The changes to data controllers’ complaints handling obligations, made via the Data (Use and Access) Act, will come into force on 19 June 2026. These include a new obligation to acknowledge complaints within 30 days, respond without undue delay, and
Privacy
Tax authorities’ access to individuals’ banking data: the European Court of Human Rights sets privacy limits in the case of Ferrieri and Bonassisa v. Italy

The 2026 opened with a notable decision by the European Court of Human Rights (ECtHR) in the case of Ferrieri and Bonassisa v. Italy.
The ECtHR found the violation of Article 8 of the Convention for the Protection…
Privacy Day 2026: Why trust is the new competitive advantage
Every year, Privacy Day gives organizations a moment to pause and reflect on how rapidly the data landscape is shifting, but 2026 feels different. The conversation has moved beyond compliance checklists and breach headlines. Privacy is moving beyond legal, shaping…
Agentic AI: the ICO’s early thoughts on the data protection implications

The ICO has kicked off 2026 with sharing its early thoughts on the data protection implications of agentic AI in its ICO tech futures: Agentic AI report. The report considers the novel data protection risks presented by agentic AI.
Text messages and the new Texas registration requirement
On September 1, 2025, Texas amended its telephone solicitation law to include text messages and to add several new requirements, including a registration requirement with the Texas Secretary of State, plus a form of security (such as a bond) in…
The Healthline Order: Privacy law grows teeth
The proposed $1.55 million CCPA settlement with Healthline is not just the largest of its kind to date – it is, more importantly, it marks a pivotal evolution in how American regulators are approaching consumer privacy enforcement.
The facts are…
AI Armageddon Series
The biggest AI privacy problems no one is talking about: Installment 1: The Agent2Agent (“A2A”) Protocol
In the privacy world, everyone is focused on fairness, bias, and data scraping. These issues, however, are not even among the top 3 AI…
CJEU Advocate General clarifies when pseudonymised data falls outside the definition of personal data

On 5 February 2025, the Advocate General of the Court of Justice of the European Union (CJEU) issued its opinion in the case of C 413/23 P European Data Protection Supervisor (EDPS) v Single Resolution Board…
Online Safety Act: Protecting Children from Harmful Content Online – Ofcom’s Guidance on Age Assurance for Part 3 Services
Ofcom has published its guidance for implementing age assurance measures for regulated service providers. User-to-user (U2U) services and search services take note: a decision not to implement highly effective age assurance measures means that your service may be deemed by…
FTC finalizes COPPA rule amendments
On January 16, 2025, the Federal Trade Commission (FTC) announced significant amendments to the Children’s Online Privacy Protection Act (COPPA) Rule after a comprehensive review that began in 2019. This marks the first major update since 2013 and represents a…









