Data & Privacy Matters: Legal Updates - May 2025

We begin with the Irish Data Protection Commission’s engagement with Meta’s plans to train its generative AI models using public Facebook and Instagram content. We also cover the potential for legal challenges to Meta's plans from civil society as well as other Meta developments in Germany and their response to the EDPB’s ‘consent or pay’ opinion.

Shifting focus to broader data protection issues, we discuss the EDPB’s positive opinion on the European Patent Organisation’s adequacy decision and its cautious stance on extending the UK’s adequacy status. We also consider the European Commission's proposed targeted GDPR compliance simplifications for a specific category of small mid-cap (SMCs) enterprises.

Enforcement actions continue across the EU, with the Irish DPC fining TikTok €530 million for unlawful data transfers to China, the Italian SA fining Luka Inc. €5 million over its AI chatbot, Replika and France’s CNIL penalising SOLOCAL €900,000 for unlawful marketing practices.

In the UK, the Data Use and Access Bill faced amendments around AI transparency in the House of Lords, and the ICO responded to the major cyberattacks on several UK retailers.

These updates underscore the intensifying regulatory focus on AI, cross-border data flows, and commercial data use—essential insights for anyone navigating the evolving digital compliance landscape.

Sources of the news discussed:

DPC and Meta

• DPC statement on Meta AI | 21/05/2025 | Data Protection Commission
• noyb sends Meta 'cease and desist' letter over AI training. European Class Action as potential next step 

Other Meta news

• German privacy watchdog scraps plans to stop Meta AI training on personal data - Euractiv 
• Meta’s appeal against EU privacy watchdogs’ ‘consent or pay’ opinion rejected | MLex | Specialist news and analysis on legal risk and regulation 

Data Use and Access Bill

• PL&B News - Lords amend DUAB to require transparency in relation to AI models 

European developments

• Commission proposes simplification measures to save EU businesses a further €400 million per year 
• European Patent Organisation and extension of adequacy decisions for the UK: EDPB adopts opinions | European Data Protection Board 

ICO Statement on UK retail cyber attacks

• Statement on cyber incidents impacting retailers | ICO 

Enforcement

• AI: the Italian Supervisory Authority fines company behind chatbot “Replika” | European Data Protection Board 
• Ireland's DPC discusses recent TikTok enforcement decision | IAPP 
• Data brokers: SOLOCAL MARKETING SERVICES fined €900,000 | CNIL