Data Dispatch - March 2025

Welcome to the latest edition of Data Dispatch from the Data Advisory team at RPC. Our aim is to provide you on a regular basis with an easy-to-digest summary of key developments in data protection law.

Please do feel free to forward on the publication to your colleagues or, better still, recommend that they subscribe to receive the publication directly.

If there are any issues on which you'd like more information (or if you have any questions or feedback), please do let us know or get in touch with your usual contact at RPC.

An Update on the DUA Bill

 The Data (Use and Access) Bill (DUA Bill), introduced in Parliament on 24 October 2024, has completed its passage through the House of Lords and will now be debated in the House of Commons. On 10 February 2025, the ICO updated its response to the DUA Bill.

Key amendments have been made to the draft in the House of Lords. A public interest test has been added to the processing of personal data for the purposes of scientific research. The Bill was also amended to include further duties in respect of children's data. The ICO has reserved its position on these amendments pending further consideration and discussion.

Significantly, the Bill also introduces new amendments proposed by Baroness Kidron regarding training AI models on web-scraped data. The new measures would subject AI providers to UK copyright law, reveal the owners of web crawlers and allow copyright owners to know if their work is being used. This would mean a change to the ICO's role, and it has indicated that this needs to be properly discussed with the government.

The government has also committed to using their secondary legislation powers to require the ICO to produce new codes of practice – including one on AI and automated decision-making. This statutory code of practice has previously been described by the ICO as a "single set of rules" for those developing or using AI products.

(ICO response to DUA Bill)

(ICO letter to PM)

Sky Betting and Gaming unlawfully processed a recovering gambling addict's data

On 23 January 2025, in the case of RTM v Bonne Terre Limited and Hestview Limited [2025] EWHC 111 (KB), the High Court ruled on the standards of consent required when relying on the consent lawful basis in carrying out profiling and direct marketing activities, particularly in sensitive situations involving vulnerable individuals.

The claimant, a recovering online gambling addict, brought claims against the Sky Betting and Gaming (SBG) brand under data protection law and the tort of misuse of private information. He argued that SBG had used sophisticated algorithms and personalised marketing and his ability to consent was compromised by his gambling addiction.

The court found for the claimant. It considered that data protection law requires that consent to processing be of "relatively high" quality i.e. free, unambiguous, informed, and specific.  The context around which the consent was given must be considered. In this case, the consent had been given in the context of the claimant's "damaged and defective condition of personal autonomy" caused by his addiction and therefore was not freely given.

The court also commented on online gambling in general as a sector in which there is a real risk that consent provided does not meet the necessary requirements because of the issue of problem gambling. It will be interesting to consider if similar concerns would apply in other sectors that encounter addictive behaviour e.g. online gaming.

This decision comes only a few months after Sky Betting and Gaming was reprimanded by the ICO for unlawfully processing personal data when placing advertising cookies.

(Judgment)

noyb turns attentions to Chinese companies for alleged illegal data transfers

 The advocacy group, None of Your Business (noyb), has filed six GDPR complaints against TikTok, AliExpress, SHEIN, Temu, WeChat and Xiaomi accusing them of transferring personal data to China in breach of the EU GDPR. This marks noyb's first ever legal action against Chinese companies, having previously focused on US companies.

AliExpress, Shein, TikTok, and Xiaomi expressly acknowledge in their privacy policies that they transfer user's personal data to China. Temu and WeChat mention transferring data to undisclosed 'third countries' which noyb assumes likely includes China. noyb is arguing that personal data cannot be adequately protected in China as companies cannot realistically shield data from access by the Chinese government. 

Noyb has filed these complaints with data protection authorities in Greece, the Netherlands, Belgium, Italy, and Austria, requesting: (i) the immediate suspension of data transfers to China; (ii) that the companies are required to bring their practices in line with the EU GDPR; and (iii) fines to prevent similar breaches in the future.

(noyb news)

Other important developments

Updated data protection fees: On 17th of February 2025, the Data Protection (Charges and Information) (Amendment) Regulations 2025 (SI 2025/63) came into force. As a result, the new fees to be paid to the ICO are £52 for micro-organisations, £78 for small and medium organisations, and £3,763 for large organisations. (Legislation)

EU withdraws ePrivacy Regulation: After years of stalemate, the European Commission has finally decided to revoke the ePrivacy Regulation, which was intended to complement the GDPR by regulating marketing emails, cookie usage, and other forms of electronic communication. The Commission commented that a new legislative framework may be introduced in the future, concentrating on data retention, web cookies, and digital advertising. (Commission Work Programme)

In our February episode of The Work Couch, Jon Bartley and Helen Yost join host Ellie Gelder in a two-part series which delves into data protection compliance in the employment context. Listen here.

In celebration of Data Protection Day 2025, Jon Bartley, along with representatives from Terralex members around the world, share insights on key developments in privacy and data protection for the year ahead. Watch here.