Data Bytes 67: Your EMEA Data Privacy Update for July 2026

According to Ashurst Perkins Coie, the UAE Artificial Intelligence and Data Authority was formally established on 14 June 2026.[1] The firm says that, with the new child digital safety regime and recent DIFC and ADGM changes, the UAE is "beginning to look much more like a mature, multi-layered privacy market"[1].The firm reports that on 29 June 2026, privacy NGO noyb warned that the US Supreme Court's decision in Trump v. Slaughter[1] undermines the legal basis of the EU-US Data Privacy Framework. Ashurst Perkins Coie adds that noyb has indicated it will file a lawsuit seeking annulment of the DPF by the CJEU.[1]The update also says that on 8 July 2026, alongside its new anonymisation and web scraping guidelines, the EDPB adopted guidelines on the processing of personal data through blockchain technologies[1].For the UK, the firm reports that the ICO's "Edtech examined" report found compliance gaps including providers incorrectly identifying their controller/processor status[1] and weak data minimisation. According to the firm, providers reportedly accepted and implemented 98% of the 596 recommendations made.[1]Ashurst Perkins Coie also notes that on 3 July 2026, the ICO published advice aimed at small retail businesses on lawfully using personal information[1] to help deal with theft and violence against staff, including CCTV and facial recognition.Gibson Dunn reports that the EDPB's consultation on a new breach notification template runs until 5 August 2026[2].