Data and Cyber Update - August 2026

Welcome to the latest edition of the Stephenson Harwood Data and Cyber Update, covering the key developments in data protection and cyber security law in August 2026.

In data regulation news, the ICO has opened a consultation on anonymisation and pseudonymisation for research, Ofcom has published its first major age-assurance report, the ICO has set out its expectations for police use of facial recognition, France's Constitutional Council has struck down the country's proposed under-15 social media ban, and the Austrian Supreme Court has required an accommodation platform to disclose host identities to customers.

In cybersecurity news, an extortion group has claimed responsibility for theft of data from the Department for Education and the Police National Legal Database, and the ICO has reprimanded the ACRO Criminal Records Office over cyber security deficiencies.

In our enforcement and civil litigation update, a for-profit mass GDPR claims model has reached the CJEU, the Spanish and Italian data protection regulators have both issued fines bearing on the limits of controller responsibility, Apple has filed a further challenge to a UK investigatory powers notice, Meta has settled a claim brought by 29 US states over allegations of teen addiction to its platforms, Ofcom has opened an investigation into TikTok, and the Court of Appeal has ruled that misleading headlines can constitute unlawful processing.
 

Data Regulation

• ICO consults on anonymisation and pseudonymisation for research

• Ofcom's landmark age-assurance report finds age-inference systems failing

• France's Constitutional Council strikes down under-15 social media ban

• Austrian Supreme Court: accommodation platform must disclose host identity after reservation, rejecting EU GDPR defence

• ICO sets expectations for facial recognition in policing
   

Cybersecurity

• Extortion group claims theft of DfE and Police National Legal Database records

• ICO reprimands ACRO criminal records office over unclear cyber responsibilities
   

Enforcement and Civil Litigation

• For-profit mass GDPR claims model reaches CJEU

• Spain fines Vodafone €750,000 for supplier breach and Italy's Garante fines a US data broker €2 million for transparency, fairness and minimisation failures

• Meta settles US teen-addiction claim for up to $18 billion and agrees to platform changes

• Ofcom investigates TikTok's compliance with Online Safety Act duties

• Apple files a further challenge to a UK backdoor notice

• Misleading publications: Court of Appeal opens the door to data protection remedies
   
  

Data Regulation

ICO consults on anonymisation and pseudonymisation for research

On 7 August 2026, the ICO opened a consultation on draft guidance covering the use of anonymisation and pseudonymisation for research, archiving and statistical purposes. It forms part of the ICO's wider reworking of its anonymisation guidance. This draft guidance will, once finalised, add a dedicated section covering research contexts.

The question of when data is sufficiently anonymised to fall outside UK GDPR persists, largely because anonymisation is not a fixed process. The same dataset could be personal data in one organisation’s hands and anonymised in another’s, depending on what other information each recipient could realistically use to reidentify individuals.

The draft guidance addresses how controllers should approach this risk in a research context. Before a controller processes personal data for research purposes, it must first consider whether it can use anonymised data; and if it cannot, whether pseudonymisation can aid in minimising personal data processed. Controllers must consider identifiability risk in context, including who else can access any anonymised data and what other information they may hold; and must take particular care with certain types of data that might be particularly susceptible to reidentification even after the removal of obvious identifiers (such as genetic data). Finally, the guidance sets out some options available to controllers to support anonymisation, pseudonymisation and data minimisation, such as Trusted Research Environments and federated access approaches.

The consultation is open until 19 October 2026.
 

Ofcom's landmark age-assurance report finds age-inference systems failing

A report by Ofcom on age assurance under the Online Safety Act confirms rapid deployment but uneven effectiveness. Over 69 million age checks were completed across 32 services in the second half of 2025, a 23-fold increase on the prior period, and the proportion of children encountering highly effective checks nearly doubled. Gaps persist, however. Many pornography sites still lack any age verification and where checks are in place, effectiveness varies. Over one in ten 15 to 17-year-olds continued to visit three of the most popular dating apps in December 2025, suggesting their methods may not be sufficiently aligned with Ofcom's guidance.

The regulator has raised particular concerns about the age inference methods used by several major social media platforms. These analyse user behaviour to estimate age. Ofcom's evidence suggests these methods may be failing to identify significant numbers of child users, meaning children risk exposure to harmful content. The related enforcement action Ofcom is taking is set out in our “enforcement” section below.

The report sets outs Ofcom’s expectation that services lacking age checks must implement them without delay. Those relying on age inference must switch to methods listed in Ofcom's guidance as highly effective or must otherwise demonstrate, with reliable and compelling evidence, that their current method meets that standard. Ofcom has also stated that current age inference methods will be insufficient to underpin the planned social media restrictions for under-16s, and has said that it will deliver an assessment to Parliament by the end of October on what highly effective checks should look like in that context.
 

France's Constitutional Council strikes down under-15 social media ban

On 14 August 2026, the French Constitutional Council (the "Council") annulled the country's proposed under-15 social media ban, ruling that it disproportionately restricted freedom of expression and failed to provide sufficient safeguards for privacy. The Council found that the law imposed a general prohibition without properly accounting for platform-specific risks, the age and maturity of individual children, or the safeguards already in place on the relevant platform.

The ban would have applied broadly to online platforms that allow users to communicate, share content and discover other users or content. Although certain educational, scientific and open-source services were excluded, the Council found that the exceptions were too narrow and that the ban could therefore capture services whose risks to children had not been established. It also gave parents and legal representatives no ability to authorise access based on a child's circumstances or the nature of the service.

The ruling also makes clear that the ban would likely require all users, including adults, to prove their age before accessing affected platforms. As the legislation did not set out the conditions, limits or safeguards governing those checks, it failed to provide sufficient protection for users' right to privacy. The decision therefore confirms that mandatory age verification is itself a potential interference with privacy rights, requiring a clear legal framework and appropriate safeguards.

The ruling does not rule out age restrictions altogether. The French Government is now expected to develop a revised proposal addressing both the judgment and the interaction between national measures and the EU Digital Services Act.

The judgment is also significant for the wider European debate on children's online safety. It places a constitutional limit on blanket age restrictions just as the European Commission prepares its own proposals on youth protection. The decision also follows the G7 backing proportionate privacy-preserving age assurance measures (which we covered in our July Update, here).

The ruling comes as New Zealand becomes the latest country to propose an under-16 social media ban, with legislation introduced on 24 August 2026 that would require platforms to take reasonable steps to verify users' ages. It also coincides with European governments reportedly examining whether Meta should adopt similar child protection measures in Europe to those it has agreed to roll out in the United States, following its settlement on teen addiction (see our enforcement section below for more details).
 

Austrian Supreme Court: accommodation platform must disclose host identity after reservation, rejecting EU GDPR defence

The Austrian Supreme Court has ruled that the travel company Booking must disclose the name and address of private accommodation providers to travellers immediately after they have made a reservation. The decision, dated 20 May and published by the Austrian consumer association VKI, confirms the judgments of the lower courts and resolves a dispute brought by the VKI on behalf of the Austrian Ministry of Social Affairs.

The court held that the provider's name and address constitute essential information within the meaning of Austria's Unfair Competition Act. It adopted a broad interpretation of the concept of a "commercial decision," finding that it encompasses not only the conclusion of the contract but also the exercise of rights after the contract has been entered into. The Court was clear that it is insufficient for Booking to supply this information only on request, as this would undermine consumers' legitimate interest in straightforward enforcement of their rights.

Booking had argued that sharing providers' personal data would breach the GDPR principles of purpose limitation and data minimisation. The Court rejected both arguments, holding that the processing serves the purpose of, and is necessary for, fulfilling information obligations under unfair competition law, and is therefore compatible with both principles.

The ruling is notable for platform operators across the EU. It demonstrates that data protection obligations do not override statutory disclosure duties owed to consumers, and that platforms cannot rely on the GDPR as a shield against transparency requirements rooted in consumer protection and competition law. Platform operators facilitating transactions between consumers and private providers should review their disclosure practices to ensure compliance with equivalent obligations in other EU jurisdictions.
 

ICO sets expectations for facial recognition in policing

On 18 August 2026, the ICO published findings from audits of five police forces using facial recognition technology ("FRT") in England and Wales. The audits covered both live FRT, which compares faces against a watchlist in real time, and retrospective FRT, which operates over pre-recorded images. The audits produced mixed results. The audited forces generally performed well in identifying and documenting lawful basis, limiting data used in live FRT deployments, and maintaining strong breach-reporting procedures. However, compliance was more robust for live recognition than retrospective use.

Across the five audits, the ICO made 107 recommendations, all of which were accepted or partially accepted by the police forces. Areas requiring improvement included clearer senior oversight, better training, more accurate records of data sources used, and tighter controls on images retained for retrospective searches. Forces were also asked to test systems regularly for accuracy and to take steps to reduce the risk of bias or unfair treatment.

The ICO also raised concerns regarding the algorithm used by UK police forces for retrospective searches of the Police National Database, after a 2025 test by the National Physics Lab identified possible demographic bias within the algorithm. The Home Office and National Police Chiefs' Council have introduced measures such as additional training, oversight reporting and equality impact assessments, alongside longer-term plans to replace the algorithm altogether.

As police use of FRT expands, the ICO's message is that public trust will depend on more than demonstrating a lawful basis. Forces will need to show that deployments are necessary and proportionate, that appropriate safeguards are in place and that responsibility sits clearly with senior officers. The ICO's approach is also relevant to commercial operators of FRT, providing a clear indication of the governance, oversight and DPIA standards likely to be required before live FRT is deployed.
 

Cyber Security

Extortion group claims theft of DfE and Police National Legal Database records

A previously unknown extortion group, ExfilSquad, has claimed the theft of around 607,000 records from the UK Department for Education (the "DfE") and around 135,000 records from the Police National Legal Database, publishing samples on a dark web leak site on 26 July 2026 as part of a wider campaign. No systems were encrypted in the course of the attack, which followed a pattern of data theft for extortion, rather than a ransomware lockout. This pattern has become the dominant model, as attackers have increasingly found that the threat of publication is leverage enough.

Both bodies have self-reported to the ICO, and the DfE is working with the National Cyber Security Centre and the National Crime Agency. None of the compromised DfE systems is a core operational DfE network. This illustrates that the security measures obligation under Articles 5(1)(f) and 32 of UK GDPR extends across the entire processing estate, including peripheral, outsourced, and legacy systems, which are often under-maintained. The nature of any ICO enforcement decision that might follow will likely turn on whether the security measures applied to these peripheral systems were proportionate to the volume and sensitivity of the data they held.
 

ICO reprimands ACRO criminal records office over unclear cyber responsibilities

The ICO has reprimanded ACRO Criminal Records Office after cybersecurity failings left the personal data of up to 10,920 individuals potentially exposed, including names, addresses, National Insurance numbers, bank details, biometric data and criminal offence information. Between August 2022 and March 2023, an attacker gained and then maintained unauthorised access to ACRO's website and content management system ("CMS"), staging personal data for exfiltration. ACRO could not conclusively determine whether the data was, in fact, removed from its systems.

The ICO found infringements of Articles 32(1), 32(1)(b) and 32(1)(d) of the UK GDPR, concluding that ACRO lacked appropriate organisational measures to ensure security commensurate with the risk. ACRO had engaged third-party providers for security management and support, but failed to ensure clear responsibility for identifying and monitoring critical CMS security updates. ACRO's CMS had run on an unpatched version from September 2019 to March 2023, with none of the security updates or hotfixes released in that period applied. Security alerts generated by ACRO's antivirus software were not investigated, and ACRO could not identify who was responsible for reviewing or escalating them.

The ICO's Group Manager for Civil and Cyber Investigations noted that the case shows how basic cyber security failings can create significant risks for thousands of people, particularly where organisations process large volumes of highly sensitive personal information. For controllers processing sensitive data at volume, the case underscores that outsourcing security functions does not discharge accountability. Patch management, alert triage and monitoring responsibilities must be clearly assigned, documented and assured, because the gaps between internal teams and external providers are common failure points.
 

Enforcement and Civil Litigation

For-profit mass GDPR claims model reaches the CJEU

The Landgericht Leipzig (Leipzig Regional Court) has referred a question to the Court of Justice of the European Union (the "CJEU") as to whether a for-profit claims company can pool individual GDPR compensation claims and pursue them collectively. The reference (Case C-323/26, Protectra) arises from claims assembled by the debt-collection agency Protectra after a cyberattack compromised the personal data of more than 50 customers, with the affected individuals assigning their claims to the company to pursue collective litigation.

The question is whether the GDPR permits this assignment model, or whether the right to compensation under Article 82 is personal to the data subject and cannot be transferred to a commercial vehicle for bulk enforcement. The answer will be critical in determining whether a market for aggregated data protection claims could develop in the EU, in an equivalent manner to funded collective actions under competition and consumer law.

For controllers, the stakes are significant. If the CJEU permits the model to go forward, a single breach affecting many individuals could give rise to a consolidated, commercially funded damages claim brought by a specialist litigation business, rather than a scatter of individual complaints that most data subjects never pursue further. This would materially increase the financial consequences of a breach across the EU, because low-value individual claims that data subjects rarely consider worth the effort could instead be pursued together.
 

Spain fines Vodafone €750,000 for supplier breach and Italy's Garante fines a US data broker €2 million for transparency, fairness and minimisation failures

Two enforcement decisions this month further illustrate how regulators are policing the boundaries of controller responsibility, in the contexts of outsourced processing and large-scale data scraping.

Spain's data protection authority has fined Vodafone €750,000 after customer data held by a third-party supplier was accessed during a cyberattack. Despite Vodafone having outsourced the processing, the regulator held it responsible for safeguarding the data, as the controller.

Three distinct failings were identified: insufficient encryption of the customer data, inadequate verification measures, and the absence of a processor agreement with the third-party supplier prior to the incident.

Separately, Italy's Garante fined US data broker Lusha Systems Inc. €2 million and ordered the deletion of all personal data relating to individuals in Italy, together with an immediate ban on further processing. Lusha operates a paid platform that supplies "enriched" profiles, combining data scraped from social networks with information purchased from other brokers, for commercial prospecting and anti-fraud purposes. The database included records on a large number of Italian residents, among them senior figures from public institutions, law enforcement and the judiciary.

The Garante found breaches of the GDPR principles of lawfulness, fairness, transparency and data minimisation. Lusha's reliance on legitimate interest as its lawful basis for processing was rejected: given the scale of collection, the absence of any direct relationship with the individuals, and the commercial purpose of the activity, the balancing test against the data subjects’ rights and freedoms was found not to have been met.

Critically, the Garante treated Lusha's continuous updating and verification of profiles as systematic monitoring under Article 3(2)(b), bringing the processing within the GDPR's territorial scope despite Lusha having no EU establishment.

Together, the decisions illustrate two practical points. Firstly, outsourcing processing does not outsource controller liability, and a compliant Article 28 processor agreement is treated not as a paperwork formality but as a baseline security measure that must be in place before processing begins. Secondly, for data brokers and enrichment platforms, ongoing profile updates can convert an initial collection into monitoring activity that triggers full GDPR applicability, with legitimate interest being a difficult basis to rely on for large-scale data scraping and resale.
 

Meta settles US teen addiction claim for up to $18 billion and agrees to platform changes

On 26 August 2026, Meta settled a claim brought by 29 US states alleging that it had designed Facebook and Instagram to addict children and had misled the public about the platforms' safety. Under the terms of the settlement, which came shortly after the trial got underway, Meta agreed to pay up to $18 billion (part of the settlement sum being dependent on the outcome of other, similar claims currently being brought against other platforms), and to make changes to both platforms, while denying the allegations and admitting no liability. The case, filed in 2023 and which was to be tried in California, concerned claims that Meta had knowingly encouraged use by underage users and had built in engagement-driven features, such as infinite scrolling, while presenting itself as prioritising child safety.

Among the publicised settlement terms is a stipulation that for the next ten years, Meta will apply daily time limits and overnight restrictions to accounts on its platforms held by children, and must introduce enhanced age-assurance measures intended to keep children off the platform and away from age-restricted content, although personalised recommendations and targeted advertising are retained.

The settlement establishes design-based obligations towards minors, and age assurance in particular, as a key measure. It sets a benchmark that is likely to inform regulatory and governmental expectations in other jurisdictions.
 

Ofcom investigates TikTok's compliance with Online Safety Act duties

Ofcom has opened an investigation into TikTok's age-inference systems, and pressed Google and Bing to account for the visibility of pornography sites that lack age checks in their search engine results. The move follows Ofcom's first major review of age assurance under the Online Safety Act (covered above), and signals a move away from setting expectations and towards testing named services against them. For platforms within the scope of the Online Safety Act, the investigation appears likely to give an early indication of how Ofcom will assess whether age assurance is "highly effective" in practice.
 

Apple files a further challenge to a UK backdoor notice

Apple has filed a further challenge in the Investigatory Powers Tribunal against a UK government notice under the Investigatory Powers Act 2016 that would require it to enable law enforcement and intelligence services to access to encrypted user data via insertion of a “backdoor”.

This latest notice, and the challenge being brought against it, follows an earlier, broader notice covering all users internationally, which – after a similar challenge from Apple – was withdrawn and replaced with a narrower notice limited to UK users. The detail of the challenge is unclear, because notices of this kind and the proceedings around them are subject to statutory secrecy. The case will test how far the UK Government can compel a provider to weaken end-to-end encryption, an outcome with direct implications for any business that relies on strong encryption to meet its own security obligations.
 

Misleading publications: Court of Appeal opens the door to data protection remedies

In a judgment handed down on 15 July 2026, the Court of Appeal has held (in Vince v Associated Newspapers Ltd [2026] EWCA Civ 899), that the presentation of a misleading headline and image can amount to unfair processing of personal data under the UK GDPR, even where a libel claim would otherwise fail.

Joanne Elieli and Daniel Bishop have considered the decision in further detail, and examined what it means for publishers and other online content creators, in an article for PLC Magazine. Click here for more details.