Abstract Perhaps one of the great ironies of one’s legal practice is that one becomes a better lawyer from learning from the mistakes of others. In many cases, we can gather those learnings from reviewing secondary sources such as articles, while in others we may be fortunate enough to have the actual pleadings be publicly available. In the case of Capita Group, the regulator made a deal: agree to admit to liability, and not object to the publication of the details of our enforcement action against you, and we will significantly reduce the penalty (from £58 million, to £14 million). The result was the publication of this Penalty Notice, together with all the gory details of the offence. However, it also raises difficult questions about the fairness of this Penalty Notice. On its face, the details of the source of the concern were clear. In short, a high-priority alert was raised within minutes of a security breach at Capita Group, and yet the compromised device remained connected to the network for nearly 58 hours. The Capita incident unfolded as a cascading five (5) stage cyberattack that moved from initial compromise, to privilege escalation, to lateral movement, to large-scale data exfiltration, and ultimately to ransomware deployment (II.3.). The UK regulator treated the case as a stark example of how security failures are often not the product of a single missed control, but of layered governance, monitoring, and response deficiencies that together magnify the scale of harm. The resulting settlement (II.7.), including the £14 million penalty and admissions of liability by the provider Capita entities, is therefore more than a significant enforcement outcome: it is a warning that known vulnerabilities, under-resourced security operations, and delayed containment can transform an initial, mundane intrusion into a crisis affecting millions of individuals. After a brief review of the Background (I.), the article provides a detailed review of the Facts (II.) and the ICO Penalty Notice (III.) and elaborates with a detailed Critique of the Commissioner’s Rationale (IV.) leading to six key Lessons Learned (V.).
Abstract The article examines the obligation to prepare technical documentation under the GDPR, the CRA, and the AI Act, conducts a comparative analysis to explore synergies, overlaps, and divergences between the technical documentation obligations under the three frameworks, and assesses the feasibility of developing joint technical documentation.
Abstract The inaugural major revision of the Cybersecurity Law of the People’s Republic of China (CSL, 中华人民共和国网络安全 法), enacted in 2016 and effective since 2017, was formalized with the adoption of the 2025 Amendment by the Standing Committee of the National People’s Congress (NPCSC, 全国人 民代表大会常务委员会) on October 28, 2025, entering into force on January 1, 2026. This Amendment represents a significant intensification of the regulatory framework, substantially enhancing enforcement powers, codifying stricter legal liabilities for enterprises and responsible personnel, delineating the gradations of regulatory violations, and imposing more rigorous compliance mandates on operators of Critical Information Infrastructure (CII, 关键信息基础设施). The revisions underscore the government’s strategic objective to foster the development of the artificial intelligence (AI) sector while concurrently fortifying national cybersecurity postures.
Abstract The use of AI systems such as ChatGPT is increasingly contentious within the legal world. Several litigants and their lawyers have been discovered to have made use of the technology in preparing cases, only to fall victim to the technology’s tendency to invent fictitious authorities with judges in some cases reporting lawyers to their professional bodies to face disciplinary sanctions. For perhaps the first time, we now have a case, Peggie v. Fife Heath Board and Dr B Upton in the United Kingdom where the suggestion is that a judge has relied upon AI to produce substantial parts of a judgment without acknowledging the fact. This note assesses the potential significance of such action.
Abstract While parties - with justification - tend to focus on those “big ticket” terms with which we are all very familiar (e.g. indemnities, liability caps, and termination rights), the success or failure of a project frequently hinges on lower profile provisions: that is, on provisions that dictate how the contract operates to address day-to-day issues, not the bet-the-company litigation. Drawing from experience over the past decade, this article explores practical strategies to address common key issues which are critical to operations but which have traditionally had a lower profile: namely, that (1.) align with the project methodology (e.g. waterfall vs. agile); (2.) emerge operational problems early; (3.) escalate problems in a timely manner; (4.) incentivize the vendor to achieve positive dispute outcomes; (5.) ensure customer has reasonable time to dispute issues; (6.) start the contractual limitation period only after sufficient dispute details have been provided; (7.) require automatic escalation for repeating problems; (8.) prevent incentives from disrupting the resource allocation of the vendor; and (9.) incorporate a structured penalty mechanism, so to avoid the problem of penalties that, in practice, are too big to use.
