Data Privacy & Cybersecurity

ICO Guidance: Data Protection Complaints Process

The UK's Information Commissioner's Office (ICO) has published new guidance detailing requirements for organisations to establish a data protection complaints process. These requirements, stemming from the Data (Use and Access) Act 2025, will become legally effective on June 19, 2026, but are presented as good practice in the interim.

EDPB Work Programme 2026-2027

The European Data Protection Board (EDPB) has published its Work Programme for 2026-2027. This document outlines the EDPB's priorities and planned activities for the upcoming two-year period, focusing on data protection and GDPR compliance across the EU.

EDPB Report on GDPR Compliance Templates Consultation

The European Data Protection Board (EDPB) has published a report on its public consultation regarding helpful templates for organizations to facilitate GDPR compliance. This report summarizes the feedback received from stakeholders on potential template needs.

AEPD Resolution: Simyo Denied Voice Recording Access

The Spanish Data Protection Agency (AEPD) issued a resolution against Simyo (Orange España Virtual, S.L.) for denying a consumer's right of access to voice recordings related to a SIM swap. Simyo initially conditioned access on a judicial order, which is not required by law, but later provided the recordings after the complaint.

AEPD resolves identity theft data use complaint against TELFY TELECOM

The Spanish Data Protection Agency (AEPD) has resolved a complaint against TELFY TELECOM for alleged misuse of personal data in an identity theft case. The company failed to respond to a data access request from a customer who was a victim of identity theft, leading to a formal resolution by the AEPD.

AEPD Resolution on Data Protection Access Right Procedure

The Spanish Data Protection Agency (AEPD) issued a resolution regarding a data protection rights procedure, specifically concerning the right of access. The resolution details the process followed after a complaint was filed and notes that the data controller ultimately provided the requested response.

ICO Enforcement: Eight Guilty in Nuisance Call Investigation

The UK's Information Commissioner's Office (ICO) announced further convictions in its largest nuisance call investigation, bringing the total prosecuted to 10 individuals. The investigation involved the unlawful accessing and sale of personal data from garages and claims management companies.

EDPB Work Programme 2026-2027

The European Data Protection Board (EDPB) has adopted its work programme for 2026-2027, focusing on enhancing harmonisation, promoting compliance with GDPR, and strengthening enforcement cooperation. The programme outlines key initiatives including new guidelines on AI, consent, and anonymisation, alongside efforts to simplify GDPR compliance for stakeholders.

FTC Sends $103,420 in Refunds to Consumers for Deceptive Marketing

The FTC is sending over $40,700 in refunds to 578 consumers who purchased deceptively marketed products from Golden Sunrise Nutraceutical between July 2017 and July 2020. The refunds stem from a court order against the company and its director for making false health claims.

EDPB-EDPS Joint Opinion on Digital Omnibus Legislative Proposal

The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) have issued a joint opinion on the Digital Omnibus legislative proposal. This opinion provides their assessment and recommendations on the proposed legislation, which impacts data protection and privacy within the EU.