The ECJ has said GDPR transparency rules apply to body worn cameras, Texas sues Sony, LG and other smart TV makers over privacy breaches, and German data regulators push for clearer EU-wide AI rules – plus other key updates.
Shutterstock.com/Nico El Nino
Lexology PRO explores some of the most useful articles recently published on Lexology and externally to help businesses stay abreast of key data protection developments and risks.
This key update was produced with the assistance of generative AI.
Litigation
On 18 December 2025, the European Court of Justice said in a judgment that the collection of personal data by means of body cameras worn by public transport ticket inspectors falls under the GDPR article 13. The court noted that the controller should have therefore provided data subjects with information in accordance with the article and confirmed that the source of the personal data collected is the only relevant criterion when determining the scopes of articles 13 and 14 of the GDPR. . It also endorsed the European Data Protection Board’s layered approach to transparency, under which essential information on the processing of personal data, such as the controller’s identity, the purpose of recording, and individuals’ rights, must beprovided on visible notices, with additional information accessible through secondary means such as scanning a QR code.
On 11 December 2025, European Court of Justice advocate general Richard de La Tour issued an opinion on access to beneficial ownership data under EU anti-money laundering rules and it’s compatibility with the GDPR.In the opinion, arising from questions referred to the ECJ by Italy’s Council of State on Italy’s implementation of the Fourth Anti-Money Laundering Directive, de La Tour said access to trust beneficial ownership registers can be allowed where legitimate interested is demonstrated and appropriate safeguards are applied, but must be assessed on a case-by-case basis.
Enforcement actions
On 17 December 2025, privacy group noyb filed a complaint with the Austrian data protection authority against TikTok, dating app Grindr and marketing analytics company AppsFlyer for breaching the GDPR by unlawfully collecting, sharing and processing users’ data across apps without valid consent. Noyb said TikTok collected a large amount of data on users’ off-app behaviour in violation of the GDPR principles of data minimisation and lawful processing. The complaint highlighted that data held byTikTok showed the complainant actively using Grindr and alleged that AppsFlyer acted as an intermediary by receiving and transferring sensitive data from the dating app to TikTok without a sufficient legal basis.
The Texas Attorney General’s Office has sued Sony, Samsung, LG, Hisense and TCL, alleging that the tech firms collected personal data without consent. The lawsuits were filed in several Texas state courts on 15 December 2025. The lawsuits alleged that the smart TVs’ automatic content recognition (ACR) technology monitors users' behaviour by continuously tracking, analysing and sharing details about what they have watched with third parties. It further alleged that the ACR software captures or infers user traits relating to race, sex or religious and political beliefs, which are treated as sensitive category data under the Texas Data Privacy and Security Act 2023 and claimed that the companies failed to obtain informed consent for that data. On 17 December 2025, one of the courts granted a temporary restraining order against Hisense to stop it from collecting personal data via the ACR software.
Regulatory and industry updates
On 17 December 2025, Thailand’s Ministry of Digital Economy and Society instructed the Office of the Personal Data Protection Commission (PDPC) to suspend and scrutinise technology-driven activities that may violate the Personal Data Protection Act 2019, amid growing concerns over online scams. The Ministry also warned that biometric and digital asset technologies could be misused to deceive the public, and instructed the PDPC to investigate and monitor suspected cases and take action against the unauthorised collection and use of personal data.
Germany's state data protection authorities on 12 December called for legal reforms relating to the processing of personal data by AI systems “that go beyond” those set out in European Commission digital omnibus proposals. The regulators said the laws should set specific legal bases for the development, training and operation of AI models, and give greater consideration to individual rights when AI is used. –The authorities said a requirement that data subjects be informed when their personal data is processed by an AI system should be written into the GDPR. The regulators further noted that the proposals are underdeveloped andand fail to ease the burden on small businesses. "Legal certainty and innovation go hand in hand," said Berlin data protection commissioner Meike Kamp, adding that "adjustments to the GDPR regarding the use of AI should be clear and balanced."
New legislation and rules
On 16 December 2025, the European Commission announced a proposed Biotech Act 2025 to strengthen the EU’s biotechnology and biomanufacturing sectors, with afocus on creating targeted amendments to EU health and food legislation. The proposal prioritises industrial growth and regulatory simplification and aims to expand the use, access and governance of health, research and industrial data, including through the European Health Data Space, data-sharing frameworks, and trusted AI testing environments. The proposed package also combines funding and innovation incentives with biosecurity safeguards and sets out measures to speed up market access for biotech products while supporting data-driven and AI-enabled development across the sector.
Track the latest data protection updates from authorities around the world using Scanner, Lexology PRO’s automated regulatory monitoring tool.
Visit Scanner’s data protection dashboard by clicking here to get started.
Stay up to date with key developments and in-depth articles by following Lexology’s data protection hub.