UK law ICO fines South Staffordshire plc and South Staffordshire Water plc £963,900 following cyberattack and data breach The Information Commissioner’s Office (ICO) has fined South Staffordshire plc and South Staffordshire Water plc £963,900. This follows a cyberattack and data breach which led to the personal information of 633,887 customers and employees being extracted and published…
The Information Commissioner’s Office (ICO) has issued an update on its online tracking strategy, which it launched at the beginning of 2025. It sets out the ICO’s plans to give people choice and control over how they are tracked online and provide businesses with certainty so they are able to innovate responsibly. We recently wrote…
UK law Patents Court rules in FRAND case In Samsung Electronics Co., Ltd and another v ZTE Corp and others [2026] EWHC 999 (Pat), the Patents Court set the terms of a global FRAND portfolio cross-licence for ETSI-declared SEPs, renewing the parties’ 2021 licence (the 2021 PLA). The Court set a FRAND lump-sum balancing payment…
The ICO has published its finalised guidance on Storage and Access Technologies. The guidance, which covers how the Privacy and Electronic Communications Regulations 2002 (PECR) (and where relevant, the UK GDPR) apply to cookies, tracking pixels, device fingerprinting and similar technologies (‘storage and access technologies’), incorporates updates following two consultations and changes introduced by the…
Read More… from ICO publishes final storage and access technologies guidance
UK law ICO updates guidance on direct marketing using electronic mail The ICO has issued its guidance on direct marketing using electronic mail. The Data (Use and Access) Act 2025 introduced a new soft opt-in for charitable purposes in PECR regulation 22(3A). This allows charities to send direct marketing by electronic mail without people’s consent…
UK law Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 made The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 SI 2016/425 have been made. They require the Information Commissioner to prepare a code of practice on the processing of personal…
In RTM -v- Bonne Terre Limited and another [2026] EWCA Civ 488, the Court of Appeal has clarified that the test for whether consent has been lawfully given under data protection law is objective, not subjective, overturning a High Court decision concerning targeted gambling advertising. In other words, the focus is on what the data…
Read More… from Court of Appeal clarifies consent standard in gambling advertising case
UK law UK government tables amendments to Crime and Policing Bill on harmful pornography and tech liability The government has tabled amendments to the Crime and Policing Bill meaning tech execs could be held personally liable if platforms fail to comply with Ofcom’s enforcement decisions to remove people’s intimate images that have been shared without…
UK government responds to call for views on enterprise connected device security The government has responded to its call for views on enterprise connected device security which ran from 12 May to 4 August 2025. The response includes an overview of the feedback received and key themes that emerged, as well as the next steps…
BCC errors still cause a good deal of regulatory intervention. Dr W Kuan Hon has catalogued some below. This table supplements an article on the data protection risks of not using BCC available here. Below, in reverse chronological order of decision publication date, are selected (non-exhaustive) examples, as at March 2026, of incidents where emails…
Read More… from TABLE: Enforcement action & publicity for not using BCC