Company: FRFXF
Filing Date: 2025-03-14
Form Type: F-4
Source: 0001104659-25-024010
Chunk: 94

Company: FAIRFAX FINANCIAL HOLDINGS LTD/ CAN
Filing Date: 2025-03-14
Form: F-4
Chunk 94
---
 (especially in the United Kingdom), and the retention of data for excessive periods of time. Alongside the EU GDPR and
UK GDPR, the rules surrounding the sending of electronic marketing communications are governed by the -e-Privacy Directive, which
has been implemented at a local level across each EU Member State and in the United Kingdom as the Privacy and Electronic Communications
Regulations (commonly known as PECR).

The concept of accountability
is at the heart of the data protection regime, meaning that companies need to be able to demonstrate that they have implemented a compliance
program that reflects and enables them to meet the legal requirements for processing of personal data in the EEA and/or the United Kingdom.
On October 23, 2024, the Labour Government introduced the Data (Use and Access) Bill, a successor to the previous government’s
Data Protection and Digital Information Bill (which did not pass) which set out proposed amendments to the UK GDPR. These include amendments
to the rules on automated decision making, introducing the concept of recognized “legitimate interests” and amendments
to the purpose limitation and export rules. The proposed Bill is currently working its way through the legislative process. It remains
to be seen if such reforms could potentially challenge the United Kingdom’s “adequacy” designation and make it more
difficult for companies to transfer personal data from the EEA to the United Kingdom.

Regulators are also increasingly
focused on artificial intelligence (“AI”). In the United Kingdom, this focus is currently on the ways in which risks
associated with the deployment of AI can be assessed in the context of existing laws, including the UK GDPR and requirements around treating
customers fairly, with a clear focus on conducting risk assessments on the use of AI. In the EU, alongside a focus on assessment and
compliance with existing laws, further laws are also now in force – most notably, the EU AI Act which applies from February 2,
2025. The current and emerging regulatory regimes will require increased assessments of AI solutions and failure to comply with relevant
requirements in relation to the deployment of AI may result in regulatory fines, damages claims and reputational damage.

Business interruption test case

Our insurance business in
the United Kingdom includes insurance of business interruption risks. In May 2020, the FCA announced its intention to bring a test
case in the High Court of England and Wales to seek legal clarity about the meaning and effect of selected business interruption insurance
policy wordings in the context of COVID-19 claims. The F