PUBLICTEC | DATA PROTECTION UPDATE
April 2026 | Public Sector
Practical updates. Regulatory developments. Stronger information governance.
April's developments highlight the growing overlap between data protection, digital services and Freedom of Information. New ICO guidance covers cookies and other storage/access technologies, while several FOI decisions demonstrate that public authorities must apply exemptions correctly and continue providing appropriate advice and assistance.
🍪 ICO publishes final cookies and tracking guidance
On 29 April, the ICO published final guidance covering Storage and Access Technologies, including:
- •Cookies
- •Tracking pixels
- •Device fingerprinting
- •Similar tracking technologies
The guidance reflects changes resulting from the Data (Use and Access) Act and applies PECR alongside UK GDPR where relevant.
Why public bodies should take notice
Public-sector websites increasingly include:
- •Analytics → Embedded video → Mapping → Chatbots → Online forms → Third-party widgets → Session recording
These can introduce storage and tracking technologies even where the public body itself did not develop them.
PublicTec recommendation
Review your corporate website and digital services against:
- •Cookie inventory → Consent mechanism → Third parties → Analytics → Privacy information → Retention
📩 FOI cost limits don't remove the duty to assist
An April decision involving the Police and Crime Commissioner for Cleveland confirmed that the authority was entitled to rely on the FOIA cost limit.
However, the ICO also found that it had not fully complied with its duty to provide advice and assistance to help the requester refine the request.
PublicTec View
Section 12 should not simply result in:
"Your request is too expensive — refused."
Where appropriate, the authority should explain how the request might be narrowed or refined to bring it within the applicable cost limit.
⚖️ Vexatious FOI exemptions must be used carefully
The ICO considered an FOI request for a redacted contract between Leicestershire Police and Palantir Technologies.
Leicestershire Police had relied on section 14(1), concerning vexatious requests. The Commissioner determined that section 14 was not engaged and required disclosure of the contract, subject to applicable law-enforcement, commercial and personal-data redactions.
PublicTec View
A difficult, detailed or inconvenient request is not automatically vexatious.
Section 14 decisions should be properly reasoned and documented.
🌳 Don't overlook Environmental Information Regulations
An April decision involving Somerset Council found that the authority had breached the Environmental Information Regulations by failing to provide an internal review within the applicable 40-working-day period.
Why this matters
Public bodies often focus heavily on FOIA while EIR receives less attention.
Requests involving:
- •Planning → Land → Development → Pollution → Transport → Waste → Environmental policy → Infrastructure
may fall under EIR rather than FOIA.
✅ APRIL PUBLIC SECTOR CHECKLIST
01 | Cookies Audit your public websites and portals.
02 | FOI cost limits Review how advice and assistance is provided.
03 | Section 14 Make sure vexatious decisions have documented justification.
04 | EIR Confirm teams can recognise environmental information.
05 | Internal reviews Monitor statutory deadlines.
06 | Third-party technology Identify tracking introduced by embedded website services.
PublicTec Technology | Data Protection | Governance
Practical support. Clear advice. Better governance.
This newsletter provides general information and guidance and should not be treated as legal advice. Individual circumstances should always be considered when making data protection decisions.