Welcome to the latest installment of Arnold & Porter’s Virtual and Digital Health digest. This digest covers key virtual and digital health regulatory and public policy developments during August 2026 from the EU and UK.
The more significant developments this month have been in the data protection space. Notably, Uber was fined almost €825 million following a finding that they breached the general prohibition on fully automated decision-making in the General Data Protection Regulation (GDPR). This decision serves as an important reminder for the need for meaningful human review in the Life Sciences industry as companies increasingly rely on AI-assisted decision-making, for example in screening candidates for eligibility to take part in clinical trials.
Further, the European Data Protection Board (EDPB) has written to the European Commission to request that the commission “closely assess” the recent U.S. Supreme Court decision of Trump v. Slaughter and its impact on the EU-U.S. Data Privacy Framework (DPF) adequacy decision. The EDBP has raised that this decision, which holds that the statutory protection against removal of Federal Trade Commissioners are unconstitutional, may affect the validity of the DPF decision.
Other developments include that the International Medical Device Regulators Forum (IMDRF) has published technical guidance regarding Predetermined Change of Control Plans (PCCP) for medical device software. This guidance intends to foster regulatory harmonization by identifying the essential principles for developing PCCP.
Regulatory updates
IMDRF Publishes Technical Guidance Document Regarding Predetermined Change Control Plans for Medical Device Software. The IMDRF has published a technical guidance document regarding PCCP for medical device software. Whereas traditional regulatory processes may lead to delays in deploying important updates to medical device software because the manufacturer would be required to submit a new or additional application for relevant changes, a PCCP allows the manufacturer to receive advance authorization for multiple planned changes during the initial or an existing application. The guidance sets out what PCCPs should contain and is intended to support regulatory harmonization without superseding existing national laws or regulations. It identifies the essential principles for developing PCCPs, including that they must be risk-based, evidence-based, transparent, and focused.
NICE Launches Public Dialogue on the Use of AI in Health Care. NICE has announced that AI will be the next topic considered through its “NICE Listens” public engagement program, which aims to explore the moral, ethical, social, and value-based questions that underpin complex health care decisions. NICE states that, while AI has the potential to support diagnosis, productivity, and help services respond to growing pressure, its increasing use also raises important questions regarding trust, transparency, accountability, and fairness. NICE will use the dialogue to shape its approach to AI effectively and at an early stage. The dialogue will help inform how NICE communicates about AI-related guidance, thinks about evidence and value, and how NICE builds confidence in decisions that may increasingly involve AI-enabled technologies.
UK Advertising Standard Authority (ASA) Issues Guidance on the Illusion of Artificial Intelligence in Advertisements. ASA issued guidance on the illusion of artificial intelligence in advertisements. ASA has advised advertisers to be careful with the claims that they make in relation to AI chatbots including those which are proposed to be used as a tool for patients waiting to talk to mental health care professionals. ASA has recommended that any advertisement should avoid implying that the AI tool can be used in place of a qualified therapist, and any claims that the apps are suitable for emergency or crisis situations are strongly discouraged. If health claims are made, the advertiser must be able to provide evidence to support them. However, ASA’s “CAP Code” only applies to advertisements rather than the products which are advertised. Therefore, the ASA cannot necessarily comment on the AI products themselves.
Privacy updates
Dutch DPA Fines Uber Almost €825 Million Over Unlawful Automated Decision-Making. The Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, has fined Uber €824,990,000 after finding that the company breached the GDPR’s prohibition on fully automated decision-making. The AP found that, between 2018 and 2022, Uber used software to monitor drivers’ behavior and customer ratings and, where the software flagged suspected fraud or persistently low ratings, automatically suspended or permanently deactivated drivers’ accounts with no meaningful human review, cutting off their income with immediate effect. The AP also found that Uber failed to give drivers adequate information about this automated decision-making. The investigation originated from complaints by 171 French drivers to the Ligue des droits de l’Homme, which were referred to the CNIL and, because Uber’s European headquarters are in the Netherlands, passed to the AP as lead supervisory authority. Uber has said it disagrees with the decision and will appeal. This is the second-largest fine ever imposed under the GDPR, after the Irish DPC’s €1.2 billion fine against Meta in 2023, and a reminder of the priority EU regulators continue to place on Article 22 GDPR compliance for algorithmic human resource (HR) and platform-worker decisions. Life sciences companies increasingly rely on automated or AI-assisted decision-making of their own, for example in screening clinical trial candidates for eligibility, or managing HR and field-force decisions, and this decision is a reminder that such systems generally require meaningful human review and clear upfront information to the individuals affected wherever they produce legal or similarly significant effects.
EDPB Asks European Commission to Assess Impact of U.S. Supreme Court Ruling on EU-U.S. Data Privacy Framework. Following a discussion at its June plenary, the EDPB has written to European Commissioner Michael McGrath asking the commission to “closely assess” whether the U.S. Supreme Court’s judgment in Trump v. Slaughter (June 29, 2026), which held that statutory protections against at-will removal of FTC commissioners are unconstitutional, affects the continued validity of the EU-U.S. DPF adequacy decision. In its letter to Commissioner McGrath, dated July 31, 2026 (reported August 3, 2026), the EDPB notes that the existence and effective functioning of independent supervisory authorities in a third country is a key factor in assessing adequacy, and that the DPF adequacy decision expressly relied on FTC commissioners being removable only for cause. The DPF adequacy decision remains in force and transfers under it remain lawful; the letter does not itself change the legal position, but it formally puts the question before the commission and may prompt a wider review of the framework. This is particularly relevant for life sciences companies that rely on the DPF for transatlantic transfers of clinical, research, or HR data, who should keep transfer impact assessments under review as this develops.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
