While the UK government failed to pass the Data Protection and Digital Information Bill before the July general election, the EU had more success with finalising flagship legislation.

UK legislation

Draft Data (Use and Access) Bill

The Data (Use and Access) Bill was published and received its first reading in the House of Lords on 23 October 2024. It replaces the Data Protection and Digital Information Bill, which failed to pass before the July general election.  Like its predecessor, it aims to reform the UK's data protection and ePrivacy regimes, provide for sharing of business and customer data, and introduce a framework for trusted digital identity verification (among other things).  Read more on the DUA Bill here. See the Tech and Digital section of this update for other on digital identity verification developments.

The government has also said it will introduce cyber security legislation in 2025, most likely to bring the UK's regime more in line with the EU's NIS2 regime.

PSTIA regime

The UK's connectable products regime came into effect when the Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023 came into force on 29 April 2024. The government also updated its PSTIA Regs guidance to include additional guidance on the Statement of Compliance and automotive vehicles.

Secondary legislation

• The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024 were made on 7 March 2024. They amend the immigration exemption in paragraph 4 of Part 1 of Schedule 2 to the Data Protection Act 2018 following the Court of Appeal decision which held the previous version to be incompatible with Article 23(2) GDPR.
• The Investigatory Powers (Amendment) Act 2024 (Commencement No 1 and Transitional Provisions) Regulations 2024 were made on 10 October 2024 and brought in a number of provisions of the Investigatory Powers (Amendment) Act 2024 on 14 October.

EU legislation

Personal data

The European Commission published its second report evaluating the GDPR on 25 July 2024.  The report found that the GDPR was fit for purpose but improvements could be made around enforcement.   In particular, the GDPR Procedural Regulation would help, but the report also emphasised the need for consistent approaches and cooperation between Member State regulators, both in relation to the GDPR itself, and in terms of its place in the wider digital regulatory framework.  The draft Regulation laying down additional procedural rules relating to the enforcement of the GDPR proceeded to trilogue stage and is a priority for 2025.

The Regulation permitting continuation of certain derogations of the ePrivacy Directive under an Interim Regulation to combat child sexual abuse was published in the Official Journal in May 2024.  The original Interim Regulation is being extended to 3 April 2026 to allow time for the EU's draft Child Sexual Abuse Material (CSAM) Regulation to come into effect.  Not only did the CSAM Regulation fail to make it to enactment during 2024, but the draft ePrivacy Regulation, long since stalled, also failed to make progress.  While it remains on the legislative agenda, it is thought it will be formally dropped on publication of the planned Digital Fairness Act proposal.

Data sharing

The EU's Data Act came into force on 11 January 2024. It is intended to remove barriers to data sharing, give businesses access to data they contribute to creating, and individuals more control over all their data (not just personal data). It will empower users of connected devices to access and share data they generate with third parties as well as switch cloud and edge service providers. It also aims to protect SMEs by providing a harmonised framework in which data can be shared, equalising access to data across the single market. While the Data Act will mostly apply from 12 September 2025, some elements will be introduced on other dates. The European Commission published FAQs on the Data Act on 6 September 2024. See our step plan to compliance and an article analysing the new obligations for cloud and edge services here.

The Interoperable Europe Act was published in the Official Journal on 22 March 2024.  It introduces a co-operation framework for public administrations in the EU to facilitate cross-border exchanges of data.  The intention is to ensure interoperable digital solutions and tools to help remove administrative burdens.  The Act entered into force on 11 April 2024 and has largely applied since 12 July 2024, with limited provisions applying from 12 January 2025.

The European Council and Parliament reached provisional political agreement on the Regulation to establish a common European Health Data Space on 15 March 2024.  The legislation was expected to be passed this year, but at the time of writing had not been finalised.  The European Parliament and Council also agreed their positions on the proposed financial data space which now moves to trilogues.

The Short-term rental Regulation was published in the Official Journal on 29 April 2024. It sets out rules for data collection by competent authorities and providers of short-term online rental platforms and for sharing that data. It applies to short-term rental platforms which allow hosts to provide short-term rentals in the EU and to hosts providing those services.  The Regulation will apply from 20 May 2026.

The Regulation to amend the eIDAS Regulation as regards establishing the European Digital Identity Framework (eID Regulation) was published in the Official Journal on 30 April 2024.  It establishes a new digital identity framework for EU citizens and a European Digital Identity Wallet. Read more.

On 23 May 2024, the European Commission opened infringement proceedings against 18 Member States requiring them to implement the Data Governance Act within two months. Non-compliance issues related mainly to failure to designate responsible authorities or demonstrate that these are empowered to perform tasks allocated under the DGA.

Cyber package

The Cybersecurity Regulation, which sets out common cyber security standards at the institutions, bodies, offices and agencies of the EU, came into force on 7 January 2024. 

The  Regulation for an EU common criteria-based cybersecurity certification scheme (EUCC) entered into force on 27 February 2024.  This is the first cyber security certification scheme under the Cybersecurity Act intended to enhance cyber security of ICT products, services and processes. Further schemes are planned on cloud services and 5G security. 

The European Council and Parliament this year approved:

• The Cyber Solidarity Act which aims to build a more resilient, collective EU response against cyber threats. 
• A Regulation amending the Cybersecurity Act to enable the adoption of an EU certification scheme for managed security services – outsourced services that support an organisation's cyber security risk management.

Following signature, they will be published in the Official Journal. 

On 25 June 2024, the Council of the EU adopted a Recommendation on a Blueprint for protecting EU citizens and the internal market, essentially to coordinate a response at EU level to disruptions to critical infrastructure with significant cross-border relevance.  The focus is on sharing experience and information about an incident to help coordinate public communications and an effective response.

23 Member States missed the 18 October deadline for passing NIS2 Directive implementing legislation on 14 October 2024. As a result, on 17 October 2024, the European Commission announced the adoption of an Implementing Act under the NIS2 Directive. The Act sets out cyber security risk management measures and the cases in which an incident should be considered significant and therefore reportable. In late November, the Commission gave non-compliant Member States a further two months to introduce their legislation or face enforcement action.

The EU's Cyber Resilience Act(CRA) was published in the Official Journal on 20 November 2024. It introduces mandatory cyber security requirements for the design, development, production and making available of products with digital elements and ancillary services. Essentially this covers the cyber security of IoT or connected products.  Manufacturers will be required to embed security by design and provide security support and software updates.  There are also information and incident reporting requirements.  The CRA will apply generally from 11 December 2027 with some provisions applying earlier.  See here for how the CRA compares with the UK's PSTIA regime on connected products and here for more on the CRA.

In-scope businesses have also been getting ready for the Digital Operational Resilience Act (DORA) which will apply from 17 January 2025.  Read more.

EU Political Advertising Regulation

The EU's Regulation on transparency and targeting of political advertising was published in the Official Journal on 20 March 2024. This applies to certain types of political advertising disseminated in the EU, brought into the public domain in one or more Member States, or directed at EU citizens regardless of country of origin and means used to publish. The Regulation has applied since 10 October 2024, with Articles 3 (definitions) and 5(1) (restrictions on providers of political advertising services) applying from date of entry into force.

The ICO and EDPB have had another busy year. Here are the 2024 highlights.

UK ICO

Online safety and protection of children

This was a priority area for the ICO in 2024, not least in support of the UK's Online Safety Act (OSA). During 2024:

• In January, the ICO updated its 2021 age assurance Opinion to provide guidance on what online services need to do if they are likely to be accessed by children; reflect technological developments; and explain legislative developments and how organisations can comply with data protection law while also complying with the OSA's requirements on using age verification/assurance.
• In February, the ICO published guidance on content moderation and how organisations can respect information rights when moderating online content. The guidance is intended to help organisations caught by the OSA comply with their data protection obligations when moderating content.
• In April, the ICO set out its priorities when it comes to protecting children online during 2024-25. The ICO's Children's Code strategy will focus on: default privacy and geolocation settings; profiling children for targeted advertisements; using children's information in recommender systems; and using information of children under 13. The ICO then launched a call for views on the latter two elements.
• Under the banner of the Digital Regulatory Cooperation Forum (DRCF), Ofcom and the ICO published a Joint Statement on Collaboration on the Regulation of Online Services on 1 May 2024. The ICO will work closely with Ofcom in its capacity as regulator of the OSA, and with other national and international regulators. 
• In August, eleven social media and video sharing platforms were told by the ICO to improve their children's privacy practices or face enforcement action.
• The ICO published its response to Ofcom's first consultation on the Online Safety Act, which focuses on protecting people from illegal harms online in Autumn 2024. The ICO emphasises that it is essential that users of online services have confidence that their privacy will be protected and commented on areas of overlap between the data protection and online safety regimes.
• On 29 October 2024, the ICO published a statement on its work to protect children online following research that showed that for many children, data is their only currency and they see giving it to apps and services to help them socialise as a necessary exchange. 

The ICO expects to update its Children's Code Strategy next year. See here for more on children's data and online harms.

Technology

In addition to focusing on AI (see below), the ICO also published:

• a reminder to all app developers to focus on privacy as its review showed a need for general improvements
• a Tech Horizons report which looks at the implications of eight technologies it believes will significantly impact our societies, economies and information rights in the next two to seven years. The report looks at the privacy implications of genomics, immersive virtual worlds, neurotechnologies, quantum computing, commercial drone use, personalised AI, next-generation search and central bank digital currencies
• new guidance on biometric recognition on 23 February 2024, which explains how data protection law applies when using biometric data in biometric recognition systems
• a joint paper as part of the DRCF on 14 May 2024, looking at consumer attitudes towards digital assets and how consumers interact with them. The report is intended to inform the regulatory approach from a financial and data protection perspective
• the final version of its Enterprise Data Strategy following a public consultation. Part of the ICO's ICO25 strategic plan, the Strategy sets out how the ICO plans to use its data assets and exemplify responsible data
• a report in August on tackling barriers to privacy-enhancing technologies (PETs) adoption. The report covers an analysis of the barriers and recommendations on how to overcome them, based on input from an ICO workshop on PETs
• a report on genomics and data protection concerns in November. The ICO raises concerns around third party data, inappropriate bias, data security and data minimisation
• on 9 October 2024, the ICO published a blog launching its report ICO tech futures: quantum technologies
• on 22 November 2024, the ICO published new practical advice to provide clarity on data protection considerations and support organisations in sharing data responsibly to tackle scams and fraud. 

Fines and fees

On 18 March 2024, the ICO published new fining guidance setting out how it decides to issue penalties and calculate fines.  The government also consulted on raising the fee to £3,979 for tier 3 organisations with more than 250 staff or an annual turnover of over £36m. Tier 1 fee changes are proposed to rise from £40 to £55 and tier 2 from £60 to £82.

ICO's Journalism Code of Practice

The ICO's final Code of Practice on Data protection and journalism came into force on 22 February 2024. The Code provides guidance for journalists and media publications on data protection in the context of journalism. It looks at how to apply the journalism exemption including looking at public interest and freedom of expression. The Code has statutory force, which means it is not legally binding but failure to comply can be taken into account by the courts.

Employment and HR

On 6 November 2024, the ICO published the results of its consensual audit engagements with developers and providers of AI tools used in recruitment, together with a series of recommendations for developers and recruiters. The ICO recognises the value of using AI in recruitment but also made a series of nearly 300 recommendations following the voluntary audit, which are summarised in the report alongside key questions for procurers to ask themselves during the procurement process.

The ICO also consulted on two further sets of draft guidance for employers and recruiters that will form part of the ICO's overhauled guidance on employment information, covering keeping employment records and recruitment and selection, and published guidance for employers on sharing staff personal data in a mental health emergency on 1 March 2024.  

AI

In response to a request from the Department for Science, Innovation and Technology, the ICO published its strategic approach to regulating AI at the end of April 2024. This covers the opportunities and risks of AI, the role of data protection law, the ICO's work on AI to date and its plans for further work. The relevance following the imminent publication of the new government's AI policy is now unclear. See section on AI training for more.

Tools and certification schemes

The ICO launched a new audit framework to help larger businesses and organisations assess their compliance with data protection law. It is not aimed at SMEs, which should use the self-assessment toolkit and other resources. It is an extension of the Accountability Framework and contains nine toolkits covering different key areas including AI and age-appropriate design.

On 20 August, the ICO launched a privacy notice generator tool to help sole traders, start-ups, small organisations and charities create bespoke privacy notices in a variety of sectors. These include finance, insurance, legal sectors, education, health and social care, retail and manufacturing.

In February, the ICO approved a  certification scheme for legal professionals who process personal data. Certification helps law firms and other legal professionals demonstrate compliance with data protection requirements and reassure those using their services. This is the fifth approved certification scheme. The others cover: offering secure re-use and disposal of IT assets; age assurance; children's online privacy; and training and qualification service providers.

On 7 November, the ICO and DSIT's Responsible Technology Adoption Unit published the Privacy Enhancing Technologies PETs) Cost-Benefit Awareness Tool, alongside a checklist to support organisations. The tool focuses on emerging PETs and is structured around an example of using PETs to train a machine learning model without centralised data collection or processing.   

On 13 November 2024, the ICO announced it had approved the first sector-owned code of conduct by the Association of British Investigators Limited. The Code applies to UK private investigators and is approved in accordance with Article 40 UK GDPR. 

Regulatory cooperation

The UK's ICO and the USA's Federal Communications Commission signed a Memorandum of Understanding pledging to work together to protect people from unwanted marketing communications and the misuse of private and sensitive data.  

Following a roundtable meeting on 10 and 11 October 2024 of the G7 data protection authorities, the Canadian DPA published a communiqué setting out three pillars of focus for cooperation – data transfers, emerging technologies such as AI, and bilateral and multilateral enforcement actions.

On 4 April 2024, the ICO signed up to a new international multilateral agreement with the Global Cooperation Arrangement for Privacy Enforcement. This is intended to facilitate cooperation in cross-border data protection and privacy enforcement.  Other members include the USA, Australia, Canada, Mexico and Japan.

In August, the ICO and the National Crime Agency signed a Memorandum of Understanding setting out how they will help UK organisations become more resilient to cybercrime and share information.

Transparency and information standards in health and social care

On 15 April 2024, the ICO published guidance to improve transparency in health and social care. This is the final version of the guidance following a consultation earlier this year. On 22 November 2024, DHSC published its response to a consultation on information standards for health and adult social care in England. The consultation relates to changes made to s250 of the Health and Social Care Act 2012 (HSCA) which have not yet been brought into effect. These changes will be complemented by provisions in the Data (Use and Access) Bill which include standardisation for data sharing across health and social care as information standards covered under s250 of the HSCA. DHSC is expected to begin preparations to implement mandatory information standards in early 2025, and to lay legislation before Parliament in the Spring.

ICO review of public sector approach

On 9 December 2024, the ICO published the results of its two-year trial public sector approach which placed an emphasis on reprimands and collaboration rather than financial sanctions where public sector organisations breach data protection rules.  The ICO considers the approach to have been largely successful. It proposes to continue it but does acknowledge potential areas for improvement, in particular, by making it clearer which organisations are covered in the public sector approach and what type of infringements could lead to a fine. As a result, the ICO is consulting on the latter issue. Responses are invited by the end of January 2025.

EDPB

2024 was another active year for the EDPB. While some developments (and those relating to the EDPS) are covered in other sections of this update, here's a selection of its work.

In 2024, the EDPB:

• published its annual report for 2023 and its Strategy 2024-2027, as well as adopting its 2024-25 Work Programme
• adopted its contribution to the Article 97 report on the application of the GDPR in January 2024. It considered that the GDPR has been successful and does not need revisiting
• published its report on its 2023 coordinated enforcement action, which focused on the role of the DPO, and began its Coordinated Enforcement Action for 2024 focusing on rights of access
• published a case digest of one stop shop decisions on data security and breach notification relating to Articles 32-34 GDPR
• published a website auditing tool to support controllers, processors and DPAs in conducting data audits
• adopted an Opinion on the notion of main establishment and on the criteria for the application of the one-stop-shop mechanism. The Opinion clarifies the meaning of "main establishment"
• published a statement on the legislative developments on the proposed Prevention of Child Sexual Abuse Material (CSAM) Regulation expressing concerns around indiscriminate monitoring of private communications
• adopted an Opinion on the use of live facial recognition technology at airports in May 2024
• published a statement on the financial data access and payments package in May, making suggestions on how to align the proposals with EDPB Guidelines
• adopted the final version of its Guidelines on Article 37 of the Law Enforcement Directive, which relates to data transfers
• adopted a statement on the role of DPAs in the AI Act framework in July 2024, recommending that the DPAs be designated as the Market Surveillance Authorities under the EU AI Act
• published draft guidelines on Article 6(1)(f) GDPR – the lawful basis of legitimate interests – for consultation in October
• adopted an Opinion on certain obligations flowing from the reliance on processor(s) and sub-processor(s) following an Article 64(2) GDPR request by the Danish SA. The Opinion covers situations where controllers rely on one or more processor and sub-processor
• adopted a Statement on amendments made by the European Parliament and Council to the draft Regulation on additional procedural rules relating to GDPR enforcement. The Statement broadly welcomes the modifications but recommends addressing further elements
• published final guidelines on the Technical Scope of Article 5(3) ePrivacy Directive. The guidelines analyse what is covered (beyond cookies) by the ePrivacy Directive wording "to store information or to gain access to information stored in the terminal equipment of a subscriber or user".
• adopted a statement on the second report of the European Commission on the application of the GDPR. The EDPB underlined the importance of coherence between the GDPR and other digital legislation and said it would focus on producing content for non-experts and SMEs. It also stressed the need for greater financial and human resources for the EDPB and Member State Data Protection Authorities.
• adopted an Opinion approving Brand Compliance certification criteria concerning processing activities by controllers or processors on 3 December 2024. The criteria, previously approved for use in the Netherlands, will now be applicable across the EU and as a Data Protection Seal
• published draft guidelines on Article 48 GDPR for consultation. Article 48 covers requests for data from third country public authorities. The draft guidelines provide recommendations for controllers and processors to help ensure they deal properly with such requests and comply with data transfer provisions if they transfer personal data in response to such requests.

One of the biggest controversies of the year was the 'pay or ok' or 'consent or pay' model adopted most frequently in the EU but also in the UK.  Privacy campaign group NOYB continued its crusade against tracking cookies for behavioural advertising, while industry groups continued to focus on finding a solution satisfactory to the digital advertising ecosystem, privacy campaigners, and data protection regulators.

ICO

At the start of the year, the ICO called for organisations to take proactive action to make advertising cookies compliant with data protection law, notwithstanding a positive response to its warnings to top websites.  In November 2023, the ICO wrote to 53 of the UK's top 100 websites, warning them that their use of advertising cookies was not compliant with data protection law and that they would face enforcement action if they failed to take action.  Subsequently, the ICO welcomed changes made by 80% of the 53 organisations it initially approached about their cookie practices and is now focusing on the next 100 most frequented websites.  It warns that its next announcement in this space will be about enforcement action against organisations which have ignored the law.

'Pay or OK'

Following ECJ rulings that effectively determined that the only lawful basis available to Meta for targeted advertising was consent, Meta and others switched to what is known as the 'pay or ok' or 'pay or consent' model. This gives users the choice between an ad-free subscription model and agreeing to the use of their personal data for targeted advertising purposes in exchange for a free service.

The 'pay or ok' model came under the scrutiny of data protection regulators in the UK and EU, and in the EU was also the subject of consumer complaints and enforcement action under the EU's Digital Markets Act (DMA).

The EDPB was asked in January to look at the 'pay or ok' model following requests from Member State DPAs amid concerns that consent cannot be said to be freely given in this situation, and that the charging model is insufficiently transparent and potentially unfair.

The EDPB published its Opinion on valid consent in the context of pay or ok models implemented by large online platforms (LOPs) on 17 April 2024. The EDPB concluded that "in most cases it will not be possible for [LOPs] to comply with the requirements for valid consent, if they confront users only with a choice between consenting to processing of personal data for behavioural advertising purposes and paying a fee". The EDPB suggested that LOPs should not be offering a binary choice to consent to advertising or to pay for an ad-free service.  Instead they should consider providing an equivalent alternative such as a free service with non-behavioural advertising, ie advertising which uses less personal data than behavioural advertising or none at all. 

The Opinion included elements to help assess consent against the GDPR standard in relation to 'pay or OK' but the EDPB also plans to develop guidelines on 'pay or OK' with broader scope, and on 5 September 2024, it invited stakeholders to participate in a remote event on 18 November intended to gather information about 'consent or pay' models.

IAB Europe published a response to the EDPB's Opinion arguing that the EDPB mischaracterised both the 'consent or pay model' and personalised advertising and risks creating legal uncertainty for many businesses beyond large online platforms.

Read more.

On 1 July 2024, the European Commission informed Meta that its preliminary findings were that Meta's 'pay or consent' advertising model breached the DMA.  Under Article 5(2) of the Digital Markets Act, gatekeepers must seek user consent to combine their personal data between designated core platform services and other services.  If a user refuses consent, they should be offered access to a less personalised but equivalent alternative service.  Gatekeepers cannot make the provision of certain services or functionalities conditional on user consent.

The EC provisionally found that Meta's 'pay or consent' advertising model breaches the DMA because:

• it does not allow users to opt for a service that uses less of their personal data but is otherwise equivalent to the service which offers personalised ads, and
• it does not allow users to exercise their right to give their consent freely to the combining of their personal data across services.

Consumer protection also featured in pay or ok concerns.  On 29 February 2024, BEUC (the European consumer protection group) announced that eight of its members had filed complaints to the national data protection regulators about Meta's 'pay or OK' model, arguing it did not follow the principles of fair processing (transparency), data minimisation or purpose limitation. They also argued that consent was not freely given and questioned the lack of information to explain how the subscription price was set.

The EU's Consumer Protection Cooperation Network (CPC) sent a letter to Meta on 22 July, The Commission expressed concerns that Meta used misleading or aggressive practices and was insufficiently transparent when offering consumers the choice between paying for an ad free model and consenting to being tracked for advertising purposes.  This action was distinct from other investigations.

In an effort to allay concerns, Meta announced a new version of its EU services on 12 November 2024.  Meta will offer a version of Facebook and Instagram with "less personalised ads".  Under the new model, those selecting a free service will still receive ads but the targeting will rely on less data ie it will be contextual, using a minimal set of data points including age, location, gender and how a person engages with ads.  Meta will also reduce the cost of its ad-free subscription model. 

Meanwhile in the UK, the ICO launched a call for views on the 'consent or OK' model for website access in general on 6 March 2024.  It invited publishers, advertisers, intermediaries, civil society, academia and other interested stakeholders to respond and help it inform its position.  The ICO also wrote to the Association of Online Publishers and the Internet Advertising Bureau UK, setting out its views on various online advertising models and how to give users a fair choice over how their personal information is used, while waiting for views on the 'consent or ok' model before venturing an opinion on that.  The ICO is expected to issue updated guidance for consultation in relation to the use of cookies after the Data (Use and Access) Bill gets Royal Assent and to be able to provide more detailed guidance on the interplay between consent for targeted advertising and functionality that can be considered intrinsically linked on a technical level for that purpose.

Competition issues

After concerns expressed by the CMA and the ICO, Google announced on 22 July 2024 that "instead of deprecating third-party cookies, we would introduce a new experience in Chrome that lets people make an informed choice that applies across their web browsing and they'd be able to adjust that choice at any time". It will continue to work on Privacy Sandbox APIs and to make them available in discussion with regulators and industry.  Google has also said it will offer additional privacy controls by introducing IP Protection into Chrome's Incognito mode.  The CMA said it was "considering the impact of this announcement" and the ICO said: "We are disappointed that Google has changed its plans… we will reflect on this new course of action when more detail is available".

On 6 September, the CMA published a statement of objections setting out how Google may have broken competition law by using its dominance to favour its own adtech services in open-display advertising.  The CMA's provisional findings are that Google has abused its dominant position on both the ad server (DoubleClick for Publishers or DFP), and the buying tool (Google Ads and DV360) side to restrict competition in the UK.  In particular, it has preferenced its own ad exchange (AdX), harming competition and advertisers and publishers.  The CMA finds that since 2015, Google has used its buying tools and publisher ad server to strengthen AdX's position and restrict competitor opportunities.  It has also prevented rival publisher ad servers form being able to compete effectively with DFP.  The CMA will consider representations from Google before reaching a final decision.  Google's adtech practices are also under scrutiny from competition regulators in the EU and USA.

Separately, the CMA announced on 20 August 2024 its decision to accept a variation of Meta's binding commitments to address competition concerns relating to its use of digital display advertising service data.

NOYB complaints

NOYB filed a number of tracking/cookie-related complaints during 2024, including:

• a complaint to the Austrian Data Protection Authority in which it alleges Microsoft 365 Education unlawfully tracks children regardless of their age
• a complaint with the Austrian DPA alleging that Google is not being transparent about the fact that it continues to track Chrome browser users after they have turned on the 'ad privacy' feature
• a complaint with the Garante against Microsoft-owned ad broker Xandr on 9 July 2024. NOYB alleges Xandr does not comply with GDPR transparency requirements in its use of personal data for targeted advertising, particularly as regards special data
• a complaint with the French DPA, the CNIL, against Pinterest. NOYB alleges that Pinterest wrongly relies on legitimate interests despite the Bundeskartellamt ECJ judgment to process personal data for tracking and behavioural advertising processes. It also says personalised advertising is turned on by default, consent is not obtained to tracking, and Pinterest does not provide sufficient information about the categories of personal data it shares with third parties.

NOYB also published a report on 11 July 2024, analysing decisions taken by national data protection regulators relating to cookie consent banners, and comparing them with the position taken by the EDPB's cookie banner taskforce.

Other enforcement

• LinkedIn said in June it would stop targeting ads at EU users based on sensitive data following a complaint that doing so was in breach of the Digital Services Act. The DSA prohibits targeting online adverts based on profiling using special categories of personal data. However, on 24 October 2024, the Irish DPC announced its final decision to fine LinkedIn €310m for GDPR failings relating to the processing of personal data for behavioural analysis and targeted advertising.  The DPC investigated the complaint as lead regulator following a referral from the CNIL and under the Article 60 GDPR procedure.  The DPC found that LinkedIn had failed to process the personal data fairly and lawfully as it had not validly relied on either consent, legitimate interests or contractual necessity.  It also failed to comply with information provision requirements.
• Norway's Personal Data Protection Board held the Norwegian DPA does not have the authority to impose a daily penalty on Meta Ireland for failing to comply in Norway with the ban on behavioural advertising on the basis of legitimate interest or contractual necessity.  The behavioural advertising ban was, however, upheld in a separate decision.
• On 17 September 2024, the ICO issued a reprimand to Bonne Terre Limited trading as Sky Betting and Gaming (SkyBet), over its unlawful processing of personal data by using advertising cookies without user consent.

Industry initiatives

• The ASA published a guide to privacy rules on 25 April 2024.  This focuses on CAP Code rules for featuring an individual (whether a public person or a private individual) and private property in ads.  It also makes reference to Section 10 of the CAP Code which deals with personal data issues.
• On 9 October 2024, the Coalition for Privacy Compliance in Advertising (CPCA) announced it is working with the ICO to try and develop an ICO-approved privacy certification for digital advertising technology that is compliant with ICO guidelines. Industry groups including the Incorporated Society of British Advertisers and the Association of Online Publishers are also set to get involved. CPCA hopes to launch the certification in 2025 and intends it will work with European initiatives.
• On 29 October 2024, US-based global digital advertising standards body IAB Tech Lab announced the release of its Global Privacy Platform (GPP) Implementation Guidelines for consultation. IAB Tech Lab developed the GPP intending it to help participants in the digital advertising ecosystem comply with privacy regulations across multiple regimes. The implementation guidelines are resources to help product and engineering teams adopt the GPP and comply with GDPR, US state laws and other privacy regulations.
• In 2022, the Belgian Data Protection Authority held that the TC string used in IAB Europe's Transparency and Consent Framework constitutes personal data.  It also found that IAB Europe was a joint controller of that personal data.  IAB Europe appealed the decision before the Brussels Court of Appeal which made a reference to the ECJ.  On 7 March 2024, the ECJ agreed with the Belgian DPA on these two issues.  It also held that IAB Europe should not necessarily be viewed as a joint controller in relation to the subsequent data processing performed in pursuit of the TCF purposes.  The case now returns to the Brussels Court of Appeal.  IAB Europe acknowledged the decision.  The Belgian DPA's initial decision has been suspended pending the outcome of the appeal.  See our article for more.

Alongside the EU AI Act and considerations about whether or not to legislate on AI in the UK, data protection regulators in the UK and EU have continued to focus on the use of personal data to train AI models.  This has resulted both in guidance and in engagement with some of the tech giants on the issue. Data protection concerns have focused largely on the issue of scraping or otherwise using personal data to train AI without consent. For more on AI, see the AI section of this update. 

Regulator guidance and consultations

ICO consultations on generative AI

The UK's ICO launched a series of consultations over the course of 2024, looking at how aspects of data protection law should apply to the development and use of generative AI. The consultations set out the ICOs thinking on how to interpret specific requirements of the UK GDPR and Part 2 of the DPA 18 in relation to pressing questions including about:

• Appropriate lawful basis for training generative AI models (the ICO suggests this is likely to be legitimate interests, subject to the outcome of a legitimate interests assessment)
• Purpose limitation in the AI lifecycle
• Accuracy of training data and model outputs
• Data subject rights in the context of training and use of generative AI
• The allocation of controllership across the AI supply chain with a focus on AI as a Service.

EDPS and EDPB

In June, the European Data Protection Supervisor published guidelines to help EU institutions, bodies, offices and agencies comply with the GDPR when using generative AI. The guidelines run through the data protection principles and provide practical examples to anticipate risks, challenges and opportunities. There is also a focus on when to carry out DPIAs and how to conduct them.

The EDPB announced plans to develop guidelines on generative AI which will focus initially on data scraping in the context of AI training data.  It held a stakeholder event on AI models on 5 November 2024.

The EDPB's ChatGPT taskforce set up to promote cooperation between DPAs investigating ChatGPT's data protection compliance, published an interim report on its work to date on 24 May 2024.  The investigation is ongoing.

The European Data Protection Supervisor's 2025 TechSonar report was published on 15 November 2024 and focuses on the impact of AI on individual rights and freedoms.

OECD expert group for policy synergies in AI, data and privacy

The OECD  announced in February it had set up a new expert group for policy synergies in AI, data and privacy.  The intention is to break down silos in recognition of the rise of privacy enforcement actions focused on AI, to address concerns that data protection law may be hindering AI development, and to focus on synergies.

Global Privacy Assembly follow-up statement on unlawful data scraping

The ICO, together with 16 other DPAs working as part of the Global Privacy Assembly International Enforcement Cooperation Working Group, published a follow-up joint statement on protecting data from unlawful data scraping on 28 October 2024. The initial joint statement, published in August 2023, set out key privacy risks associated with data scraping.  The follow-up statement has been published as a result of engagement with the largest social media companies. It sets out further expectations for organisations.

Issues with use of training data

Meta, X, LinkedIn and Google were all under scrutiny in the EU and the UK over their various practices of using EU/UK personal data to train their AI models during 2024. 

On 6 June 2024, NOYB filed complaints with eleven European DPAs about Meta's planned changes to its privacy policy.  Meta was proposing to start processing EU and UK user data on its platforms to train generative AI models on the basis of Meta's legitimate interests although users would be able to opt out.  NOYB argued Meta was required to obtain user consent and had issues with the opt-out form and policy.  Similarly, in the UK, privacy advocacy group Open Rights Group (ORG) submitted a complaint to the ICO about Meta's proposed changes

In June 2024, Meta paused its use of EU and UK personal data on Facebook and Instagram to train generative AI.  While it has undertaken to make this pause permanent in the EU, it will resume these activities in the UK after having made changes to the process including simplifying user opt out and giving users longer to do so.  The ICO says it will monitor the situation as Meta begins informing users and is clear that it has not provided regulatory approval for the processing.  It says it is now up to Meta to "ensure and demonstrate ongoing compliance".

X also agreed not to use EU/EEA data to train its AI tool Grok and LinkedIn has said it would pause the use of UK personal data to train generative AI models as a result of concerns raised by the ICO and pending further engagement.

In April, data privacy campaign group NOYB filed a complaint with the Austrian DPA asking it to investigate OpenAI's data processing and the measures it takes to ensure accuracy of personal data processed in the context of its large language models.  NOYB also asked the regulator to require OpenAI to comply with a subject access request made by Max Schrems.  The background to the complaint is the fact that ChatGPT gave an incorrect date when asked the date of Mr Schrems's birthday – known as a 'hallucination'.  NOYB alleges that this breaches accuracy principles and that there is no way for OpenAI to give effect to rectification and deletion requests.  There are also transparency issues as ChatGPT does not always make sources clear.  NOYB argues that it is able to bring the complaint in Austria as OpenAI's EU headquarters in Ireland does not control the data processing of ChatGPT and therefore the one stop shop does not apply.

On 7 June 2024, Microsoft announced it was making changes to its AI-powered 'Recall' feature for new laptop Copilot+ following privacy concerns.  The Recall feature is billed by Microsoft as like giving the computer a photographic memory, allowing it to recall anything which has ever appeared on screen by taking regular screenshots and making those searchable.  Microsoft is now giving people a clearer choice to opt in and is turning the system off by default.  Strong authentication and 'proof of presence' will be required for users wanting to view their timelines and saved activity.  The UK's ICO has been making enquiries with Microsoft about the system.

On 12 September 2024, the Irish DPC announced it had begun a cross-border statutory inquiry into Google's AI practices under s110 of the Data Protection Act 2018.  The inquiry looks at whether Google has complied with requirements to carry out a Data Protection Impact Assessment before using EU/EEA personal data to train its AI model Pathways Language Model.

Finally, on 25 October 2024, the ICO applied to the Upper Tribunal for permission to appeal a First-Tier Tribunal (FTT) decision which overturned the ICO's fine and data processing ban on Clearview AI in 2022.  The ICO had fined Clearview £7.5m for scraping the internet for images to train its image recognition system without the consent of data subjects.  The ICO also banned Clearview from processing UK personal data.  The ICO's decision was overturned in October 2023 on the basis that it did not have jurisdiction to enforce against a US-based company supplying services to foreign law enforcement agencies, and the ICO was refused permission to appeal in December 2023.  The ICO has now applied directly to the Upper Tribunal for permission to appeal the FTT decision.

After the drama of recent years, 2024 was a relatively quiet year for data transfer issues.

UK and ICO

EU-UK adequacy

Concerns that first the Data Protection and Digital Information Bill, and then its replacement the Data (Use and Access) Bill (DUA), might adversely impact the EU-UK adequacy decision, appear to have been put to rest. This is notwithstanding the fact that the DUA Bill does propose changes to the UK's data transfer regime. The ICO is confident that adequacy is not in jeopardy and there have been no indications of serious concern form the European Commission.

EU/UK-US data transfers

On 17 July 2024, the EDPB published FAQs on the EU-US Data Privacy Framework (DPF) for individuals and businesses.  It also adopted Rules of Procedure, a public information note and template complaint forms to facilitate the implementation of the redress mechanisms under the EU-US Data Privacy Framework (DPF).  The documents relate to two redress mechanisms to handle complaints by EU individuals relating to national security or commercial purposes and in relation to data transferred after 10 July 2023.

On 9 October 2024, the European Commission published a report following its first review of the adequacy decision for the EU-US Data Privacy Framework (DPF).  The Commission concluded that the US authorities have put in place all the necessary structures and procedures to ensure the DPF functions effectively. This includes suitable redress mechanisms, and safeguards to ensure that access to EU personal data by intelligence authorities is limited to what is necessary and proportionate. The Commission made a few suggestions for further steps and said it would review the decision again in three years' time. 

Following the Commission's first annual review of the EU-US Data Privacy Framework, the EDPB adopted its own report on 4 November 2024.  The EDPB recognises the steps taken by the US authorities and the EC to implement the DPF, both commercial and in terms of complaints and redress.  The EDPB does however, suggest the US authorities develop guidance on data transfer requirements and human resources data.  It also recommends the authorities monitor the compliance of DPF-certified organisations more closely.  In August, Switzerland approved its own US Data Privacy Framework. 

The UK's House of Lords European Affairs Committee issued a call for evidence on the existing arrangements for EU UK data adequacy on 15 March 2024.  A report was expected by the summer but has not yet been published.  Meanwhile, the ICO published guidance for organisations transferring personal data to the US under Article 46 transfer mechanisms (UK IDTA and UK BCRs).  The guidance explains how the UK-US Data Bridge can help streamline the Transfer Risk Assessment process required when making transfers to the US under Article 46 (as opposed to under the Data Bridge itself).

None of this means the end of the Schrems litigation.  The Irish High Court has allowed Max Schrems to join Meta's appeal against the Irish DPC's decision to prohibit Meta from transferring personal data to the USA under its Standard Contractual Clauses and supplementary measures, and the related €1.2bn fine for unlawful transfers.  Both Meta and the Irish DPC opposed the application by Schrems, but he was held to be uniquely and directly affected given he was the originator of the initial complaints against Meta. 

Separately, the EC announced it would consult on a review of the Standard Contractual Clauses.

Other EU adequacy agreements

The European Commission published a report upholding the adequacy decisions for Andorra, Argentina, Canada, the Faroe Islands, Guernsey, Isle of Man, Israel, Jersey, New Zealand, Switzerland and Uruguay (11 of the current 16 adequacy decisions).  In some cases, the Commission makes recommendations for further protections, but essentially finds these countries continue to provide an adequate level of protection to EU personal data.

In February, the EU and Japan signed an economic partnership agreement agreed in October 2023.  The protocol includes provisions on cross-border data flows with the aim of providing greater legal certainty that data flows between the two jurisdictions will not be hampered by unjustified data localisation measures.  This was ratified and entered into force on 1 July, now forming part of the EPA.  It provides for the free flow of data (not just personal data) between the EU and Japan and removes data localisation requirements among other things.

As cyber incidents continue to cause financial and reputational damage to businesses, and harm to individuals, regulators and legislators continue to try and contain the problem. We are increasingly seeing cyber vulnerabilities exploited as a geopolitical weapon, which means cyber resilience remains a focus. In addition to the legislative initiatives mentioned in the Legislation section of this update, here is a small selection of other developments. You may also be interested in our Global Data Hub articles on cyber security.

UK

Government and regulatory

It is unclear how relevant some of the initiatives published in the first half of the year will be given the change in government.  The current government has, however, announced it will publish cyber security legislation in 2025 and also said it would carry on the previous government's work in a draft code of practice for software vendors to improve software security and resilience, on cyber security of AI including a voluntary Code of Practice, and on the future of the CyberFirst programme and how this can be scaled to inspire future talent.

• At the end of 2023, the House of Commons Joint Committee on the National Security Strategy published the findings and subsequent recommendations following its call for evidence on ransomware. The Committee's recommendations to the government focused on cyber resilience of critical infrastructure and reform of the Computer Misuse Act. On 11 March 2024, the House of Commons Joint Committee on National Security published the government's response to its consultation and subsequent recommendations on tackling ransomware. The Committee's subsequent press release was headed "Government's "ostrich strategy" in response to large and imminent national cyber-threat does not reassure", as the government had rejected key recommendations.
• In January 2024, the government published a call for evidence on the draft Cyber Governance Code of Practice. The Code sets out the critical governance areas directors need to tackle in order to protect their organisations.
• In January, the government also published its response to the call for views on software resilience and security for businesses and organisations. The government proposed a new voluntary code of practice for software vendors setting out the security obligations for organisations that sell software commercially.
• Also in January, the National Centre for Cyber Security published a report looking at the cyber threats posed by AI over the next two years. It concludes that AI will certainly increase the volume and impact of cyber attacks but suggests the threat will be uneven. It notes that many threat actors already use AI but as AI capability becomes more sophisticated, attacks will become more effective. The report analyses which threat actors will be most likely to have enhanced capability and the impact that is likely to have. See our article for more on this issue.
• The McPartland Review of Cyber Security and Economic Growth, a government-commissioned independent review of cyber security as a driver of economic growth, published a call for evidence in February.
• The UK government launched two calls for views on voluntary codes of practice for AI cyber security and cyber security issues for software vendors on 16 May 2024. The call for views on AI cyber security focused on the introduction of a voluntary code of practice on AI cyber security. It set out specific interventions to help secure AI and hopes to contribute to developing a global standard. The intention is to set out baseline security requirements together with risk mitigation actions in twelve key principles. These are designed to cover the entire AI lifecycle across the supply chain. The proposed code of practice for software vendors sets out fundamental security and resilience measures to be reasonably expected of B2B software developers and vendors. The draft code sets out 21 provisions under four overarching principles.
• On 12 September 2024, the government announced that data centres will be designated as Critical National Infrastructure (CNI). This will allow the government to support the sector in the event of critical incidents, minimising their effect on the economy. There will be a dedicated CNI data infrastructure team which will monitor and anticipate potential threats and provide prioritised access to security agencies and emergency services. On 14 October 2024, the government announced over £25bn of investment in UK data centres since it had taken office, including from Amazon Web Services, CyrusOne, ServiceNow, CloudHQ, CoreWeave and Blackstone.
• On 10 May 2024, the ICO called on organisations to do more to boost cyber security and protect the personal data they hold in the context of a growing threat of cyber attacks. The call followed publication of a report analysing trends in cyber security breaches during 2023. Finance, retail and education were the sectors reporting the most incidents.
• The UK's National Cyber Security Centre published updated guidelines on multi-factor authentication (MFA) on 26 September 2024.
• On 1 November 2024, the ICO published new guidance to help organisations communicate with empathy after a data breach. See our article on emotional and institutional resilience for victims of cyber crime here.
• On 6 November 2024, the National Cyber Security Centre (NCSC) published new guidance for brands to help advertising partners counter malvertising (malicious advertising which spreads malware and ransomware and which can lead to fraud). The guidance is aimed at brands which use in-house and third-party digital advertising services to help them choose partners who prioritise cyber security. 
• The FCA, jointly with the Prudential Regulation Authority (PRA) and the Bank of England, set out the final requirements and expectations for critical third parties (CTPs) to the financial sector and their operational resilience on 12 November 2024. The new rules will apply from 1 January 2025. 
• On 15 November 2024, the FCA, ICO and the Pension Regulator (TPR) published a joint statement on data protection and effective communications to consumers in relation to retail investment and pensions.

Breaches

We're not going to try and summarise all the breaches that hit the headlines this year, but here are a few that caught our eye, some of which also affected individuals outside the UK.

• The British Library fell victim to a ransomware attack by criminal group Rhysida at the end of October 2023. Not only did it result in personal data records and other files being placed for sale on the dark web, it also incapacitated the British Library systems. While final costs are unconfirmed, reports suggest that the Library will use 40% of its cash reserves to resolve the issues.
• EasyPark Group, owner of RingGo and ParkMobile, reported to the ICO that it had suffered a data breach after hackers accessed their customer data. Around 950 UK users were involved with the majority of those affected are based in Europe.
• Live Nation confirmed the theft of data belonging to 560m customers worldwide. Responsibility was claimed by ShinyHunters, which demanded £400,000 for the return of the data comprising names, addresses, contact numbers and incomplete credit card details. The group also claimed responsibility for a cyber attack on Santander Bank in which they claim to have stolen the data of 30m customers, including 6m account numbers and balances and 28m credit card numbers, as well as staff data. It has reportedly asked for £1.6m to release the data.
• The BBC suffered a data breach which exposed the details of more than 25,000 members of its occupational pension schemes, although the BBC said it had no evidence of a ransomware attack.
• The NHS suffered a ransomware attack in June believed to have been carried out by the Russian Quilin criminal gang. The attack affected the IT system of Synnovis, which analyses blood tests on behalf of the NHS. A number of non-urgent operations were cancelled and appeals for blood donors were issued. On 21 June, health data stolen was reportedly published online. The NCSC said it was investigating whether or not the published data was in fact data extracted from Synnovis, and both it and NHS England provided online support tools.
• On 10 June 2024, the UK and Canadian data protection regulators announced they would investigate the 23andMe data breach which last year saw a threat actor compromise over six million profiles in a credential stuffing attack.
• Chaos ensued on 19 July after CrowdStrike issued a faulty software update causing many devices using Microsoft Windows to crash. CrowdStrike said around 8.5m devices were impacted. While CrowdStrike said the issue was not due to a cyber attack, there were concerns that hackers would exploit the event by falsely claiming to represent CrowdStrike in order to get access to systems. The impact of the CrowdStrike incident was expected to trigger large insurance claims with estimates that US Fortune 500 companies alone would be likely to claim USD 5.4bn in insured damages. 
• TfL limited access to some of its online services on becoming aware of a cyber attack on 8 September 2024. TfL said the attack mainly impacted its backroom systems at its corporate HQ but it had no reason to believe any personal data had been compromised.
• The ICO confirmed on 3 October 2024 that it was fining the Police Service of Northern Ireland £750,000 after it disclosed employee records including surnames, initials, ranks and roles of 9,483 employees in response to a freedom of information request.
• The ICO announced on 4 November 2024, that it was seeking leave to appeal the judgment of the Upper Tribunal relating to DSG Retail Limited in the Court of Appeal. DSG was fined £500k (reduced under appeal to £250k) under the Data Protection Act 1998 in relation to a cyber breach which affected 14m people. Separately, DSG was given permission to appeal, first to the FTT and then to the Upper Tribunal which allowed the appeal and remitted the case to the FTT to be re-decided.

EU

• In January, ENISA published a report which aims to contextualise the main design principles for engineering data protection in Common European Data Spaces.
• ENISA and the European Securities and Markets Authority, the European Insurance and Operational Pensions Authority and the European Banking Authority published a multilateral memorandum of understanding on cooperation between the ESAs and ENISA on 4 June 2024. This covers cooperation and information exchange relating to DORA, NIS2 and other areas of common interest. In particular, common incident reporting and developing common technical standards will be prioritised.
• On 27 June 2024, the European Systemic Risk Board published a compliance report on its recommendation on the establishment of a pan-European systemic cyber incident coordination reporting framework (EU SCICF). Its recommendation was published in January 2022 for issues that EU authorities should consider in preparation for DORA and requirements around points of contact. 
• On 27 September 2024, the Irish Data Protection Commissioner announced it had issued a reprimand and a EUR 91m fine to Meta for security failings relating to the storage of passwords in plain text. The Irish DPC found not only that Meta had failed to notify it of a data breach and to document data breaches concerning the storage of passwords in plain text, but it had not used appropriate technical or organisational measures to protect the passwords against unauthorised measures and use a level of security appropriate to the risk.
• In September, changes made to the latest version of the draft EU Cloud Services Cybersecurity Scheme dropped controversial EU localisation requirements in favour of transparency provisions which include information on storage location and data processing methods. Once ENISA adopts the EUCS, the EC will issue implementing legislation under the Cybersecurity Act, after which all Member States will be able to adopt the certification scheme should they wish to. They will be able to pass local laws making the scheme mandatory for specific types of data.
• The European Supervisory Authorities, the EA, ESMA and Eiopa (ESAs), published joint guidelines on the oversight cooperation and information exchange between the ESAs and the competent authorities under the Digital Operational Resilience Act (DORA) on 6 November 2024. The guidelines apply from 17 January 2025.
• On 7 November 2024, ENISA published a consultation on technical guidance for the cybersecurity measures of the NIS2 Implementing Act. The guidance will support Member States and government entities with compliance.
• In December, ENISA published the first biennial report on the state of cyber security in the EU (as required under the NIS2 Directive).

ECJ ruling on controller liability for third-party cyber attacks

The ECJ ruled in a reference from Bulgaria on issues around controller liability for third-party cyber attacks and compensation for fear of misuse of personal data. The ECJ held that:

• the mere fact of unauthorised access to data is not, in itself, evidence that a controller has failed to take appropriate technical and organisational measures to protect the data. This must be assessed by the national courts on a case by case basis
• the controller must be able to demonstrate that its security measures are appropriate in accordance with s32 requirements and the principle of accountability. An expert report will not necessarily be sufficient
• Article 82 means that a controller may have to compensate data subjects who have suffered damage as a result of unauthorised access to or disclosure of their personal data unless the controller can prove it is not responsible for the damage, and
• fear of potential misuse of data by third parties as a result of a data breach can constitute non-material damage for the purposes of Article 82 GDPR.

Here are some of the more interesting judgments and Opinions coming from the EU and UK involving data privacy during 2024 which are not dealt with elsewhere in this update.

UK cases 

• In April, the Upper Tribunal Administrative Appeals Chamber dismissed the ICO's appeal against a First Tier Tribunal decision to overturn an order it made against credit broker Experian. The ICO has said it will consider its next steps, including whether or not to appeal.

• The High Court held in Harrison v Cameron and another that a controller may rely on the 'rights of others' exemption under the DPA 18 and Article 15 UK GDPR and refuse to disclose identities of individuals in response to a SAR where doing so could reasonably be expected to create a significant risk that the individuals would face intimidation and threats from the maker of the SAR.
• On 3 July 2024, the High Court ruled in Pacini and another v Dow Jones & Company Inc. [2024] EWHC 1709 (KB).  The court rejected an application to strike out a claim for breach of data protection law brought by the two claimants – former senior executives of the XIO group. The claim related to two articles published in 2017 and 2018 and the right to be forgotten. 
• An amended collective proceedings application brought by Dr Liza Lovdahl Gormsen against Meta was accepted by the Competition Appeal Tribunal in February. On 1 November 2024, the Court of Appeal refused an application by Meta to reverse the judgment of the Competition Appeal Tribunal. The CPO claims Meta abused its dominant position impacting UK Facebook users, by using their personal data for commercial purposes without their consent.

ICO enforcement

• On 24 July 2024, the ICO issued a reprimand to a school which introduced facial recognition technology in its canteen without first conducting a DPIA as required under the UK GDPR.
• On 7 August 2024, the ICO announced its provisional decision to fine Advanced Computer Software Group Ltd £6.09m for failing to protect the information (which included sensitive data) of just over 80,000 people. Advanced acts as a data processor in providing IT and software services to organisations including the NHS and other healthcare providers. It suffered a ransomware attack in August 2022 via a customer account that did not have multi-factor authentication.  This led to the exfiltration of the personal data of 82,946 people and to disruption to critical services such as NHS 111 and access by medical staff to patient records. The ICO will consider representations by Advanced before making a final decision. If it does proceed with the fine, it will be the first major UK GDPR fine issued to a data processor.
• On 28 August 2024, the ICO issued a reprimand to the Labour Party for repeatedly failing to respond to subject access requests.
• The ICO announced it had issued an enforcement notice against Serco Leisure, requiring it to stop using facial recognition technology and fingerprint scanning to monitor employee attendance.
• On 1 March 2024, the ICO found that a Home Office pilot scheme to use GPS electronic monitoring of migrants breached data protection law because it failed to assess the privacy intrusion of GPS monitoring, did not provide transparency information, and did not take risk assessment and mitigation measures in terms of the impact on potentially vulnerable people.
• Of course, fines continued to flow for unlawful marketing during 2024, starting in January when the ICO fined HelloFresh £140,000 for sending over 79m spam emails and 1m spam texts in seven months.

ECJ judgments and AG opinions

• In January, AG de la Tour opined in a reference from Germany's Federal Court of Justice. The reference asked whether failure to take appropriate measures under Article 12(1) GDPR to provide Article 13(1) required information is a breach of data subject rights and whether, consequently, a representative action brought by a consumer protection association based on such an infringement should be allowed to proceed in accordance with Article 80(2). The AG opined that such a breach could give rise to such proceedings. The referring case relates to a challenge to a consumer representative body bringing an action against Meta Platforms Ireland, alleging it had failed to provide fair processing information to users of free games available in its app centre.
• In February, the ECJ gave a ruling on a customer's claim for compensation for non-material damages after his personal data was disclosed to a third party due to employee error. The ECJ held that the mere fact that a document is provided in error to an unauthorised third party is not sufficient to consider the controller did not take appropriate technical and organisational measures to protect the data. The ruling narrows the scope of the December 2023 judgment in VB v Natsionalna agentista za prihodite, which found that fear of misuse of personal data by third parties following a GDPR infringement can give rise to a claim for non-material damages.
• On 7 March 2024, the ECJ handed down a preliminary decision in a reference from Finland that related to oral disclosure of personal data. The ECJ was asked whether oral disclosure of personal data constituted processing of personal data under the GDPR.  The ECJ was also asked about the balance of interests between an individual subject to criminal proceedings and public interest in having information about this.  The court said that given the sensitivity of data relating to criminal convictions, the fundamental rights of the data subject and protection of personal data would likely prevail over public interest in having access to official documents, whether or not the requestor is a company or a private individual and whether the information is disclosed orally or in writing.
• On 14 March 2024, the ECJ ruled in a reference from Hungary, that a Member State DPA can make an own-volition order to delete unlawfully processed personal data, even in the absence of a prior request made by the data subject. This is because the DPA has a duty to remedy GDPR infringement and a failure to act would mean the controller could retain the data and continue to process it unlawfully. This is true whether the data originated directly from the data subject, or from another source.
• On 2 February 2024, the ECJ ruled in a reference from Germany on issues around the processing of employee health data where the controller is a medical service that creates reports on insured persons' fitness for work.

  The ECJ held that the exception to the prohibition on processing special data in 9(2)(h) (processing necessary for preventative or occupational medicine for the assessment of the working capacity of an employee) does apply where a medical examination body processes the data not as an employer but as a medical service, subject to other relevant conditions being met.  Article 9(3) does not require a controller to ensure that no colleagues of the employee concerned are able to access the data.  In addition, at least one of the Article 6(1) conditions (lawful basis) must be met.

  The ECJ also said that Article 82(1) (compensation) must be interpreted to mean that financial compensation payable in accordance with that Article should be compensatory not punitive or dissuasive and that while fault of the controller had to be established to award compensation, the seriousness of the fault need not be take in into account when awarding non-material damages.

• In September, the ECJ ruled in a reference from Germany, that Supervisory Authorities (SAs) have discretion as to whether or not to exercise corrective powers where a controller has already taken steps to remediate an issue. This particular case related to a minor data breach by an employee at a bank. The affected customer argued that the relevant SA should have fined the bank. The ECJ held that: an SA is not required to exercise a corrective power (particularly a fine) where to do so would not be appropriate, necessary and proportionate; and the SA is required to exercise one or more of its corrective powers where it is appropriate, necessary and proportionate.
• On 4 October 2024, the ECJ handed down judgment in a reference from Austria in a case brought by Max Schrems who complained that personal data relating to his sexual orientation had been processed unlawfully by Meta to send him advertising targeted at homosexuals. He argued this was done without his consent or under any other lawful basis. The ECJ said: the GDPR principle of data minimisation precludes all personal data obtained by a controller from being aggregated, analysed and processed for the purposes of targeted advertising without restriction as to time and without distinction as to the type of data; the fact that Mr Schrems made a statement concerning his own sexual orientation during a public panel discussion may constitute an act by which he "manifestly made public" the information, thereby negating the prohibition on processing special data although it will be for the national court to decide, but making the data public does not in itself permit its processing for the purposes of personalised advertising. 

• On 4 October 2024, the ECJ ruled in the Lindenapotheke (Case C-21/23) – a reference from Germany. The German court asked whether the GDPR precluded a competitor bringing a case against it for breach of the GDPR under unfair commercial practices legislation. The ECJ said it did not. The ruling also discussed what constituted health data. Read more.
• On 4 October 2024, the ECJ ruled in a reference from the Netherlands regarding the Royal Lawn Tennis Association (KNLTB). The KNLTB had disclosed member personal data to be used for marketing purposes. The Dutch Supervisory Authority (AP) fined the KNLTB for breaching GDPR and, in particular, for not having a lawful basis for the processing at issue. The AP said for the purposes of Article 6(1), legitimate interests are only those enshrined in and determined by law. The referring court then asked the ECJ how to interpret what constitutes a legitimate interest. In short, the ECJ underlined that a legitimate interest can be purely commercial provided it is lawful but the interest does not need to be determined by law. The processing needs to be necessary to fulfil the purpose and a legitimate interest assessment must be carried to determine that the interests of the controller are not overridden by the rights and freedoms of the data subjects.

NOYB complaints

NOYB, the privacy advocacy group, had another busy year.  In addition to various complaints around digital advertising and data transfers, it also filed:

• eight complaints against X – these were filed with eight Supervisory Authorities after NOYB accused the Irish DPC of failing to tackle core issues around X's use of personal data. The complaints ask the SAs to investigate all X's data processing practices for GDPR compliance
• a court action against the Swedish SA – NOYB alleges that the Swedish SA has not complied with its obligations and "seems to forget it's an enforcement authority", and
• two complaints with the EDPS against the European Parliament – NOYB has lodged complaints on behalf of four European Parliament employees relating to the impact of a data breach of the EP's recruitment database in June 2024. The first complaint concerns the revelation of special personal data and the second, refusal to respond to an erasure request.

Austria and Ireland have certified NOYB as a "qualified entity", entitling it to bring collective redress actions in courts throughout the EU.  This can take the form of an application for an injunction, or collective redress, ie class actions, on the proviso they are on a non-profit basis, so NOYB is likely to get even more active in 2025.