generated works with no human author, while retaining protection for AI-assisted works where a human has contributed creatively. It says that this is consistent with the principle that copyright “should incentivise and protect human creativity”. This reflects the fact that the majority of respondents were in favour of scrapping the provisions.

The Government is to consider merits of introducing a “personality right” to combat digital replicas:

The report identifies digital replicas (i.e., AI-generated imitations of a person’s voice or likeness) as an area where existing copyright and performers’ rights provisions are inadequate. The Government intends to “explore options” to combat the risks of impersonation for both artists and the general public, including whether creating a new “personality right” may be the most appropriate step. In the meantime, the report acknowledges that more well-known artists may be able to protect their voice or likeness via the tort of passing off or via registered trade marks, but for lesser-known artists and the general public, this will be insufficient.

If you’d like to read the full report, it is available here: Report on Copyright and Artificial Intelligence.

If there’s anything raised by the Government report that you’d like to talk about, don’t hesitate to get in touch.

F1 season cut short: What happens next?

Posted on by Anna Weeden

On Saturday Formula 1 (F1) announced the decision to cancel the Bahrain and Saudi Arabia Grands Prix due to the conflict in the Middle East.

While the human cost of the conflict is immeasurable and far outweighs any sporting consideration, the cancellation of multiple races will nonetheless have significant consequences for F1.

The sport is reported to face losses in excess of £100m as a result of the cancelled races – a figure that is likely to be substantially higher once sponsor compensation and other stakeholder claims are factored in, given the loss of value arising from a shortened season.

Depending on how the war unfolds, cancellations to further races could follow – in particular rounds 23 and 24, in Qatar and Abu Dhabi, could be at risk.

Mass race cancellations are not unprecedented, with the Covid pandemic resulting in races being cancelled or held behind closed doors. The prospect of a reduced racing calendar has therefore been front of mind for stakeholders negotiating contracts with rightsholders including F1 and the teams in recent years.

This has led to sophisticated stakeholders – in particular drivers, sponsors and broadcasters – digging into the force majeure provisions in their contracts with rightsholders, which can relieve a party of its obligations if they are unable to perform due to circumstances outside of its control. Sponsors and broadcasters will often try to negotiate these clauses to ensure they are entitled to a pro-rata refund of the fee for the affected Season if races are cancelled, while drivers will be keen to ensure their fee is unaffected by circumstances outside of their control.

Rightsholders will be reluctant to make these changes, given the loss of income, and there will be many cases where unequal bargaining power, or a willingness to get the deal done will leave parties who signed up to rightsholders’ standard terms without legal recourse.

While many cases will be resolved on a commercial level, with substitute rights granted at other races to maintain partnerships and key relationships in a sport that is notoriously a “small world”, the soaring commercial success of F1 and the ever increasing values of commercial deals means it would be unsurprising if the 2026 Season is marred by high-profile litigation.

Brands negotiating new sponsorship agreements with sports rights holders (including F1 teams), or renewing existing arrangements for the 2027 Season onwards, will now be minded to dig into force majeure provisions to ensure there is a satisfactory mechanism – which may include substitute rights or expert determination of the value of the lost rights – to ensure their interests are protected if races are cancelled.

Behind the lens of March 2026: UK Film and TV insights

Posted on by Anna Weeden

In 2026, buzzwords like digital-first, micro-dramas, the creator economy and vodcasts will face their moment of truth; Paramount’s Warner Bros. Discovery deal could reshape UK PSBs – will Sky and ITV tie the knot, and what about a BBC-Channel 4 merger? AI’s influence will grow with the anticipation of the first fully AI-generated feature film and increased use of generative tools by UK broadcasters.

The year is off to a flying start and the first 2026 edition of our UK film and TV newsletter covers how shifting viewing habits will see ad-supported streaming rise, cinema admissions decline and more YouTube experimentation, and discuss how studios will adapt by testing vertical drama formats while broadcasters strengthen partnerships with global streamers.

HARBOTTLE HIGHLIGHTS

Harbottle & Lewis and Animation UK Partnership

We are excited to announce our brand-new partnership with UK Screen Alliance /Animation
UK as their exclusive legal sponsor for 2026.

Since its inception, UK Screen Alliance, in partnership with Animation UK, has championed
the strengths of the sector, playing a pivotal role in securing the introduction of the UK’s Film
and High-End TV tax relief in 2013. More recently, the UK Screen Alliance and Animation UK
persuaded the UK government to introduce an uplift in respect of Animation and VFX in the
Audio-Visual Expenditure Credit.

Keep an eye on our LinkedIn to learn more about how we’ll be working with UK Screen
Alliance /Animation UK over the next 12 months. And if you’re a member, you may be seeing
more of us in the near future!

GROWTHLAB AND INDIELAB INNOVATION AWARDS 2025

2025 marked Indielab’s 10th anniversary, and as part of our ongoing partnership, we joined
their Growthlab conference in November for the launch of their first Innovation Awards.
Edward Lane, Clare McGarry, Katerina Capras, and Caitlin McGivern all attended and Ed
had the honour of presenting the award for ‘Outstanding Indie of the Year’ to CPL
Productions, the creative force behind MAFS UK, Love is Blind, 90 Day Fiancé, and A League
of Their Own, among others. It was a fantastic day and evening celebrating some of the
most exciting innovation and creativity across UK television and digital-first content.

CONTENT LONDON

Our annual industry “Harbottle Happy Hour” returned this year and was held at the German Gymnasium in King’s Cross. This was a great opportunity to catch up with friends, clients and contacts during one of the busiest weeks in the industry calendar.

WOMEN IN FILM AND TV AWARDS 2025

Back in December, Sarah Lazarides, Abigail Payne, Catherine Flood, and Caitlin McGivern attended the Women in Film and TV Awards, joined by key contacts and clients at our annual table. The awards celebrate the outstanding female talent across the film and television industry, and it was a pleasure to be part of such an inspiring event.

INDIELAB CONTENT FUTURES ACCELERATOR 2026

We are continuing our long-standing partnership with Indielab into 2027 as the exclusive legal sponsor of their Content Futures 2026 Accelerator.

This year, the newly rebranded Content Futures programme will focus on technology, branded entertainment, digital platforms and the global TV market, supporting participants in reaching their goals in distribution, funding, and investment.

INDUSTRY UPDATES

PACT/EQUITY UPDATE

UK film and TV performers vote overwhelmingly for AI protections

Equity’s indicative ballot in December saw 99.6% of participating performers vote to refuse digital scanning on set without stronger AI protections. Although not legally binding, the result prompted Equity to push Pact for improved proposals focused on explicit consent, transparency and fair compensation, building on standards set by SAG AFTRA. Pact has now issued a revised counterproposal that strengthens provisions around synthetic performers and maintains that existing protections, combined with UK GDPR, already offer comprehensive safeguards. Pact has also rejected claims that producers are selling biometric data to third parties, noting no evidence has been found, but has agreed to review GenAI market practices on a regular basis.

New Pact Equity TV Agreement rates card

As of 1 January 2026, the new rates card under the TVA is now in effect. Pact and Equity have
also agreed to extend the current rates under the CFA until 5 April 2026.

EMPLOYMENT RIGHTS ACT 2025

After the twists and turns of its parliamentary journey in 2025, the long-awaited
Employment Rights Act 2025 is now law. Read our note to see what this means for
employers in the film, TV and entertainment sectors: ERA 2025: the new Act and the
entertainment industry.

NEW DIRECTORS UK BLANKET AGREEMENT

The updated agreement, effective from 1 July 2025, keeps commercial fees for PSB and Sky
commissions at current levels and introduces a 3% net revenue share from year eight on profitable, fully recouped programmes.

Producers do not need to include this in individual contracts, as it applies automatically unless a separate deal is less favourable. The agreement covers all new and returning commissions after the effective date and will be reviewed in 2028.

RIGHT TO WORK CRACKDOWN

Proposed Home Office reforms could see companies face fines of up to £60k per casual worker if they fail to carry out right to work checks on freelancers, extending existing obligations beyond standard employment contracts and hitting sectors reliant on short term labour such as film and TV. Experts warn that gaps in verification processes could create significant financial and reputational risk, and the clear message for employers is that right to work checks must be completed for every individual engaged, regardless of contract type or duration.

OFCOM STATEMENTS

In November 2025, Ofcom released two significant publications relating to the implementation of the Media Act 2024, which is expected to result in substantial changes in the media landscape by 2027. Ofcom’s report focuses on how streaming services that are available in the UK protect their audiences and further identifies areas for improvement.

Read our note on the key points and practical implications: Ofcom gives weight to the Media Act.

AI UPDATE: FIRMLY IN FOCUS FOR 2026

Disney Partners with OpenAI’s generative platform to license iconic characters

Disney is making more than 200 characters, along with costumes, props and vehicles from Marvel, Pixar, Star Wars and classic animations available on OpenAI’s Sora platform, allowing fans to create AI generated videos and images. Disney also plans to use OpenAI technology internally to support new products and enhance Disney Plus, with both companies stressing responsible AI use and a commitment to protecting creators’ rights while expanding storytelling and audience engagement. This is BIG news, especially given Disney’s historic reputation of being super protective over its IP.

No changes to the UK’s AI legislative framework

The UK has made no major changes to its AI framework following its government consultation, confirming it will retain a flexible, non-binding, sector based approach rather than introduce formal legislation (for now…). Although the consultation highlighted gaps and the need for more support, the government has kept its non-statutory model and committed funding to strengthen regulators instead of creating binding obligations. With other regions introducing comprehensive AI laws, the UK’s slower approach risks ongoing uncertainty for the creative sector seeking clearer rules on responsible AI use.

Getty v Stability AI: UK Appeal set to shape copyright & AI in 2026

Getty Images has been given permission to appeal its case against Stability AI. Getty’s original claims centred on the alleged use of millions of its images to train Stable Diffusion, but the primary infringement claim was dropped after the court accepted that training took place outside the UK.

After the primary claim fell away, Getty instead argued that making the model available for download in the UK amounted to importing an infringing copy, which the court rejected on the basis that Stable Diffusion does not contain copy’s of Getty’s works. The court recognised the issue as both novel and important and allowed an appeal on the meaning of an infringing copy, leaving open future arguments about AI training and primary infringement.

The Court of Appeal’s decision will be key in determining the reach of English copyright law reaches into global AI development.

IT’S ALL ABOUT COLLABORATIONS

BBC announces new strategic partnership with YouTube

The BBC is expanding its YouTube presence with new digital first programming, including targeted channels for children and young adults such as Deepwatch and channels featuring content from Operation Ouch, Horrible Histories, Horrible Science and Deadly 60. The partnership aims to boost the visibility of major BBC brands and deliver trusted news through global channels, live story streams and new storytelling formats to reach younger audiences who do not consume traditional BBC content. It also includes a UK wide creator development programme, with around 150 media professionals receiving YouTube training through workshops and events led by the National Film and Television School.

Netflix and Spotify’s video podcast partnership: a strategic move

Netflix has partnered with Spotify to bring a slate of established video podcasts to the SVOD platform, supporting its strategy to expand engagement through more diverse and timely formats. The selected shows sit within genres where Netflix already has a strong presence or ambitions to grow, including sport and true crime, and are intended to complement its mix of appointment viewing and more casual background content. The move is aimed at positioning the service more competitively against platforms like YouTube in the live and interactive space. While some questions remain about how this fits with Netflix’s premium brand, the partnership offers creators new distribution opportunities and opens the door for further live or timely formats.

Netflix and Sony expand exclusive movie pact

Sony and Netflix have expanded their Pay 1 deal into what they describe as an industry first worldwide arrangement that will roll out as Sony’s individual territory licences expire, giving Netflix exclusive first post theatrical rights to Sony films. The deal builds on their existing agreements in the US, Germany and Southeast Asia and is expected to reach full global availability by early 2029.

Titles covered include Sam Mendes’ four-part Beatles project due in 2028, Spider Man: Beyond The Spider Verse, the live action Legend of Zelda adaptation, Sony Pictures Animation’s Buds and The Nightingale, with Netflix also licensing select Sony feature film and television library titles.

IN THE SPOTLIGHT

M&A – THAT’S ALL, FOLKS!

Written by partner Ed Lane.

The last few days has brought big news on two of the most exciting “will they, won’t they” storylines we’ve had since Ross and Rachel. Paramount pipped Netflix to the post on Warner Bros Discovery and – hot off the press – Banijay Entertainment and All3Media have finally confirmed their merger of equals. Yes, please welcome to the stage (deep breath) Paramount Skydance Warner Bros Discovery and Banijay Entertainment All3Media. I am sure that someone is, as we speak, working on some better names.

Yes, big deals are back!

Paramount is forking out $111bn for Warners and the combined Banijay/All3 will be the largest production group outside of the US. We’ve also in recent months had French studio Mediawan’s acquisition of Peter Chernin’s The North Road Company and Sky and ITV in talks to do a $2.2bn tie-up.

After years of lacklustre M&A activity, what’s going on? Well, in this modern era, scale is survival. These are defensive moves. The move to streaming as the dominant business model has made access to huge amounts of content paramount. Audiences have never had more choice, and streamers have responded by competing for the best, most enduring IP. Scale also gives you pricing power and better terms.

The broader macroeconomic environment is still uncertain, inflation remains stubbornly high and interest rates are not coming down as quickly as expected. Uncertainty is the new paradigm. This should mean less M&A. The fact that we are seeing these big deals means all is not well. The Attention Wars aren’t going great for traditional media: competition from YouTube, Instagram, TikTok, purveyor of parasocial relationships OnlyFans and prediction markets has meant those selling more traditional content are fighting over an ever-shrinking pool of attention. People are spending less time watching long form content and subscriber growth has slowed.

These megadeals are really about securing a bigger slice of a smaller pie.

The question now for Paramount is whether it can get past the various regulatory hurdles and close the deal – this is only the beginning of a long process, in the course of which AI may have transformed (even more) the world of content. Meanwhile, Netflix’s share price has skyrocketed, telling us all we needed to know about the market’s view of the deal (at one point its share price has dropped by more than the $82bn it had bid for Warners). Netflix also receives a $2.8bn break fee for its troubles; not bad for a few months’ work.

At the smaller end of the market, we are seeing good levels of activity and hope to be able to talk about a number of cool things we’ve been working on soon. The main driver of the deals we’re doing is more positive: larger businesses acquiring indie expertise and experience in areas they want to expand into – it’s all about backing talent and giving them the resources to meet their full potential.

Until next time!

IP, THEREFORE I AM?

Increasingly, AI is being used to generate digital replicas, also known as “deepfakes”, of reallife individuals. This is often for commercial use, including on social media, to promote products and services. This is of particular concern for actors and celebrities, whose images and likenesses are widely available and accessible online, meaning that there is an abundance of source material for AI systems to draw from.

Intellectual property managing associate, Daniel Prim, shares his insight on how this development might unfold in the UK and its impact on the creative industry on our website.