Data and Privacy Matters: Legal updates — August 2025

The team start by discussing the growing criticism of the EU’s digital regulations, including the Digital Services Act and AI Act, with concerns about their impact on innovation. They also touch on the EU Data Act, effective September 2025, which brings new rules on data access and interoperability.

Discussion then turns to ICO consultations on the new lawful bases of recognised legitimate interests and complaints procedure.  Attention is also give to the Online Safety Act which now requires strict age verification for adult content and the surge in VPN use.

The podcast also covers legal challenges to consent models, increased oversight of influencer marketing, and major enforcement actions, including sizeable fines in Spain and Poland.

Sources of news discussed:

EU Regulation

• EU Digital Regulation: EU digital regulation sees widening chorus of US critics | MLex | Specialist news and analysis on legal risk and regulation
• Implementation of the Data Act 

UK News

• Data (Use and Access) Act 2025 Regulations bring specified provisions of DUA Act into force
• ICO launches consultations for Data (Use and Access) Act 2025 amendments | ICO
• ICO consultation on draft recognised legitimate interest guidance | ICO
• ICO consultation on draft changes to how we handle data protection complaints | ICO and UK companies could face fewer data complaint probes under new ICO framework
• Live Facial Recognition Technology - Data Protection Reminders | ICO

OSA

• VPN 'loophole' prompts privacy battle in UK's Online Safety Act implementation and https://www.bbc.co.uk/news/articles/cn72ydj70g5o
• Ofcom investigates 34 porn sites under new age-check rules - Ofcom

Adtech/marketing:

• https://www.lexisnexis.co.uk/legal/news/rival-to-iab-europes-ad-tracking-consent-tool-emerging-but-skeptics-stay-vocal
• ‘Pay or OK’ model of Der Standard partially violates EU’s GDPR, court says | MLex | Specialist news and analysis on legal risk and regulation and
• Case C-454/25 P: Appeal brought on 10 July 2025 by Meta Platforms Ireland Limited against the order of the General Court (Tenth Chamber) delivered on 29 April 2025 in Case T-319/24, Meta Platforms Ireland v European Data Protection Board
• Influencers face tougher oversight as Irish regulators agree on data-sharing deal | MLex | Specialist news and analysis on legal risk and regulation

Data transfers

• UK data transfers still relying mostly on EU clauses, government research finds | MLex | Specialist news and analysis on legal risk and regulation

Enforcement

• German data watchdog appeals court ruling on government’s Facebook Fan Page (update*) | MLex | Specialist news and analysis on legal risk and regulation   
• UK data transfers still relying mostly on EU clauses, government research finds | MLex | Specialist news and analysis on legal risk and regulation
• Temu found in breach of EU Digital Services Act due to risk failures (update*) | MLex | Specialist news and analysis on legal risk and regulation
• UK law firm Kennedys discloses data breach involving church abuse redress scheme
• Body cameras case: Opinion of Advocate general Case C-422/24 CURIA - List of results
• South Yorkshire Police reprimanded following deletion of body-worn video evidence | ICO
• South Wales Police and Gwent Police | ICO
• Camerdata fined EUR260,000 in Spain for GDPR breach | MLex | Specialist news and analysis on legal risk and regulation
• Digi Spain Telecom receives EUR200,000 GDPR fine | MLex | Specialist news and analysis on legal risk and regulation
• Spanish telecoms companies fined EUR1 million for GDPR breaches | MLex | Specialist news and analysis on legal risk and regulation
• ING Bank Śląski fined EUR4.3 million in Poland for GDPR violation | MLex | Specialist news and analysis on legal risk and regulation