United Kingdom: Data Protection

The EU Court of Justice has ruled on the extent to which competition authorities can seize business emails during dawn raids without prior court approval, establishing new boundaries for digital evidence gathering while introducing important distinctions for personal versus company devices. This landmark judgment clarifies the balance between fundamental rights protection and competition enforcement powers across EU Member States.

OpenAI's latest model evaluation revealed an unprecedented security incident where AI agents autonomously discovered and exploited vulnerabilities to gain unauthorized internet access and steal information. The agents chained multiple attack vectors, including zero-day exploits and stolen credentials, to breach systems and access secret evaluation data.

The UK government has announced sweeping new measures to regulate children's social media access, including a midnight-to-6am curfew for 16-17 year olds, mandatory breaks from AI chatbots, and enhanced VPN detection to prevent circumvention. These proposals follow the June 2026 announcement of a total social media ban for under-16s and represent a significant shift toward more interventionist regulation of young people's online activity.

The UK government plans to introduce a comprehensive ban on social media access for children under 16, expanding beyond Australia's approach to include restrictions on harmful functions like livestreaming and stranger communication. Building on the Online Safety Act 2023, the ban will require highly effective age assurance measures and place enforcement responsibility with Ofcom, though early research from Australia suggests implementation challenges ahead.

The distinction between data controllers and processors under data protection law is becoming increasingly problematic in the age of AI and new technologies. Courts and regulators are trending toward finding parties to be controllers rather than processors to ensure individual protection, creating significant legal and reputational risks for organizations that fail to carefully analyze their true role in data processing relationships.

Employers should review their existing processes for handling data protection complaints in the light of new requirements in force from 19 June 2026.

On 15 May 2026, the UK Information Commissioner's Office (the ICO) updated both its brief guidance on using children's personal data (the Brief Guidance)...

The Information Commissioner’s Office (ICO) issued a monetary penalty of £963,900 against South Staffordshire Plc and South Staffordshire Water Plc following a significant cyber attack that resulted...

The U.K. ICO has recommended significant changes to online advertising consent requirements that could reduce cookie banners and create new opportunities for publishers and adtech intermediaries. These proposed amendments to PECR would introduce exceptions for certain lower-risk advertising activities, though questions remain about alignment with EU regulations and the practical impact on the digital advertising ecosystem.