Technology, Data and Privacy

Lorna Cropper, Emma Yaltaghian and Sandra Ofili round up key data and privacy developments from July 2026. 
They discuss the EDPB's draft guidance on anonymisation and web scraping for generative AI, as well as its proposed EU-wide personal data breach notification template and calls for greater regulatory cooperation across Europe.
The team also covers the EU Digital Omnibus amendments to the AI Act, the ICO's plans to evolve its regulatory sandbox for AI innovation, and developments relating to children's privacy, neurotechnology and risk-based complaint handling.
International data transfers and AI regulation are also on the agenda, with discussion of two UK Government calls for evidence on the future of data regulation and cross-border data flows.
Moving on to online safety, the team looks at the House of Lords inquiry into the Online Safety Act, proposals to restrict children's access to social media across Europe, and Ofcom's latest update on age assurance measures.
The episode concludes with a review of recent enforcement action from the Italian Data Protection Authority and the ICO, including cases involving data brokerage, telemarketing compliance and unlawful employee access to personal data.

Nuria Pastor, Sophia Steiger and Yanis Lau round up key data and privacy news from June 2026.
They discuss developments from the EU as the EDPB adopts a common data breach notification template and launches a dedicated contact form to allow stakeholders to report possible inconsistencies in GDPR implementation. They also cover the EDPB's update on its One-Stop-Shop case digest on the right to object and right to erasure.
The ICO is the next focus and the team looks at the ICO's response towards advisory AI Growth Labs, its 'Edtech examined' report and the final guidance on consumer Internet of Things products and services. They also looked at the ICO's statement on inappropriate access of patient data and call on social care leaders to commit to better care records.
There are important developments in the online safety landscape, and the team discusses the government's proposal of a blanket ban on social media for under 16s and to make it impossible for children to take, share or view naked pictures on their devices. The team also looks at Ofcom's proposed major updates to the Illegal Harms regulatory guidance.
Moving on to developments in the AI space, the team discusses the new regulations brought by the EU Digital Omnibus. Staying with Europe, the team then discusses the recent CJEU judgement of Case C‑414/24 (Datenschutzbehörde), which clarified that data subjects can exercise parallel remedies under the GDPR without prejudice to each other.
The episode ends with a discussion on recent enforcement actions from the ICO and the Norwegian DPA.

Lorna Cropper, Chloe Abbott and Sandra Ofili round up key data and privacy developments from May 2026.
They begin by highlighting a significant milestone: May marked ten years since the GDPR came into force and the two-year countdown to applicability started. The team reflects on the GDPR’s lasting influence on data protection legislation across the EU and beyond.
Continuing with European developments, the team discuss the European Parliament and Council's provisional political agreement on the Digital Omnibus reforms to the AI Act, as well as the European Commission's publication of draft, non‑binding guidelines on the classification of high-risk AI systems. 
The focus then shifts to the UK, where the team outlines key legal updates, including the deadline to inform individuals of their right to make a data protection complaint and to implement an appropriate complaints procedure. To support organisations in updating their policies and procedures, the team has prepared a practical one-page guide, available here.
Children’s online safety also remains a key priority this month. The team discusses the ICO’s statement on age assurance, Ofcom’s update following tech firms’ responses to its call for action to protect children, and the close of the UK Government’s consultation on children’s digital wellbeing.
The podcast concludes with recent enforcement developments, including the ICO’s decision to fine South Staffordshire Plc and South Staffordshire Water Plc following a major cyber incident, and the Irish Data Protection Commission’s formal inquiry into SHEIN’s Irish entity concerning the transfer of EU/EEA personal data to China.

Nuria Pastor, Hannah Wallet, and Sophia Steiger round up key data and privacy news from April 2026. 
They discuss developments from Europe as the EDPB adopts new guidelines on the processing of personal data for scientific research and a new DPIA template. The ICO is the next focus and the team looks at a joint report concerning agentic AI, a new Code of Practice on AI and Automated Decision Making Regulations together with the new guidance on storage and access technologies. 
The relationship between children and social media remains a hot topic and the team discuss the latest developments across different jurisdictions. The team looks at the judgment in RTM v Bonne Terre Ltd & Hestview Ltd[2025] EWHC 111 (KB) which examines the objectivity of "consent" under the UK GDPR and PECR. 
The episode then discusses the trend with privacy-related fines in the US before finishing with some recent high-profile data breaches from across Europe and the globe, and the lessons that can be learnt from these incidents.
Find the sources here: Data and Privacy Matters: Legal Updates - April 2026

In the March edition of Data & Privacy Matters, the Fieldfisher Tech and Data team round up key UK and EU developments across data protection, online safety, cybersecurity, and digital regulation. 
They begin with the ICO’s draft updated guidance on automated decision‑making and profiling, published following the Data Use and Access Act 2025. The guidance clarifies when automated decision‑making rules apply, what meaningful human involvement looks like, and signals a shift towards a more permissive “right to challenge” model.
Staying with the ICO, they discuss updated purpose limitation guidance, which tightens expectations around compatibility assessments and record‑keeping where personal data is reused, particularly where consent was the original lawful basis.
Children’s online safety remains a major focus this month. The team cover the joint ICO and Ofcom statement on age assurance under the Online Safety Act, alongside potential European Commission enforcement under the Digital Services Act, reflecting increased regulatory scrutiny of age assurance, default settings and systemic risk.
European developments continue with draft guidance on the Cyber Resilience Act, clarification on software scope, and the closure of the Digital Fitness Check consultation under the Commission’s Digital Omnibus initiative.
They conclude with enforcement and litigation updates, including the CJEU’s Brillen Rottler ruling on abusive DSARs and a cyber incident at UK Companies House.
Find the sources here.