The Privacy Partnership Podcast with Robert Bateman
The Privacy Partnership Podcast is hosted by Robert Bateman and covers the latest developments in data protection and privacy law and practice. Episodes alternate between solo news updates and short interviews with guests from the privacy field. It is produced by Privacy Partnership, a data protection consultancy, and is aimed at professionals who need to keep up with regulatory changes and compliance issues.
Episodes
TikTok throws in two towels: How the battle with the ICO played out
Seven years after former Information Commissioner Elizabeth Denham told MPs that a probe into TikTok would conclude "in the fall," the enforcement saga has finally come to an end.This week on the Privacy Partnership Podcast, Robert Bateman breaks down the history of the ICO's £12.7 million penalty against the social media giant following the company's unexpected decision to wit
New EDPB guidance: When to issue a GDPR fine
How does a data protection regulator decide whether to hand down a multi-million euro fine or issue a simple reprimand? In this episode, Robert Bateman breaks down the European Data Protection Board’s (EDPB) newly published draft Guidelines 04/2026. Adopted for public consultation on 17 September 2026, these guidelines replace the 2017 Article 29 Working Party guidance and aim to heavily harmonise
Are Meta Ray-Bans legal under the GDPR? A roundup of regulatory positions
In this episode of the Privacy Partnership Podcast, Robert Bateman looks at the mounting regulatory scrutiny and public backlash across Europe regarding Meta’s Ray-Ban smart glasses. Is data protection law actually equipped to handle a world where consumers wear data-scraping AI devices on their faces?From striking guerrilla protest ads on the London Underground to a 55-page technical and legal te
Grindr settles for £26 million... But wait, what about Lloyd v Google?
In this episode of the Privacy Partnership Podcast, Robert Bateman unpacks Grindr's recent agreement to pay £26 million to settle a major UK data privacy lawsuit. The UK is currently viewed as a highly conservative, even hostile, environment for mass privacy claims. So how did a payout of this magnitude happen?Robert breaks down the historical data sharing allegations, the regulatory backdrop
Summer Special: Privacy action you might have missed
n this late-summer roundup episode of the Privacy Partnership Podcast, host Robert Bateman unpacks a massive €825 million GDPR fine, the immediate impact of the EU AI Act taking effect, and a wave of enforcement actions across the UK, Europe, and the United States.In this episode, we cover:Mind the Gap (UK ICO Enforcement): Why the disconnect between an organisation's written privacy policies
France fails to ban kids from social media: Age assurance remains privacy's "hard problem"
France’s Constitutional Council has struck down the central provision of a new law that would have banned under-15s from accessing social media.In this episode, Robert Bateman looks at why the Council found the measure disproportionate, focusing on two fundamental rights: freedom of expression and the right to private life.The decision also highlights a longstanding problem with age assurance: to
Is TikTok a patron of the arts? How an appeal under the "special purposes" exemption failed
In this episode of the Privacy Partnership Podcast, Robert Bateman dives into a fascinating and highly creative legal defense recently mounted by TikTok. Facing a £12.7 million fine from the UK Information Commissioner's Office (ICO) for processing the data of underage children, TikTok attempted to use a jurisdictional trump card: the "special purposes" exemption under Section 156 o
Web scraping under the GDPR: The EDPB's uncharacteristically pragmatic solution
Can you scrape the internet for AI training data without completely running afoul of the GDPR? The European Data Protection Board (EDPB) has finally offered an answer: Yes, but get ready to implement a massive amount of filtering.In this episode of the Privacy Partnership Podcast, Robert Bateman breaks down the EDPB’s newly adopted Draft Guidelines 03/2026 on web scraping for generative AI. Robert
The EDPB's new anonymisation framework: 5 things you need to know
This week, Robert Bateman breaks down the newly adopted EDPB Guidelines 02/2026 on Anonymisation. Dragging the ancient 2014 Working Party 29 framework into the age of generative AI and EU data spaces, these new rules are dense, highly technical, and will undoubtedly complicate your compliance programmes.Robert explores the new concept of "relative anonymity," explains the rebranded techn
Rob rambles about Trump v Slaughter from a European perspective
A longer edition of the podcast because Rob gets unreasonably animated about EU-US data transfers.On 29 June 2026 the US Supreme Court ruled that the Federal Trade Commission's protection from presidential removal is unconstitutional, overruling ninety years of precedent on independent agencies. The ruling says nothing about data protection, but the EU-US Data Privacy Framework is built on th
CalPrivacy Director Tom Kemp on how businesses should approach California's robust privacy regulation
What happens when a Silicon Valley cybersecurity founder takes the reins at one of the world's most powerful privacy regulators?In this special edition of the Privacy Partnership Podcast, Robert Bateman is joined by Tom Kemp, Executive Director of CalPrivacy (the California Privacy Protection Agency). They dive deep into California’s aggressive new enforcement strategies and the technical too
The death of the EU-US DPF? Trump v Slaughter and the future of transatlantic data flows
Did the US Supreme Court just sign the death warrant for the EU-US Data Privacy Framework (DPF)? In this explosive episode of the Privacy Partnership Podcast, Robert Bateman breaks down yesterday's monumental 6-3 SCOTUS decision in Trump v. Slaughter, which fundamentally rewrites the rules of the American administrative state.By confirming the President's authority to fire FTC Commission
Data transfers at the Irish courts: A partial win for TikTok
The Irish High Court has just delivered a massive judgment in TikTok’s appeal against the Data Protection Commission (DPC). The court upheld a staggering €530 million fine—but surprisingly tore up the regulator’s order to suspend TikTok's data transfers to China. Who actually won this case, and what does it mean for the future of international data flows?In this episode of the Privacy Partner
John Edwards resigns! A look back at his time at the ICO
John Edwards has abruptly resigned as the UK Information Commissioner via a LinkedIn post, leaving behind a rather complicated legacy. In this episode, Robert Bateman looks back at Edwards’ four-and-a-half-year tenure. We unpack an era defined by massive platform fines, jurisdictional ping-pong, a highly convenient alignment with Home Office surveillance goals, and a surprisingly lenient approach
Data transfers: How encryption and SCCs failed to save Yango Taxi from a €100 million fine
f you’re going to encrypt European personal data before transferring it to a high-risk jurisdiction, the golden rule is simple: don't leave the encryption keys on the exact same server.In this episode, Robert Bateman unpacks a staggering €100 million fine handed down by the Dutch Data Protection Authority (AP) against MLU B.V., the legal successor to the operator of the Yango ride-hailing app
AI Act loophole? How one company navigated the ban on workplace emotion recognition
Can an employer use AI to read its employees' Slack and Teams messages to diagnose their stress levels? Under the EU AI Act, that sounds like a clear violation of the ban on workplace emotion recognition. Yet, one AI company, Myndoor, just survived a regulatory investigation by the Italian Data Protection Authority (the Garante) for doing exactly that.In this episode, Robert dives into this f
Regulating the reality of adtech: The ICO’s recommended PECR reforms
The internet’s worst-kept secret is that basic digital advertising operations involve breaking privacy laws millions of times a day. But instead of dropping the enforcement hammer, the ICO is proposing a novel solution: just make it legal.In this episode, Robert Bateman unpacks the ICO's surprising new advice to the UK government (DSIT) on creating fresh exceptions to Regulation 6 of PECR. Ro
Decoding the AI Act: A first look at the Commission’s "high-risk" draft guidelines
The European Commission just dropped its highly anticipated first set of draft guidelines on high-risk AI classification under the AI Act—all 150 pages of them. Published for stakeholder consultation on May 19th, 2026, this document is the closest thing we have to a compliance manual for navigating Article 6 and Annex III of the Act. In this episode of the Privacy Partnership Podcast, Robert Batem
Get 40% off an ICO fine! The South Staffordshire case and early settlements
How do you knock 40% off a looming data protection fine? In this episode of the Privacy Partnership Podcast, Rob Bateman breaks down the recent £963,900 penalty handed down by the ICO to South Staffordshire Plc and explores the fascinating procedural mechanics that kept the final invoice under the one million pound mark.In this episode, we cover:How a single malicious attachment led to the exfiltr
RTM v Bonne Terre: Court of Appeal redraws the line on consent
The Court of Appeal has ruled that consent under the UK GDPR and PECR is objective. A data subject's hidden vulnerabilities are not, in themselves, decisive, and even a controller's constructive knowledge of those vulnerabilities is not a stand-alone qualifier.In this episode, Robert Bateman breaks down the judgment in RTM v Bonne Terre [2026] EWCA Civ 488, handed down on 21 April 2026.I
What actually counts as 'scientific research'? Here's the EDPB's six-point answer
On 15 April 2026, the European Data Protection Board adopted Guidelines 1/2026 on the processing of personal data for scientific research purposes. The 66-page document is now out for public consultation.In this episode, Robert Bateman breaks down what the guidelines mean for pharma companies, AI developers, universities, and anyone relying on the GDPR's scientific research provisions.The GDP
'Clarity in action'?! The EDPB's 2025 annual report and litigation battles
In this episode, Rob looks at the newly published European Data Protection Board (EDPB) annual report for 2025. We are skipping the usual backward-looking statistics to focus entirely on the regulator's pipeline for 2026 and the massive multi-front litigation war currently playing out in the European courts. From new harmonised templates to high-stakes legal battles with Big Tech and fellow r
AI in recruitment: ICO highlights poor practices as UK overhauls automated decision-making rules
Are your hiring managers quietly letting an algorithm bin hundreds of job applications while claiming a human is technically in charge?This week on the Privacy Partnership Podcast, Rob unpacks a massive structural shift in the UK’s framework for Automated Decision-Making (ADM). We dive into two major new releases from the ICO: the highly revealing Recruitment Rewired report and the newly updated d
Brillen Rottler: A German optician fights back against 'abusive' DSARs
Are you seeing a rise in "copy-paste" Data Subject Access Requests (DSARs) designed primarily to extract a quick financial settlement?In this episode of the Privacy Partnership Podcast, Robert Bateman unpacks a highly practical new judgment from the Court of Justice of the European Union (CJEU) that offers controllers a potential shield against abusive access requests.Looking at the fact
Amazon's €746m fine overturned: But who actually won this case?
A €746 million GDPR fine gets completely annulled by a Luxembourg court. A massive, unmitigated victory for big tech, right? Not exactly. In this episode of the Privacy Partnership Podcast, Robert Bateman dissects the highly anticipated March 12, 2026 judgment from the Luxembourg Administrative Court concerning an anonymised e-commerce giant ("Company AA", clearly Amazon) and a record-br
Invisible, indestructible signatures: The AI Act’s text watermarking problem
Can you hide an indestructible, imperceptible signature inside a basic marketing blog post? The European Commission seems to think you should try. Following the release of the Second Draft of the Code of Practice on Transparency of AI-Generated Content this Tuesday, Robert Bateman dives into the technical and regulatory headaches awaiting providers of generative AI text systems. We look at the Com
Are you a 'data broker'? Maybe, under the EDPB’s expanding definition
Are you a data broker? You might not think so, but European regulators could soon be looking at your business model and concluding otherwise.In this episode of the Privacy Partnership Podcast, Robert Bateman breaks down a revealing market study commissioned by the Belgian Data Protection Authority through the EDPB’s Support Pool of Experts. Designed to identify and map the data broker ecosystem, t
Reddit’s £14.5m fine and the “hard problem” of age assurance
The ICO has issued a £14.47 million fine against Reddit for alleged children's privacy failures, officially signaling the end of the road for the age verification "honour system." But with the full penalty notice yet to be published, what can privacy professionals actually glean from the regulator's press release?In this episode of the Privacy Partnership Podcast, Robert Batema
EDPB highlights "right to erasure" inadequacies: Exceptions, backups, and pseudonymisation
Rob presents a few highlights from the EDPB's latest Coordinated Enforcement Framework report on the "right to erasure".- Poor storage limitation and retention schedule practices are leading to issues satisfying erasure requests.- Too many people still conflating anonymisation and pseudonymisation, and thus incorrectly relying on the latter as an erasure method.- Controllers are fai
CJEU: Private companies CAN sue the EDPB
In this episode of the Privacy and Partnership podcast, Rob discusses a significant ruling from the CJEU regarding WhatsApp's legal challenge against the European Data Protection Board (EDPB). The CJEU's decision allows companies to directly challenge binding decisions made by the EDPB. Rob explores the implications of this ruling, particularly how it affects the relationship between tec
The ICO's planned 'experimentation regime' to attract AI firms to the UK
Rob discusses the recent letter from the Information Commissioner's Office (ICO) to UK government officials, highlighting the ICO's focus on economic growth and innovation. The ICO plans a statutory code of practice for AI and an "experimentation regime" for data protection. There will also be a review of low-risk online advertising activities, and new support for SMEs.
Happy Data Protection Day! A brief history of UK data protection law
On Data Protection Day 2026, Rob talks us briefly through the history of data protection in the UK: From the "data users" of the Data Protection Act 1984 to the "recognised legitimate interests" of last year's Data (Use and Access) Act.
The EDPB and EDPS 'slam' AI Act reforms under the Digital Omnibus
Along with plans to "simplify" the GDPR, there's an AI Digital Omnibus that proposes amendments to the AI Act. In a new Joint Opinion, the EDPB and EDPS say they support the objective to simplify the law, but they don't seem to like any of the Commission's ideas.For example, they don't like the Commission's proposal to allow bias detection processing for all AI s
Happy New Year? A look at the ICO's new 'international data transfers' guidance
Rob looks at the ICO’s newly released guidance on international transfers and what it means for UK privacy professionals.• The “Three-Step Test” for identifying restricted transfers• Why UK processors returning data to overseas controllers are no longer “initiating” transfers• Clarifications on transfers between branches and employees within the same legal entity• How the guidance incorporates the
'No surprises': The ICO and the Government come to an understanding
The ICO and the UK Government have come to an understanding: "No surprises", "supportive challenge", and a seat at the table for the Commissioner.A Memorandum of Understanding signed today between the ICO and the UK Government formalises an already pretty cosy relationship between the regulator and its largest stakeholder. While the MoU explicitly preserves the ICO's indep
Christmas Special: The top 5 data protection CJEU cases of 2025
Time for the Privacy Partnership Podcast Christmas Special, where Rob looks at his top 5 data protection CJEU judgments for 2025. Here's the list of cases I summarise in this podcast, which span data transfers, non-material damages, data minimisation, and more:1. Bindl v European Commission8 January 2025Case T‑354/222. Mousse v CNIL (Mousse v Commission nationale de l'informatique et des
The Accidental Americans v FATCA: Like the Schrems cases, but for tax
The CJEU will soon hear the Belgian DPA's case against FATCA, the tax treaty that results in the systematic bulk transfer of data about thousands of "Accidental Americans" to the IRS.FATCA is a US law intended to prevent US citizens from hiding assets in foreign banks.But it also hits "Accidental Americans"—people who might have been born in the US and acquired a US passpo
Did the CJEU just junk the EU's intermediary liability AND general monitoring rules? X v Russmedia
Did the CJEU just use the GDPR to junk the intermediary liability exemption and impose a general monitoring obligation? Here's a look at yesterday's Russmedia judgment.The facts are pretty grim: "X" saw an ad on an Russmedia's online marketplace falsely promoting her as a sex worker. She reported it, Russmedia took it down, but the ad had already been scraped and copied on
The 'final straw': Open letter calls for inquiry into the ICO
A coalition of organisations and experts sent an open letter calling for a Parliamentary inquiry into the performance of the UK ICO. What's the problem, and will this work?Full disclosure: I was asked to sign this letter, but I decided against it. Many people I know and respect are on the list of signatories, and while there's some stuff in here I'm not 100% behind, I think it makes
It's here! Major proposed GDPR changes under the Digital Omnibus Regulation
In this episode of the Privacy Partnership Podcast, Rob walks you through the most important aspects of the proposed Digital Omnibus Regulation. • A new Article 88c states that processing of personal data for the development and operation of AI systems may be pursued for legitimate interests (p85).• A new condition under Article 9 allows the processing of special category data for AI training if s
GDPR's "death by 1000 cuts"? A look at the leaked Digital Omnibus draft
"Death by a thousand cuts?" That's what the leaked Digital Omnibus proposals represent to the GDPR, according to noyb.eu. Here's a look at some of the most significant ideas, from the new definition of "personal data" to the narrowing of Article 9.--Note: This is an unconfirmed internal draft from the Commission’s DG CONNECT and not an official proposal. It may change
Up to 40% off UK GDPR fines! The ICO's draft enforcement guidance
The ICO is offering up to 40% off UK GDPR fines under its new draft Data Protection Enforcement Procedural Guidance. Here's how to take advantage of this special deal!The draft guidance updates the ICO's Regulatory Action Plan, which has been in place since 2018.There are two particularly interesting bits:- New teeth available to the ICO under the Data (Use and Access) Act (DUAA), should
The TikTok China decision: A de facto ban on international data transfers?
The DPC's TikTok decision is not that surprising if you understand the law, but it's actually a pretty huge deal to see this play out in reality. Are most international data transfers de facto illegal?TikTok enabled remote access to EEA users' personal data in China, purportedly for purposes like maintenance and user support.The DPC said: Remote access is a transfer. Not really surp
The EDPB's long list of problems with UK data protection standards
The EDPB just published its opinion on the UK's adequacy decision and it's pretty critical of the country's post-Brexit direction on data protection. But does the EDPB's opinion matter?Probably not—directly, at least.The Commission's draft adequacy decision now goes to a vote at the Comitology Committee and is very unlikely to be voted down, despite the EDPB's reserva
What is going on between the ICO and Clearview AI? The UK GDPR's scope and the meaning of "monitoring behaviour".
What is going on between Clearview AI and the ICO?Actions against Clearview have been a test of how far digital regulation actually has extraterritorial effect. This month, we got an answer on this from the UK’s Upper Tribunal, and it’s an important judgment about the territorial reach of the UK GDPR—at least on paper.In May 2022, the ICO fined Clearview AI £7.5 million and ordered it to delete th
Discord's photo ID breach: Are the UK GDPR and Online Safety Act to blame?
Discord's recent data breach exposed photo IDs used to verify users' ages. Should we blame the Online Safety Act, the Children's Code, or the UK GDPR? It's complicated. (Please excuse the unsightly cut on my forehead in this one).While this breach probably just boils down to vendor security, I wanted to consider whether Discord was obliged to collect users' ID documents, a
Tractor Supply: The first CCPA case involving HR data
Tractor Supply: The first CCPA case about job applicants' privacy (and the largest CPPA settlement yet). Don't forget: Unlike other states, California's privacy law applies to data about employees and job applicants.Tractor Supply settled for $1.35 million for failing to tell job applicants about their rights (among other, more commonplace violations—GPC, Do Not Sell, the usual stuf
LinkedIn's AI training plans are back, but not all users are treated equally
LinkedIn's AI training settings don't affect all users equally. Did you notice that LinkedIn will share UK users' data with Microsoft, but not EEA users? In this video, Rob looks at the background, the broader context, and the details.LinkedIn first floated the idea of training its AI models on users' personal data last summer and has since encountered several bumps in the road
The ICO is consulting on guidance on the new cookie rules—and whether to enforce them.
The ICO has yet MORE draft guidance, this time on the UK's upcoming changes to the law on cookies (etc). At the same time, it's running a "call for views" about whether it should enforce that law in certain contexts.The updated cookies guidance includes a new chapter on the consent exceptions provided by the Data Use and Access Act (DUAA).We also get new material reflecting the
The first criminal prosecution for 'ignoring' a DSAR: More common than we think?
An individual has been criminally prosecuted for "ignoring" or having "blocked, erased, or concealed" a subject access request. A rare (perhaps unprecedented) case, but Rob wonders if this behaviour is more common than we might think.This care home director was prosecuted under Section 173 of the Data Protection Act 2018, which makes it a criminal offence to "alter, deface
What does 'without undue delay' ACTUALLY MEAN? IL v Veracash
All over EU and UK law, we see a requirement to report certain stuff "without undue delay", often coupled with a hard deadline period (e.g., within 72 hours). A CJEU case from last month explored what these dual obligations mean in practice.IL v Veracash (Case C‑665/23, 1 August 2025) concerned the old Payment Services Directive (PSD). The PSD requires cardholders (consumers) to notify p
More ICO guidance! Recognised legitimate interests
More draft ICO guidance! This time, about one of the Data (Use and Access) Act's most important concepts: "Recognised legitimate interests". The "recognised legitimate interests" are data processing activities that, frankly, the government would like you to do more of.Unlike regular old legitimate interests, you won't need to conduct a "balancing test" befor
How to handle data subject complaints: New draft ICO guidance
In advance of new obligations under the Data (Use and Access) Act, the ICO has published some draft guidance on handling data subject complaints. This episode breaks down some of the ICO's expectations in this area.As always, the ICO sets out three tiers: • "Must": Legal duties, for example, under UK GDPR or DPA 2018. • "Should": Good practice stuff that you should do unle
UK Data (Use and Access) Act: The first provisions take effect
Some parts of the Data (Use and Access) Act (DUAA) take effect today! This is our first chance to see how the Act is actually going to operate in practice. In this video, I'll talk you through the relevant provisions.Many of these provisions are quite technical. So to make sense of them, Rob breaks them down into three categories: • New powers for government and regulators • Institutional ref
The Online Safety Act's tensions with the UK GDPR
The Online Safety Act is why you might have been asked for your driver's licence on Reddit, X, and some... other websites. In this video, I explain how the OSA works and how it raises tensions with the UK GDPR.The OSA applies to "user-to-user" and search services with "links to the UK". This covers websites from social media giants to tiny online message boards.Through a s
AI Act: Should you be watermarking your AI-generated content?
Are you using an in-house tool powered by an AI model from OpenAI, Google, or Meta to produce marketing copy? You might soon be responsible for watermarking your AI-generated content.In this episode of the Privacy Partnership Podcast, Rob explores a common scenario, where a company fine-tunes a general-purpose AI model and builds a simple internal tool for staff to generate copy in its own brand v
The ICO's Birthlink Fine: Accountability, Integrity, and the 'Public Sector Approach' (?)
Last week, the ICO fined Scottish charity Birthlink £18,000 for destroying around 4,800 adoption records. In this video, Rob explains why this is such an interesting case.Birthlink is an Edinburgh-based charity that maintains the Adoption Contact Register for Scotland. It provides specialised support for people involved in adoptions.At the heart of this case are the "linked records": Man
Access to Customer and Business Data Under the DUAA with Boris Wojtan
I spoke to Boris Wojtan, Senior Privacy Counsel at Privacy Partnership Law, about "Access to Customer and Business Data" under Part 1 of the UK's Data (Use and Access) Act.This has been on my "get to grips with this" list for absolutely ages.Like me, you're probably familiar with the DUAA's amendments to the UK GDPR, the DPA 2018, and PECR.But that's just on
