Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Stuart Davey
Plans to bolster cyber resilience in Britain’s energy sector to be taken forward
According to the Department for Energy Security and Net Zero (DESNZ) and Ofgem, the baseline standards will be founded on the existing ‘Cyber Essentials Plus’ scheme that the government operates, which sets cyber standards that organisations can adopt and obtain independent certification for. A consultation on the precise substance of the requirements is planned for next year.
UK security body confirms ‘unprompted’ cyber attacks by AI agents
The institute was carrying out a “cyber evaluation” of ‘frontier AI’ models – the very latest AI models – when it identified “19 distinct instances of unsanctioned action” taken by Mythos 5 and GPT-5.6 Sol. The two AI models have been developed by Anthropic and OpenAI, respectively. The institute said it is not aware of any “real-world harm” being caused but that it is treating the matter as “a serious security incident that warrants scrutiny, transparency, and action”.
PODCAST: Why energy companies are under pressure to improve their cybersecurity
Speak to an advisor from your nearest office Please accept the geolocation request appearing in your browser Find other offices
New cyber obligations proposed for British energy businesses
Currently, only some energy businesses in Britain are subject to cyber regulation. In this respect, the Network and Information Systems (NIS) Regulations 2018 apply to operators of ‘essential services’, which must keep their networks and information secure and notify security incidents to Ofgem when they occur.
MPs question regulators' capacity to meet cyber security demands
Government's bill increases scope of service providers and platforms which would come under scrutiny, says Stuart Davey The capacity of British regulators to meet the increased cyber security demands being placed on companies under planned new legislation has been questioned by lawmakers.
Economic impact and regulatory limits in spotlight as MPs debate new UK cyber security law
Members of parliament challenged if regulators such as the Information Commissioner’s Office would have the capacity and technical capability to manage the increased scope of service providers and platforms which would come under their scrutiny as part of the Cyber Security and Resilience Bill. A particular focus of MPs was the ability of companies and organisations which now fall under the scope of regulation for the first time to manage the increased costs and demands of compliance.
Businesses must be ready for cyber security threats
Microsoft Cares About Your Privacy Microsoft and our third-party vendors use cookies to store and access information such as unique IDs to deliver, maintain and improve our services and ads. If you agree, MSN and Microsoft Bing will personalise the content and ads that you see. You can select ‘I Accept’ to consent to these uses or click on ‘Manage preferences’ to review your options and exercise your right to object to Legitimate Interest where used.
UK cyber watchdog sounds preparation warning after sharp rise in significant attacks
The number of significant cyber attacks doubled in the last year, despite the National Cyber Security Centre (NCSC) receiving the same amount of calls for support during the same period. But the headline-grabbing attacks on the likes of Jaguar Land Rover, Marks and Spencer and Co-op underline how hackers are targeting significant national organisations and infrastructure in their attempts to penetrate cyber defences.
Tech suppliers and data centres to face UK cyber law duties
The UK government outlined plans to bring ‘managed service providers’ within the scope of the UK’s existing Network and Information Security (NIS) regulations as part of a wider legislative reform initiative that will involve the introduction of a new Cyber Security and Resilience Bill. At the same time, the UK government indicated an intention to bring data centre providers within the scope of NIS, which follows recent designation of such providers as ’critical national infrastructure’.
Laws to disrupt ransomware payments considered in the UK
The proposed new “payment prevention regime” would apply to all potential ransomware payments from the UK and forms part of a broader package of potential new ransomware-related legislation the Home Office opened a consultation on, on Tuesday.
NIS2: EU chases 23 countries on cyber law implementation
Cyber law expert Stuart Davey of Pinsent Masons said the lack of national implementing legislation for NIS2 is hampering business efforts to comply with the new regime. NIS2 builds on the original NIS directive which took effect in the EU in 2018 and imposes cybersecurity risk management and incident reporting obligations on in-scope organisations under a tiered system of regulation.
NIS2 compliance hampered across EU as October deadline approaches
The EU’s second Network and Information Security Directive (NIS2) will strengthen existing cybersecurity risk management and incident reporting obligations that have applied under the original NIS regime and extend them to thousands of other businesses. However, as we explore below, some EU member states look set to miss the 17 October deadline for implementing the directive into their national legislation.
Value of data centres to UK economy highlighted by government action
Stuart Davey, Michael Pocock and Robbie Owen of Pinsent Masons were commenting after the UK government announced that it has designated data centres as ‘critical national infrastructure’ (CNI) in the UK. Data centres is the fourteenth sector to obtain a CNI designation in the UK – energy, health, transport, and water are among the other sectors designated. The designation covers both physical data centres and those operated virtually by cloud computing providers.
PODCAST: The huge changes ahead for UK construction industry following Grenfell Inquiry findings, and an unusual fine for a data processor
Select your language We can use your selection to show you more of the content that you’re interested in. Technology, Science & Industry Sign-up to follow topics, sectors, people and also have the option to receive a weekly update of lastest news across your areas of interest. Got an account already?
Processor fine proposed in UK GDPR first
The Information Commissioner’s Office (ICO) has signalled its intention to fine a software provider more than £6 million in what would be the first example of it imposing a monetary penalty notice on a processor under the UK General Data Protection Regulation (GDPR). Data protection law expert Malcolm Dowden of Pinsent Masons said the case highlights how the GDPR applies directly to processors, unlike was the case under its predecessor legislation.
King’s Speech: UK’s ‘NIS2’ trailed as new cyber resilience law announced
Cyber risk expert Stuart Davey of Pinsent Masons said news of the proposed new legislation comes amidst a heightened and evolving threat environment for organisations and as policymakers in other jurisdictions move to strengthen their own cybersecurity frameworks.
Construction firms urged to be aware of cyber risk heading into 2024
Cyber risk experts Stuart Davey and Laura Gillespie of Pinsent Masons were commenting on the high level of cyber risk faced by the UK’s infrastructure sector, following the UK parliament’s recent inquiry into cyber resilience of the UK’s critical national infrastructure.
Experts back new global guidelines for AI security
Agencies from 18 countries, including the US, endorsed new UK-developed guidelines on AI cyber security, led by GCHQ’s National Cyber Security Centre. The guidelines aim to raise the cyber security levels of artificial intelligence and help ensure that it is designed, developed and deployed securely. Stuart Davey, cybersecurity expert at Pinsent Masons, said: “These global guidelines, led by the UK, mark a significant step in the ongoing AI discussions.
NIS2 preparation advised as guide explain how cyber law interacts with DORA
NIS2 is the second Network and Information Security Directive. The legislation came into force in the EU in January this year, but EU member states have until 17 October 2024 to implement it into national frameworks.
Intelligence chief warns of cyber risk to LNG terminals
Head of the BND intelligence service Bruno Kahl recently warned a security conference about the expansion of targets of cyber criminal activity, according to one report. He said that conflict was spreading geographically beyond the immediate war region and was expanding into other targets. “Beyond the known spectrum the new facilities for landing liquefied gas must also be considered as possible further targets," Kahl told a forum in Stuttgart in September.
UK GDPR fines could be linked to NCSC engagement
Businesses found to have breached UK data protection laws when falling victim to cyber attacks could receive lower fines in respect of those infringements if they engage appropriately with the UK’s National Cyber Security Centre (NCSC), under a new agreement forged by the NCSC and the UK’s data protection authority.
Cyber incident reporting guide updated for UK digital infrastructure sector
Ofcom has published revised guidance (70-page / 842KB PDF) relevant to incident reporting obligations ‘operators of essential services’ in the digital infrastructure sub-sector are subject to under the Network and Information Security (NIS) Regulations 2018. The revised guidance reflects changes brought in by the Network and Information Systems Regulations (Amendment and Transitional Provision etc.) Regulations 2020 (the Amended NIS Regulations).
‘Unprecedented’ warning over cyber threat to UK critical national infrastructure
Dowden said: “Disclosing this threat is not something that we do lightly. This is an unprecedented warning for businesses. We have never publicly highlighted the threat from these kinds of groups attempting such attacks before. And I should stress that we do not think that they currently have the capability to cause widespread damage to our infrastructure in the UK.
UK government outlines reforms to thirty-year-old cybercrime law
“A notable feature of the proposed changes is around trying to break the link between criminal domains and victim domains. It is achieved through granting law enforcement agencies the power to take control of or take down the domains and IP addressed used by criminals, as well as the power to require the UK registry not to register domain names that are predicted to be used for criminal purposes,” said Varley.
Masterclass in Technology Claims - Part Two: A technology claims scenario
Join us for an exclusive two-part webinar series providing a masterclass on technology related claims pursuant to professional indemnity/errors and omissions insurance policies. Gain practical strategies and legal insights from our team of technology disputes lawyers to enable you to better manage technology claims.
NIS: UK cyber reforms to impact tech providers
Broader changes to the regulation of DSPs under the NIS regime remain under consideration. The government has consulted on establishing a two-tier system of regulation, where ‘critical’ DSPs would be subject to proactive supervision and remaining DSPs subject to a “reactive regime”. However, DCMS has now said that “determining the appropriate criteria for a tiered regime could be problematic” and that it is “considering whether a more flexible, risk-based assessment may be a better approach”.
NIS2 cyber laws approved by EU legislators
NIS2 builds on the original NIS Directive which took effect in the EU in 2018. It is broader in its scope than the original directive, meaning more organisations across both the public and private sectors will be subject to cybersecurity risk management and incident reporting obligations than before.
EU and UK propose stronger NIS incident reporting requirements
The Network and Information Security Directive (NIS 2.0), already agreed between MEPs and the European Council in May, will set tighter cybersecurity obligations for risk management, reporting obligations and information sharing. The requirements cover incident response, supply chain security, encryption and vulnerability disclosure, among other provisions. More entities and sectors will have to take measures to protect themselves.
Cyber risk accountability focus grows in UK civil nuclear sector
The strategy confirmed that new cyber and information security requirements are to be built into the design assessment process that the ONR oversees for prospective new reactors, while suppliers to nuclear organisations can also expect to be subject to “baseline cyber and information security standards”. The new strategy also called for cybersecurity in the civil nuclear sector to be appropriately prioritised “as part of a holistic risk management approach”.
Risks in terminating IT contracts highlighted by exclusion clause ruling
CIS raised an appeal against that judgment. The Court of Appeal has now ruled that the High Court had wrongly interpreted the exclusion clause in the contract and held that CIS is entitled to an award of more than £80m in damages from IBM in relation to its wasted expenditure.
UK organisations urged to improve cyber resilience
Out-Law News | 01 Feb 2022 | 12:02 pm | 3 min. read UK organisations should apply security patches for their systems, develop an effective incident response plan, and test their online defences, the National Cyber Security Centre (NCSC) has advised. The recommendations form part of a package of actions the NCSC said businesses and public sector bodies should take to remain cyber resilient when the cyber threats they face are heightened.
UK incident reporting laws updated as ransomware attacks rise
Search engines, online marketplaces and cloud computing providers are more likely to have to report major cybersecurity incidents in the UK after the government moved to address “EU-exit related deficiencies” in UK regulation. Changes to the UK’s regulations on network and information security (NIS) impacting ‘digital services providers’ (DSPs) operating in the UK took effect on 12 January.
‘Smart’ product makers could face £10m fines for cybersecurity breaches
Manufacturers of internet-connected ‘smart’ products could be fined up to £10 million for cybersecurity breaches under the terms of a new bill presented to the UK parliament. Currently, regulations do not include consumer protections against cyber attacks, which can include fraud and theft of personal data. Instead, manufacturers of smart products including mobile phones, connectable speakers and smart TVs only have to comply with rules preventing physical harm from issues like electric shock.
Ransomware attacks surge across UK, new report finds
Ransomware attacks against public and private sector bodies in the UK have surged in recent years, according to a new report by the government’s cyber security agency. The National Cyber Security Centre’s (NCSC) 2021 annual review (88-page/6. 03MB PDF) found that there were three times as many ransomware attacks – where hackers extort organisations for the return of stolen data - in the first quarter of 2021 than in the whole of 2019.
Fundamentals for scaling up AI in life sciences
The increased use of AI in life sciences will make the sector an even bigger target for cyber attacks. A report by the EU Agency for Cybersecurity (ENISA) provides a useful overview of the types of cyber risks arising in the context of AI specifically. One of the central risks comes from the sheer complexity of AI systems. An AI model is heavily reliant upon a number of input assets and component parts, each distinct from one another and dependent on different suppliers.
Triple Point ruling clarifies rights to claim liquidated damages for delay
The UK Supreme Court has resolved uncertainty surrounding the rights of businesses to claim liquidated damages for suppliers’ delay in completing work under contracts they terminate.
How to prepare for a ransomware attack
Whether to pay a ransom With the ransomware threat constantly evolving and challenging the measures organisations put in place to address cyber risk, there remains a real possibility that criminals will succeed in implementing a ransomware attach – however comprehensive the defences organisations implement. The Ransomware Task Force’s report also therefore sets out a series of recommendations on what can be done to make the response to ransomware attacks more effective.
A legal review of IT project delivery can help to avoid disputes
The successful delivery of major IT projects can be transformational for businesses seeking to harness the potential of digital technology and the efficiencies it can provide, but in some cases the projects can run into difficulty and disputes arise between customers and their suppliers. Organisations that undertake a legal review of their programme delivery will be best set to identify features that can lead to disputes and therefore well-placed to address them.
US publisher not within GDPR scope despite European readership
A US-registered publisher will not have to defend claims that its processing of a British resident's personal data breached EU data protection laws after the High Court in London ruled that the laws do not apply to it.
Why cyber incident response is going global
Organisations that operate across multiple jurisdictions should take the time to understand the regulatory requirements they would be subject to in the event of a data security incident, in light of the global cyber risk they face and recent moves by policy makers across the world to bolster data security requirements.
Trends point to a rise in data breach claims
Organisations should prepare for an increase in claims raised by data subjects following cybersecurity incidents. The combination of heightened cyber risk, potential legislative reform and growing interest in this area from claimant law firms and litigation funders suggests that the threat of data subject claims is a growing corporate risk – both financially and reputationally.
Data and incident response a focus of cyber investigations
Out-Law Analysis | 05 Oct 2020 | 9:05 am | 2 min. read The way businesses organise the data they hold and address security weaknesses identified in the aftermath of cyber incidents has come into sharp focus.
Cyber improvements may stem from Covid-19 pandemic response
Out-Law Analysis | 01 Oct 2020 | 8:17 am | 4 min. read The changes businesses have had to make to their IT estates in recent months as a consequence of the coronavirus crisis, including their investment in cloud-based solutions, could result in long-term improvements to cybersecurity.
Technology disputes and renegotiations
We advise clients through difficult and uncertain matters, using all forms of dispute resolution procedures including mediation, international arbitration and litigation. Technology disputes We act for both customers and suppliers on complex matters in relation to international telecoms infrastructure, telecoms regulatory, data and information technology disputes.
LCIA comments on use of experts in international arbitration
A new note by the LCIA calls for all those involved in arbitration to work to ensure that this expertise is "utilised to the fullest extent". The LCIA's note summarises how experts are involved in arbitration in a variety of ways. It goes on to identify the benefits that experts can bring to the arbitration process in each of these areas, together with some associated challenges.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Stuart
Contact Stuart, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack