On 17 September 2026, the European Commission unveiled its proposal for the EU KIDS Act (EU Keeping Internet Digital Spaces Accountable and Trustworthy), a harmonised EU framework designed to reshape how children engage with online services. The proposal goes well beyond age verification requirements and seeks to fundamentally change the design of digital services used
Continue Reading EU: Commission proposes a new KIDS Act to protect children online
The United States Supreme Court’s decision in Trump v. Slaughter significantly alters the constitutional framework governing independent regulatory agencies and may have implications for transatlantic personal data transfers.
The six-to-three decision overturns Humphrey’s Executor v. United States, a 1935 case establishing that Federal Trade Commission (FTC) commissioners could be removed by the President only
Continue Reading US / EU: US Supreme Court overturns Humphrey’s Executor: Implications for independent agencies and US–EU data transfers
The Data (Use and Access) Act 2025 (“DUAA“), introduces a new statutory requirement for all controllers, with no exceptions, to implement a formal process to handle data protection complaints by 19 June 2026.
Key changes
The DUAA received Royal Assent on 19 June 2025 and introduces a number of amendments to the UK’s data
Continue Reading UK: New complaints handling rules under DUAA take effect on 19 June 2026 – are you ready?
Organisations are increasingly turning to AI-enabled tools throughout the recruitment lifecycle, from CV filtering and suitability scoring to online assessments and behavioural analysis. These tools can offer real advantages, including faster hiring processes and the potential to reduce human bias that inevitably exists in traditional recruitment. However, their use often creates a tension with data
Continue Reading UK: ICO Report on Automated Decision-Making in Recruitment
The EU General Court has dismissed a French MEP’s challenge to the EU-U.S. Data Privacy Framework (“DPF”) for the transfer of personal data between the European Union (“EU”) and the United States (“U.S”). While the decision is welcome news to organisations relying on the DPF for transfers underpinning their
Continue Reading EU-U.S. Data Privacy Framework Survives First Challenge
In the UK, there is currently heightened regulatory scrutiny and increased public interest in children’s data protection and online harm, with a raft of new guidance and regulation from both the ICO and Ofcom, the chief regulator of the Online Safety Act, in relation to children’s safety online.
Since the introduction of the ICO’s Children’s
Continue Reading UK: ICO and Ofcom approach to regulation of online services
