The Guardian has an article on the Italian oil firm Eni’s use of defamation claims against journalists and NGOs, which critics have called an intimidation campaign. Dubbed a ‘Slapp addict,’ Eni has filed at least six defamation claims since 2019 against critics including the Italian public broadcaster Rai, Greenpeace and multiple newspapers.

The company has sought more than €10m (£8.6m) in damages across the known cases, according to analysis shared exclusively with the Guardian by Aria, a non-profit research organisation. Eni’s latest lawsuit does not seek compensation.

On 2 July 2025, there was an application for permission appeal concerning civil procedure in the Court of Appeal in Gotti v Perrett CA-2024-002323. The Court of Appeal is asked to decide whether the County Court had the power to award the Defendant her costs and to make other orders in her favour in a case where the Claimant obtained an interim injunction but never issued a claim form, 5RB reports.

Judgment in the case of Currie v Soho Theatre Company Ltd [2025] EWHC 1645 (KB), delivered ex tempore on 3 April 2025 is now available on Bailii.  Nicklin J  found that the publication made defamatory allegations of fact but that the allegation that the claimant’s conduct was “intimidating and antisemitic” was a statement of opinion.

Internet and Social Media

On 4 July 2025 judgment on preliminary issues was handed down in favour of the Information Commissioner in the appeal of TikTok Inc v Information Commissioner [2025] UKFTT 798 (GRC). A summary of the decision is given below.

Data Privacy and Data Protection

The Mishcon de Reya blog has an article exploring how the new Data (Use and Access) Act 2025 will make it easier for fines to be issued for serious cookie infringements.

An update planned for 7 July 2025 will allow Gemini AI to override Android users’ privacy settings and gain full access to texts, calls, and WhatsApp – even if Gemini Apps Activity are turned off. Google’s AI model will assist apps on Android like WhatsApp, messages, and phone. Simply put, Gemini will get access to these apps. Soon the AI tool will be able to run tasks like send WhatsApp messages, set timers, and even make calls – regardless of whether users previously told Google’s Gemini not to track them. Learn how to disable Gemini on Android from accessing your phone’s services and using your data for AI here.

Surveillance

A security vulnerability in an Android spyware operation called Catwatchful has exposed thousands of its customers, including its administrator. The bug, which was discovered by security researcher Eric Daigle, spilled the spyware app’s full database of email addresses and plaintext passwords that Catwatchful customers use to access the data stolen from the phones of their victims. Catwatchful is spyware masquerading as a child monitoring app that claims to be “invisible and cannot be detected,” all the while uploading the victim’s phone’s private contents to a dashboard viewable by the person who planted the app. The stolen data includes the victims’ photos, messages, and real-time location data. The app can also remotely tap into the live ambient audio from the phone’s microphone and access both front and rear phone cameras. TechCrunch has more information here.

Newspapers Journalism and Regulation

Hacked Off has an article criticising The Daily Mail’s misogynistic reporting of the Chancellor following her widely reported appearance in Parliament this week. Rachel Reeves has explained that the reason she had been crying was due to a personal matter. Hacked Off reminds politicians that they have failed to protect the public from abuse and discrimination in the press; “Women and others at risk of discrimination are being let down by the Government’s inaction on press reform every day.  The Mail publishes this stuff because it knows that – until the Prime Minister develops sufficient courage to take action – it can get away with anything.”

IPSO

Statements in Open Court and Apologies

We are not aware of any apologies or statements in open court from the last week.

New Issued Cases

There was one defamation claim, one harassment claim and one miscellaneous claim filed in the Media and Communications list last week.

Last Week in the Courts

On 1 July 2025 there was a preliminary issues trial in the defamation case of Ness v Miller KB-2025-000232.

On 4 July 2025, judgment on preliminary issues was handed down in favour of the Information Commissioner in the appeal of TikTok Inc & Anor v Information Commissioner [2025] UKFTT 798 (GRC). The Preliminary Issue before the Tribunal was whether the Monetary Penalty Notice (“MPN”) issued by the Commissioner under s.155 and Schedule 16 of the DPA 2018 on 4 April 2023 was made “with respect to processing of personal data for the special purposes” within the meaning of ss.156 and 174 DPA?” [16]. The tribunal found that the processing with which the parts of the MPN dealing with the alleged breaches of Articles 5 and 8 was concerned was the processing of personal data for Underage Children [110], and at least some of that processing was in connection with the provision of targeted advertising [115]. Further, the tribunal concluded that for the purposes of the Preliminary Issue, the alleged breaches in relation to transparency obligations under UK GDPR Articles 12 and 13 were not the processing of personal data with which the MPN was concerned [130]. The tribunal concluded that the processing of personal data by TikTok in respect of which the MPN was made was not for the special purposes. Accordingly, the Information Commissioner was not required to obtain leave from a court under section 156 before issuing the MPN and the MPN was not issued ultra vires. This is because the MPN concerns – and was given “with respect to” (the language of section 156 DPA) – specific processing of data by TikTok that was not “for the special purposes” [155]. Because the tribunal determined that the MPN in its entirety was not issued ultra vires, the entire MPN now falls to be determined by way of a substantive hearing. This means the tribunal did not need to consider whether or not those parts of the MPN which were ultra vires should be severed from the remaining issues, as the MPN remains intact as issued [156].

On Friday 4 July 2025, there was a return date hearing in the case of SHM v Persons Unknown.

Media Law in Other Jurisdictions

Australia

On 1 July 2025 judgment was handed down in Wertheim v Haddad [2025] FCA 720. William Haddad is a preacher at Al Madina Dawah Centre Inc (AMDC). AMDC operates a Muslim religious centre located on Kitchener Parade, Bankstown, NSW. In November 2023, Mr Haddad delivered a series of three lectures to a small group of congregants at the Centre. Peter Wertheim AM and Robert Goot AO SC, leaders in the Jewish community and associated with the Executive Council of Australian Jewry, claim that the speeches constitute unlawful offensive behaviour based on race or ethnic origin under s.18C of the Racial Discrimination Act 1975. The Court has found that the series of lectures, titled “The Jews of Al Madina”, conveyed disparaging imputations against Jewish people that, in all the circumstances, were reasonably likely to offend, insult, humiliate and intimidate Jews in Australia, and that the imputations were conveyed because of the race or ethnic origin of that group.

China

On 27 June 2025, the Cyberspace Administration of China released the third version of the Guidance on the Application for Security Assessment of Cross-border Data Transfers. The Guidance sought to optimize and simplify the relevant materials required for security assessment, providing more detailed operational guidance for data handlers. The Privacy and Information Security Law Blog has more information here.

Germany

On 4 July 2025, a German court has awarded a Facebook user €5,000 in compensation for data protection violations involving Meta’s Business Tools. The Leipzig District Court found that Meta Platforms Ireland Limited systematically breached the General Data Protection Regulation through its extensive tracking infrastructure. According to the court filing, the 5th Civil Chamber responsible for data protection law based its decision exclusively on Article 82 of the GDPR rather than national personality rights law. This approach distinguishes the Leipzig ruling from comparable cases in other German courts, establishing a European legal framework for calculating compensation damages. Read more at PPC Land.

Ireland

The partner of murdered school teacher Ashling Murphy has settled his High Court claim for defamation against the BBC, receiving substantial damages. In a statement read to the court in Dublin on 3 July 2025, the BBC said it stood by the journalism involved in the episode in question, which it said “debated serious issues of public interest”, and acknowledged Mr Casey’s personal tragedy. “The BBC is however happy to clarify that it does not consider Ryan Casey to be a criminal or a racist, or someone guilty of or attempting to incite hatred, or someone seeking to pose as a hero of the far right through his victim impact statement,” the statement continued. The BBC has more information here.

The Cearta.ie blog has a piece entitled Prior restraints, facial and as-applied challenges, overbreadth, and anti-social behaviour orders: a note on Tallon v DPP [2023] IECA 125 (25 May 2023) – this deals with an important Court of Appeal decision handed down in 2023 but only uploaded to the Courts.ie website on 20 June 2025.

Spain

The Spanish Data Protection Authority has published its 2024 annual report, which includes the AEPD’s awareness-raising activities; the collaboration and inspection activities of the Spanish authorities; relevant reports and procedures published during 2024; and an analysis of regulatory trends and key privacy challenges for the coming months. The annual report’s key elements are summarised by DLA Piper here.

United States

Congress’ proposal to block states from regulating artificial intelligence has been removed from consideration in the Senate’s reconciliation bill after a near-unanimous vote to abandon the provision. The revised moratorium sought to reduce the AI law enactment and enforcement pause to five years while creating exceptions for laws tackling how AI affects children’s online safety, images and likeness. The proposal to tie the provision to federal broadband funding was set to remain in place if the compromise advanced, IAPP reports.

On 1 July 2025, the California Office of the Attorney General announced that the AG had reached a proposed settlement with Healthline Media LLC, the publisher of a website that provides medical and health-related information, over alleged violations of the California Consumer Privacy Act. Under the largest CCPA settlement to date, Healthline will be required to pay a record $1.55 million in penalties and implement a CCPA compliance program, among other requirements. The Privacy and Information Security Law Blog has more information here.

The 19th News has an article on the increase use of deepfakes amongst minors to perpetrate intimate-image abuse and the law’s inability to keep up.

Research and Resources

Next Week in the Courts 

On 7 to 10 July 2025 Heather Williams J will hear a trial in the defamation case of Chaudry v Qureshi KB-2022-003483.

On Wednesday 9 July 2025 there will be a PTR in the breach of confidence case of Ahluwalia v Verma KB-2023-001466.

On Friday 11 July 2025 there will be a summary judgment application in the defamation case of Whyte v British Medical Association KB-2024-002315.

Reserved Judgments

Kul and Ors v DWF Law LLP – 4 and 5 June 2025 (Eady J).

Baroness Lawrence of Clarendon v Associated Newspapers, 6 and 7 May 2025 (Nicklin J).

Clarke v Guardian News and Media, 4 March – 4 April and 11 April 2025 (Steyn J).

Colette Allen is the host of Newscast on Dr Thomas Bennett and Professor Paul Wragg’s The Media Law Podcast (@MediaLawPodcast).