- within Strategy, Tax and International Law topic(s)
European Data Protection Board Sets a Higher Bar for Anonymous Data
On 7 July 2026, the European Data Protection Board (“EDPB”) adopted draft guidelines explaining when information is genuinely anonymous. Anonymous information falls outside the General Data Protection Regulation (“GDPR”), while pseudonymised information remains subject to it. Removing names or replacing them with identification codes is not enough if an individual can still be identified using other available information.
The Guidelines set out three criteria for assessing whether data is anonymous: individuals must not be capable of being isolated from the dataset; records must not be capable of being linked with other data relating to the same individual; and the data must not allow meaningful information about an individual to be inferred. If any of these criteria is not met, further analysis is required.
The draft does not create separate binding obligations at this stage, but it raises the standard organisations will be expected to meet before claiming that data falls outside the GDPR. The consultation closes on 30 October 2026.
US Supreme Court Brings Geofence Data under Fourth Amendment Scrutiny
The US Supreme Court case concerning geofence warrants and smartphone location data was decided on 29 June 2026. In Chatrie v. United States, the Court ruled that police access to historical smartphone location data constitutes a “search” under the Fourth Amendment, thereby triggering its constitutional safeguards against unreasonable searches and seizures. The Court emphasised that even short time windows of data can reveal highly sensitive information about a person’s movements, habits, and associations. These protections apply regardless of whether the data is held directly by law enforcement or stored by a private technology company. Police must therefore obtain a valid warrant supported by probable cause before accessing detailed historical location information from service providers.
The decision also has practical consequences for technology companies that collect or retain precise location data. They should no longer treat law-enforcement demands for this information as routine requests for company records. Before disclosing the data, companies should require a warrant and examine whether it clearly identifies the information sought and is sufficiently limited in scope. They may also need to update their internal procedures for receiving, reviewing and responding to geofence and similar location-data requests.
EU Safety Mandate Sets Strict Limits on In-Cabin Attention Data
From 7 July 2026, all newly registered passenger cars, vans, busesandtrucksinthe European Union must include an Advanced Driver Distraction Warning (“ADDW”) system. The requirement had applied only to newly approved vehicle models since 2024. ADDW systems monitor whether the driver is looking away from the road for too long and issue a visual, audible or physical warning.
These systems commonly use an inward-facing camera, but they may not use biometric data to identify the driver or another occupant. Information used to measure attention must remain within the vehicle’s closed system. It may not be sent to the manufacturer or another third party and must be deleted after the immediate assessment.
Austria Confirms Special Protection for Inferred Political Opinions
In a judgment delivered on 24 June 2026 and announced on 16 July 2026, Austria’s Supreme Administrative Court confirmed the unlawful processing of political-affinity profiles created for approximately 2.2 million people and reduced the applicable GDPR fine from EUR 16 million to EUR 13 million. The company had calculated how likely each person was to respond to advertising from particular political parties and had sold some of those predictions without consent.
The Court confirmed that statistically inferred political-affinity scores constitute sensitive personal data, even where they reflect predicted rather than expressly stated political opinions. Companies therefore cannot avoid the GDPR’s heightened safeguards by presenting political profiles as marketing probabilities. As the scores had been stored and partly sold without consent, their processing was unlawful.
European Union Court Limits Automatic Publication of Doping Sanctions
On 14 July 2026, the Court of Justice of the European Union (“CJEU”) ruled that an athlete’s name, infringement and suspension may be published online to deter doping and inform people affected by the ban. However, such publication must comply with the principle of proportionality under EU data protection law. This requires a case-by-case assessment, including the seriousness of the infringement, the purpose of publication, and whether less intrusive measures could achieve the same objective. Publication cannot therefore occur automatically without considering the individual circumstances of the athlete. In particular, keeping the information online after the suspension has ended will generally be considered disproportionate.
The Courtalsoclarifiedthatadoping infringement is a sporting disciplinary matter rather than a criminal offence for data protection purposes. Information about the substance or method used will receive the stricter protection given to health data only if it reveals something about the athlete’s physical or mental health. Athletes must also be able to complain to the competent data protection authority before publication takes place.
FTC Removal Powers Cast Doubt on the DPF’s Regulatory Foundations
On 29 June 2026, the US Supreme Court ruled in Trump v. Slaughter that the President may remove Federal Trade Commission (“FTC”) commissioners without establishing misconduct or another statutory reason. As the European Commission’s approval of the EU-US Data Privacy Framework (“DPF”) partly relied on independent US regulatory oversight, the decision has raised questions about whether the framework continues to provide adequate protection. On 31 July 2026, the European Data Protection Board asked the European Commission to review the issue.
The DPF remains valid, and companies may continue relying on it for transfers to certified US recipients. However, organisations should identify transfers that depend on the framework and prepare alternative safeguards, such as Standard Contractual Clauses, in case the adequacy decision is amended, suspended or invalidated.
United Kingdom Moves to a Board-Led Data Protection Regulator
On 15 July 2026, the United Kingdom appointed seven non-executive members to the new Information Commission and began recruiting its Chair. The Information Commission was created by the Data (Use and Access) Act 2025 and will replace the Information Commissioner’s Office (“ICO”). Its new corporate structure will include a Chair, a Chief Executive Officer, executive directors and the seven non-executive members.
The Chair will lead the board and work alongside Chief Executive Officer Paul Arnold in setting the Commission’s strategic direction. Its initial priorities are expected to include children’s data, artificial intelligence, public-sector data use and cyber resilience. The restructuring is intended to strengthen accountability and bring a wider range of experience into the regulator’s decision-making while maintaining continuity in the application of UK data protection law.
Federated Learning and Synthetic Data Enter Singapore’s AI Compliance Toolkit
On 20 July 2026, Singapore’s Personal Data Protection Commission (“PDPC”) and Infocomm Media Development Authority (“IMDA”) issued updated guidance on federated learning and synthetic data. The materials frame both technologies as practical ways to support AI development while reducing direct exposure to personal data. Federated learning is described as a method where models are trained across multiple organisations without moving raw datasets, with only model updates shared centrally. Synthetic data is presented as artificially generated information that mirrors statistical patterns without replicating real individuals.
The guidance focuses on how these tools should be implemented in practice. Organisations are expected to define clear responsibilities, choose suitable technical setups and test whether personal data could still be reconstructed from either model updates or synthetic outputs. IMDA also expanded its Privacy-Enhancing Technologies (“PETs”) Sandbox with additional use cases. The authorities emphasise that PETs do not create exemptions from data protection obligations, and organisations must still address core requirements such as consent, transparency, security and the risk of re-identification.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
