dpas bulletin - october 2026
Welcome back to our monthly DPAS bulletin, where we cover the latest data protection news and developments from around the world.
Will the big tech companies behave themselves when it comes to feeding personal data to their AI? Are you tired of reading about PHP yet? Did Uber enjoy their letter from the Dutch Data Protection Authority? Will New Mexico issue a fine to Meta again? Have the Metropolitan Police processed data without sufficient basis? What is the worst password?
Read about all this and more in our latest DPAS Data Protection Bulletin.
The ICO scrutinises leading AI developers
The Information Commission (still ICO) has managed to secure data protection improvements from ten of the world’s largest AI foundation model developers. The likes of Anthropic, Google and OpenAI have committed to introducing data protection changes across three key areas: clearer transparency information, stronger mechanisms to allow people to exercise their rights, and ‘tougher assessments of safeguards’.
The ICO has reiterated the importance of AI governance by reminding developers that they must have a lawful basis, provide meaningful transparency, enable users to exercise their rights, and show that they have safeguards in place that materially reduce risk. You would be right to think that these are already required by law, but AI developers appear to have been working outside of the legal boundaries. The ICO has encouraged AI developers to do, what this humble practitioner would think is, the bare minimum. Otherwise, we may start seeing enforcement.
Read more about this here.
PHP flaws take down UK government sites
It was hard to escape this story. On Wednesday 21st and Thursday 22nd of October, websites were taken offline after identification of a critical vulnerability in PHP. For anyone who had their head in the sand, PHP is a programming language. When the websites were taken offline, the House of Lords was told that 32 government services were unavailable while the security patch was being applied.
The concern was that the vulnerability allowed for malicious parties to take control of a website’s server without needing the password. Pulling the plug on websites became the safest bet to ensure that no attacks were carried out, but it was perhaps a glimpse at what a cyber-attacked Britain would look like amid calls from the government for homes to have days of supplies at the ready.
Read more about this here.
Google Cloud failure knocks UK courts and banks offline
Widespread disruption caused by a power event at Google’s London-based cloud centre significantly affected UK courts and banks. Services were only down for a few hours per reports, but that was enough time to cause significant disruption to critical transactions and proceedings. In the courts, this affected the system that allowed defendants to attend remotely while in custody and pushed back several hearings.
Revolut and Halifax struggled during the outage as card payments, cash withdrawals and transfers were disrupted by the outage. Revolut was significantly affected, with customers losing access to most services until a solution was implemented. This is the first outage of Google services since they became subject to the regulations of the FCA and the Bank of England, so it remains to be seen whether Google will face any repercussions.
Read more about this here.
Dutch Data Protection Authority fines unlawful Uber
The Autoriteit Persoonsgegevens (AP), try saying that five times over, has imposed an €825m fine on Uber for breaches around their automated decision-making and providing insufficient information on its profiling practices. This concludes the case that originally arose years ago, following 171 French Uber drivers submitting their complaints to the CNIL.
Where Uber had suspicions of fraud or customer reviews were too low, drivers’ accounts would be automatically temporarily deactivated, or if the low review scores persisted, deactivated entirely. This impacted them directly as it meant the drivers lost income, breaching Article 22 of the GDPR.
Read more about this here.
Stockton BCC blunder makes BBC news
If you thought your organisation had it bad, spare a feeling for Stockton Council who have had their BCC faux pas reported by the BBC. Admittedly, it was on the larger side of BCC blunders with around 250 email addresses disclosed to other recipients.
The ICO was contacted for comment but had not heard from Stockton. Given the contents, I think it’s unlikely Stockton would end up reporting the breach to the ICO but I’d be interested to know what the journalists were expecting the ICO to say. To those responsible for data protection at Stockton Council, my commiserations.
Read more about this here.
ICO confirm Password1 is not appropriate
The ICO has reprimanded Ogi Networks Limited and Data Cymru following a ransomware attack. This is an unusual result from a ransomware attack, until you learn that 3,300 people’s information was protected by an account whose password was ‘Password1’. Data related to children and families who were being supported by the organisations was compromised.
It’s the sort of story you expect to have been left behind in 2018, but it goes to show that password security is still not taken seriously by some. ‘Password1’ is a password that can be compromised in less than a second by modern tools. If you are, or know of anyone still, using such a password that protects any level of personal data, please change it. This was an easily avoidable mistake.
Read more about this here.
Meta fined $25bn for continuous fibbing
In a story that’ll make Uber feel better, New Mexico has once again gone after Meta with another court case. The judge has ordered Meta to pay $25bn after Meta executives were found to have made many statements over the years that they never shared or allowed third parties to access data without a user’s permission. This was, unsurprisingly, not the reality.
The jury in the case found that Meta had breached the state’s laws over 40 million times, which seems a little extraordinary even for Meta. The fine was calculated at $219bn, but New Mexico will be happy with about $25bn. Meta will rely on its argument, as they always seem to do in America, that this fine is unconstitutional. Presumably, this will not be the end as Meta is spending $135bn on AI alone this year and will likely not want any money to go to humans.
Read more about this here.
Metropolitan Police pulled over for unapproved crime intelligence-sharing
The ICO has hit the Met Police with a reprimand and enforcement notice following investigations into a third-party retail crime intelligence-sharing platform that was being used without appropriate data protection safeguards, governance or oversight. Between March 2023 and September 2024, 500 accounts were created by Met Police officers and staff. 179 people had their personal information shared on the platform, including names, dates of birth, and in some cases home addresses.
There was no DPIA to be found, data was processed without consent and where there was no sufficient basis for sharing for law enforcement purposes. As part of their enforcement notice, the Met will be expected to complete all the necessary due diligence to ensure that platform is fit for use. A pleasant read, given the Met Police’s appetite for personal data over the years.
Read more about this here.
GET IN TOUCH WITH US!
If you need any support in ensuring your organisation is complying with the relevant legislation, or require training in the areas of data protection and information security, get in contact with us.
Either call us on 0203 3013384, email us at info@dataprivacyadvisory.com, or fill out our contact form. Our dedicated team will get back to you as soon as possible.
