Children’s hospital reprimand highlights paper record security risks for UK organisations
Ireland’s Data Protection Commission (‘DPC’) has reprimanded Children’s Health Ireland (CHI) following serious shortcomings in the storage, management and disposal of children’s medical records at its Tallaght facility…
NHS England receives 44,000 objections to Palantir-powered data platform
More than 44,000 people have formally objected to the processing of their health information within NHS England’s Palantir-powered Federated Data Platform…
OpenAI agent gains unauthorised access to Australian government health portal
Australia has launched an urgent review after an OpenAI agent gained unauthorised access to a government health data portal while researching public medical expenditure…
TikTok abandons appeals and accepts £12.7 million children’s privacy penalty
TikTok has withdrawn two appeals arising from action taken by the UK regulator concerning its processing of children’s personal information…
Police cloud arrangements highlight difference between location and sovereignty
Questions have been raised about the protection of highly sensitive information held by more than 40 UK police forces on Microsoft’s Azure cloud platform…
First reported AI agent-linked breach tests conventional security controls
Spain’s data protection authority has publicised what it describes as the first known personal data breach allegedly carried out by an AI agent with minimal human intervention…
Cyber Resilience Act incident reporting duties come into force
New reporting obligations under the EU Cyber Resilience Act took effect on 11th September 2026, creating short notification deadlines for manufacturers of products containing digital elements…
Fraudulent government requests expose Revolut customer information
British fintech company Revolut has confirmed that it disclosed sensitive customer information to an unauthorised third party after receiving fraudulent information requests sent from the genuine email domain of a government agency…
Gambling websites accused of widespread cookie and tracking failures
A study of 624 websites operated by British-licensed bookmakers and online casinos has alleged widespread non-compliance with privacy requirements governing cookies and online tracking…
HSE fined after medical records found in contaminated storage sites
Ireland’s Data Protection Commission has fined the Health Service Executive €645,000 after finding serious and systemic failures in its storage and retention of paper records containing sensitive medical information…
ICO contacts Meta after major US children’s safety settlement
The ICO has said that it is contacting Meta following the company’s settlement of US claims concerning the design of Facebook and Instagram and their effects on children…
Cyberattack exposes data of 8.7 million UK airport customers
Manchester Airports Group has confirmed that an unauthorised third party accessed information concerning approximately 8.7 million customers of Manchester, London Stansted and East Midlands airports…
EU e-Evidence rules take effect for cross-border data orders
The EU’s e-Evidence Regulation began to apply on 18th August 2026, introducing a new framework through which judicial authorities can seek electronic evidence directly from service providers operating across borders…
ICO calls for stronger governance as police facial recognition expands
The Information Commissioner’s Office has warned that stronger and more consistent data protection governance is needed as police forces across England and Wales expand their use of facial recognition technology…
NHS transplant service sent sensitive patient data over unencrypted pagers
NHS Blood and Transplant has acknowledged a personal data breach after sensitive information about transplant patients was routinely transmitted through an unencrypted pager network…
Not such a modest duty: why the new DUAA complaints regime deserves attention
Not such a modest duty: why the new DUAA complaints regime deserves attention Kate Brimsted Partner, Shoosmiths Kate Brimsted, Partner at Shoosmiths LLP, explores the new complaints-handling duty introduced by the Data (Use and Access) Act 2025, explaining the scope of the duty, the practical challenges it creates, key operational risks and practical guidance on […]
ACRO reprimanded over cybersecurity failings
The ICO has reprimanded the ACRO Criminal Records Office after cybersecurity failings potentially exposed the personal information of up to 10,920 people…
Upper Tribunal draws a firm boundary around special-purposes processing
The Upper Tribunal has dismissed TikTok’s appeal concerning whether the ICO’s £12.7 million penalty notice engaged the special-purposes restrictions in sections 156 and 174 of the Data Protection Act 2018…
ICO action against Met highlights the limits of policies and training reminders
The Information Commissioner’s Office has issued the Metropolitan Police Service with an enforcement notice and reprimand after investigating two highly sensitive disclosures of personal information…
ICO clarifies the independent status of the UK-US data bridge
The ICO has updated its international transfers guidance to emphasise that the UK Extension to the EU–US Data Privacy Framework is legally separate from the European Commission’s adequacy decision for the US…
UK regulator raids businesses linked to car finance nuisance marketing
The ICO has executed search warrants at properties in Bolton, Burnley, Liverpool, London and Swansea as part of an investigation into suspected nuisance marketing connected with car finance mis-selling claims…
TikTok provisionally found to have failed to protect children
The European Commission has provisionally concluded that TikTok’s arrangements for protecting minors fall short of the requirements of the EU Digital Services Act…
ICO updates guidance on the right to object
The ICO has updated its public-facing guidance on the right to object to reflect the changes made by the Data (Use and Access) Act 2025…
Government launches trio of consultations on future UK data policy
The UK government has launched three calls for evidence seeking views on key aspects of the UK’s future data policy framework, covering international data transfers, data regulation in the age of AI and other data-intensive technologies, and the marginal cost restriction on public sector information re-use…
ICO annual report reveals sharp rise in complaints and personal data breach reports
The Information Commissioner’s Office has published its Annual Report for 2025/26, revealing a significant increase in data protection complaints, personal data breach reports and Freedom of Information complaints received during the year…