Data and Privacy Matters: Legal Updates - April 2026

Data and Privacy Matters: Legal Updates - April 2026

Nuria Pastor, Hannah Wallet, and Sophia Steiger round up key data and privacy news from April 2026.  They discuss developments from Europe as the EDPB adopts new guidelines on the processing of personal data for scientific research and a new DPIA template. The ICO is the next focus and the team looks at a joint report concerning agentic AI, a new Code of Practice on AI and Automated Decision Making Regulations together with the new guidance on storage and access technologies.  The relationship between children and social media remains a hot topic and the team discuss the latest developments across different jurisdictions. The team looks at the judgment in RTM v Bonne Terre Ltd & Hestview Ltd[2025] EWHC 111 (KB) which examines the objectivity of "consent" under the UK GDPR and PECR.  The episode then discusses the trend with privacy-related fines in the US before finishing with some recent high-profile data breaches from across Europe and the globe, and the lessons that can be learnt from these incidents. Find the sources here: Data and Privacy Matters: Legal Updates - April 2026 [https://www.fieldfisher.com/en/insights/data-and-privacy-matters-legal-updates-april-2026]

Data and Privacy Matters: Legal Updates - March 2026

In the March edition of Data & Privacy Matters, the Fieldfisher Tech and Data team round up key UK and EU developments across data protection, online safety, cybersecurity, and digital regulation.  They begin with the ICO’s draft updated guidance on automated decision‑making and profiling, published following the Data Use and Access Act 2025. The guidance clarifies when automated decision‑making rules apply, what meaningful human involvement looks like, and signals a shift towards a more permissive “right to challenge” model. Staying with the ICO, they discuss updated purpose limitation guidance, which tightens expectations around compatibility assessments and record‑keeping where personal data is reused, particularly where consent was the original lawful basis. Children’s online safety remains a major focus this month. The team cover the joint ICO and Ofcom statement on age assurance under the Online Safety Act, alongside potential European Commission enforcement under the Digital Services Act, reflecting increased regulatory scrutiny of age assurance, default settings and systemic risk. European developments continue with draft guidance on the Cyber Resilience Act, clarification on software scope, and the closure of the Digital Fitness Check consultation under the Commission’s Digital Omnibus initiative. They conclude with enforcement and litigation updates, including the CJEU’s Brillen Rottler ruling on abusive DSARs and a cyber incident at UK Companies House. Find the sources here. [https://www.fieldfisher.com/en/insights/data-and-privacy-matters-legal-updates-march-2026]

Data and Privacy Matters: Legal Updates - February 2026

Tune in to the action-packed latest episode of Fieldfisher's Data & Privacy Matters podcast, as Camille Ebden, Melanie Ludolph and Rida Ahmed look at the key data and privacy news from February 2026. Read more here. [https://www.fieldfisher.com/en/insights/data-and-privacy-matters-legal-updates-february-20]

Data and Privacy Matters: Legal Updates - January 2026

The episode starts with a discussion of the EDPB's consultation regarding the Processor Binding Corporate Rules (BCR-Ps). The consultation seeks feedback on the EDPB's draft recommendations on the BCR-Ps which include standardisation measures and various clarifications and explanations, alongside discussion on the scope of the BCR-Ps. The team then speaks about recent developments in online safety for children. As discussed last episode [https://www.fieldfisher.com/en/insights/data-and-privacy-matters-legal-updates-december-20], it truly does seem to be the year of the child when it comes to international data protection.  First, the podcast discusses the Global Online Safety Regulators Network's joint statement on shared principles for the adoption of age-assurance technologies. The UK government's consultation into children's access to social media is also explored, and finally the podcast reviews the EU push for age-based restrictions to social media. The podcast then summarises news from the UK. The episode looks at the ICO's new powers and the new criminal offences under the Data (Use and Access) Act 2025. Recent investigations are then discussed, with a focus on Grok and Meta who are under scrutiny from the ICO and Ofcom. Before moving on to the EU, the team also touch on various structural developments to the ICO and Ofcom, with a formal cooperation agreement established between Ofcom and the Internet Watch Foundation, and updated ICO guidance published on Rights of Access and International Data Transfers. On the EU front there was a range of matters requiring the podcast's attention this month. The diverse topics explored include the EU-Brazil adequacy decision, the Irish X Internet Unlimited Company litigation, an EU Digital Omnibus update, negotiations regarding the detection of online CSAM and new Regulation (EU) 2025/2518. The episode is wrapped up with mentions of significant fines and enforcements, including various French CNIL fines ranging from €3.5 million to €27 million and the European Commission's preliminary findings that TikTok is in breach of the Digital Services Act (although we note a final decision has not yet been reached). With the volume of continuous developments in the data and privacy ecosystem, it can be hard to stay on top of the key news stories. This is a must-listen podcast to catch up on notable data and privacy news in the past month and consider what your business or organisation needs to be doing in response. Find the source of news discussed here. [https://www.fieldfisher.com/en/insights/data-and-privacy-matters-legal-updates-january-202]

Data and Privacy Matters: Legal Updates - December 2025

In the latest privacy podcast episode Anna Rawlinson [https://www.fieldfisher.com/en/people/anna-rawlinson], Lorna Cropper [https://www.fieldfisher.com/en/people/lorna-cropper] and Harry Barder [https://www.linkedin.com/in/harry-barder-60500b20a/] delve into the data and privacy stories that captured their attention throughout December 2025. Join them as we explore developments and new stories that are impacting businesses and organisations, including: * updates to the rules and regulations applicable to children's use of online services from across the globe in Australia to here in the UK; * recent developments from Ofcom, including insights into recent fines issued; * updates from the ICO including their response to the Cyber Security and Resilience Bill and their revised Right of Access guidance; * news from the EU, including an analysis of the practicality of a single cyber-reporting hub in the EU and the CJEU's ruling on X v Russmedia Digital SRL and Inform Media Press SRL; and * various fines and enforcement actions during the month. Read more here: Data and Privacy Matters: Legal Updates - December 2025 [https://www.fieldfisher.com/en/insights/data-and-privacy-matters-legal-updates-december-20]