DPC issues final decision on HSE physical records; General Court confirms DMA gatekeeper discretion
The Irish Data Protection Commission issued a final decision following its inquiry into the Health Service Executive, signalling active enforcement focus on physical records management and third-party storage arrangements. The EU General Court ruled in Case T-357/24, confirming the European Commission retains broad discretion in setting gatekeeper designation thresholds under the Digital Markets Act. The EDPB published Guidelines 02/2025 on personal data processing through blockchain technologies, requiring organisations to assess their architecture against expectations on immutability and erasure.
For you: Dual UK-EU operators using blockchain or automated decision-making systems should prioritise a gap analysis against EDPB Guidelines 02/2025 and document their GDPR Article 22 compliance position in light of the Uber drivers' class action.
How to read this digest
▼
Enforcement
Fines, sanctions, rulings
Legislation
New laws, statutory instruments
Consultation
Calls for evidence
Guidance
Frameworks, codes of practice
↔ Divergence
UK-EU moving apart
Commentary
Background, no action needed
Click a domain tile to expand, then click a category tag to see individual items.
What matters today
Enforcement
DPC final decision targets HSE physical records and third-party storage compliance
Updated records management controls required for any organisation using third-party physical storage of personal data within the DPC's jurisdiction.
Data Protection
Guidance
EDPB publishes Guidelines 02/2025 on blockchain personal data processing
Architecture review required to assess compliance with EDPB expectations on immutability, erasure rights, and controller accountability in blockchain systems.
Data Protection
Enforcement
General Court ruling confirms Commission discretion on DMA gatekeeper designation thresholds
Compliance programmes for platform operators should account for the confirmed broad Commission discretion when assessing gatekeeper designation risk.
Digital Markets
Guidance
MHRA and Manchester NHS launch AI medical technology regulatory sandbox
Structured regulatory pathway now available for organisations developing AI-enabled medical technologies seeking to generate NHS-grade evidence for MHRA approval.
Health & Life Sci
Guidance
UK product safety report flags Wallbox Pulsar Max EV charger for corrective action
Businesses selling or distributing the Wallbox Pulsar Max EV charger in the UK must assess obligations around recall, withdrawal, or correction without delay.
Product Safety
Legislation
Vehicle Emissions Trading Schemes Order 2023 Revocation Bill introduced in UK
Revocation of the 2023 Order would remove binding ZEV mandate obligations on vehicle manufacturers and dealers, requiring immediate review of compliance and sales planning frameworks.
This call for evidence seeks practical examples of how personal and non-personal data regulation interacts with AI and other data-intensive technologies, and insights on how techno
This consultation invites views on how consumer protection for home upgrades should be reformed to support delivery of the Warm Homes Plan . In most cases, work on government schem
This consultation: considers a number of developments in the vehicle regulations within the EU and internationally asks for views on our intended approach to incorporate these into
Following publication of the Smart Data strategy 2035 , we are considering how Smart Data schemes should be prioritised, designed and delivered in practice. As the Smart Data progr
From this date, manufacturers of products with digital elements must report actively exploited vulnerabilities and significant incidents to national authorities and ENISA.
Domains
Signals and context
Signals help explain where regulation, markets and technology may be moving. They are not obligation evidence.
US resistance to binding AI rules at G20 level increases pressure on EU and UK frameworks to define international interoperability without US alignment.
If enacted, mandatory AI shutdown powers would create new compliance obligations for AI developers and data centre operators on system architecture and emergency response protocols.
AI Governance
1 item
1 consultation
Chemicals
1 item
1 consultation
Data Protection
3 items
1 guidance2 commentary
Digital Markets
1 item
1 commentary
Health & Life Sci
1 item
1 commentary
Product Safety
1 item
1 guidance
Vehicles & Mobility
1 item
1 legislation
AI Governance
The European Parliament published a draft report on the proposed European Business Wallet regulation, which has implications for how mandatory data-sharing obligations may be structured for cross-border trading businesses within the EU single market.
Businesses trading cross-border in the EU should track how the European Business Wallet framework will shape mandatory digital credential and data-sharing obligations.
Chemicals and Substances Regulation
A draft European Parliament report was published on the proposal to amend ECHA's mandate alongside four underpinning regulations, including REACH and the Biocidal Products Regulation, which could reshape registration, authorisation, and restriction procedures for businesses placing chemicals and treated articles on the EU market.
Amendments to ECHA's mandate and the four underpinning regulations could reshape registration, authorisation and restriction obligations for chemicals industry operators across the EU.
Data Protection, Privacy and Surveillance
The Irish DPC issued a final decision following its HSE inquiry, focusing enforcement attention on physical records and third-party storage. The EDPB published Guidelines 02/2025 requiring blockchain operators to assess immutability and erasure compliance. Uber drivers launched a European class action testing the lawfulness of automated pay decisions under GDPR Article 22.
The decision signals DPC enforcement focus on physical records management and third-party storage arrangements as a live GDPR compliance risk for large public-sector data controllers.
This litigation tests whether automated decision-making in gig economy pay systems is lawful under GDPR, with potential compensation liability across multiple jurisdictions.
Organisations using blockchain for data processing must now assess their architecture against EDPB expectations on immutability versus the right to erasure.
Digital Markets and Competition
The EU General Court issued its ruling in Case T-357/24, confirming the European Commission's discretion in applying gatekeeper designation thresholds under the Digital Markets Act, with direct consequences for how browser market participants assess their designation risk.
The ruling confirms the Commission's discretion in gatekeeper designation thresholds, directly affecting how browser markets are regulated under the DMA.
Health Data, Medical Devices and Life Sciences
The MHRA and Manchester NHS announced a health innovation sandbox partnership, providing a structured regulatory pathway for organisations developing AI-enabled medical technologies to generate NHS-grade evidence in support of regulatory approval.
Organisations developing AI-enabled medical technologies gain a structured regulatory pathway to generate NHS-grade evidence ahead of broader deployment.
Product Safety, Conformity and Standards
The UK published a product safety report identifying the Wallbox Pulsar Max EV charging point as requiring corrective action, obliging businesses that sell or distribute this product in the UK to assess their recall, withdrawal, or correction obligations.
Businesses selling or distributing the Wallbox Pulsar Max EV charger in the UK must assess recall, withdrawal or corrective action obligations under the UK Product Safety and Metrology etc. (Amendment etc.) (EU Exit) Regulations.
Vehicles, Mobility and Charging Infrastructure
The Vehicle Emissions Trading Schemes Order 2023 (Revocation) Bill was introduced, which if enacted would remove binding zero-emission vehicle mandate obligations currently applying to vehicle manufacturers and dealers in the UK.
Revocation would remove the binding ZEV mandate obligations on vehicle manufacturers and dealers, requiring immediate reassessment of compliance programmes and fleet electrification targets.