International Comparative Legal Guide - Digital Business Laws and Regulations United Kingdom 2022

1. E-Commerce Regulations

1.1. What are the key e-commerce legal requirements that apply to B2B e-commerce in your jurisdiction (and which do not apply to non-e-commerce business)? Please include any requirements to register, as well as a summary of legal obligations specific to B2B e-commerce.

There are no specific requirements to register B2B e-commerce organisations in the UK.

Outside of registration requirements, the Platform to Business Regulation applies to providers of online search engines and providers of online intermediation services (which are based on a contract between the service provider and a business user, and allow business users to offer goods and services to consumers (examples include online e-commerce marketplaces)). The regulation contains transparency requirements for the online inter-mediation service provider and online search engines (such as availability of terms and conditions and the content of such terms and conditions). An aim of the regulation is to establish a fair, predictable, sustainable and trusted online business environment by enhancing transparency and redress obligations for business users of online platforms.

The E-Commerce Directive applies to information society services (namely ‘any service normally provided for remuneration, at a distance, by electronic means and at the individual request of a recipient of services’ ), and therefore may apply to both B2B and B2C e-commerce businesses. The E-Commerce Directive requires information society services to provide certain information to purchasers of the service before a contract is made, such as information about the identity of the information society service and the contractual process (for example, the steps involved in completing the contract online).

If an e-commerce business (whether B2B or B2C) provides services within the UK (as opposed to goods) the Provision of Services Regulations (‘PSRs’) will require applicable businesses to provide contact details and other information to customers as well as deal with customer complaints.

The Company, Limited Liability Partnership and Business (Names and Trading Disclosures) Regulations 2015 (SI 2015/17) require UK companies (both B2B and B2C) to disclose their registered name at various locations including their registered office and in communications (which includes its website). Companies are also required to disclose other key information in their business letters, order forms and on all websites of the company, including the part of the UK in which they are registered, their registered number, and their registered office address. UK general and limited partnerships are required to set out the name of each member of the partnership and address for service for each in various locations including invoices and receipts issued in the course of business.

The UK’s exit from the EU has only had a minor impact on the regulation of online platforms and how they deal with their consumer and business users; time will tell whether there will be future divergence between UK and EU law in this space.

1.2. What are the key e-commerce legal requirements that apply to B2C e-commerce in your jurisdiction (and which do not apply to non-e-commerce business)? Please include any requirements to register, as well as a summary of legal obligations specific to B2C e-commerce.

The Unfair Commercial Practices Directive (2005/29/EC) (‘UCPD’) was implemented in the UK by the Consumer Protection from Unfair Trading Regulations 2008 (SI 2008/1277). The UCPD enforces strict requirements on online platforms which trade with consumers, and prohibits such online platforms from using commercial practices which are misleading, aggressive or contrary to the requirements of professional diligence.

B2C e-commerce businesses must also comply with the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 (SI 2013/3134) (‘CCRs’) and the Consumer Rights Act 2015 (‘CRA’).

Under the CCRs, the business must provide certain pre-contract information, including delivery restrictions, means of payment accepted, the main characteristics of the goods, services or digital content, the identity of the trader and address and contact details. There may be overlap between the information requirements under the E-Commerce Regulations and those under the PSRs.

One of the main requirements under the CRA is that consumers, who have entered into a contract online, have the right to cancel the contract (or change their mind) without having to give a reason to do so.

B2C e-commerce businesses should also be mindful of the requirements of the UK GDPR and the Privacy and Electronic Communication Regulations, and that there may be sector-specific legal requirements, particularly in respect of those businesses in the consumer credit or financial services space.

2. Data Protection

2.1. How has the domestic law been developed in your jurisdiction in the last year?

The landscape of data protection law within the UK has shifted since the UK’s exit from the EU. The UK GDPR is now in force and is the retained EU law version of the General Data Protection Regulation 206/679 (‘EU GDPR’), which no longer applies within the UK.

Whilst the UK GDPR is substantially similar to the EU GDPR, we expect to see some divergence over the course of the next few years, noting, however, that any substantial divergence from the EU GDPR may affect the UK adequacy decision granted by the European Commission (which allows for the free flow of personal data from the EU to the UK without any additional safeguards).

A notable recent development in respect of the UK GDPR relates to one of the mechanisms for transfers of personal data outside of the UK. As of 21 March 2022, the International Data Transfer Agreement and the International Data Transfer Addendum to the European Commission’s standard contractual clauses for international data transfers came into force. These documents replace the previous standard contractual clauses and are to be used as one of the available appropriate safeguards if organisations are transferring personal data outside of the UK.

The UK Information Commissioner’s Office (‘ICO’) continues to release regulatory guidance to assist with organisations’ compliance with the UK GDPR.

2.2. What privacy challenges are organisations facing when it comes to fintech, retail, AI and digital health?

There are many privacy challenges which organisations face in these areas. Examples include ensuring the security of personal data and reacting to changes in privacy law (given the pace at which the regulatory space is evolving).

2.3. What support are the government and privacy regulators providing to organisations to facilitate the testing and development of fintech, retail, AI and digital health?

The ICO regularly produces guidance on different aspects of privacy compliance.

The ICO also provides a regulatory sandbox for organisations who intend to, or are in the process of, developing innovative products and services using personal data in the public interest, as well as the Innovation Hub, which helps innovators build privacy by design into their new products (the Innovation Hub’s current priority sectors include digital industries, financial services and health).

The UK government recently announced that The Alan Turing Institute, supported by the British Standards Institution and the National Physical Laboratory, will pilot a new UK government initiative to lead in shaping global technical standards for AI.

The UK government also announced it would partner with the UK National Health Service (‘NHS’), aiming to eradicate biases in AI; the NHS will trial a new approach to the ethical adoption of AI in healthcare via Algorithmic Impact Assessments.

3. Cybersecurity Framework

3.1. Please provide details of any cybersecurity frameworks applicable to e-commerce businesses.

E-commerce businesses should note that the UK’s legal approach to cybersecurity consists of a patchwork of different pieces of legislation. The two key legal frameworks to be aware of relate to privacy and cybersecurity.

The Data Protection Act 2018 (‘DPA 2018’) and the UK GDPR make up the UK’s privacy legislation, establishing rules for the processing of personal data and imposing strict penalties for data breaches. Cybersecurity aspects of the DPA 2018 and UK GDPR require data controllers to follow several data protection principles and ensure organisational accountability. The ICO also issues codes and guidance by which organisations should abide, and enforces UK data protection law.

The Network and Information Systems Regulations 2018 (SI 2018/506) (‘NIS Regulations’) impose additional cybersecurity and incident reporting obligations on ‘relevant digital service providers’, and certain e-commerce businesses will fall under this definition.

3.2. Please provide details of other cybersecurity legislation in your jurisdiction. If there is any, how is that enforced?

Other legislation that may be relevant for e-commerce businesses includes:

• the Communications Act 2003;
• the Computer Misuse Act 1990;
• the Investigatory Powers Act 2016;
• the Official Secrets Act 1989; and
• the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426).

Regulatory bodies (such as the aforementioned ICO) play a powerful role in many UK industries. E-commerce businesses operating in the finance or insurance sectors should note that they may need to comply with the Financial Conduct Authority (‘FCA’) Handbook and/or the Prudential Regulation Authority (‘PRA’) Rulebook, and organisations involved in advertising or broadcasting may come under the regulatory remit of Ofcom.

4. Cultural Norms

4.1. What are consumers’ attitudes towards e-commerce in your jurisdiction? Do consumers embrace e-commerce and new technologies or does a more cash-friendly consumer attitude still prevail?

Consumers based within the UK accept and embrace e-commerce to purchase goods and services. It is widely accepted that the COVID-19 pandemic has impacted consumers’ attitudes toward e-commerce, with many consumers favouring e-commerce as opposed to ‘high street’ shopping.

It has been reported that debit cards are the most used payment method in the UK. There is an expectation that the use of cash will continue to decline as a result of the COVID-19 pandemic, with many businesses opting for ‘card only’ payments.

4.2. Do any particular payment methods offer any cultural challenges within your jurisdiction? For example, is there a debit card culture, a direct debit culture, a cash on delivery-type culture?

As discussed above, there is a culture of card payments within the UK. Recently, there has also been an increase in ‘buy now pay later’ culture, with consumers electing to pay at a later date, or in instalments. These payment methods generally do not offer any cultural challenges within the UK. 144

4.3. Do home state retailer websites/e-commerce platforms perform better in other jurisdictions? If so, why?

From our research, there is no evidence to suggest UK-based websites/e-commerce platforms perform better in other jurisdictions.

4.4. Do e-commerce firms in your jurisdiction overcome language barriers to successfully sell products/services in other jurisdictions? If so, how and which markets do they typically target and what languages do e-commerce platforms support?

English is widely spoken in the UK. UK-based e-commerce firms benefit from the global use of the English language. On this basis, it appears that generally UK e-commerce firms do not focus on overcoming language barriers to successfully sell products/services in other jurisdictions.

4.5. Are there any particular web-interface design concepts that impact on consumers’ interactivity? For example, presentation style, imagery, logos, currencies supported, icons, graphical components, colours, language, flags, sounds, metaphors, etc.

There does not appear to be a common trend of particular web-interface design concepts that impact consumers’ interactivity in the UK. It is generally accepted that user-friendly designs are preferred; for example, having the ability to ‘auto-fill’ certain required customer information.

4.6. Has the COVID-19 pandemic had any lasting impact on these cultural norms?

As discussed above, the use of cash will continue to decline following the COVID-19 pandemic and consumers are now regularly turning to e-commerce to purchase goods and services.

5. Brand Enforcement Online

5.1 What is the process for online brand enforcement in your jurisdiction?

An e-commerce ‘brand’ may be made up of multiple overlapping elements, including copyright, goodwill, trade marks, domain names, and designs. Overall, brand protection is heavily associated with the enforcement of intellectual property (‘IP’) rights.

First, you need a right to enforce. Trade marks are one of the most important IP rights in the context of brand protection and a strong portfolio of registered rights is essential. Trade marks are defined by the Trade Marks Act 1994 as signs capable of distinguishing the goods or services of one business from those of another. Brand owners may also be able to rely on passing off (which protects goodwill), copyright, design rights, and registered domain names, depending on the circumstances. Some IP rights arise automatically (e.g. copyright, unregistered design rights) but others require registration (such as trade marks and domain names). Licences or other actions in relation to rights may also need to be registered.

The IP rights in an e-commerce brand can be enforced in a number of ways, taking advantage of both legal and practical options (separately or concurrently) depending on the nature of the infringement and infringer (e.g. counterfeiter, social media impersonator, copyright pirate, cyber-squatter, or copycat website).

Practical actions

• Monitor e-commerce platforms, social media, and other websites for potential infringement, either yourself or through a brand monitoring service.
• Engage infringers with cease-and-desist correspondence (either yourself or through lawyers), bearing in mind any applicable laws governing the making of threats in relation to IP rights (particularly trade marks).
• Educate customers to recognise legitimate goods and services from fake ones.
• Make a takedown request to the relevant platform – mainstream online marketplaces and social media sites typically have dedicated forms for reporting IP infringement. Online platforms are not courts: they may set their own IP policies and apply them with total discretion, with some being more helpful than others.
• Legal actions
• Submit a domain name complaint to the relevant body (Nominet for .uk domains) under its dispute resolution procedure.
• Issue formal legal proceedings. The main objective of an IP infringement claim is usually obtaining an injunction to prevent the infringement from continuing (and/or for the delivery up and destruction of infringing goods), with the award of damages or an account of profits playing a secondary role (but not always). Injunctions can also be sought on an interim basis to stop harmful activity prior to a full trial.

5.2. Are there any restrictions that have an impact on online brand enforcement in your jurisdiction?

The UK is a reliable jurisdiction for brands seeking to protect and enforce their IP rights. Given the cross-border nature of e-commerce, difficulties in enforcing IP rights are in practice more likely to arise where UK-targeted infringement is conducted by an actor based outside the UK. This is particularly true if an infringing website is hosted by a registrar based in a jurisdiction that offers weaker IP protection.

As a result of the UK GDPR it is now more difficult to identify the personal details of the owner of a potentially infringing website (known as ‘WHO IS’ data). This is because mainstream WHO IS search providers mask registrants’ names and addresses due to privacy concerns. In the case of .uk domains, brand owners seeking WHO IS data must make a Data Release Request to Nominet.

Brands should be aware of the impact of Brexit on IP rights in the UK and EU. Whilst copyright and patents have largely been unaffected, since 1 January 2021 new EU trade marks and registered designs no longer offer protection in the UK. However, all registered EU trade marks and designs as at 1 January 2021 have been cloned into UK equivalents, preserving their UK protection. The UK has also offered automatic continued protection for unregistered community design rights and introduced a new right called the ‘supplementary unregistered design’.

Brands should also familiarise themselves with the UK’s legislation governing the making of ‘groundless threats’ of infringement proceedings by owners of various IP rights, including trade marks, patents, and certain design rights. The Intellectual Property (Unjustified Threats) Act 2017 offers protection against such threats and can trigger liability for parties that make them.

Finally, if relying on an online marketplace complaint, it is essential to demonstrate that your rights as an e-commerce brand have been infringed. The claim is then assessed, but it is up to the marketplace as to whether they find your evidence compelling and consequently the infringing product may remain on sale. Some marketplaces also do not recognise specific types of infringement, including those involving certain product information storage mechanisms (such as barcodes) as they are not considered to be capable of intellectual property protection.

6. Data Centres and Cloud Location

6.1. What are the legal considerations and risks in your jurisdiction when contracting with third party-owned data centres or cloud providers?

When contracting with third party-owned data centre or cloud providers, it is crucial to ensure a review of the contractual terms and conditions to identify the risks. It may be possible, dependent on the parties’ bargaining power, to enter into negotiations with the third party-owned data centre or cloud provider to resolve some of those identified key risks. The key legal risks to look out for when reviewing such agreements in the UK, include:

• Reviewing the data protection provisions to consider whether such provisions are sufficient and compliant with UK data protection legislation, particularly where the data centre or cloud provider:
• resides outside the UK, and therefore appropriate safeguards must be in place to transfer personal data outside the UK; and
• is undertaking data-processing activities, and therefore the mandatory provisions required by Article 28 of the UK GDPR, for controller-to-processor relationships, are included.
• Reviewing the data centre or cloud provider’s performance obligations to ensure they are appropriate for the services being provided. The performance obligations are often set out by way of service levels. Arguably service levels are the most important provisions of the agreement, given that they set the tone for the level of service to be provided.
• Reviewing the available remedies for service failures by the data centre or cloud provider. Reluctantly data centre or cloud providers may offer service credits for service failures, a financial mechanism to re-coup monies for a failure to achieve the agreed service levels. It is important to pay particular attention where the data centre or cloud provider tries to make the service credits the sole remedy for service failures. Service failure may cause significant disruption and loss to its customers, and therefore consideration as to whether the service credit mechanism sufficiently compensates the customer is vital.
• Reviewing the limitation of liability provisions. It is often market standard that the data centre or cloud provider will limit its liability to 100% to 150% of charges paid or payable by the customer. This is typically market-standard in the UK; however, dependent on the criticality of the data centre or cloud services, the user should consider whether such liability cap is sufficient should there be a requirement to recover losses from the provider. Digital businesses are heavily reliant on data centre or cloud providers, and therefore should pay particular attention to the liability caps.
• Reviewing provisions relating to termination assistance by the data centre or cloud provider. There are risks when it comes to an expiry or termination of an agreement with a data centre or cloud provider. The customer must ensure the appropriate provisions are included for termination assistance, meaning the provider will assist during the transition of the services to an alternative provider. It is crucial to ensure a smooth transition between providers, reducing the chances of business interruption.

6.2. Are there any requirements in your jurisdiction for servers/data centres to be located in that jurisdiction?

When contracting with a third party-owned data centre or cloud provider, one of the key legal considerations is the location of the personal data. The UK GDPR and DPA 2018 set out certain requirements with regard to transferring personal data outside the UK.

The UK GDPR and DPA 2018 do not prevent personal data from being transferred outside of the UK; however, there are imposed restrictions on the transfer (or onward transfer) of personal data outside the UK. There are two main mechanisms for transferring personal data outside the UK:

• An adequacy decision under Article 45 of UK GDPR.
• Appropriate safeguards such as standard contractual clauses or binding corporate rules (on condition that enforceable data subject rights and effective legal remedies for data subjects are available).

The benefit of having a data centre in the UK is avoiding the pitfalls of international data transfers under the UK GDPR.

7. Trade and Customs

7.1. What, if any, are the technologies being adopted by private enterprises and government border agencies to digitalise international (cross-border) trade in your jurisdiction?

For around 25 years, the UK has used the Customs Handling of Import and Export Freight (‘CHIEF’) system to facilitate cross-border trade, and is currently transitioning to the Customs Declaration Service (‘CDS’), which is reported to be a more secure and stable platform with increased capacity. The transition to CDS is expected to be fully complete by 30 September 2022 for import declarations and 31 March 2023 for export declarations.

Both CHIEF and CDS digitalise cross-border trade into and out of the UK, recording the movement of goods by land, air and sea, allowing importers and exporters to electronically complete customs forms and automatically check for entry errors.

7.2. What do you consider are the significant barriers to successful adoption of digital technologies for trade facilitation and how might these be addressed going forward?

In the UK, one of the challenges will be the capability of CHIEF and/or CDS to deal with the ongoing effects of Brexit and the increased volume of customs applications following the UK departing from the European Union single market.

8.Tax Treatment for Digital Businesses

8.1. Please give a brief description of any tax incentives of particular relevance to digital businesses in your jurisdiction. These could include investment reliefs, research and development credits and/or beneficial tax rules relating to intellectual property.

The UK has a number of incentives and reliefs available for use by digital business and investors in digital business to reduce their tax charge.

R&D tax reliefs are available for UK companies that meet strict criteria around investing in innovation. The key qualification for relief is that the company incurs expenditure on a specific project seeking to make an advance in science or technology. The reliefs available depend on the size of the business. An SME may claim the ‘enhanced expenditure deduction’ which gives an additional 130% of R&D expenditure to set against their profit, and they may also claim an R&D tax credit if the company is loss making. Large companies can claim the R&D expenditure credit (‘RDEC’), which amounts to 13% of the company’s qualifying R&D expenditure (if incurred after 1 April 2020). The autumn budget 2021 emphasised the UK government’s focus on R&D, and extended the scope of qualifying expenditure to include expenditure on data and cloud computing – from April 2023, cloud computing costs directly associated with R&D (including storage) will qualify for relief.

The patent box is intended to be an incentive for companies to retain and commercialise intellectual property in the UK. Companies that commercially exploit patented inventions can elect to benefit from a lower rate of corporation tax on certain profits arising from this (at the time of writing, the rate is 10%). The company must own or have exclusively licensed-in the patents, and have undertaken qualifying development on them.

There are two main schemes that are intended to encourage equity investment in high-risk companies by offering income tax and capital gains tax reliefs to investors in the early years of trading.

• The seed enterprise investment scheme (‘SEIS’) is for companies that are fewer than two years old (and meet extensive conditions, including in relation to employee numbers and gross assets). It offers tax reliefs to individual investors who buy new shares in a company established in the UK that carries out a qualifying trade. A company can receive a maximum of £150,000 from SEIS investments.
• The enterprise investment scheme (‘EIS’) is generally for companies that are within seven years of their first commercial sale (or 10 years for knowledge intensive companies). Companies can raise up to £5 million under the EIS each year (up to a maximum of £12 million in their lifetime, with a higher limit of £20 million for knowledge-intensive companies). As for the SEIS, various conditions must be met in order for a company and an investor to qualify for the EIS.

Investors may also get similar tax relief by investing in a venture capital trust, which in turn invests in small, unquoted trading companies.

8.2. What areas or points of tax law do you think are most likely to lead to disputes between digital businesses and the tax authorities, either domestically or cross-border?

The pandemic has accelerated many businesses’ digital capabilities, but the pace of ‘going digital’ for non-digital companies may bring about unfamiliar tax territory and, as a result, potentially more disputed tax. For example, businesses may find that their dealings with intangible property have increased and that they therefore need to understand the associated tax regime.

Advances in or new uses of technology may result in tax disputes where they are not adequately covered by existing tax legislation or HMRC guidance. The use of crypto assets is currently one such area.

The OECD’s multijurisdictional two-pillar solution is intended to address tax challenges arising from the digitalisation of the economy and is due to be implemented in 2023. This will inevitably pose challenges, particularly around interpretation and application alongside double tax treaties.

As an interim measure pending the implementation of a multijurisdictional approach, from April 2020, the UK government introduced a 2% tax on the revenues of search engines, social media services and online marketplaces which derive value from UK users. This applies only to businesses with group worldwide revenues of more than £500 million from relevant activities, with more than £25 million of these revenues being derived from UK users. Since this tax is novel and potentially complex, this could be an area which leads to disputes for companies within its scope.

HMRC is currently consulting on introducing a new online sales tax for online businesses, with the aim of funding a reduction in business rates for physical retail premises. The consultation documents outline potential issues with introducing such a tax, in particular the difficulty in distinguishing between online and offline business activity as retailers now offer a plethora of ordering services and fulfilment methods. This could potentially cause disputes around interpretation and application of any new rules if implemented.

9. Employment Law Implications for an Agile Workforce

9.1. What legal and practical considerations should businesses take into account when deciding on the best way of resourcing work in your jurisdiction? In particular, please describe the advantages and disadvantages of the available employment status models.

Employment status has been a hot topic in the UK in recent years as many businesses, particularly those in the digital arena, have implemented operating models that are moving away from more traditional employment arrangements.

For employment law purposes (as opposed to tax purposes) there are three categories of employment status:

• employee;
• worker; or
• self-employed individual.

Individual and collective employment rights will depend on employment status, with those who are employees enjoying most protection.

Workers and employees both benefit from a number of core rights, such as entitlements to the national minimum wage, paid holiday and protection against discrimination. Employees also enjoy additional rights and protections including a right not to be unfairly dismissed, entitlements to family leave and the right to a redundancy payment. Self-employed individuals do not usually have employment rights but enjoy more autonomy and flexibility than workers and employees.

A desire for increased flexibility on the part of both businesses and individuals combined with developments in technology has led to new ways of operating emerging. In particular, the gig economy, which sees businesses contract with individuals on a gig-by-gig basis, typically via an app or other digital platform, has expanded significantly and more employers across a range of sectors are looking at how they can take advantage of this model.

As a result of this shift, there has been an increase in claims relating to employment status. Individuals engaged as gig or on-demand workers have challenged their employment status arguing that they are workers, rather than self-employed. Many of these claims have been prompted by individuals seeking to establish their rights to the national minimum wage and/or paid holiday. A trade union, the Independent Workers’ Union of Great Britain, has also been established in response and has backed a number of these claims.

Although on occasion the courts have rejected claims (for example, where an individual is genuinely free to provide a substitute to do the work in their place), in a number of high-profile decisions the courts have held that the individuals are workers despite written contracts stating that they are self-employed. The courts have made it clear that when making their decision they will look beyond what the contract says and will also analyse how the arrangements work on the ground.

If you are looking to implement an operating model where individuals are less likely to be viewed as workers or employees, you will need to look closely not just at what the contractual terms say but also at how the arrangements work in practice. Factors to consider include (but are not limited to) the extent to which you can minimise control over what the individual does, whether an individual can send a substitute in their place, and what the consequences are if an individual turns down an offer of work.

9.2. Are there any specific regulations in place in your jurisdiction relating to carrying out work away from an organisation’s physical premises?

The pandemic has given rise to a ‘work from anywhere’ mindset, with employees often now working from home or away from the physical workplace as a matter of course. However, what employers may not appreciate, is that where you have employees working from home or otherwise away from your workplace, your legal obligations as their employer continue to apply.

For example, you remain responsible for the employee’s health and safety. This means you need to carry out risk assessments for those employees in the same way that you would for those working in your physical workplace. Some employers have used online questionnaires to assess their employees’ homeworking arrangements. Make sure you consider both the employees’ physical health (including providing appropriate equipment and ergonomic supports) and their mental health and wellbeing. Be sure to engage with those who work from home and consider what arrangements can be made to avoid them becoming isolated or overworked – do not forget the Working Time Regulations (including protections allowing rest breaks) continue to apply.

Homeworking and working away from site can make it more complex when it comes to keeping confidential information and personal data secure. Where you have an agile workforce, review the arrangements you have in place for confidential information and IT security – do employees understand your security requirements? Are they able to lock away confidential information and do they have equipment/workspace to allow them to make confidential work calls without being overheard? Some employers have introduced monitoring technology to review productivity levels for homeworkers, which can have privacy implications. Linked to these issues is data protection and the need to comply with your legal obligations under the UK GDPR on processing and storing personal data.

Employers will also need to check that their insurance policies cover the new working arrangements and cover their agile workforce.

9.3. What long-term effects or changes are likely to result from the COVID-19 pandemic?

The impact of the pandemic and, in particular, the immediate requirement for businesses to facilitate home-working, has led to a (probably) irreversible shift in how and where people work.

The prospect of ‘working from anywhere’ is attractive – a whole range of new opportunities open up to the individual and employers have a wider talent pool to choose from. Indeed the pandemic saw many employees relocating and, in some cases, moving abroad whilst continuing to work for their UK employer. As we start to live with COVID-19, the practicality of these arrangements may need to be evaluated and expectations aligned. Who will pay the travel expenses for a workplace visit and how often will you expect to see the employee in person? Having an employee working for you from abroad on a long-term basis can also give rise to tax and social security liabilities in the host country, so take advice before agreeing to make arrangements permanent.

Looking ahead, for employers looking to attract the best people, flexibility is key. Want someone in the office full-time? Beware the competitor prepared to offer home-working as permanent. That is not to say the office is doomed, the physical workplace still plays an important role. Opportunities for active knowledge-sharing, in-person team-working and a sense of collegiality remain highly valued, so offering a mix of remote and in-person working arrangements, where possible, is a sensible move.

Businesses operating on a hybrid basis are working to a range of models – some are prescriptive, stipulating how many and which days people need to be in the workplace, whilst others are more fluid. Bear in mind, however, that some individuals, including those with caring responsibilities, may need a degree of predictability in their arrangements. You may see an increase in flexible working requests as a means of securing that certainty.

If your employees are working remotely for much or all of the time, you may need to adapt how you manage them. Those working remotely should feel equally ‘seen’ as those who come into work. Schedule regular 1-to-1s and check in between calls. More junior and/or new recruits may welcome having a ‘buddy’.

The long-term effects arising from the pandemic on our ways of working are potentially seismic. Employers who look to embrace these new ways of working are likely to find their efforts rewarded.

10. Top ‘Flags’ for Doing Business as a Digital Business in Different Jurisdictions

10.1. What are the key legal barriers faced by a digital business operating in your jurisdiction?

In recent years, cybersecurity has been creeping its way to the top of board agendas, and the Department for Digital, Culture, Media and Sport (DCMS) revealed the frequency of cyber-at-tacks in 2022 remains at the levels witnessed in 2021. Digital businesses are being urged to strengthen their cybersecurity practices and statistics show that 82% of senior managers in UK businesses now see cybersecurity as a ‘very high’ or ‘fairly high’ priority, which is up from 77% in 2021.

The challenge faced by the UK government is the ability to reform/introduce regulations to keep pace with the speed in which digital technology develops. The challenge is to ensure, despite the ability to develop digital technologies at a pace greater than regulatory reform, that the technologies developed protect society and uphold the fundamental rights of UK citizens.

10.2. Are there any notable advantages for a digital business operating in your jurisdiction?

Digital technology is the driving force in the UK’s economy. It is reported that 2021 was the best year for the UK tech sector, with £26 billion in venture capital investments, the number of UK tech unicorns climbed to 116, and record London listing and more jobs. London is not the only location in the UK, and research has shown that the regions including Cambridge, Manchester, Edinburgh and Cardiff have all seen successful growth. This growth is a notable advantage for digital tech businesses wishing to operate in the UK.

The UK government recently introduced the UK’s world-leading National AI Strategy. The purpose of the strategy is to ensure that UK businesses remain at the forefront of AI. It is keen to ensure the UK gets the national and international governance of AI technologies right in order to encourage innovation and investment. The UK government’s National AI Strategy demonstrates the commitment to the technology sector, which is a notable advantage to those digital tech businesses within the UK.

An area of concern for many businesses is the ever-growing regulatory compliance requirements such as the UK GDPR, DPA 2018 and the NIS Regulations. However, now that the UK has exited the EU, the UK government expressed the opportunity to build on the UK’s world-leading regulatory regimes by taking a pro-innovation approach to regulating, and in certain circumstances de-regulating, digital technologies. This pro-innovation approach taken by the UK government is one that is welcomed by digital businesses and certainly an advantage for digital business.

10.3. What are the key areas of focus by the regulator in your territory in respect of those operating digital business in your territory?

The UK government is aiming to strengthen critical businesses’ cyber-resilience by updating the NIS Regulations, which sets out cybersecurity rules for essential services such as water, energy, transport, healthcare and digital infrastructure.

The proposed update to the NIS Regulations will include:

• added powers to the UK Cyber Security Council to raise the bar and create a set of agreed qualifications and certifications so those working in cybersecurity can prove they are properly equipped to protect businesses online;
• widen the list of companies in scope to include Managed Service Providers (‘MSPs’), which provide specialised online and digital services. MSPs include security services, workplace services and IT outsourcing; and
• increased cyber-incident reporting requirements to regulators such as Ofcom, Ofgem and the ICO, including a requirement to notify regulators of all cybersecurity attacks suffered.
• The UK government published the Plan for Digital Regulation, setting out the approach to be taken when regulating technologies in the UK. It aims to adopt an agile and proportionate approach, removing unnecessary regulatory burdens on digital businesses and offering confidence to digital businesses and consumers. The key areas of focus are:
• the accumulation, processing and portability of personal data;
• oversight, accountability and verification of digital content;
• transparency and use of advanced data analytics and algorithms;
• scale, scope and network effects of digital businesses;
• the relative ease and anonymity of disruption to digital services;
• the global nature of data and digital; and
• the critical role of digital infrastructure and networks.

The introduction of a Digital Markets Unit (‘DMU’) within the Competition and Markets Authority in April 2021 was in response to the market dominance of few key tech companies, which leads to fewer opportunities for start-up and scale-up digital businesses. The DMU is tasked to begin work to operationalise the future pro-competition regime for digital markets, promoting greater competition and innovation.

11. Online Payments

11.1. What regulations, if any, apply to the online payment sector in your jurisdiction?

The main legislation in the UK governing payments are:

• the Payment Services Regulations 2017 (SI 2017/52) (‘PSRs 2017’); and
• the Electronic Money Regulations 2011 (‘EMRs 2011’).

The FCA and the Payment Services Regulator play important roles under the PSRs 2017 and EMRs 2011. Digital businesses that are considering offering online payments will also need to consider other legislation as well as parts of the FCA Handbook.

The PSRs 2017 apply to Payment Service Providers, which is anyone who provides a payment service (including online payments) as a ‘regular occupation or business activity in the UK’.

Under the PSRs 2017 there is an established list of firms that are either authorised or registered. Whether a firm is authorised or registered will determine how the FCA regulates and scrutinises such firm. An authorised firm will receive more scrutiny from the FCA than that of a registered firm. It will ultimately depend on the activity and facts as to whether a digital business providing online payment services will be authorised or registered.

The FCA sets out in its Payment Services and Electronic Money Approach Document which firms will require authorisation or registration for payment services activities, which are as follows:

• payment initiation service providers;
• account information service providers;
• merchant acquiring firms;
• non-bank credit card issuers;
• certain electronic communication network operators offering payment services; and
• money remitters.

Part 2 of Schedule 1 of the PSRs 2017 sets out a lengthy list of activities that do not constitute payment services. As a starting point, digital businesses should review the (non-exhaustive) list of services to consider whether its services will likely fall under the governance of the PSRs 2017.

In the event that a digital business is providing electronic money (e-money) payment services, then the EMRs 2011 will apply. The EMRs 2011 govern the authorisation and associated requirements for electronic money institutions (‘EMIs’). The EMRs 2011 also set the conduct of business rules for issuing e-money.

EMIs are required to be either authorised or registered with the FCA and to comply with the rules on issuing e-money and carrying on payment services.

The EMRs 2011 set out, amongst other things, the:

• definition of e-money;
• firms that must be authorised or registered with the FCA for issuing e-money;
• standards to be met by EMIs;
• capital requirements and safeguarding requirements of EMIs;
• rules on issuing and redeeming e-money; and
• the FCA’s power and function relating to the EMRs 2011 and issuing of e-money.

In addition to complying with the PSRs 2017 and EMRs 2011, the legislative requirements and the FCA Handbook should be taken into account.

11.2. What are the key legal issues for online payment providers in your jurisdiction to consider?

In recognition of the payment landscape dramatically changing since the introduction of the open banking framework and to prioritise making payments safe and accessible as outlined in the FCA 2021/22 Business Plan, the FCA published a policy statement (PS21/19).

The policy statement set out amendments to the UK Regulatory Technical Standards on Strong Customer Authentication and Secure Communications (UK SCA-RTS), and the Payment Services and Electronic Money Approach Document. The amendments to these documents were as a result of the FCA’s consultation on open finance.

The consultation identified two main barriers to the development of open banking:

• the requirement for customers to re-authenticate with their Account Servicing Payment Service Provider (‘ASPSP’) every 90 days to continue accessing account information through a Third-Party Provider (‘TPP’); and
• use of existing customer interfaces that are not specifically designed for TPPs to access customer account information.
• The amendments to the UK SCA-RTS include:
• creating a new UK SCA-RTS exemption in Article 10A so that customers do not need to re-authenticate with their ASPSP every 90 days when accessing their account information through a TPP;
• requiring certain ASPSPs to provide dedicated interfaces to enable TPP access to customer account information for retail and SME payment accounts;
• amending requirements on providing interface technical specifications, testing interfaces and fallback interfaces by ASPSPs; and
• allowing ASPSPs with a deemed authorisation under the Temporary Permissions Regime to rely on an exemption from setting up a fallback interface granted by a competent authority in the EU.

The FCA in its 2021/22 Business Plan identified the payment sector as a priority for the next three years. Online payment providers will need to keep abreast with regard to future consultations, and likely changes to the guidance and regulatory framework. The FCA over the next three years will attempt to ensure:

• consumers transact safety with payment providers;
• payment firms meet their regulatory obligations while competing on quality and value; and
• access for consumers and businesses to a variety of payment services.

12. Digital and the Green Economy

12.1. With the current global emphasis on the environment and sustainability, is there any current or anticipated legislation in that area which is likely to impact digital business in your jurisdiction?

The UK government set an ambitious target to reach net-zero carbon by 2050 under the Climate Change Act 2008. To achieve the net-zero carbon target by 2050, the UK government will be introducing new, and tightening existing, regulations.

The EU and UK trade and co-operation agreement contains commitments that the EU and UK will not regress on the levels of environment and climate protections that were in place at the end of the transition period, and that both the EU and UK will implement the United Nations 2030 Agenda and the United Nations Sustainable Developments Goals.

The financial services sector includes many digital businesses and is a big focus for the UK government in order to achieve its net-zero target by 2050. The UK government and regulators are taking significant measures to reform sustainable finance to ensure the UK becomes a net-zero financial centre, and such measures will, in due course, extend beyond the financial services sector.

The UK government published a policy paper on Greening Finance: A Roadmap to Sustainable Investing. The policy paper published in October 2021 sets out three phases to ensure the financial system is sustainable:

• Phase 1: Informing – ensuring information on environmental sustainability is available for corporates and consumers. This will be achieved through the introduction of Sustainability Reporting Disclosures (‘SDRs’).
• Phase 2: Acting – mainstreaming the information on environmental sustainability in business and financial decisions, in order to help businesses with risk management.
• Phase 3: Shifting – ensuring financial flows across the economy shifting to align with a net-zero UK and nature-positive economy.

The SDRs regime aims to create a framework for disclosures on sustainability. The purpose of the SDRs is to ensure sustainability information flows from business to the financial sector, and into financial products that will allow investors and consumers to make informed decision on financial products.

It is not entirely clear exactly which corporates will be required to comply with the SDRs regime, but it will likely include UK-listed companies and UK-registered companies. The scope and timing of requirements for companies, and the reporting details, will be determined following consultation.

12.2. Are there any incentives for digital businesses to become ‘greener’?

There are great business opportunities where digital business can develop digital products and services that are environmentally friendly and sustainable. UK government incentives may also provide opportunities in new sectors such as cleantech and renewable energy.

12.3. What do you see as the environmental and sustainability challenges facing digital businesses?

The environment and sustainability is certainly an area of focus and it is increasingly important for digital business to ensure sustainability is at the forefront of their behaviours and decision-making. It is likely that legislation and onerous reporting requirements will filter down and apply to less high-energy-consumption organisations.

The severity of environmental and sustainability risks from climate change has grown exponentially over the years. The increased focus by the UK government, businesses and consumers on environmental and sustainability have caused numerous challenges for digital business.

In-scope public sector bodies are required by the Procurement Policy Note 06/21, when procuring goods or services or works with an anticipated contract value of £5 million per annum, to include a selection criterion that bidding vendors provide a carbon reduction plan confirming their commitments to achieving net zero by 2050. Digital businesses can prepare by taking meaningful steps and holding themselves accountable to a net-zero strategy. Failure to acknowledge and take action regarding environmental and sustainability may result in the inability to take part in lucrative public procurement opportunities.

This article was first published in ICLG - Digital Business. Please click here to view the full guide.

Disclaimer

This chapter is for general information purposes only. It does not purport to provide comprehensive full legal or other advice. The contributors accept no responsibility for losses that may arise from reliance upon information contained in this publication. This chapter is intended to give an indication of legal issues upon which you may need advice. Full legal advice should be taken from a qualified professional when dealing with specific situations.