Data and Cyber Update - October 2026
Welcome to the latest edition of the Stephenson Harwood Data and Cyber Update, covering the key developments in data protection, cyber security and online regulation in October 2026.
In data and digital regulation news, the ICO has secured data protection changes from ten leading foundation model developers and opened a call for evidence on agentic AI; the EU Data Act’s access-by-design obligations now apply to newly marketed connected products; and the EDPB has released a statement on the data protection challenges of smart glasses, published new guidelines on fining and finalised guidance on the interplay between the DSA and the GDPR.
In cyber security news, we look at the ASOS cyber incident, in which hackers sent an unauthorised notification to app users and accessed customer data held on third-party platforms; and the “PHP2Shell” vulnerabilities, where AI-assisted research exposed long-standing flaws in PHP.
In our enforcement and civil litigation update, the Supreme Court has heard the appeal in Farley v Paymaster on whether a threshold of seriousness applies to data protection damages claims, and TikTok has withdrawn its appeals against the ICO, accepting a £12.7 million fine and allowing a separate investigation into its recommender systems to resume.
More details on each of these developments are set out below.
Data and digital regulation
ICO secures changes from foundation model developers as scrutiny turns to agentic AI
EDPB harmonises fining methodology and finalises DSA-GDPR guidance
Cybersecurity
ASOS cyber incident places third-party platforms and customer communications under scrutiny
AI-assisted research exposes long-standing PHP vulnerabilities
Enforcement and Civil Litigation
DATA AND DIGITAL REGULATION
ICO secures changes from foundation model developers as scrutiny turns to agentic AI
On 8 October 2026, the ICO published a report, Building trust and transparency into generative AI development: our work to create regulatory certainty, in which it confirms that ten of the largest AI foundation model developers operating in the UK have made, or committed to make, changes to their services following its intervention. This includes Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI. The report closes a two-year supervision programme under the ICO’s AI and biometrics strategy.
The changes include providing clearer transparency information, stronger mechanisms for individuals to exercise their rights and tougher assessments of safeguards. The ICO says it is monitoring progress against the commitments.
The ICO also set out its policy positions and regulatory expectations on longstanding issues developers have been grappling with. These include how developers should approach special category data in training datasets, and how they should determine whether a model itself may contain personal data.
The ICO’s position is that a model can contain personal data, and therefore itself be subject to data protection law, where datasets used to train a foundation model contain personal data and that training data is embedded into the model. A case-by-case assessment of the model is required including to establish the extent to which an AI model memorises its training data. If it does, this would increase the risk of the model inadvertently disclosing personal data, and would make it more vulnerable to attack.
On the use of special category data, the report addresses the tension between enabling AI innovation, protecting individual rights and maintaining trust, particularly in circumstances where special category data is being used – whether or not intentionally - to train a model, acknowledging that the ‘scientific research’ condition is unlikely to cover all foundation model development.
The ICO accepts that current foundation model training practices present technical challenges for compliance with UK data protection law and data protection by design principles, and confirms it is proactively raising this with the Government, suggesting that these challenges may ultimately need to be resolved through policy rather than guidance alone.
The ICO has also opened a six-week call for evidence on how organisations are managing the data protection risks of agentic AI. It covers security, transparency, accountability, automated decision-making, fairness and lawful data use, and closes on 20 November 2026.
The ICO has made enquiries with OpenAI, Anthropic, Meta and the AI Security Institute after reports that certain agents bypassed protections, used unauthorised communication channels and accessed external systems during testing. In our August 2026 edition of Neural Network, we covered instances of AI agents taking unsanctioned actions on the live internet during cyber security evaluations, including an attack on the AI platform Hugging Face. The ICO’s message is consistent: an agent acting autonomously is, in the words of the ICO’s Director of Technology Regulation, Richard Nevinson, “not an excuse for poor compliance”.
EU Data Act access-by-design obligations now applicable
The EU Data Act’s access-by-design obligations are now applicable, as from 12 September 2026. Connected products and related services placed on the EU market from this date must be designed so that users can access the data they generate by default.
This adds to the wider data access and sharing rights that have applied under the Data Act since 12 September 2025.
For an overview of the key rights, obligations and business implications of the entry into force of the EU Data Act, access our EU Data Act series here, and for a visual summary see our LinkedIn carousel post.
EDPB highlights data protection challenges of smart glasses
On 13 October 2026, the European Data Protection Board (the “EDPB”) released a statement on smart glasses alongside a report, The connected gaze. Video recording, surveillance and administering evidence in the age of smart glasses. The report was prepared by an external expert as part of its Support Pool of Experts programme. The statement sets out the EDPB’s preliminary regulatory position, while the report provides the underlying sociological analysis.
In its statement, the EDPB highlights that smart glasses pose a risk to transparency obligations under the GDPR because they can be difficult to distinguish from ordinary eyewear.
The report sets out that connected glasses can become tools of interpersonal surveillance. The report focuses on “capture signage”: whether bystanders can tell that smart glasses are recording. It notes that some users treat the LED indicator as a transparency signal, while more critical non-users describe it as a “sham transparency”, because it may be hard to see, easy to hide and does not tell bystanders what happens to the data.
The statement also keeps the focus on broader data protection compliance. Children are specifically highlighted as more vulnerable, because they may be less aware of the presence or implications of smart glasses. The EDPB therefore encourages controllers to adopt data minimisation measures, such as limiting continuous recording and live streaming. Beyond that, to mitigate other risks, it recommends other privacy-friendly methods, including measures to blur, obscure or avoid processing the identity of bystanders, or anonymisation before sharing data.
For businesses developing, deploying or permitting smart glasses, the message is practical. Compliance cannot stop at a privacy notice or a small recording light. Organisations need to consider who is acting as controller(s), how bystanders are notified, whether recording is necessary, and whether the technology creates new risks in sensitive settings such as workplaces, schools and healthcare environments.
Employers and regulators, including those in in Australia, Norway and Germany, are increasingly alive to those risks, as we covered in our recent insight, Smart glasses, sighting the risks.
EDPB harmonises fining methodology and finalises DSA-GDPR guidance
On 21 September 2026, the EDPB announced that it had adopted draft guidelines on when a data protection authority (“DPA”) should impose administrative fines under the GDPR, and published the final version of its guidelines on the interplay between the Digital Services Act (the “DSA”) and the GDPR.
Guidelines 04/2026 on the application of the power to impose administrative fines
The fining guidelines, open for consultation until 13 November 2026, set out a five-step approach for DPAs to follow. They may be instructive for organisations facing a potential fine and are as follows:
Check whether the infringement can lead to a fine under the GDPR or national law.
Confirm whether the party under investigation can be fined, which depends on whether the controller or processor is bound by the provision breached.
Assess whether the infringement was intentional or negligent. Here the bar set out is strikingly low: plain human error may indicate negligence and, where EDPB guidelines exist, an error is always considered avoidable and therefore at least negligent. Legal advice is no shield either: relying on an external opinion that departs from majority legal opinion, or on internal advice that contradicts the regulator’s known opinion, will not avoid a finding of negligence.
Weigh up the aggravating and mitigating factors to decide whether the infringement is minor. If it is, a reprimand will generally follow instead of a fine; if not, there is a strong presumption that a fine should be imposed.
Assess whether a fine would be effective, proportionate and dissuasive. This assessment must reflect whether the objective pursued is to establish compliance with the rules, punish unlawful behaviour or both. and may depart from the general approach in either direction.
Guidelines 3/2025 on the interplay between the DSA and the GDPR
The final DSA-GDPR guidelines clarify how in-scope intermediary service providers should coherently interpret and apply the GDPR and the DSA when processing personal data. The guidelines focus on specific provisions of the DSA where there is significant interplay with the GDPR and, critically, confirm that the DSA does not override the GDPR and the two must be applied consistently. The guidelines cover content moderation, notice and action, deceptive design, advertising, recommender systems, protection of minors and systemic risk assessments.
Particular points to note from the guidelines include:
Reporting illegal content: hosting providers should collect only the personal data they need. Users should be able to report anonymously, unless they must be identified to verify the claim.
No targeted ads to children: platforms should not show targeted ads to users they know are minors. Platforms do not need to collect extra data to confirm a user’s age as this can often be inferred from the nature of the service or from data they already hold.
Avoid invasive age checks: organisations should generally avoid age verification that identifies users unambiguously, such as government ID. Where age estimation is needed, an age range should be used if it gives reasonable certainty. Providers should store only whether the user meets the conditions to use the service.
No-tracking recommender option: very large online platforms and search engines should offer at least one recommender option for each system that is not based on profiling. Both options should be shown equally when the service is first used, and no profiling data should be collected while the no-tracking option is active.
The guidelines will be directly relevant to ChatGPT, Reddit and Roblox which, as we reported in our September 2026 update, have been designated under the DSA and must assess and mitigate systemic risks, including those linked to their recommender systems.
CYBER SECURITY
ASOS cyber incident places third-party platforms and customer communications under scrutiny
On 6 October 2026, ASOS app users received an unauthorised pop-up notification, with ASOS later confirming that hackers had been able to access customers’ personal data and search histories.
It is understood that the hackers gained access to an ASOS employee’s account via sophisticated impersonation of a trusted contact and then used the login credentials obtained to access certain third-party platforms used by ASOS. ASOS has confirmed that payment details and passwords were not accessed. In the notification sent to app users, the hackers claimed to have “fully compromised the Snowflake instance”, a reference to the data storage company, which has said it found no compromise of its platform.
Retail cyber incidents have been on the rise, and the methods used by hackers are becoming increasingly sophisticated. In the case of ASOS, the reported access to customer contact details and search histories creates a risk that scams and phishing emails could be more targeted and harder for ordinary consumers to spot. The incident also highlights the vulnerability of employee-facing systems, and the importance of stringent and appropriate cyber and phishing training for employees to better protect organisational and customer data.
AI-assisted research exposes long-standing PHP vulnerabilities
On 21 October 2026, the PHP project released emergency fixes to address two critical vulnerabilities identified in PHP, the long-established server-side scripting language used across a significant proportion of the web.
The vulnerabilities, known as PHP2Shell, could allow attackers to access, execute or alter code on affected websites and web applications if left unpatched. For affected organisations, the exposure concern extends not just to whether their own website, intranet, client portal, or other internal application runs on PHP, but also whether PHP is present anywhere in its wider technology ecosystem, including in third-party software, further exposing the organisation to a risk of a data breach or other security incident. It is common for SaaS platforms, hosted websites, and other off-the-shelf software products run PHP
The issue has attracted attention for two reasons: PHP’s ubiquity and the way in which the flaws were uncovered. PHP was created in 1993 and has since become one of the core technologies underpinning the modern web. According to cyber-security firm Wiz, which helped uncover the flaw, PHP is used by around 70% of the world’s websites. OpenAI announced that cybersecurity company Calif had identified a critical flaw using OpenAI’s LLM GPT-5.6 Sol as part of its Patch the Planet initiative, while Wiz independently discovered and reported both vulnerabilities. It is understood the underlying flaws had been present for more than a decade, but that frontier AI models reduced the barrier to turning complex, long-standing weaknesses into working exploits.
The National Cyber Security Centre (“NCSC”) has urged UK organisations to act immediately. Its advice is to identify systems running PHP, prioritise internet-facing systems, update to the latest fixed versions and monitor third-party software that may bundle PHP.
PHP2Shell serves as a reminder that patch management, software asset visibility and supplier monitoring remain core cyber governance issues. As AI-assisted vulnerability research becomes more capable, organisations should also expect the timeframe between discovery, disclosure and attempted exploitation to narrow.
ENFORCEMENT AND CIVIL LITIGATION
Supreme Court considers seriousness threshold for GDPR damages claims in Farley v Paymaster
On 7 and 8 October 2026, the Supreme Court heard the appeal in Michael Farley and 431 others v Paymaster (1836) Limited (trading as Equiniti). The question the Court considered was whether a threshold of seriousness applies to claims for damages under the UK GDPR and the Data Protection Act 2018 (“DPA 2018”). The answer will shape the viability of low-value data breach claims, particularly when they are brought as group actions. We will report on the judgment when it is handed down.
As we reported in our September 2025 update, the Court of Appeal reversed the High Court’s decision that a claim under the UK GDPR and the DPA 2018 had to be for “serious distress” to be actionable. The Court of Appeal held that disclosure to a third party is not an essential ingredient of an infringement, and that there is no threshold of seriousness that must be met before distress can be compensated. Paymaster appealed to the Supreme Court on the compensation issue only. In the Supreme Court appeal, the Information Commissioner and Open Rights Group each filed an intervener’s written case on 23 September 2026, addressing the seriousness-threshold issue before the Court. Judgment is now awaited.
The Supreme Court’s decision is likely to resolve long-running tension in this area. The Court of Justice of the European Union (the “CJEU”) held in Austrian Post that there is no obligation to prove that non-material damage has reached a “certain degree of seriousness”. English courts, however, have applied a de minimis approach, including in Lloyd v Google under the old Data Protection Act 1998 and in Stadler v Currys under the UK GDPR. If the Supreme Court upholds the Court of Appeal, mass claims of modest individual value arising from routine errors are likely to become harder to strike out at an early stage. If the judgment reinstates a threshold, controllers will have a stronger basis for resisting such claims.
This reflects similar developments in the EU, where the CJEU is considering whether for-profit claims models can pool GDPR compensation claims, which we covered in our August 2026 update.
TikTok accepts £12.7 million children’s privacy fine as recommender-systems investigation resumes
On 24 September 2026, the ICO announced that TikTok had withdrawn its appeal against the £12.7 million fine imposed in 2023, so the penalty notice is now final. The fine relates to TikTok’s failure to use children’s personal data lawfully, with the ICO finding that TikTok:
did not carry out adequate checks to identify and remove under-13s;
did not obtain parental consent; and
did not give users clear information about how their data was used.
The ICO estimated that up to 1.75 million UK children under 13 used the platform in 2020. We considered the original penalty in our 2023 insight, Spotlight on TikTok.
The appeal withdrawal came after the Upper Tribunal’s ruling in August. The Tribunal dismissed TikTok’s argument that its processing was for artistic purposes. If that argument had succeeded, the ICO would have needed prior court approval before issuing the penalty.
TikTok has also dropped its appeal against an ICO information notice. The notice relates to a separate investigation into how TikTok processes 13 to 17-year-olds’ personal information in its recommender systems. The appeal had stalled that investigation, which the ICO opened in February 2025 and can now pursue.
The case comes as regulators look more closely at how platforms identify and treat younger users. In our August 2026 update, we reported that Ofcom had opened an investigation into TikTok’s age-inference systems under the Online Safety Act. TikTok now faces scrutiny of its age assurance under the Online Safety Act and of its algorithmic profiling under data protection law. Other platforms using similar systems should expect the same questions.
