AI – how to regulate it and how to exploit it – dominated the tech agenda in 2021 and is likely to continue to do so for the foreseeable future.  Other areas which cropped up repeatedly in terms of legal developments were the internet of things (IoT), drones and electric and automated transport.  See our Download edition on Disruptive Tech 2021 for more detailed features but here are (just some of) this year's highlights in a very crowded space.

AI

It began to feel that each day brought a new report or legislative initiative on AI this year but two elements stand out (for AI and data issues, see section on Data Privacy).  Everyone is clear that regulation is needed, particularly around ethical issues, and that international consensus would be beneficial, but achieving that is far from easy.

The EC draft AI Regulation

In May, the EC published its draft AI Regulation as discussed here.  The draft AI Regulation sets out proposals for:

• harmonised rules for developing AI systems, placing them on the market, and using them in the EU
• prohibitions on certain types of AI
• requirements for high-risk AI systems and for their operators
• transparency rules for AI systems
• a regulatory system and enforcement
• stimulating the development of AI systems.

Stakeholders who have had to get to grips with the GDPR will find many of the concepts in the Regulation familiar. From the risk-based approach, to the requirements around transparency and information provision, as well as record-keeping, territorial scope and enforcement, cybersecurity and data governance, there are recognisable requirements.

The Regulation will not apply in the UK but its wide territorial scope means it will impact UK businesses placing AI products on the EU market, using them in the EU, and providing output from AI which is used in the EU.  

The UK's National AI Strategy

The UK has not gone as far down the line as the EU.  Perhaps it is waiting to see how the AI Regulation progresses.  It did, however, publish a National AI Strategy which sets out a 10 year plan to ensure the foundations are laid for sustainable and ethical AI governance and development.  The focus is on building a sound governance system to encourage long term innovation and success.

In the next six to twelve months, the government will publish a White Paper on a pro-innovation national position on governing and regulating AI and piloting an AI standards hub.  The hub will be used to co-ordinate UK engagement in global AI standardisation.

Parliamentary Group calls for an 'Accountability for Algorithms' Act to counter negative impact of AI at work

The All-party Parliamentary Group on the future of work has called for an 'Accountability for Algorithms' Act.  This is partly in response to the growing use by employers of monitoring technologies and performance targets set by algorithms,  The Group's report 'The New Frontier - Artificial Intelligence at Work', suggests legislation could be used to counter negative impacts of these technologies by creating a new corporate and public duty to carry out an algorithmic impact assessment (similar to a DPIA). It remains to be seen whether the government will follow any of these recommendations and how any legislation would sit with the UK GDPR which already covers elements of the recommendations. In the meantime, the government is piloting an algorithmic transparency standard for governmental departments and public sector organisations.

Drones and e-mobility

New rules

New rules on drone operation came into force in the EU and in the UK on 31 December 2020.  Small drones need to be registered.  Distinctions between commercial and recreational drone use have been removed.  Rules on where drones can be flown and how they can be traced have been simplified.  See here for more.

No sooner had the new rules come into force, than the EU began consulting on the development of a Drone Strategy 2.0 for a smart and sustainable unmanned aircraft eco-system in Europe.  The consultation is open until 31 December 2021.

Consultation on connected and automated mobility

The Centre for Connected and Autonomous Vehicles (CCAV) published a call for evidence on connected and automated mobility (CAM) seeking views from organisations across the sector in relation to vehicle and infrastructure technologies, knowledge and skills and services that enable or will be enabled by CAM.  It is also trying to understand how the CAM sector can support the government's environmental aims, and to make the UK globally competitive in the sector.  The consultation closed on 16 July 2021.

CMA final report on electric vehicle charging market study

The CMA published its final report on its market study into the supply of charging for electric vehicles in the UK.  The report concludes that while some parts of the sector are proceeding well, others are facing problems which will disrupt rollout, and, potentially, the plans to ban the sale of new petrol and diesel cars by 2030. The CMA recommends the government set out an ambitious national strategy for rollout and support local authorities to boost rollout.  It will take action if parts of the sector develop in ways which damage competition.

Read more about the developing UK EV market here.

Internet of things

UK plans new legislation on IoT

In April, as discussed in more detail here, the UK government published updated policy intentions following the responses to its Call for Views on regulatory proposals on cybersecurity of consumer internet of things devices. The Product Security and Telecommunications Infrastructure Bill was published in November.

Part 1 sets out a new regime to help ensure security of consumer connectable products.  It creates powers for ministers to introduce security requirements.  Three existing requirements set out in a 2018 Code of Practice on the security in consumer internet of things, will be placed on a statutory footing. These will include:

• a ban on the use of default passwords
• a requirement for products to have a vulnerability disclosure policy
• a requirement to be transparent about the length of time for which products will get security updates. 

Other security standards are yet to be published.

The requirements will apply to manufacturers, importers and distributors of consumer connectable products which will include smartphones, connected cameras, TVs and speakers, wearable fitness trackers, outdoor leisure products with GPS, connected home automation and alarm systems, connected appliances, smart home assistants, and connected safety products, as well as IoT base stations and hubs.

The Bill also contains stringent enforcement measures including fines up to the greater of £10, or 4% of qualifying worldwide revenue.  The Bill is currently progressing to its second reading.

EC provisional findings in consumer internet of things sector inquiry

In June, it was the EU's turn to focus on IoT when it published a preliminary report setting out its provisional findings in its sector inquiry into the consumer internet of things (IoT).  The focus was on the manufacture of smart home devices, the provision of voice assistants, the provision of consumer IoT services (eg information and search services) and wearables.

The report identified quality and brand reputation as the main parameters of competition in the IoT sector.  The main obstacle to innovation was found to be the lock that the tech giants have over certain products and services, their control over user relationships with other smart devices or with consumers and the lack of interoperability and common standards.

EC proposes new rules on cybersecurity of radio-connected IoT devices

In November, the EC proposed a Delegated Regulation under the Radio Equipment Directive to strengthen cybersecurity of connected devices which use radio technology.  EU manufacturers and those placing products on the market in the EU will be required to take steps to prevent harm to networks, protect personal data and privacy and to minimise the risk of fraud for devices taking electronic payments.

The Regulation will cover a wide range of connected devices including wearables, toys, phones, fitness trackers and telecoms equipment.  Some devices are excluded from scope because they are covered by other legislation, for example, connected vehicles and medical devices. 

The Regulation is expected to come into force in 2024 following a 30-month transition period.  The Commission also plans a Cyber Resilience Act which will cover a wider range of products throughout their lifecycle.

Digital identity and assets

Digital identity and attributes trust framework

As we discussed, the government released its digital identity and attributes trust framework in February (updated in July). The framework seeks to develop the government's commitments to establishing a governance and oversight function for the rules around creating and using a digital identity service.  The DCMS subsequently launched a consultation on how its digital identities and trust framework should function and be governed which closed in September. 

Law Commission call for evidence on digital assets

The Law Commission of England and Wales began working on analysing English law with respect to digital assets and smart contracts in September 2020. It published a call for evidence on the way in which digital assets are being used, treated and dealt with by market participants together with views on the consequences of digital assets being 'possessable' in law in May which we discussed here.

The Law Commission published an update on three of its emerging technology projects covering smart contracts, digital assets and conflict of laws in December.  The update confirms that the Commission considers current law is able to support the use of smart legal contracts without a need for statutory reform, although some problems were identified.  

Regarding conflict of laws, the Commission has identified that there is a problem in ascribing real-world locations to digital actions and objects.  The Commission has therefore agreed to undertake a project looking at conflict of law rules as they apply to emerging technology including smart contracts and digital assets, to decide on whether or not reform is needed.  This is likely to start in mid-2022. The Commission is not expecting to complete its digital assets project until mid-2022.

Music streaming

EU

In May, The EC sent a Statement of Objections to Apple stating its preliminary view that it distorted competition in the music streaming market by abusing its dominant position for the distribution of music streaming apps through its App Store.  The Commission specifically objected to the mandatory use of Apple's own in-app purchase mechanism imposed on music streaming app developers to distribute their apps via the App Store.  It is also concerned that Apple applies restrictions on app developers which prevent them from informing iPhone and iPad users of alternative, cheaper purchasing possibilities. App developers have no choice but to distribute their apps to Apple users via the App Store and subject to Apple's non-negotiable terms and conditions, including the 30% commission it takes on in-app digital sales.

The Statement follows a complaint by Spotify.  Apple says that it only takes commission on 1% of Spotify's sales.

UK

In July, the House of Commons Digital, Culture, Media and Sport Committee published a report on the economics of music streaming.  The report called on the government to legislate to ensure performers have a right to equitable remuneration for streaming income.  It also asked the government to refer the issue to the CMA to undertake a full market study into the economic impact of the major music groups' dominance and to introduce robust, legally enforceable obligations to normalise licensing arrangements for UGC-hosting services to address market distortions and the music streaming 'value gap'.  In October, the CMA duly announced it will be launching a market study into music streaming. 

The Copyright (Rights and Remunerations of Musicians, etc.) Bill, a Private Members' was published and debated in early December. While the Bill did not pass, the debate provided some insight into the government's thinking on the issues it raised.  The Bill was intended to amend the CPDA 88 to introduce equitable remuneration for performers where they have transferred their making available right in a sound recording to the producer.  The intention was to redistribute streaming income to artists.  The government indicated that it was aware of the issues.  It wanted to encourage industry-led solutions but if those failed to materialise, it would publish legislation no later than by September 2022.

See here for our predictions for music streaming in 2022.

Ride hailing apps

In March, the Supreme Court held that Uber drivers are workers (discussed in more detail here).  Since the ruling, Uber announced it would guarantee 70,000 of its UK drivers the national living wage as a minimum (although many drivers earn more), holiday pay and pensions contributions.  It also formally recognised the GMB union. The Supreme Court ruling has potentially wide repercussions for ride hailing apps although to date, only Uber has provided protections to drivers.  It also goes a long way to clarifying issues around the status of gig economy workers. You can read more about the impact of this decision here.