Technology, Data and Privacy

 In the March edition of Data & Privacy Matters, the Fieldfisher Tech and Data team round up key UK and EU developments across data protection, online safety, cybersecurity, and digital regulation. They begin with the ICO’s draft updated guidance on automated decision‑making and profiling, published following the Data Use and Access Act 2025. The guidance clarifies when automated decision‑making rules apply, what meaningful human involvement looks like, and signals a shift towards a more permissive “right to challenge” model.Staying with the ICO, they discuss updated purpose limitation guidance, which tightens expectations around compatibility assessments and record‑keeping where personal data is reused, particularly where consent was the original lawful basis.Children’s online safety remains a major focus this month. The team cover the joint ICO and Ofcom statement on age assurance under the Online Safety Act, alongside potential European Commission enforcement under the Digital Services Act, reflecting increased regulatory scrutiny of age assurance, default settings and systemic risk.European developments continue with draft guidance on the Cyber Resilience Act, clarification on software scope, and the closure of the Digital Fitness Check consultation under the Commission’s Digital Omnibus initiative.They conclude with enforcement and litigation updates, including the CJEU’s Brillen Rottler ruling on abusive DSARs and a cyber incident at UK Companies House.Find the sources here.

Tune in to the action-packed latest episode of Fieldfisher's Data & Privacy Matters podcast, as Camille Ebden, Melanie Ludolph and Rida Ahmed look at the key data and privacy news from February 2026.Read more here.

The episode starts with a discussion of the EDPB's consultation regarding the Processor Binding Corporate Rules (BCR-Ps). The consultation seeks feedback on the EDPB's draft recommendations on the BCR-Ps which include standardisation measures and various clarifications and explanations, alongside discussion on the scope of the BCR-Ps.The team then speaks about recent developments in online safety for children. As discussed last episode, it truly does seem to be the year of the child when it comes to international data protection.  First, the podcast discusses the Global Online Safety Regulators Network's joint statement on shared principles for the adoption of age-assurance technologies. The UK government's consultation into children's access to social media is also explored, and finally the podcast reviews the EU push for age-based restrictions to social media.The podcast then summarises news from the UK. The episode looks at the ICO's new powers and the new criminal offences under the Data (Use and Access) Act 2025. Recent investigations are then discussed, with a focus on Grok and Meta who are under scrutiny from the ICO and Ofcom. Before moving on to the EU, the team also touch on various structural developments to the ICO and Ofcom, with a formal cooperation agreement established between Ofcom and the Internet Watch Foundation, and updated ICO guidance published on Rights of Access and International Data Transfers.On the EU front there was a range of matters requiring the podcast's attention this month. The diverse topics explored include the EU-Brazil adequacy decision, the Irish X Internet Unlimited Company litigation, an EU Digital Omnibus update, negotiations regarding the detection of online CSAM and new Regulation (EU) 2025/2518.The episode is wrapped up with mentions of significant fines and enforcements, including various French CNIL fines ranging from €3.5 million to €27 million and the European Commission's preliminary findings that TikTok is in breach of the Digital Services Act (although we note a final decision has not yet been reached).With the volume of continuous developments in the data and privacy ecosystem, it can be hard to stay on top of the key news stories. This is a must-listen podcast to catch up on notable data and privacy news in the past month and consider what your business or organisation needs to be doing in response.Find the source of news discussed here.

In the latest privacy podcast episode Anna Rawlinson, Lorna Cropper and Harry Barder delve into the data and privacy stories that captured their attention throughout December 2025. Join them as we explore developments and new stories that are impacting businesses and organisations, including:updates to the rules and regulations applicable to children's use of online services from across the globe in Australia to here in the UK;recent developments from Ofcom, including insights into recent fines issued;updates from the ICO including their response to the Cyber Security and Resilience Bill and their revised Right of Access guidance;news from the EU, including an analysis of the practicality of a single cyber-reporting hub in the EU and the CJEU's ruling on X v Russmedia Digital SRL and Inform Media Press SRL; andvarious fines and enforcement actions during the month.Read more here: Data and Privacy Matters: Legal Updates - December 2025

Tune in to the action-packed latest episode of Fieldfisher's Data & Privacy Matters podcast, as Camille Ebden, Tessa Waite and Rida Ahmed look at the key data and privacy news from November 2025. They dive into the latest news on the much anticipated publishing of the EU Digital Omnibus Regulation Proposal and how this aims to simplify and harmonise digital regulations in the EU. After discussing the CJEU's Inteligo Media decision which impacts the interpretation of e-marketing rules under the ePrivacy Directive, the team consider international data transfer developments in India, Brazil the US and China. This is followed by discussions around the latest Online Safety Act implementation from Ofcom and the publishing of the UK's draft Cyber Security and Resilience Bill. Finally, the team consider the latest from the ICO and highlight the key fines and enforcements that have occurred throughout the month.  A list of sources of the news discussed can be found here. 

 In the latest episode of Fieldfisher’s Data and Privacy Matters podcast, hosts Lorna Cropper, Emma Yaltaghian and Sophie Gosling provide a comprehensive roundup of the key legal developments from October 2025. The team start by discussing the Irish DPC’s €530 million fine against TikTok, with the regulator finding that TikTok had not applied appropriate safeguards when transferring data to China and had fallen short on its transparency obligations. The team also reviewed the EDPB’s opinion on the UK’s adequacy decision, which welcomed continued alignment with EU standards but raised concerns over new ministerial powers introduced under the Data (Use and Access) Act. They continue with coverage of the ICO’s successful appeal against Clearview AI, confirming that the regulator can take enforcement action against overseas organisations processing UK residents' data - even if they are third party controllers and do not engage in such monitoring themselves. The ICO’s ongoing consultations were also discussed, including new guidance on enforcement and the upcoming charitable purpose soft opt-in for direct marketing.The team reflects on the high-profile case of former MasterChef host Gregg Wallace, who brought legal action against the BBC for delayed responses to his data subject access requests, highlighting the operational and reputational risks of mishandled DSARs.Finally, the team discusses several major enforcement actions. Capita was fined £14 million following its 2023 ransomware attack, Grindr’s €6.5 million penalty for unlawful data sharing was upheld in Norway, and the Dutch DPA fined Experian €2.7 million for unlawful credit profiling.

In the latest episode of Fieldfisher's Data and Privacy Matters podcast, hosts Martin McElroy, Anna Rawlinson and Rida Ahmed provide a comprehensive roundup of the key legal developments from September 2025. Read more here: Data and Privacy Matters: Legal Updates - September 2025

In this latest episode of Fieldfisher’s Data and Privacy Matters podcast, hosts Anna Rawlinson, Lorna Cropper and Emma Yaltaghian  provide a comprehensive roundup of the key legal developments from August 2025.The team start by discussing the growing criticism of the EU’s digital regulations, including the Digital Services Act and AI Act, with concerns about their impact on innovation. They also touch on the EU Data Act, effective September 2025, which brings new rules on data access and interoperability.  Discussion then turns to ICO consultations on the new lawful bases of recognised legitimate interests and complaints procedure.  Attention is also give to the Online Safety Act which now requires strict age verification for adult content and the surge in VPN use. The podcast also covers legal challenges to consent models, increased oversight of influencer marketing, and major enforcement actions, including sizeable fines in Spain and Poland.

In the latest episode of Fieldfisher’s Data and Privacy Matters podcast, hosts Lorna Cropper, Emma Yaltaghian and Leo McSweeney provide a comprehensive roundup of the key legal developments from July 2025. The team start by discussing how the ICO released guidance to prevent data breaches in document disclosure and how the European Commission has reviewed the UK's adequacy decision. Focus then turns to AI advancements, including the European Commission’s AI Code of Practice and the UK’s digital library for AI guidance.Lorna reports on the GDPR’s positive impact on cybersecurity by way of the CNIL's report, showing reduced identity theft across the EU before highlighting OFCOM's children's codes of practice, which became effective in July and aim to improve online safety for children.The episode wraps up with significant enforcement news, including a major inquiry into a data breach affecting Afghan and British military officials and an £18,000 fine imposed on a Scottish charity for the unauthorised destruction of personal records.

In the latest episode of Fieldfisher’s Data and Privacy Matters podcast, hosts Martin McElroy, Emma Yaltaghian and David Horne provide a comprehensive roundup of the key legal developments from June 2025.Read more, and find the sources here.

In the latest episode of Fieldfisher's Data and Privacy Matters podcast, hosts Martin McElroy, Anna Rawlinson and Leo McSweeney provide a roundup of the significant legal updates from May 2025.We begin with the Irish Data Protection Commission’s engagement with Meta’s plans to train its generative AI models using public Facebook and Instagram content. We also cover the potential for legal challenges to Meta's plans from civil society as well as other Meta developments in Germany and their response to the EDPB’s ‘consent or pay’ opinion. Shifting focus to broader data protection issues, we discuss the EDPB’s positive opinion on the European Patent Organisation’s adequacy decision and its cautious stance on extending the UK’s adequacy status. We also consider the European Commission's proposed targeted GDPR compliance simplifications for a specific category of small mid-cap (SMCs) enterprises.Enforcement actions continue across the EU, with the Irish DPC fining TikTok €530 million for unlawful data transfers to China, the Italian SA fining Luka Inc. €5 million over its AI chatbot, Replika and France’s CNIL penalising SOLOCAL €900,000 for unlawful marketing practices. In the UK, the Data Use and Access Bill faced amendments around AI transparency in the House of Lords, and the ICO responded to the major cyberattacks on several UK retailers. These updates underscore the intensifying regulatory focus on AI, cross-border data flows, and commercial data use—essential insights for anyone navigating the evolving digital compliance landscape.Find the sources of news discussed here.

April was another eventful month in the world of data and privacy, so join us as we delve into the latest news in this month's episode of the Fieldfisher Data & Privacy Matters podcast.Lorna Cropper, Matthew Gregson,  and Charley Guile dive into the recent developments regarding the use of personal data for training AI systems, highlighting new inquiries by the Irish Data Protection Commission and Meta's ongoing efforts in the EU. This episode also covers the European Commission's AI Continent Action Plan and provides actionable insights for organisations to comply with the upcoming EU AI Act. Read more here:

2025 is shaping up to be an exciting year for data and privacy. Dive into the hottest stories from March in this month's episode of the Fieldfisher Data & Privacy Matters podcast.Listen here to keep updated!Read more here.

February was another eventful month in the world of data and privacy, so join us as we delve into the latest news in this month's episode of the Fieldfisher Data & Privacy Matters podcast.Martin McElroy, Matthew Gregson, and Jonathan Comfort kick off the episode with a look at the latest AI developments, including the European Commission's draft guidelines on prohibited AI practices and the continued scrutiny of the Chinese AI tool DeepSeek by various EU authorities. We also comment on the Paris AI Summit and the expanding scope of the European Data Protection Board's ChatGPT task force which now covers broader AI enforcement.Read more here.

January was a busy start to 2025 in the world of data and privacy so join us in this month's episode of the Fieldfisher's Data & Privacy Matters podcast to get some insight into the key news.Lorna Cropper, Charley Guile, and Salma Eleyan start the episode discussing China's latest AI model, its industry impact, and the swift regulatory responses. They also delve into the UK government's AI Opportunities Action Plan and the ICO's reaction to this ambitious strategy.Read more here.

Join the team as Lorna Cropper, Chloe Abbot and Anna Rawlinson discuss the European Data Protection Board’s (EDPB) opinion regarding AI models and personal data processing including the considerations that must be assessed on a case-by-case basis, particularly when using legitimate interests as a foundation for AI development.Lorna then turns to the EU's progress on the General Purpose AI Code of Practice, which guides AI providers on compliance with the AI Act. This draft involves several working groups, and the next iteration is expected soon, aimed at ensuring seamless integration and practicality.Anna follows on with updates on the ICO's consultation series on generative AI including lawful bases for using web-scraped data, the necessity for transparency, and the importance of designing AI products with data protection in mind from the outset. With the EU's digital strategy advancing, it's clear that the GDPR cannot be looked at in isolation and its interplay with the EU AI Act, the EU Data Strategy and the Digital Services Package is something the EDPB wants to receive more consideration, which it flags in its response to the EU's second GDPR evaluation report. The episode then covers the UK’s Data (Use and Access ) Bill, which proposes significant amendments to automated decision-making rules and multiple enforcement actions such as Italy's data protection regulator fining OpenAI €15 million for GDPR breaches and concludes with a discussion on Ofcom's new codes of practice aimed at addressing illegal online content under the UK's Online Safety Act.Find the sources here.

In the latest episode of Fieldfisher's Data and Privacy Matters podcast, Nuria Pastor, Sophia Steiger and Elle Calam explore the key data and privacy news from November 2024. They take us through the latest on European data transfer developments, a wealth of newly published ICO guidance, codes and recommendations across a range of different sectors, UK and EU legislative updates and, last but not least, a round-up of the month's enforcement action! For a list of sources of the news discuss see here.

The latest episode of Fieldfisher's Data and Privacy Matters podcast, hosted by Nuria Pastor, Charley Guile, and Imogen Boffin, provides a roundup of major legal updates for September. Discussion topics include new EU standard contractual clauses, collaboration between the European Commission and EDPB, Californian legislation on AI deepfakes, NIST's new AI risk management program, and updates on AI-related legal actions involving Meta, LinkedIn, and Google. The episode also covers GDPR-related court rulings, including subsidiary fine calculations and supervisory authority discretion, as well as fines imposed by the French and Irish data protection authorities on businesses for GDPR violations.

In the latest episode of Fieldfisher's Data and Privacy Matters podcast, Camille Ebden, Anna Rawlinson and Sophia Steiger explore the key data and privacy news from October 2024. From the Data (Use and Access) Bill, headlines from across the EDPB, CJEU and ICO, cyber security regulatory updates and a round-up of the month's enforcement action, this is a jam-packed episode! For a list of sources of the news discuss see here.

In this action-packed eighth episode of Fieldfisher's Data & Privacy Matters podcast, Lorna Cropper, Martin McElroy and Laura Williams look at the key data and privacy news from August 2024.  They take us through EU AI Act coming into force, the ICO's latest consultation on generative AI and the latest enforcement news from the EU and the UK. The episode explores the ICO's announcement in relation to social media and video sharing platforms and their children's privacy practices, how the new ICO privacy notice generator may help organisations and SMEs and the news that the ICO will be reviewing their fees. And to bring this episode to a close, the team will discuss the latest action taken against the Labour Party for failing to respond to SARs on time, a €290 million fine to Uber and a £6 million provisional fine against a software provider following a ransomware attack in August 2022, which disrupted the NHS and social care services. A list of sources of the news discussed can be found here.

It may be summertime and holiday season in the northern hemisphere but the world of data and privacy does not seem to pause.  July was another month filled with news and developments.  Tune in to the latest episode of Fieldfisher's Data & Privacy Matters podcast, as Lorna Cropper, Charley Guile and Sophia Steiger look at this month's key issues and takeaways this month.They start with news about the EU AI Act entering the Official Journal and how you can get involved with the AI Office's first Code of Practice or respond to its consultation on trustworthy general-purposes AI models. Guidance and commentary from DPAs across the EU is discussed before attention turns to the King's first Speech under the new UK Labour Government. IAB Europe's position paper on the 'Consent or Pay' model together with Commissions preliminary finding of this model under the DMA are discussed. The podcast concludes with details about a Swedish referral to the CJEU about body cameras and providing transparent information to individuals before we wrap with the latest enforcement new.  A list of sources of the news discussed can be found [here].

In the latest episode of Automation Unwrapped. John Cassels, a Partner at FieldFisher interviews Simon Meakins, Director of Advanced Air Mobility at Bristow Group. They discuss Simon's aviation career, autonomous technology's impact, and the future of electric powertrains and autonomy in aviation. Simon highlights regulatory challenges, technological advancements, and exciting developments expected in the near future.

Tune in to the action-packed latest episode of Fieldfisher's Technology Data and Privacy podcast and join our host Olivier Proust, Partner in our Brussels office in our Tech and Data team, as he dives into the groundbreaking AI Act which was published in the EU's Official Journal on 12th July. Olivier is joined by the insightful Laura Caroli, Senior Policy Advisor at the European Parliament, who played a pivotal role during the legislative process of this significant regulation as the MEP Assistant who worked and negotiated the text on behalf of the European Parliament. Olivier and Laura cover:An introduction to the AI Act: Understand the purpose and scope of this new regulation.Legislative process insights: Laura Caroli shares her firsthand experiences and the challenges faced during the drafting of the AI Act.Impact of the Act on innovation: A discussion on how the AI Act aims to balance regulation with the need for technological innovation.Comparisons with GDPR: Explore the differences and similarities between the AI Act and GDPR, especially in terms of enforcement and compliance.Global influence: How the AI Act is already influencing legislation in other regions, such as the United States and Latin America.Future outlook: Predictions on how the AI Act will shape the future of AI development and deployment in the EU and beyond.Listen now to gain a deeper understanding of the AI Act and its implications for the future of AI technology. Don't forget to subscribe and leave a review!If you'd like more expert insights into the most impactful issues for organisations with respect to AI, with a focus on the interplay between the AI Act and the GDPR, don't forget that Part 1 and Part 2 of our International Data and Privacy Team's webinar series are available to watch on demand. 

Tune in to the action-packed latest episode of Fieldfisher's Data & Privacy Matters podcast, as Camille Ebden, Matthew Gregson and James Lim look at the key data and privacy news from June 2024.They dive into the latest news on the EU AI Act and the reasons behind U-turns from Meta and Apple on the rollout of new AI features. The team consider key data breaches, including those affecting Ticketmaster, the UK Post Office and the NHS; followed by discussions on the latest from the ECJ, EDPB and the ICO in June. The podcast explores key developments from the US, including updates on the American Privacy Rights Act and the Swiss-US Data Privacy Framework. Finally, the team consider noyb's complaints against Microsoft regarding the processing of children's data in Microsoft's 365 education services.A list of sources of the news discussed can be found here.

In this fifth episode from Fieldfisher's Data & Privacy Matters podcast, Nuria Pastor  and Sophia Steiger  round up the key data and privacy news that has caught their attention throughout May 2024.They take us through the latest updates on AI from the EU, UK and USA as legislation evolves and the EU AI Act is approved. This episode explores updates from regulators, from the EDPB's opinion on facial recognition technology to streamline airport passengers' flow to the ICO's strategic approach to regulating AI and the Dutch DPA's guidance on data scraping. And if that is not enough, the episode touches on developments in UK public sector breaches as well as sentencing for the historic Vastaamo hacking case in Finland. A list of sources of the news discussed can be found [here].

In the latest episode of Fieldfisher's Data and Privacy Matters podcast, Lorna Cropper, Hannah Wallett and Chloe Abbott look at the key data and privacy news from April 2024. From the EDPB's recent opinion on "pay or okay" models and strategy for 2024-2027, headlines from the ICO, AI developments, an introduction to the draft American Privacy Rights Act together with a roundup of the attention grabbing enforcement action, there is certainly a lot to consider!For a list of sources of the news discussed see  our website.  

In this  episode of Fieldfisher's Automation Unwrapped podcast series, Dronamics' Co-Founder and CEO Svilen Rangelov takes us beyond the buzz and chats with Tom Ward  about the company's game-changing technology.From the origins of the idea (inspired by a craving for cheese!) to the groundbreaking Black Swan drone, designed for lightning-fast same-day delivery, this is a story you don't want to miss…But it's not just about convenience – it's about sustainability too. Dronamics is paving the way for greener logistics solutions, reducing CO2 emissions, and building infrastructure for the future of air transportation.

In this  third  episode of Fieldfisher's new Data & Privacy Matters podcast, Martin McElroy, Kristina Holm and Sophia Steiger look at the key data and privacy news from March 2024.  March gave the team much to discuss: they take us through the latest on AI from the EU and UK, the EU's Cyber Resilience Act ("CRA"), the ICO's consultation on the "pay or OK" model and two recent CJEU judgments. The episode also explores the ICO's recent fining guidance, top fines hitting the headlines around Europe and a variety of ICO enforcement action including Amazon's appeal of the $34.6 million fine from the CNIL.  A list of sources of the news discussed can be found here.

In this action-packed second episode of Fieldfisher's new Data & Privacy Matters podcast, Camille Ebden, Charley Guile and Sophia Steiger  look at the key data and privacy news from February 2024.  They take us through the second phase of the EU Digital Services Act ("DSA") coming into force, the European Commission's investigation into TikTok's DSA compliance, the ICO's new content moderation guidance and the latest on AI from the EU and the UK. The episode explores the ICO's enforcement notice to Serco regarding employee tracking via biometric data, the EDPB's opinion on when the One-Stop Shop mechanism applies as well as updates on regulator and court views regarding Meta's "pay or ok" model. If that is not enough, the episode touches on the new cookie guidance from the Spanish and Dutch regulators, a €79m marketing fine to Enel Energia from the Garante and a £350,000 ICO fine to the Ministry of Defence.A list of sources of the news discussed can be found here.

In this latest Automation Unwrapped episode Richard Lawne, Senior Associate at Fieldfisher talks to Frank Gonnello, Lead Counsel, Product and Privacy at Cruise about the dynamic relationship between legal regulation and the rapid advancements in technology, and offer invaluable insights on privacy, automation, and the future of autonomous vehicles. There is a critical need to bridge the gap between regulatory frameworks and the swift pace of technological innovation, while acknowledging both the potential benefits and downsides of automation.

In this first episode of Fieldfisher's new Data & Privacy Matters podcast, Lorna Cropper, Chloe Abbott and trainee Sophie Milne look at the key data and privacy news from January 2024.  Opening with the newly published EU Data Act and the leaked consolidated version of the EU AI Act, before turning their focus to the EDPB's publications on consolidated enforcement and One Stop Shop case digest.  The episode then considers the EDPB's website auditing tool besides the ICO's newly launched consultation series on generative AI and details about its cookie enforcement work.  The spotlight then turns to a round up of the attention grabbing administrative fines.  With a few other soundbites thrown in there is certainly a lot for all stakeholders to consider.  A list of sources of the news discussed can be found here.

Olivier Proust, Partner in our Brussels office, speaks to Nicholas Zylberglajt,  the CEO of Unmanned Life, an award winning software platform for seamless orchestration of autonomous robotics. Nicholas speaks about how the power of automation is reshaping industries far beyond a few isolated examples, his challenges and predictions for the coming years.

In this episode of Automation Unwrapped, Chris Eastham interviews Simon Delavalle, Chief Technology Officer at Veolia Nuclear Solutions to provide a glimpse into the remarkable projects and innovations revolutionising how we solve complex challenges by harnessing the power of automation. They discuss the use of robots and automation in the nuclear industry, particularly in the challenging task of cleaning up the Fukushima nuclear disaster site. Simon shares his experiences in designing robotic systems to navigate hazardous and unknown environments, and how artificial intelligence is transforming the industry.