Privacy Law Mid-Year Update: Key EU and UK Data Protection Decisions

1. Data Protection Obligations Extend Beyond Formal Compliance: Recent EU and UK decisions emphasize that organizations must demonstrate proportionality, accountability, and risk-based decision-making when processing personal data, even where disclosures are required by law or supported by valid legal bases.
   
   
2. Courts Clarify Key Boundaries Around Consent and Data Subject Rights: New guidance confirms that consent under GDPR and PECR is assessed objectively, while organizations may challenge abusive data subject access requests if they can provide clear evidence of misuse, though the threshold remains high.
   
   
3. Cybersecurity and Children’s Privacy Remain Enforcement Priorities: Courts and regulators continue to scrutinize security measures, age assurance practices, parental consent mechanisms, and privacy-by-design obligations, signaling heightened expectations for organizations handling personal data online.

A series of significant decisions in the EU and UK have provided important guidance on consent, data subject rights, publication of personal information, and cybersecurity obligations. Together, these cases demonstrate a continued focus on proportionality, accountability, and practical compliance under data protection law.

Individual Sanctions and Proportionality: NADA Austria and Others (Case C‑474/24)

In NADA Austria and Others, the CJEU considered whether Austrian legislation requiring online publication of anti-doping sanctions was compatible with the EU General Data Protection Regulation (GDPR). The legislation required publication of athletes’ names, sporting discipline, details of the anti-doping infringement, and the length of any ban.

The Court confirmed that Member States may permit such publication to advance legitimate anti-doping objectives, but GDPR compliance remains essential. Controllers must balance the competing interests before publication, and any publication must be proportionate, including in relation to how long the information remains online. The Court also stressed that athletes must have access to preventive remedies, including the ability to complain to a supervisory authority before imminent publication.

The decision highlights that, even when disclosure is required by law, organisations must still assess proportionality and data protection risks on a case-by-case basis.

Data Subject Access Requests and Abuse: Brillen Rottler (Case C‑526/24)

In Brillen Rottler, the CJEU clarified the limits of data subject access requests (DSARs) and related compensation claims. Article 12(5) GDPR establishes that the exercise of the right of access to personal data should not entail any cost for the data subject, unless the request from the data subject is manifestly unfounded or excessive, in which case the controller can either charge a reasonable fee or refuse to act on the request. The Court held that a request may be considered “excessive” under Article 12(5) GDPR even if it is the individual’s first request, provided the controller can demonstrate that the request was made for an abusive purpose rather than to verify the lawfulness of processing. Evidence that an individual has repeatedly submitted requests and pursued compensation claims against multiple organisations may be relevant but is not sufficient on its own to establish abuse. The threshold is high, with the burden on controllers to prove abusive intent unequivocally through evidence, not suspicion. Proof of an abusive practice “requires (i) a combination of objective circumstances in which, despite formal observance of the conditions laid down by the EU rules, the purpose of those rules has not been achieved and (ii) a subjective element consisting in the intention of the data subject to obtain an advantage from the EU rules by artificially creating the conditions laid down for obtaining it.”

The judgment also confirms that an unjustified refusal to comply with a DSAR can itself give rise to a claim for compensation under Article 82 of the GDPR. Importantly, the Court recognised that loss of control over personal data and uncertainty about how data are processed may constitute compensable non-material damage, provided actual damage is proven; otherwise, loss of control alone is not enough to sustain a claim for non-material damages.

For organisations, the decision reinforces the need for robust DSAR procedures while recognising that GDPR rights should not be used to manufacture claims.

Consent Under GDPR and PECR: RTM v Bonne Terre [2026] EWCA Civ 488

One of the most closely watched UK privacy decisions of the year was the Court of Appeal’s judgment in RTM v Bonne Terre. The case arose from claims by a recovering gambling addict who argued that he could not validly consent to cookies, personal data processing, and targeted marketing while suffering from a gambling disorder.

The Court of Appeal overturned the High Court and held that consent under the GDPR and Privacy and Electronic Communications Regulations 2003 (PECR) is assessed objectively. Whether consent is “freely given, specific, informed and unambiguous” depends on objectively ascertainable features of the interaction between the controller and the individual, not on the individual’s undisclosed state of mind. Controllers are therefore not required to prove what a person was actually thinking subjectively when consent was given.

However, the Court also suggested that known vulnerabilities may remain relevant. Where a controller knows or ought reasonably to know that an individual’s ability to make autonomous decisions is impaired, broader principles, such as fairness, may still come into play.

The judgment provides greater certainty for organisations relying on consent, while reinforcing the importance of considering vulnerable individuals in compliance assessments.

Cybersecurity and the Scope of the Security Duty: DSG Retail v Information Commissioner [2026] EWCA Civ 140

In DSG Retail, the Court of Appeal considered the scope of a controller’s obligation to protect personal data compromised in a major cyberattack. DSG argued that its security obligations should not extend to data that a hacker could not use to identify individuals. The Court rejected that argument.

The Court held that the security duty applies from the perspective of the controller, not the attacker. A controller is responsible for the protection of personal data even where an unauthorised third party cannot immediately identify the individuals concerned through the compromised data. The judgment confirms that organisations must implement appropriate technical and organisational measures regardless of whether stolen data are directly identifiable in the hands of a hacker.

Although the case was decided under the Data Protection Act 1998, the Court’s reasoning is likely to influence the interpretation of security obligations under the UK GDPR and Data Protection Act 2018.

ICO Enforcement Activities Show Increased Scrutiny of Children’s Privacy

Recent ICO enforcement and policy developments signal a significant tightening of expectations around children’s online privacy. By way of example, the ICO’s February 2026 fine against Imgur (MediaLab) (£247,590) demonstrates that organisations must take proactive steps to protect children where a service is likely to be accessed by them.

The ICO found that the platform’s age checks were ineffective. Self-declaration and terms of service alone were insufficient, particularly where children could access harmful content. The ICO expects proportionate, technology-based age assurance measures.

The case also involved unlawful processing of personal data for individuals under 13, because parental consent mechanisms were not properly implemented or verified. The ICO further emphasized that organisations must conduct child-focused DPIAs for services likely to be accessed by children.

The decision forms part of a broader international regulatory trend toward a stronger approach to child safety, age assurance and verification, and privacy-by-design obligations.

Conclusion

Taken together, these developments reflect a regulatory environment that is increasingly focused on accountability, risk-based decision-making, and demonstrable compliance. Whether dealing with consent, data subject rights, cybersecurity, transparency obligations or children’s privacy, organisations are expected to move beyond formal compliance documentation and embed data protection considerations into their business processes and product design from the outset.