Data and Privacy Matters: Legal Updates - July 2025

The team start by discussing how the ICO released guidance to prevent data breaches in document disclosure and how the European Commission has reviewed the UK's adequacy decision. Focus then turns to AI advancements, including the European Commission’s AI Code of Practice and the UK’s digital library for AI guidance.

Lorna reports on the GDPR’s positive impact on cybersecurity by way of the CNIL's report, showing reduced identity theft across the EU before highlighting Ofcom's children's codes of practice, which became effective in July and aim to improve online safety for children.

The episode wraps up with significant enforcement news, including a major inquiry into a data breach affecting Afghan and British military officials and an £18,000 fine imposed on a Scottish charity for the unauthorised destruction of personal records.

Sources of the news discussed:

UK updates

• New guidance on disclosing documents to the public
• ICO consults on updated guidance on storage and access technologies and on its approach to regulating online advertising | Practical Law
• ICO call for views on international transfers guidance | ICO

Online Safety

• Platforms told to introduce age checks in UK as enforcement powers start today | MLex | Specialist news and analysis on legal risk and regulation
• New profiling tools for online safety – privacy guidance
• Consultation opened on EU's cyberbullying action plan

Artificial Intelligence

• European Commission finalises code of practice for general-purpose AI models under EU AI Act | Practical Law
• Guidelines on the scope of obligations for providers of general-purpose AI models under the AI Act | Shaping Europe’s digital future
• UK to set up new one-stop shop on AI regulation with digital regulators (correct*) | MLex | Specialist news and analysis on legal risk and regulation

EU updates

• Data protection adequacy for non-EU countries
• Cybersecurity: The Economic Benefits of GDPR | CNIL

Data Breaches update

• UK data watchdog’s handling of Afghan breach could damage its ability to enforce
• Charity fined following destruction of irreplaceable personal records | ICO
• ICO statement in response to 2022 MoD data breach | ICO

UK retail sector update

• Co-op boss admits all 6.5m members had data stolen in cyber-attack | Co-operative Group | The Guardian

European enforcement

• Privacy NGO Noyb targets three Chinese apps with data access complaints - Euractiv

UK enforcement

• CO welcomes Tribunal ruling on preliminary issue raised by TikTok in its appeal of 2023 penalty | ICO