This Checklist sets out the key steps to follow when carrying out an illegal content risk assessment under the Online Safety Act 2023 (OSA 2023). Conducting a ‘suitable and sufficient’ illegal content risk assessment is one of the illegal content duties under OSA 2023. It is the first step of compliance and should be used to assess the level of risk associated with a particular service, which in turn will inform decisions about the measures a service will need to take in order to comply with its legal obligations. For guidance on services within scope of OSA 2023 and further general guidance on the duties of care, see Practice Note: The Online Safety Act 2023. This Checklist is based on Ofcom’s guidance entitled Risk Assessment Guidance and Risk Profiles (Risk Assessment Guidance). It is designed to provide an introduction to the steps required, with references to the relevant parts of the Risk Assessment Guidance that contain further detail on this process. Ofcom’s Risk Assessment Guidance recommends a four-step process

Environmental incidents often happen without warning and with significant consequences. It can be easy in those circumstances to fail to maintain a clear head about managing such an incident. Managing an environmental incident does not equate to being unco-operative with an investigation authority. In most cases, open and transparent co-operation will almost certainly be the best policy. But proper preparation for a possible future environmental incident mandates that clear policies should be in place so that, when an incident does occur, appropriate resources are directed towards minimising environmental harm, effective controlled communication with the regulator and the appropriate collection of evidence and subsequent analysis. For information about the powers held by the regulators to investigate environmental crime, see Practice Notes: • Environment Agency—powers to investigate environmental crime • Environment Agency (EA)—powers of entry • Natural Resources Wales—powers to investigate environmental crime • Natural England—powers to investigate environmental crime • Local authorities—powers to investigate environmental crime For information on the enforcement and prosecution of environmental crime generally, see Practice Notes: Environmental prosecution

Data, and consequently data protection compliance, is central to conducting clinical research whether in the context of clinical trials, pharmacovigilance activities and/or scientific research more broadly. This Practice Note explores the data protection implications of conducting clinical research. In particular, this Practice Note considers the responsibility for data protection compliance in the context of clinical research, the relevant legal grounds for processing personal data for research purposes, transparency requirements, collaborative research and data sharing as well as exceptions to data subject rights when processing personal data in the context of research. Finally, this Practice Note provides a checklist of practical data protection considerations to bear in mind when planning research activities. The GDPR regimes On 25 May 2018, the General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR) became directly applicable and enforceable in all EU Member States and the EEA (the EU plus Iceland, Norway, and Liechtenstein), including the UK at that

The Pensions Regulator’s scheme management enforcement strategy outlines its compliance and enforcement policies on defined benefits funding, defined contribution and public service pension schemes, as well as setting out the outcomes TPR might pursue, and ways it might go about achieving them in pursuit of its goal to improve safety and security for pension savers. TPR’s prosecution policy and general enforcement strategy set out the overarching aims of its enforcement work and provides insight into the framework TPR applies when selecting cases for enforcement action. Initial considerations in TPR investigations In its role as the UK regulator for work-based pension schemes, TPR has a range of information gathering powers to identify and monitor risks and gather evidence to assist a criminal prosecutions. These include: • requiring reports of breaches of law and notifiable events • requiring reports to be prepared by skilled persons on specific issues • the power to demand documents and other information from trustees and employers • the power to inspect premises For more information, see Practice Notes:

A statement made to a person, official or otherwise, in which the accused admits or claims responsibility for the acts in question.

This Practice Note covers the meaning of a confession under the Police and Criminal Evidence Act 1984 (PACE 1984) and the mechanisms available to regulate the admissibility of confession evidence in a criminal trial. It also covers the procedures for excluding a confession under PACE 1984, ss 76 and 78. What is a confession? A confession is broadly defined in PACE 1984, s 82 as any statement which is wholly or partly adverse to the person who made it. There is no requirement that the confession must be made to someone in authority such as a police officer and PACE 1984, s 82(1) provides that the 'statement' can be made by 'words or otherwise'. This means that a confession can be made orally or in written form and can include conduct such as a nod of acceptance. The courts have held that to constitute a confession under PACE 1984, the statement must have been adverse to the maker of the statement at the time the statement was made. A neutral or exculpatory statement at the time it was made does

A confidential communication is information shared between parties with an expectation that it will not be disclosed beyond an agreed circle, commonly arising in legal advice, settlement negotiations, employment, commercial and family law contexts. It is not a single statutory term but a descriptive expression used in legislation, contracts and case law across England and Wales, Scotland, Northern Ireland and Ireland, with broadly similar meaning. Legally, whether a communication is confidential depends on factors such as the circumstances of disclosure, the relationship between the parties, any express confidentiality clauses, and whether the information has the “necessary quality of confidence” (for example, being private, not public, and having commercial, personal or strategic sensitivity). Confidential communications are central to: - duties of confidentiality owed by solicitors, doctors, employees and others; - the equitable and contractual action for breach of confidence; - data protection and privacy rights; - legal professional privilege (a distinct but related concept). Courts assess misuse, unauthorised disclosure and available remedies (injunctions, damages, account of profits) by reference to the confidential nature of the communication and the scope of the duty arising from it.

Information provided to the council by a government department upon terms forbidding its public disclosure and information prohibited from public disclosure by statute or court order (section 100A(3) Local Government Act 1972).

As noted in Practice Note: The duty of fidelity and fiduciary duties, the duty of fidelity implied into every contract of employment will generally prevent an employee from disclosing to third parties confidential information which comes to their knowledge during the course of their employment. In addition to this, certain very confidential information, generally known as trade secrets, will be protected by the equitable duty of confidence. These two duties have combined historically to determine the implied duty on an employee in relation to confidential information. The manner in which business information is categorised is therefore very important; while an employee will be under an implied duty not to disclose trade secrets and/or confidential information to third parties during employment, only the implied duty not to disclose trade secrets will continue after the employment ceases. An exception to this general rule is that the employee may be prevented from taking advantage, after their employment has ended, of a breach of the implied duty that occurred during their employment (see Practice Note: Springboard

This Practice Note deals with the general principles of obtaining an injunction relating to confidential information and privacy. While other remedies are available to claimants in breach of confidence cases, an injunction preventing publication of the relevant information is often the only remedy that has any real value to the claimant. This Practice Note also covers anonymised injunctions, and both interim and final injunctions. There has been some controversy regarding injunctions relating to confidential information and privacy in recent years. ‘Super-injunctions,’ as they are commonly called, have been criticised in the media for fettering freedom of speech. However, much of this criticism stems from confusion as to what the term ‘super-injunction’ means and the impression that they are far more prevalent than is the case. This Practice Note deals with the general principles of obtaining an injunction in this area. For additional detail on injunctions for breaches of privacy, see Practice Notes: • Privacy law—misuse of private information • Misuse of private information and related claims • Privacy law—remedies • Practical and procedural matters in

All information: • on the register of title • held by the Registrar and referred to on the register of title • on the register of cautions against first registration, and • held by the Registrar in connection with an application made to Registrar is open to public inspection under the Land Registration Act 2002, s 66 (LRA 2002) (known as the general right of inspection) unless it is excepted under LRA 2002, s 66(2). How can information be kept confidential? The only reliable ways to prevent this information becoming public are: • to omit it from any document that has to be produced to HM Land Registry and include it instead in a collateral document or side letter • (so as to protect a party's identity) to consider using a nominee (though this will involve additional expense in setting up the nominee arrangement and recording its terms, and the nominee may charge a fee) • to protect the document (or the interest that it represents) by registration of a UN1: this is because a UN1

A receivables purchase facility where, prior to termination of the client's agency to collect receivables, the debtors are not given notice of the assignment of receivables to the receivables financier and the client is responsible for maintaining its sales ledgers and collecting the receivables as agent for the receivables financier.