Data and Privacy Matters – June 2025

They begin with the UK’s landmark Data (Use and Access) Act 2025, which introduces reforms to the UK GDPR, DPA 2018, and PECR, including increased fines, clarifies lawful bases for processing, and updated rules on cookies, transparency, and automated decision-making. The team also covers new ICO guidance for smart product manufacturers, aimed at improving privacy in the growing Internet of Things landscape.

Turning to AI, the podcast explores the ICO’s new AI and Biometrics Strategy, including plans for a statutory code of practice and oversight of foundation models and facial recognition. They also discuss Meta’s latest data use plans, the Irish DPC’s 2024 annual report, and developments in the EU’s AI Act.

The episode wraps up with a look at major enforcement actions across Europe, including fines against Vodafone, 23andMe, and a Finnish pharmacy, as well as updates on cybersecurity incidents affecting UK retailers and ongoing legal challenges involving Clearview AI.

These updates highlight the growing regulatory scrutiny around AI, data transfers, and digital infrastructure—essential listening for anyone navigating the evolving data protection landscape.

Sources of the news discussed:

UK updates

Data (Use and Access) Act factsheet: UK GDPR and DPA - GOV.UK

Fieldfisher article on the Data (Use and Access) Act

Your household smart products must respect your privacy – including your air fryer | ICO

Artificial Intelligence

John Edwards speaks at ICO’s event with the AI APPG in Parliament | ICO

EU could postpone flagship AI rules, tech chief says – POLITICO

Meta plans to replace humans with AI to assess risks : NPR

EU updates

Data Protection Commission publishes 2024 Annual Report | 19/06/2025 | Data Protection Commission

DPC announces conclusion of investigation into use of facial matching technology in connection with the Public Services Card by the Department of Social Protection | 12/06/2025 | Data Protection Commission

EU reaches provisional agreement to speed up cross-border GDPR enforcement | IAPP

TikTok wins temporary reprieve on suspension of data transfers from EU to China – The Irish Times

UK retail sector update  

Asda faces legal complaint after “unlawful” facial recognition trial — Big Brother Watch

M&S faces 'unprecedented' customer lawsuit over cyberattack data breach | ITV News

M&S and Co-op hacks publicly defined as a single attack - and could cost more than £400 million | TechRadar

European enforcement

Yliopiston Apteekille seuraamusmaksu verkkoapteekin tietosuojapuutteista | Tietosuojavaltuutetun toimisto

German Federal SA: Administrative fines in the amount of €15 000 000 and €30 000 000 as well as a reprimand imposed on Vodafone | European Data Protection Board

UK enforcement

23andMe fined £2.31 million for failing to protect UK users’ genetic data | ICO

Clearview AI to return to UK court next month for data regulator appeal | MLex | Specialist news and analysis on legal risk and regulation (subscription required)