June Data Wrap: A Snapshot Of Key Regulatory Developments

In March 2025, Rebecca Slaughter was fired from her position on the Federal Trade Commission (“FTC”) following Trump's claim that her service was no longer serving the administration's priorities. On 29 June 2026, the US Supreme Court overturned the 1935 case of Humphrey's Executor, which granted independent agencies protections against unconstitutional removals, to hold that the President could remove FTC commissioners at will. As a result, the FTC is no longer classified as an independent agency that implements impartial reviews, and will be subject to greater control from the President. 

This ruling has important implications for the EU-US Data Privacy Framework (“DPF”). The DPF is the legal framework which allows personal data permits personal data from the EU to be transferred to US companies certified under the DPF without the need for additional safeguards. This is based on the European Commission's adequacy decision, which recognises that the US provides an essentially equivalent level of data protection to that in the EU for organisations registered with the DPF.

The foundations of the EU's adequacy decision are based on the US' Executive Order on 'Enhancing Safeguards for United States Signals Intelligence Activities'.

The Order provides Europeans whose personal data is transferred to the US a guarantee that there will be:

• Binding safeguards that limit US intelligence authorities' access to personal data, unless necessary and proportionate to protect national security.
• Oversight of US intelligence services to ensure compliance with limitations on surveillance activities.
• An independent redress mechanism, which including a Data Protection Review Court to investigate and resolve complaints about data misuse.

The fundamental impact of Trump v Slaughter is that the FTC is no longer considered institutionally independent as it had been for the past 91 years. Because the European Commission's 2023 adequacy decision in part relied on the existence of independent bodies with redress mechanisms, the reduced independence of the FTC, and potentially also the Data Protection Review Court, may risk undermining the authority of the DPF. 

Given this uncertainty regarding the EU-US DPF, companies should review their Transfer Impact Assessments (“TIAs”) and continue to monitor the DPF adequacy decision for EU to US data transfers.

On 2 May 2025, the Irish Data Protection Commission (“DPC”) fined TikTok €530m and ordered corrective measures after an inquiry was launched to examine TikTok’s transfer of EEA-based user data to China. Despite TikTok's appeal, the Irish High Court upheld DPC's fine against TikTok on 3 June 2026. The fine was awarded in respect of TikTok’s unlawful data transfers to China, and for failures to comply with the GDPR’s transparency requirements (i.e. providing users with information about these transfers).

Whilst TikTok stores its EEA user data on servers based in the US, Malaysia and Singapore, TikTok had allowed personnel from parent company ByteDance, based in China, to access this data remotely to carry out business functions (including data analytics, customer support and R&D activities). TikTok relied on the European Commission's approved Standard Contractual Clauses (“SCCs”) as a ground for data transfers from the EU to China for such access, and submitted TikTok’s transfer risk assessments (“TRAs”), stating that whilst the TRAs identified that Chinese law diverged from the EU GDPR’s level of data protection measures, TikTok did not consider that Chinese authorities would have a legal basis to compel entities/individuals in China to provide access to data that was remotely accessed (and held outside of China). On this basis, the SCCs provided sufficient safeguards for the protection of EEA user data. 

However, the DPC rejected this argument and held that such transfers of EEA user data were in breach of the GDPR, and that TikTok had failed to sufficiently 'verify, guarantee and demonstrate that supplementary measures and SCCs ensured remote personal data of EEA users were granted a level of protection essentially equivalent to the EU'. TikTok's failure to implement supplementary measures and SCCs that ensured an adequate level of personal data protection of EEA users led to an order of suspension of EEA data transfers for 6 months. The DPC also enforced corrective measures, demanding TikTok to reform their processing operations in compliance with GDPR. While the High Court upheld DPC's fine, the High Court encouraged the DPC to reconsider the suspension order of TikTok's data transfers to China. 

The High Court's upholding of DPC's fine against TikTok demonstrates the importance for implementing supplementary measures to ensure an essentially equivalent level of data protection when companies transfer data to countries outside of the EEA. Additionally, companies should ensure that TRAs go beyond identifying conflicting local laws, and instead actively implement measures that ensure an essentially equivalent level of protection in practice. Additionally, companies should ensure that their privacy notices are appropriately updated to reflect any international transfers of personal data.

On 10th June 2026, the European Data Protection Board ("EDPB") launched a public consultation on a standardised template for Personal Data Breach Notifications ("PDBN"). 

Article 33 of the GDPR requires data controllers to notify the relevant DPA within 72 hours after becoming aware of a personal data breach if there is a risk to the rights and freedoms of individuals. However, although Article 33 prescribes a minimum standard for PDBNs (describing the nature of the personal data breach, categories and number of data subjects concerned, the categories and approximate number of personal data records concerned, a description of the likely consequence of the data breach, measures taken by the controller to address and mitigate the breach etc.) there has been limited detail provided for how data controllers can specifically meet this standard. As a result, different Data Protection Authorities ("DPA") have their own reporting format and expectations. Given that a data breach may require a data controller to report to several DPAs, form harmonisation offers clear benefits for such a time-sensitive task. 

The template is aimed to incentivise GDPR compliance and strengthen consistency across the EU. The template is composed of a maximum of 125 questions (of which 10 are optional and 42 whose optionality is dependent on a data controller's response to previous questions), each with detailed explanations of what is required, examples (if necessary) or predefined options. The template also expressly contemplates reports to be withdrawn, for example, in the case of duplicate reports or where the breach is later considered to be unlikely to result in a risk to the rights and freedoms of individuals. This is aimed to simplify the administrative burden for data controllers and to incentivise reporting of breaches even where at the time of the breach the risk is unclear.

In some respects, the template may be considered a welcome development in offering clarity over previously somewhat vague regulatory requirements. However, some elements may be less so; notably the PDBN template is significantly longer than most current templates and includes questions which may be difficult to assess within the timeframe (particularly given the time-critical nature of reporting). For example, the PDBN asks whether 'the data was unintelligible to anyone who was not authorised to access it'. Often an assessment will not be possible until after a thorough investigation and while the PDBN template typically allows an uncertain answer for these questions enabling a report to be updated after the 72 hour window (provided justification is given for the delay), data controllers may now have an open-ended commitment to provide a definitive answer. This may be difficult or impossible to ever answer definitively (e.g. if encrypted data was leaked to a sophisticated entity).

Ultimately, the intention is that PDBN templates will be made available by each member state’s respective DPA through an IT tool (presumably via each DPA's website). 

A consultation on the template will continue until 5 August 2026, and anyone can submit comments here. Following the consultation, the EDPB will decide on a timeline to standardise PDBNs in accordance with the template.

On 4 June 2026, the Court of Justice of the European Union ("CJEU") held that the retention of data from criminal investigations regarding an employee by an employer where no employee wrongdoing on the part of the employee was found where such data was initially collected, stored and processed for criminal investigations, but was later retained and used for another (HR-related) purpose, was non-compliant with GDPR. 

The decision concerned a police officer employed by the Bulgarian Ministry of the Interior. He had been interrogated in police custody as a suspect in a robbery, in a case brought by the organisationally distinct Public Prosecutor's Office. Although the investigation was later suspended, no perpetrator was ever found, and no charges or disciplinary proceedings were ever brought against the individual, information on the investigation was stored in the individuals personnel file. The individual was later denied promotion within the Ministry of the Interior because of this retained information, despite having a high employee classification that would have otherwise supported a case for promotion. The CJEU ruled that the retention and use of the data for this purpose was not consistent with the original basis on which the data was collected. 

GDPR considerations do not apply during the criminal investigation process and instead Directive (2016/680) (the Law Enforcement Directive) separately addresses the retention and processing of data relating to law enforcement. GDPR rights would be engaged after the data ceased to be stored and processed for matters of law enforcement or internal security and was instead stored and processed for an ancillary purpose. Once the data was used for a different purpose, in this case an employment context, its retention and further processing was subject to GDPR. As the data concerned criminal investigations, it was additionally subject to the considerations laid down in Article 10 of the GDPR. The CJEU held that, where personal data is retained after the original purpose for which it has been collected has been met, the data subject should have the right for such personal data to be rectified or deleted. 

While this case is nuanced (and indeed several questions were referred to the CJEU), a broad point for organisations is that, in circumstances where an employer collects information for one narrow purpose, it will need to be cognisant of the restrictions regarding using it for another purpose as well as the period of retention and enabling the data subject to exercise their rights regarding such data.

In a judgment handed down on 19 June 2026 ([2026] EWHC 1458 (KB)), Mr Justice Murray dismissed Reform UK Party Limited's (“Reform”) application to strike out – or obtain summary judgment on – a representative data protection claim brought against it by Good Law Project Limited ("GLP"), allowing the claim to proceed to trial. The core allegations are that Reform failed to respond to data subject access requests ("DSARs") sent by 51 individuals within the statutory time limit, and that its late responses were substantively deficient causing non-material damage including concern, worry, uncertainty, and distress. The DSARs arose from a pre-election campaign where over 11,600 individuals used an online tool provided by GLP to send notices to major political parties, with 1,746 choosing to send a notice to Reform. Reform failed to respond within one month of receipt and when it did respond following GLP’s pre-action letter, Reform sent a generic bulk email.

The claim from GLP was brought under Article 80 of the UK GDPR and section 187 of the Data Protection Act 2018 (“DPA 2018”). Article 80(1) of the UK GDPR gives data subjects the right to mandate a body/organisation meeting the conditions in sections 187(3) and (4) of the DPA 2018 to exercise their rights to an effective judicial remedy under Articles 77, 28 and 79 and to receive compensation under Article 82 on their behalf. Each of the 51 individuals positively authorised GLP to act. The conditions include that the body/organisation must, by virtue of its constitution or enactment: (a) be required to apply its income and capital to charitable or public purposes; (b) be prohibited from distributing its assets amongst its members; and (c) have objectives within the public interest. It must also be active in the field of data protection. Reform's primary challenge was that GLP did not satisfy those statutory conditions and therefore lacked standing. The Court accepted that GLP’s Articles of Association provide a reasonable basis for arguing that all of its income and capital must be applied solely towards its objects, that all of those objects fall within the broad definition of charitable or public purposes, that they are in the public interest, and that there is sufficient evidence of activity of GLP in the field of data protection. Mr Justice Murray therefore concluded that GLP had a reasonable basis for arguing at trial that it has standing to bring the claim and none of the grounds put forward by Reform in support of its application were made out, and so the claim should proceed to trial.

The Court’s refusal to dismiss the claim at strike-out stage confirms that the section 187 DPA 2018 / Article 80 UK GDPR representative action mechanism is a viable route for aggregating data protection claims, signifying that we may see more of these types of representative action claims in the future. Now more than ever organisations, particularly those processing personal data at scale, therefore need to ensure that they are responding to DSARs adequately to protect themselves against not only regulatory action, but also collective legal action.

On 11 June 2026, the ICO published its final guidance on consumer IoT products and services which sets out expectations for manufacturers and developers on how to use individual’s personal information responsibly. The guidance outlines the ICO’s recommendations for good practice when processing personal information in IoT products (i.e. connected devices) and explains how data protection law and the Privacy and Electronic Communications Regulations 2003 (“PECR”) applies.

The guidance targets any organisation involved in processing personal data through IoT products – a category that extends well beyond device manufacturers to include operating system developers, mobile and web app developers, cloud providers, AI service providers, and cybersecurity providers. In terms of products, the guidance covers a wide range of consumer-facing connected devices, from smart speakers, connected TVs and toys, to fitness trackers, home automation systems, smart domestic appliances, over-the-counter medical monitoring devices, and security cameras. It also applies to user devices on which software or apps are installed that enable, configure or control the functionality of an IoT product.

The guidance contain the following key principles:

1. Privacy by design means it must be built in from the start: data protection must be a core consideration at every stage of a product’s lifecycle, from initial design through to post-launch updates. Putting in place appropriate technical and organisational measures includes asking questions such as: Do you only collect and retain the minimum personal information you need for the product to function? Does your product offer strong privacy defaults, user-friendly options and controls, and respect user preferences? 
2. Valid consent requires clear positive action: consent must be freely given, specific, informed, unambiguous and given by a clear affirmative act. Consent must be as easy to withdraw as it is to give. A pre-ticked box is not UK GDPR compliant.
3. Transparency means more than having a privacy notice: privacy information must be separate from the T&Cs and must be concise, intelligible, in plain language and easily accessible. Although it must be provided at the time of collecting the personal information, you should consider providing it at other points of the user journey and consider the most appropriate method for the product’s interface.
4. Data Protection Impact Assessments (“DPIAs”) will be required from most organisations: given the ICO considers that most data processing involving IoT products is likely to result in high risk due to the nature of the products and their use in individuals’ private lives, it expects most organisations will be required to conduct DPIAs. The same applies if the product is offered to children.
5. It is a legal obligation that security must be considered continually: while a risk analysis should be completed from the outset and appropriate security and organisational measures should be in place, you must also provide regular security updates for IoT products, giving users the option to update their products manually if it’s not automatic.

On 29 June 2026, the Council of the EU gave its final approval to the Digital Omnibus on Artificial Intelligence (the “Omnibus”), part of the EU’s Omnibus VII simplification package. The measure amends the EU AI Act (Regulation (EU) 2024/1689) and related legislation following the European Parliament’s endorsement on 16 June 2026 and is expected to enter into force shortly after publication in the Official Journal.

The Omnibus does not alter the AI Act’s core risk-based framework but introduces targeted implementation and simplification measures. Most notably, it defers key compliance deadlines for high-risk AI systems to 2 December 2027 (Annex III systems) and 2 August 2028 (AI embedded in regulated products), reflecting delays in the development of harmonised standards.

Among the most notable data protection developments in the Omnibus is the introduction of new Article 4a to the EU AI Act, which establishes a dedicated legal basis permitting providers of high-risk AI systems to process special categories of personal data for the purposes of bias detection and correction. The provision is subject to strict safeguards, including requirements of necessity, pseudonymisation, access controls, prohibitions on onward transfer, data retention limits and documentation obligations, and is intended to provide organisations with greater legal certainty when assessing and mitigating discriminatory outcomes. Article 4a(2) extends this basis to providers and deployers of other AI systems and models, and to deployers of high-risk AI systems, where bias is likely to affect the health and safety of persons, have a negative impact on fundamental rights or lead to discrimination prohibited under Union law, though it expressly does not impose any obligation to conduct such bias detection and correction.

The Omnibus also maintains transparency obligations for AI-generated content, with a 2 December 2026 deadline for certain systems already on the market.

Additional changes include:

• clarifications narrowing the scope of “safety components” and reducing overlap with sectoral product legislation, particularly for machinery;
• a new prohibition on AI systems used to generate non-consensual intimate content and child sexual abuse material;
• simplification measures for small and medium-sized enterprises and small mid-cap companies; and
• enhanced supervisory powers for the EU AI Office over certain general-purpose AI systems.

Overall, the Omnibus is intended to reduce regulatory burden and improve legal certainty, while maintaining the substantive obligations and protections established under the AI Act.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.