UK New Blueprint for AI Regulation
The UK government has announced a blueprint for artificial intelligence regulation that would allow new AI products to be tested under relaxed rules, in a bid to drive growth and innovation in sectors such as healthcare and housebuilding.
Under the plans, unveiled by the UK’s technology secretary Liz Kendall at the Times Tech Summit in London on 21 October, a proposed AI Growth Lab, or sandbox, would enable companies and innovators to test AI tools “in real-world conditions, with some rules and regulations temporarily relaxed under strict supervision”.
Dutch DPA Fines Experian €2.7million for Unlawful Data Use
On 17 October 2025, the Autoriteit Persoonsgegevens (AP) fined Experian Netherlands €2.7 million for unlawfully collecting and using personal data to compile consumer credit scores. The company obtained information from both public and private sources and resold details about payments, debts, and bankruptcies. The AP found that Experian failed to clearly inform individuals about what data was collected, how it was used, and why — leaving many unaware they were included in its database.
Following the decision, Experian has ceased operations in the Netherlands and will delete all related personal data by the end of the year.
To ensure transparency and lawful processing, organisations should:
- Clearly explain what data is collected, why it is needed, and how it will be used
- Avoid collecting or sharing data from secondary sources without a valid lawful basis
- Regularly review privacy notices and update them when processing activities change
- Conduct Data Protection Impact Assessments (DPIAs) for large-scale or high-risk processing activities
EU Commission Proposes Changes to EU Cookie Consent Obligation
The European Commission plans to simplify digital rules by reassessing the 2009 e-Privacy Directive that requires websites to obtain user consent before placing most cookies. Cookies collect information ranging from login status to browsing and shopping behaviour, and the directive currently forces websites to show consent banners unless cookies are strictly necessary to provide a service. Officials are considering changes to allow users to set preferences once (for example, in browser settings) or to expand exceptions for technically necessary or basic statistical cookies, reducing repetitive consent prompts.
