ICO Publishes Facial Recognition Audits and 107 Recommendations for Police Forces
On 18 August 2026, the Information Commissioner’s Office (“ICO”), published its report “Facial recognition in law enforcement” alongside audits of five police forces in England and Wales, conducted between June 2025 and March 2026. The regulator made 107 recommendations covering compliance and best practice, all of which were accepted or partially accepted. It found inconsistencies in compliance across forces, with live facial recognition generally better governed than retrospective searches, and identified priority work on senior oversight, staff responsibilities, and controls over the source and retention of images. Forces were advised to limit watchlist sizes and use only accurate, verifiable and lawfully held images.
FTC Proposes Enforcement Policy Statement on Personalised Pricing
On 19 August 2026, the US Federal Trade Commission (“FTC”) voted to seek public comment on a proposed Enforcement Policy Statement on “personalised pricing” - using personal data such as inferred income, household composition, browsing history and location to determine what a consumer may be willing to pay. The statement warns that at businesses may face enforcement action if they collect or use personal data for personalised pricing without appropriate consent or fail to clearly disclose that a price is personalised, the basis for the personalisation and the types of data used. While the FTC acknowledged that it cannot prohibit personalised pricing outright, it indicated that undisclosed data-driven pricing may constitute an unfair or deceptive practice. Once the proposal is published in the Federal Register, the public will have 30 days to submit comments.
Apple Challenges Renewed UK Demand for Access to Encrypted iCloud Data
On 5 August 2026, it was reported that Apple had filed a second legal challenge against the UK Government over access to encrypted iCloud backups. The UK Government initially demanded that Apple create the technical capability to provide access to end-to-end encrypted backups belonging to users of UK and US customers’ data alike. After withdrawing that demand in 2025, it issued a narrower order seeking the same capability in relation to UK users only. Apple argues that even it cannot currently access data protected by its Advanced Data Protection service and that compliance would therefore require the creation of a “backdoor” capable of bypassing the encryption. Apple is challenging the UK Government’s power to impose this requirement, maintaining that any such mechanism would weaken the security of all users’ data. The UK Government argues that the requested access is necessary for investigations into terrorism, serious crime and child sexual abuse.
German Privacy Group Files Criminal Complaint Over Meta Smart Glasses
On 12 August 2026, German human rights organisation HateAid filed a criminal complaint against Meta, Ray-Ban, Oakley and several German retailers. HateAid argues that Meta smart glasses look like ordinary glasses and can therefore be used to film people without their knowledge, putting them at risk of having the recordings shared online. In an accompanying petition, HateAid calls for three measures: 1) banning the sale of the glasses in Germany; 2) requiring cameras and recording activity to be clearly noticeable and 3) protected against tampering; and ensuring that people filmed without their knowledge have reliable access to legal support, including when recordings are shared online.
Brazilian Regulator Halts Facial Recognition Attendance in Paraná Schools
Brazil’s National Data Protection Authority has ordered Paraná’s public school system to immediately stop processing children’s and adolescents’ biometric data for attendance via facial recognition. The regulator found that the state had not established an adequate legal basis for processing the sensitive data or demonstrated that facial recognition was necessary and proportionate, particularly given the availability of less intrusive methods. It also identified insufficient safeguards concerning data security, information governance, image sharing and retention, noting that some students’ biometric data could have been stored for up to 14 years. The state must confirm within ten days that processing has ceased across all systems, schools and companies involved.
New Jersey Supreme Court Clarifies Liability Under Daniel’s Law
On 12 August 2026, the New Jersey Supreme Court clarified the scope of Daniel’s Law, a state privacy law that allows judges, prosecutors, law enforcement officers and certain other public officials, as well as their immediate family members, to require organisations to remove data concerning their home addresses and telephone numbers from publicly available sources. The Court unanimously ruled that an organisation that fails to remove such data within ten business days may be liable for at least US$1,000 per violation, without the claimant having to prove intent, recklessness or negligence. The ruling is particularly significant for data brokers and other organisations that collect and publish such data online.
Brazilian Regulator Halts Facial Recognition Attendance in Paraná Schools
Brazil’s National Data Protection Authority has ordered Paraná’s public school system to immediately stop processing children’s and adolescents’ biometric data for attendance via facial recognition. The regulator found that the state had not established an adequate legal basis for processing the sensitive data or demonstrated that facial recognition was necessary and proportionate, particularly given the availability of less intrusive methods. It also identified insufficient safeguards concerning data security, information governance, image sharing and retention, noting that some students’ biometric data could have been stored for up to 14 years. The state must confirm within ten days that processing has ceased across all systems, schools and companies involved.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
