Contract analysis

1. Introduction and Purpose of Letter Calderwood & Harkness LLP ("C&H" or "we") writes on behalf of our client, Aurelius Global Media Group PLC ("AGMG"), a public limited company incorporated in England and Wales under Companies House number 08741562, with its registered office at 140 Threadneedle Row, London EC2R 8AH. This letter constitutes AGMG's formal and comprehensive response to the informal inquiry letter iss

2. Background to AGMG and Its UK Digital Properties By way of background, AGMG is a UK-headquartered public media, entertainment streaming, and e-commerce conglomerate listed on the Main Market of the London Stock Exchange under the ticker symbol LSE: AGMG. As of January 2024, AGMG's market capitalisation was approximately £3.8 billion. AGMG's annual revenue for the financial year ended 31 December 2023 was approxima

3. Summary of the ICO Inquiry On 22 December 2023, the ICO issued informal inquiry letter reference ICO/ENF/2023/LTR-11084, addressed to AGMG at its registered office. The Inquiry raised three principal areas of concern, which we summarise as follows: (a) The deployment of server-side tracking pixels on aureliusnews.co.uk and shopaurelia.co.uk that were identified as transmitting personal data — including, in particu

4. Scope of the Remediation Programme Upon receipt of the ICO's Inquiry on 27 December 2023, AGMG's Group General Counsel, Mr Redworth, and Group DPO, Ms Fontaine-Li, convened an internal assessment meeting on 3 January 2024. Following that assessment, AGMG took the decision to retain external legal counsel and to commission a full-scope technical audit and remediation programme that would encompass not only the two

1. Consent mechanism redesign — redesign and redeployment of cookie consent banners on all 14 European websites and consent flows on all 3 mobile applications to ensure full PECR and UK GDPR compliance;

2. Server-side pixel remediation — identification, review, and remediation (removal or consent-gating) of all non-compliant server-side tracking pixels across all properties;

3. DPA renegotiation with non-compliant vendors — execution or renegotiation of data processing agreements with all adtech vendors that were receiving AGMG user personal data without compliant contractual arrangements in place;

4. Vendor audit rights — ensuring all vendor contracts include audit and inspection rights as required by Article 28(3)(h) of the UK GDPR;

5. DPIA updates — updating the Data Protection Impact Assessment for AGMG's programmatic advertising processing activities to reflect the remediated data flows and risk profile;

6. Records of Processing Activities (ROPA) updates — updating AGMG's Article 30 records to reflect all remediated processing activities, corrected legal bases, and new vendor relationships; and

7. Regulatory responses — preparation and submission of comprehensive compliance responses to both the CNIL (in respect of formal notice MED-2023-097) and the ICO (in respect of the present Inquiry). The timeline for completion of each workstream is set out in the relevant sections below. We confirm that all seven workstreams have been completed as of the date of this letter.

5. Technical Cookie Audit Findings — UK Properties 5.1 Audit Methodology and Period The technical cookie audit was conducted by Thistlewood Consulting over a period of approximately four weeks, commencing on 22 January 2024 and concluding on 16 February 2024. The audit methodology comprised the following elements: (a) Automated scanning — Thistlewood deployed proprietary automated scanning tools to crawl all 14 Europ

6. Legal Analysis — PECR Regulation 6 and UK GDPR Compliance 6.1 PECR Regulation 6 — Storage of and Access to Information Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR") transposes Article 5(3) of Directive 2002/58/EC (the ePrivacy Directive) into UK law. Regulation 6(1) provides that a person shall not store or gain access to information stored in the terminal equip

7. Remediation Actions Completed 7.1 Consent Mechanism Redesign The redesign and redeployment of cookie consent banners and mobile application consent flows was completed across all AGMG European digital properties within the following timeline: • All 14 European websites — consent banners redesigned and redeployed by 22 March 2024, including aureliusnews.co.uk and shopaurelia.co.uk; and • All 3 mobile applications —

8. Revenue Considerations and Business Continuity AGMG wishes to draw the Commissioner's attention to the fact that the decision to pursue comprehensive remediation rather than termination of non-compliant vendor relationships was made with due regard both to data protection compliance and to the Group's obligations to its shareholders and stakeholders. The remediation approach preserved approximately €26.3 million i

9. Ongoing Compliance Governance Framework To prevent recurrence of the compliance deficiencies identified in the Inquiry and to embed a culture of privacy-by-design across AGMG's digital operations, AGMG has implemented a comprehensive, forward-looking compliance governance framework. The framework was designed by C&H in consultation with AGMG's DPO and CTO, and was formally adopted by AGMG's Board of Directors on 2

10. Coordination with CNIL Proceedings For the Commissioner's information and in the interest of full transparency, we provide the following update on the related CNIL proceedings: AGMG submitted its compliance response to the CNIL on 12 April 2024, within the extended compliance deadline of 14 April 2024 that was granted by the CNIL on 18 March 2024. The CNIL response addressed the matters raised in formal notice ME

11. Supporting Evidence and Exhibits In support of this response, AGMG encloses the following supporting materials, each of which is referenced at the appropriate point in the body of this letter: Enclosure 1: Thistlewood Consulting — Technical Verification Scan Reports for aureliusnews.co.uk and shopaurelia.co.uk, confirming no pre-consent firing of non-essential cookies or server-side tracking pixels following reme

12. Request for Closure On the basis of the comprehensive remediation programme set out in this letter, and the supporting evidence enclosed herewith, AGMG respectfully requests that the Commissioner: (a) close informal inquiry ICO/ENF/2023/LTR-11084; and (b) confirm that no further enforcement action will be taken against AGMG in connection with the matters raised in the Inquiry. AGMG is confident that its UK digita

13. Contact Information The ICO is invited to direct any further correspondence, queries, or requests for additional information to: Rachel Bernstein Partner, Privacy & Data Security Practice Calderwood & Harkness LLP One Finsbury Square London EC2A 1AE United Kingdom Telephone: +44 (0)20 7496 8247 Email: r.bernstein@calderwoodharkness.com C&H Matter No. 1017-00008 Or directly to the client's Data Protection Officer: