Company: FRFXF
Filing Date: 2025-10-09
Form Type: F-10/A
Source: 0001104659-25-098335
Chunk: 104

Company: FAIRFAX FINANCIAL HOLDINGS LTD/ CAN
Filing Date: 2025-10-09
Form: F-10/A
Chunk 104
---
 now also aligned with the UK GDPR.

The concept of accountability is at the heart of the data protection regime, meaning that companies need to be able to demonstrate that they have implemented a compliance program that reflects and enables them to meet the legal requirements for processing of personal data in the EEA and/or the United Kingdom.

On June 19, 2025, the UK’s Data (Use and Access) Act (“

#### DUAA
”) received Royal Assent. The DUAA enacts changes to the U.K.’s data protection regime. Most of the changes described herein require a statutory instrument to bring them into force.

Key changes to note are as follows: (a) controllers must facilitate the making of complaints by data subjects; (b) provisions relating to the re-purposing of personal data are clarified and expanded; (c) the default prohibition on automated decision making with legal/significant effects has been lifted and additional

<div align='center'>62</div>

TABLE OF CONTENTS

safeguards added to balance this change; (d) a new “recognized legitimate interests” lawful basis has been added to the UK GDPR; and (e) the provisions on international transfers incorporate the Information Commissioner’s Office’s (“

#### ICO
”) risk-based approach into statute. Under the DUAA, the ICO’s powers are also enhanced (powers to request documents, reports from ‘approved persons’ and requiring individuals to attend interviews).

Regulators are also increasingly focused on artificial intelligence (“

#### AI
”). In the United Kingdom, this focus is currently on the ways in which risks associated with the deployment of AI can be assessed in the context of existing laws, including the UK GDPR and requirements around treating customers fairly, with a clear focus on conducting risk assessments on the use of AI. In the EU, alongside a focus on assessment and compliance with existing laws, further laws are also now in force — most notably, the EU AI Act which applies from February 2, 2025. The current and emerging regulatory regimes will require increased assessments of AI solutions and failure to comply with relevant requirements in relation to the deployment of AI may result in regulatory fines, damages claims and reputational damage.

Business interruption test case

Our insurance business in the U.K. includes insurance of business interruption risks. In May 2020, the FCA announced its intention to bring a test case in the High Court of England and Wales to seek legal clarity about the meaning and effect of selected business interruption insurance policy wordings in the context of COVID-19