In the latest episode of Fieldfisher's Data and Privacy Matters podcast, hosts Martin McElroy, Anna Rawlinson and Leo McSweeney provide a roundup of the significant legal updates from May 2025.

We begin with the Irish Data Protection Commission’s engagement with Meta’s plans to train its generative AI models using public Facebook and Instagram content. We also cover the potential for legal challenges to Meta's plans from civil society as well as other Meta developments in Germany and their response to the EDPB’s ‘consent or pay’ opinion. 

Shifting focus to broader data protection issues, we discuss the EDPB’s positive opinion on the European Patent Organisation’s adequacy decision and its cautious stance on extending the UK’s adequacy status. We also consider the European Commission's proposed targeted GDPR compliance simplifications for a specific category of small mid-cap (SMCs) enterprises.

Enforcement actions continue across the EU, with the Irish DPC fining TikTok €530 million for unlawful data transfers to China, the Italian SA fining Luka Inc. €5 million over its AI chatbot, Replika and France’s CNIL penalising SOLOCAL €900,000 for unlawful marketing practices. 

In the UK, the Data Use and Access Bill faced amendments around AI transparency in the House of Lords, and the ICO responded to the major cyberattacks on several UK retailers. 

These updates underscore the intensifying regulatory focus on AI, cross-border data flows, and commercial data use—essential insights for anyone navigating the evolving digital compliance landscape.

Find the sources of news discussed here.