Data Bytes 67: Your EMEA Data Privacy Update for July 2026

According to Ashurst Perkins Coie, the European Commission's adequacy decision underpinning the DPF relies on the independence of the FTC, and noyb has indicated it will file a lawsuit seeking annulment of the DPF by the CJEU[1]. The firm said organisations using the DPF "should monitor developments closely and consider the resilience of their transfer mechanisms."[1]The firm reports that on 8 July 2026, alongside its new anonymisation and web scraping guidelines, the EDPB adopted guidelines on the processing of personal data through blockchain technologies[1].In the UK, Ashurst Perkins Coie says the ICO's 'Edtech examined' report covered consensual audits of 28 edtech providers[1]. The firm says the ICO found gaps including insufficiently detailed contracts with schools, incomplete data flow mapping, weak data minimisation[1], and that providers reportedly accepted and implemented 98% of the 596 recommendations made.[1]The firm also reports that on 3 July 2026, the ICO published advice aimed at small retail businesses on lawfully using personal information[1], including CCTV and facial recognition. The firm notes that on 14 June 2026, the UAE Artificial Intelligence and Data Authority was formally established[1]. It says this "could prove to be a real turning point for the onshore PDPL"[1].Separately, Kasowitz LLP says two significant Supreme Court decisions addressed the independence of the Federal Trade Commission and constitutional protections for location data[2] in July.