I have seen very little - in fact, nothing - written about the imminent EU “eEvidence” framework from the perspective of UK telecoms operators and Internet service providers. I accept that, even by my blogging standards, this one is a bit niche, but nevertheless, it might be of interest to someone. What is this about? The eEvidence regulation is an EU framework, to deal with the challenges of…
27 July - 7 August I can’t believe that I am having to do a blogpost on this again . I am due to be doing jury service again , from 27 July - 7 August. It is possible that it might finish earlier than that. It is possible - although I really hope not - that it might last longer than that. It depends on the trial(s) to which I am allocated. I will keep you up to date. I will support you as best as…
There has been a glut of new Internet Services Sanctions, making 94 in total now (from 37 in January). Update 2026-07-13: there are now even more sanctions , but I did not spot any new information, beyond that which is below. Here is the background to all of this . The OFSI sanctions list has been retired, leaving just the UK Sanctions List . Unfortunately, it is still a pain to extract…
The [Data (Use and Access) Act 2025 introduced into the Data Protection Act 2018 new requirements for handling data protection complaints . These new requirements come into effect on 19 June 2026 . The framework sets out the ability for a data subject - the person about whom a controller is processing personal data - to make complaint to the controller if that data subject considers that there is…
A couple of people have asked me about some of the proposed amendments to the UK’s Crime and Policing Bill , which is currently going through Parliament. I am working from the latest (as of 2026-04-16) publications relating to the Crime and Policing Bill . Please note that these are proposed amendments and, as such they are not (yet) law. They may never become law, or may be changed, materially or…
The European Data Protection Board is consulting on a template data protection impact assessment , for processing subject to the EU GDPR. I have had a look through the draft template, and I rather like it. It looks like a good way of thinking through, and documenting, the myriad requirements of the EU GDPR. Having everything in one place seems useful, both from the perspective of assessing risk,…
In January 2025, Ofcom consulted on changes to the telecoms Alternative Dispute Resolution (ADR) rules . The key change was reducing the “deadlock” period - the period before residential and small business consumers can access ADR if their dispute is not resolved - from eight to six weeks. This was captured as a change to the Ofcom approved complaints code of practice for customer service and…
One of the tests as to whether a user-to-user service is a “regulated” service, for the purposes of the Online Safety Act 2023, is whether the service has “links with the United Kingdom” . A service has “links with the United Kingdom” if: the service has a significant number of United Kingdom users, or United Kingdom users form one of the target markets for the service (or the only target market),…
2.5 years ago, I wrote about the Online Safety Act 2023’s (anti-)pornographic content provisions . Since then, Ofcom has launched an “enforcement programme to protect children from encountering pornographic content through the use of age assurance” and its most prolific enforcement activity has indeed related to pornographic content, so I thought that it was time for a brief update. A focus on…
The UK’s law on storing information on someone’s terminal equipment, and accessing information stored in someone’s terminal equipment, has changed. It is no longer aligned with the law in the EU, and it permits website operators and others to do more - not lots, but more - on an “opt-out” basis”. This is a change to The Privacy and Electronic Communications (EC Directive) Regulations 2003 , made…
In December 2025, the Grand Chamber of the Court of Justice of the European Union released its decision in the case of Russmedia . It focusses on the data protection obligations of the operator of an online marketplace, in terms of the personal data contained in ads placed by its users. Although it is an EU decision, and so not directly binding on courts in the UK, it is still of interest. I am…
There are currently 37 Internet services sanctions in place. Background Here is key information about the UK Internet services sanctions regime . Here is more information , including a letter from Ofcom. I’ve yet to see any enforcement action from Ofcom (or anyone else) in respect of these. What do we need to do? As a reminder, the sanction which ISPs must apply to users in the UK is: A person who…
I can’t believe that I get to write this blogpost. Sandra and I have been running our own tiny law firm, decoded.legal, for ten whole years. We had no idea how - or, indeed, if - this was going to work when we started out, but we gave it a go anyway. And, so far, so good. We are still in business, we still enjoy it, and we are still married. We have learned a lot, and we have tried to improve…
A beautiful watercolour image of a silver humanoid character on a keyboard surfboard, surfing on a wave of Matrix-style characters in the form of a wave (Art by the wonderful Jennie Gyllblad .) Wishing you all happy holidays! I have greatly enjoyed working with you all this year, and look forward to doing it again in 2026. I’m lucky to have such amazing clients. We will be back again on 5th…
Updated 2026-01-19 : the amendment has been amended , to give the Secretary of State some discretion over which services are in scope: “regulated user-to-user services” shall have the meaning given to it in the Online Safety Act 2023, subject to any modification, addition or exclusionas the Secretary of State may specify in regulations made by statutory instrument under this subsection .” Earlier…