INTRODUCTION Contributed by: Christian Schröder, Orrick
Sectoral developments The bar is rising fast in specific sectors such as health and advertising as many regulators are increasingly focusing on these critical issues. For instance, new state health privacy laws in the US focus on purpose limitation and expectation management, demanding data minimisation and vendor oversight. With the EU Health Data Space Regulation, the EU is setting new rules for the primary and secondary use of health data and the international transfer of such data to other jurisdictions. Enforcement remains strict, particularly regarding online marketing practices and the use of cookies. In the US, further action on deceptive design and misuse of sen - sitive data is expected. In France, at the end of 2025, the supervisory authority, the National Commission for Information Technology and Civil Liberties ( Commis- sion Nationale de l'Informatique et des Libertés or CNIL) imposed significant fines for alleged cookie violations under the French Data Protection Act, whereby a pub - lisher was fined EUR750,000, and a financial services provider received a penalty of EUR1.5 million. It is also notable that the DUAA is introducing chang - es to existing cookie regulations. Similarly, the EDPB guidelines on cookies continue to shape EU cookie laws under the ePrivacy Directive. While some juris - dictions do not have specific regulations on cookies, it is important to note that other data protection laws may still apply and set cookie requirements, particu - larly when cookies are related to personal data. Conclusion The landscape of data privacy law is complex and constantly evolving, reflecting the rapid pace of tech - nological changes and the growing importance of data in the digital economy. The year 2026 will bring sev - eral challenges and, considering recent international developments discussed above, organisations would be well advised to start prioritising their compliance aims. They can do this by observing new incident response and reporting rules, still treating international data transfers as an evergreen risk; operationalising AI governance and expanding privacy programs to cover AI; focusing on the use and access to non-personal data (under the EU Data Act); implementing fair-terms reviews for B2B data contracts and cloud switching; and anticipating litigation and sectoral enforcement.
Earlier in 2025, the EGC made a significant ruling, awarding damages for the transfer of an IP address to the United States prior to the approval of the DPF and in the absence of an adequacy decision. The court held that the website operator was liable for data transfers made through a third-party API embedded in the web - site, even though the transfer was not conducted by the website operator. Such decisions may have future implications for companies operating in both low-risk and high-risk contexts, as they could face mass tort litigation for using third-party services that transfer non- sensitive and device-related data to third countries. In other jurisdictions, state privacy enforcement has also matured. In the US, the Attorneys General and the California Privacy Protection Agency pressed actions on data brokers, misconfigured consent tools, and sensitive health data in digital advertising. The development of new data localisation requirements is another important area to monitor. Privacy litigation Recent decisions illustrate that data privacy litiga - tion is on the rise, with individuals and organisations increasingly seeking redress for privacy violations. In many jurisdictions, data privacy laws provide a basis for claims for immaterial damages, although the deter - mination of such damages remains a contentious issue. Recent court decisions in the EU have clarified some aspects of compensation, emphasising that it should correspond to actual harm rather than serve as a puni - tive measure. However, courts tend to interpret relevant statutes broadly to ensure the efficient and continued protection of user privacy rights, which could poten - tially lead to more waves of mass claim litigation. The introduction of collective redress mechanisms, such as the Representative Actions Directive in the EU, has fuelled this trend and expanded legal protection for consumers, enabling them to file collective actions for data protection violations. This current develop - ment increases liability risks for companies, particu - larly with cross-border implications, and highlights the importance of robust compliance programmes.
9 CHAMBERS.COM
Powered by FlippingBook