This week’s edition of Information Law weekly highlights includes a hand-picked summary of news analysis, updates and new content related to laws governing the use and dissemination of information and personal data. Each week these highlights focus on developments in key topics such as data protection, ePrivacy, cybersecurity, breach of confidence, misuse of private information, and defamation.

Welcome to this week’s edition of the Information Law weekly highlights: a hand-picked summary of news analysis, updates and new content related to laws governing the use and dissemination of information and personal data. Each week these highlights focus on developments in key topics such as data protection, ePrivacy, cybersecurity, breach of confidence, misuse of private information, and defamation. This special edition of the weekly highlights also includes a recap on the yearly highlights of 2024 and key topics to look out for in 2025.

This week’s edition of Information Law weekly highlights includes a hand-picked summary of news analysis, updates and new content related to laws governing the use and dissemination of information and personal data. Each week these highlights focus on developments in key topics such as data protection, ePrivacy, cybersecurity, breach of confidence, misuse of private information, and defamation.

Welcome to this week’s edition of the Information Law weekly highlights: a hand-picked summary of news analysis, updates and new content related to laws governing the use and dissemination of information and personal data. These highlights focus on key topics including data protection, ePrivacy, cybersecurity, breach of confidence, misuse of private information, and defamation.

Welcome to this week’s edition of the Information Law weekly highlights: a hand-picked summary of news analysis, updates and new content related to laws governing the use and dissemination of information and personal data. Each week these highlights focus on developments in key topics such as data protection, ePrivacy, cybersecurity, breach of confidence, misuse of private information, and defamation.

ARCHIVED: This Practice Note has been archived and is not maintained. This Practice Note tracks key developments and guidance specifically related to Brexit and the Information Law sector. It is divided into the following sections: • Data protection • ePrivacy • Databases • Cybersecurity • Public sector information • State security and intelligence This note does not track general Brexit developments, for which see Practice Note: Brexit timeline. To track the progress of UK legislation introduced as part of the legislative preparation for the UK’s withdrawal from the EU, see Practice Note: Brexit legislation tracker. On 31 January 2020 (exit day), the UK ceased to be an EU Member State and lost its entitlement to participate in the political institutions and governance structures of the EU. In accordance with the transitional arrangements provided in Part 4 of the Withdrawal Agreement, exit day marked the commencement of an 11-month implementation period during which the UK was treated by the EU as a Member State for many purposes. The implementation period ran until 11 pm on

This Practice Note is a horizon scanner tracking key future developments in the fields of data protection, ePrivacy, cyber security, confidential information, and misuse of private information in the UK. It provides details of key dates for your diary (including forecasted dates where the actual date is unknown) and relevant commentary in relation to: • Information Law—horizon scanner — Legislation ◦ Bills in progress ◦ Acts not in force, partially in force or subject to staged introduction • Information Law—horizon scanner — Key case appeals to the Supreme Court • Information Law—horizon scanner — Consultations and calls for evidence • Information Law—horizon scanner — Other key developments This horizon scanner does not cover past developments, such as legislation fully in force or final judgments. For details of past developments in the field of Information Law in the UK, see Practice Notes: • Data protection, privacy and confidential information case law tracker • Compensation claims by data subjects under UK data protection laws—key case tracker • UK GDPR enforcement by the Information Commission’s Office—tracker • PECR 2003

Information Law analysis: This News Analysis provides a round-up of key developments in the field of Information Law in England & Wales and at supranational EU level in 2025 and looks ahead to what’s coming up in 2026. This edition focusses on confidential information, data protection and eprivacy, cybersecurity, reputation management, public sector information and state security and intelligence.

FORTHCOMING CHANGE: On 19 June 2025, the Data (Use and Access) Bill received Royal Assent, becoming the Data (Use and Access) Act 2025 (DUAA 2025) and coming partly into force on that date. Parts 5 and 6 serve to amend aspects of data protection and ePrivacy law in the UK, including the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003, SI 2003/2426. Certain provisions of DUAA 2025, concerning matters such as responding to data subject access requests and the conferring of power to make further regulations, came into force immediately on 19 June 2025. Other provisions, concerning notices from the Information Commission and some aspects of law enforcement processing, come into effect on 19 August 2025 (being two months from the date of Royal Assent). The majority of DUAA 2025’s provisions require further regulations (in the form of statutory instruments) to be made to bring them into force. For further information on DUAA 2025 generally, see Practice

Confidential Important Notice Memorandum No. [________] provided to [_____________________]. This Information Memorandum has been prepared by [insert name of seller] (the Seller) with the assistance of [insert name of financial adviser] [(the Financial Adviser)] in connection with a possible disposal by the Seller of [insert description of the business or assets to be sold, eg 'the business of XYZ Ltd' or, in the case of a sale of a company, 'the issued share capital of XYZ Ltd'] (the Proposed Transaction). It is being delivered for information purposes only to a limited number of prospective buyers (each a Recipient) for the sole purpose of assisting them in deciding whether they wish to proceed with a further investigation of [XYZ Ltd]. This document is not intended to form the basis of an investment decision or a decision to enter into any transaction with the Seller. Neither this information nor its delivery to any prospective buyer will or is intended to constitute or form part of any offer to sell or solicitation of any offer to buy any securities of [XYZ Ltd]

1 Background information Name of[ prospective] supplier [To be completed by customer] Address [To be completed by customer] Brief description of services[ to be] supplied [To be completed by customer] Date questionnaire completed by[ prospective] supplier [To be completed by customer] Signature of authorised representative of[ prospective] supplier [To be completed by supplier/third party] Name of authorised representative [To be completed by supplier/third party] 2 Governance Who is ultimately responsible within your organisation for information and cybersecurity management? [To be completed by supplier/third party] When did the board last consider information security, cybersecurity and cybercrime risk? [To be completed by supplier/third party] 3 Security policies and procedures Do you have an information security and/or cybersecurity policy?If yes, please provide a copy ☐ Yes☐ No Please describe your arrangements for ensuring physical security of your premises and processing areas, including physical entry controls (if any) [To be completed by supplier/third party] Please describe your arrangements for equipment security and maintenance [To be completed by supplier/third party] Please describe your arrangements for password and access controls, including whether:—you enforce a password policy that is in line with recognised good practice—all staff and contractors are assigned individual accounts to log onto the organisation’s IT systems—you enforce the use of multi-factor

Restructuring & Insolvency analysis: The High Court granted an application for pre-action disclosure against Kroll Trustee Services Ltd (Kroll), which had acted as security agent and trustee under an intercreditor agreement (ICA) governing c.€650m of Hurtigruten Group debt. The applicants sought various documents in support of their intended challenge to a restructuring of the Group implemented via a distressed disposal under the terms of the ICA. The court held that the threshold requirements for pre-action disclosure were satisfied, and that disclosure of the relevant documents should not be withheld merely because the applicants had contractual rights to those documents or because the documents may be confidential to the security agent and members of the ad hoc group. This decision will be of considerable interest to restructuring and insolvency lawyers, including because it acknowledges the information asymmetries which may exist in contested restructurings, and the role pre-action disclosure can play in addressing such asymmetries. Written by Yasseen Gailani, partner, and Gregory Loukaitis, associate, at Quinn Emanuel Urquhart & Sullivan UK LLP.