The Privacy Partnership Podcast with Robert Bateman
The Privacy Partnership Podcast is hosted by Robert Bateman and covers the latest developments in data protection and privacy law and practice. Episodes alternate between solo news updates and short interviews with guests from the privacy field. It is produced by Privacy Partnership, a data protection consultancy, and is aimed at professionals who need to keep up with regulatory changes and compliance issues.
Episodes
The trouble with extraterritorial laws: Ofcom v 4chan
Send us Fan MailIn this episode of the Privacy Partnership Podcast, Robert Bateman unpacks the massive gap between a UK regulator having legal authority and actually forcing an overseas company to comply.Sparked by Ofcom’s admission that it won't be able to recover every fine issued under the Online Safety Act—and 4chan's subsequent declaration of victory—we explore the harsh realities o
Smart glasses: 3 implausible ways to lawfully wear them, according to the EDPB
Send us Fan MailSo you just bought a pair of Meta Ray-Bans, and you're ready to start publicly streaming your morning coffee run. Not so fast. According to a new statement published on October 13th by the European Data Protection Board (EDPB), stepping outside the household exemption with wearable tech puts you on the hook for the full range of applicable GDPR obligations.In this episode of t
DSG settles with ICO for £200k: The "relativity" of personal data under UK GDPR
Send us Fan MailJust yesterday, the ICO announced a £200,000 settlement with DSG Retail, finally bringing an end to nearly seven years of legal wrangling over a massive 2017 cyberattack that compromised more than 5.6 million payment cards.But beyond the shrinking fine, this case resolved a fascinating legal debate about the "relativity" of personal data: If a hacker steals your customers
TikTok throws in two towels: How the battle with the ICO played out
Send us Fan MailSeven years after former Information Commissioner Elizabeth Denham told MPs that a probe into TikTok would conclude "in the fall," the enforcement saga has finally come to an end.This week on the Privacy Partnership Podcast, Robert Bateman breaks down the history of the ICO's £12.7 million penalty against the social media giant following the company's unexpected
New EDPB guidance: When to issue a GDPR fine
Send us Fan MailHow does a data protection regulator decide whether to hand down a multi-million euro fine or issue a simple reprimand? In this episode, Robert Bateman breaks down the European Data Protection Board’s (EDPB) newly published draft Guidelines 04/2026. Adopted for public consultation on 17 September 2026, these guidelines replace the 2017 Article 29 Working Party guidance and aim to h
Are Meta Ray-Bans legal under the GDPR? A roundup of regulatory positions
Send us Fan MailIn this episode of the Privacy Partnership Podcast, Robert Bateman looks at the mounting regulatory scrutiny and public backlash across Europe regarding Meta’s Ray-Ban smart glasses. Is data protection law actually equipped to handle a world where consumers wear data-scraping AI devices on their faces?From striking guerrilla protest ads on the London Underground to a 55-page techni
Grindr settles for £26 million... But wait, what about Lloyd v Google?
Send us Fan MailIn this episode of the Privacy Partnership Podcast, Robert Bateman unpacks Grindr's recent agreement to pay £26 million to settle a major UK data privacy lawsuit. The UK is currently viewed as a highly conservative, even hostile, environment for mass privacy claims. So how did a payout of this magnitude happen?Robert breaks down the historical data sharing allegations, the reg
Summer Special: Privacy action you might have missed
Send us Fan Mailn this late-summer roundup episode of the Privacy Partnership Podcast, host Robert Bateman unpacks a massive €825 million GDPR fine, the immediate impact of the EU AI Act taking effect, and a wave of enforcement actions across the UK, Europe, and the United States.In this episode, we cover:Mind the Gap (UK ICO Enforcement): Why the disconnect between an organisation's written
France fails to ban kids from social media: Age assurance remains privacy's "hard problem"
Send us Fan MailFrance’s Constitutional Council has struck down the central provision of a new law that would have banned under-15s from accessing social media.In this episode, Robert Bateman looks at why the Council found the measure disproportionate, focusing on two fundamental rights: freedom of expression and the right to private life.The decision also highlights a longstanding problem with ag
Is TikTok a patron of the arts? How an appeal under the "special purposes" exemption failed
Send us Fan MailIn this episode of the Privacy Partnership Podcast, Robert Bateman dives into a fascinating and highly creative legal defense recently mounted by TikTok. Facing a £12.7 million fine from the UK Information Commissioner's Office (ICO) for processing the data of underage children, TikTok attempted to use a jurisdictional trump card: the "special purposes" exemption und
Web scraping under the GDPR: The EDPB's uncharacteristically pragmatic solution
Send us Fan MailCan you scrape the internet for AI training data without completely running afoul of the GDPR? The European Data Protection Board (EDPB) has finally offered an answer: Yes, but get ready to implement a massive amount of filtering.In this episode of the Privacy Partnership Podcast, Robert Bateman breaks down the EDPB’s newly adopted Draft Guidelines 03/2026 on web scraping for gener
The EDPB's new anonymisation framework: 5 things you need to know
Send us Fan MailThis week, Robert Bateman breaks down the newly adopted EDPB Guidelines 02/2026 on Anonymisation. Dragging the ancient 2014 Working Party 29 framework into the age of generative AI and EU data spaces, these new rules are dense, highly technical, and will undoubtedly complicate your compliance programmes.Robert explores the new concept of "relative anonymity," explains the
Rob rambles about Trump v Slaughter from a European perspective
Send us Fan MailA longer edition of the podcast because Rob gets unreasonably animated about EU-US data transfers.On 29 June 2026 the US Supreme Court ruled that the Federal Trade Commission's protection from presidential removal is unconstitutional, overruling ninety years of precedent on independent agencies. The ruling says nothing about data protection, but the EU-US Data Privacy Framewor
CalPrivacy Director Tom Kemp on how businesses should approach California's robust privacy regulation
Send us Fan MailWhat happens when a Silicon Valley cybersecurity founder takes the reins at one of the world's most powerful privacy regulators?In this special edition of the Privacy Partnership Podcast, Robert Bateman is joined by Tom Kemp, Executive Director of CalPrivacy (the California Privacy Protection Agency). They dive deep into California’s aggressive new enforcement strategies and t
The death of the EU-US DPF? Trump v Slaughter and the future of transatlantic data flows
Send us Fan MailDid the US Supreme Court just sign the death warrant for the EU-US Data Privacy Framework (DPF)? In this explosive episode of the Privacy Partnership Podcast, Robert Bateman breaks down yesterday's monumental 6-3 SCOTUS decision in Trump v. Slaughter, which fundamentally rewrites the rules of the American administrative state.By confirming the President's authority to fir
Data transfers at the Irish courts: A partial win for TikTok
Send us Fan MailThe Irish High Court has just delivered a massive judgment in TikTok’s appeal against the Data Protection Commission (DPC). The court upheld a staggering €530 million fine—but surprisingly tore up the regulator’s order to suspend TikTok's data transfers to China. Who actually won this case, and what does it mean for the future of international data flows?In this episode of the
John Edwards resigns! A look back at his time at the ICO
Send us Fan MailJohn Edwards has abruptly resigned as the UK Information Commissioner via a LinkedIn post, leaving behind a rather complicated legacy. In this episode, Robert Bateman looks back at Edwards’ four-and-a-half-year tenure. We unpack an era defined by massive platform fines, jurisdictional ping-pong, a highly convenient alignment with Home Office surveillance goals, and a surprisingly l
Data transfers: How encryption and SCCs failed to save Yango Taxi from a €100 million fine
Send us Fan Mailf you’re going to encrypt European personal data before transferring it to a high-risk jurisdiction, the golden rule is simple: don't leave the encryption keys on the exact same server.In this episode, Robert Bateman unpacks a staggering €100 million fine handed down by the Dutch Data Protection Authority (AP) against MLU B.V., the legal successor to the operator of the Yango
AI Act loophole? How one company navigated the ban on workplace emotion recognition
Send us Fan MailCan an employer use AI to read its employees' Slack and Teams messages to diagnose their stress levels? Under the EU AI Act, that sounds like a clear violation of the ban on workplace emotion recognition. Yet, one AI company, Myndoor, just survived a regulatory investigation by the Italian Data Protection Authority (the Garante) for doing exactly that.In this episode, Robert d
Regulating the reality of adtech: The ICO’s recommended PECR reforms
Send us Fan MailThe internet’s worst-kept secret is that basic digital advertising operations involve breaking privacy laws millions of times a day. But instead of dropping the enforcement hammer, the ICO is proposing a novel solution: just make it legal.In this episode, Robert Bateman unpacks the ICO's surprising new advice to the UK government (DSIT) on creating fresh exceptions to Regulati
Decoding the AI Act: A first look at the Commission’s "high-risk" draft guidelines
Send us Fan MailThe European Commission just dropped its highly anticipated first set of draft guidelines on high-risk AI classification under the AI Act—all 150 pages of them. Published for stakeholder consultation on May 19th, 2026, this document is the closest thing we have to a compliance manual for navigating Article 6 and Annex III of the Act. In this episode of the Privacy Partnership Podca
Get 40% off an ICO fine! The South Staffordshire case and early settlements
Send us Fan MailHow do you knock 40% off a looming data protection fine? In this episode of the Privacy Partnership Podcast, Rob Bateman breaks down the recent £963,900 penalty handed down by the ICO to South Staffordshire Plc and explores the fascinating procedural mechanics that kept the final invoice under the one million pound mark.In this episode, we cover:How a single malicious attachment le
RTM v Bonne Terre: Court of Appeal redraws the line on consent
Send us Fan MailThe Court of Appeal has ruled that consent under the UK GDPR and PECR is objective. A data subject's hidden vulnerabilities are not, in themselves, decisive, and even a controller's constructive knowledge of those vulnerabilities is not a stand-alone qualifier.In this episode, Robert Bateman breaks down the judgment in RTM v Bonne Terre [2026] EWCA Civ 488, handed down on
What actually counts as 'scientific research'? Here's the EDPB's six-point answer
Send us Fan MailOn 15 April 2026, the European Data Protection Board adopted Guidelines 1/2026 on the processing of personal data for scientific research purposes. The 66-page document is now out for public consultation.In this episode, Robert Bateman breaks down what the guidelines mean for pharma companies, AI developers, universities, and anyone relying on the GDPR's scientific research pr
'Clarity in action'?! The EDPB's 2025 annual report and litigation battles
Send us Fan MailIn this episode, Rob looks at the newly published European Data Protection Board (EDPB) annual report for 2025. We are skipping the usual backward-looking statistics to focus entirely on the regulator's pipeline for 2026 and the massive multi-front litigation war currently playing out in the European courts. From new harmonised templates to high-stakes legal battles with Big T
AI in recruitment: ICO highlights poor practices as UK overhauls automated decision-making rules
Send us Fan MailAre your hiring managers quietly letting an algorithm bin hundreds of job applications while claiming a human is technically in charge?This week on the Privacy Partnership Podcast, Rob unpacks a massive structural shift in the UK’s framework for Automated Decision-Making (ADM). We dive into two major new releases from the ICO: the highly revealing Recruitment Rewired report and the
Brillen Rottler: A German optician fights back against 'abusive' DSARs
Send us Fan MailAre you seeing a rise in "copy-paste" Data Subject Access Requests (DSARs) designed primarily to extract a quick financial settlement?In this episode of the Privacy Partnership Podcast, Robert Bateman unpacks a highly practical new judgment from the Court of Justice of the European Union (CJEU) that offers controllers a potential shield against abusive access requests.Loo
Amazon's €746m fine overturned: But who actually won this case?
Send us Fan MailA €746 million GDPR fine gets completely annulled by a Luxembourg court. A massive, unmitigated victory for big tech, right? Not exactly. In this episode of the Privacy Partnership Podcast, Robert Bateman dissects the highly anticipated March 12, 2026 judgment from the Luxembourg Administrative Court concerning an anonymised e-commerce giant ("Company AA", clearly Amazon)
Invisible, indestructible signatures: The AI Act’s text watermarking problem
Send us Fan MailCan you hide an indestructible, imperceptible signature inside a basic marketing blog post? The European Commission seems to think you should try. Following the release of the Second Draft of the Code of Practice on Transparency of AI-Generated Content this Tuesday, Robert Bateman dives into the technical and regulatory headaches awaiting providers of generative AI text systems. We
Are you a 'data broker'? Maybe, under the EDPB’s expanding definition
Send us Fan MailAre you a data broker? You might not think so, but European regulators could soon be looking at your business model and concluding otherwise.In this episode of the Privacy Partnership Podcast, Robert Bateman breaks down a revealing market study commissioned by the Belgian Data Protection Authority through the EDPB’s Support Pool of Experts. Designed to identify and map the data bro
Reddit’s £14.5m fine and the “hard problem” of age assurance
Send us Fan MailThe ICO has issued a £14.47 million fine against Reddit for alleged children's privacy failures, officially signaling the end of the road for the age verification "honour system." But with the full penalty notice yet to be published, what can privacy professionals actually glean from the regulator's press release?In this episode of the Privacy Partnership Podcas
EDPB highlights "right to erasure" inadequacies: Exceptions, backups, and pseudonymisation
Send us Fan MailRob presents a few highlights from the EDPB's latest Coordinated Enforcement Framework report on the "right to erasure".- Poor storage limitation and retention schedule practices are leading to issues satisfying erasure requests.- Too many people still conflating anonymisation and pseudonymisation, and thus incorrectly relying on the latter as an erasure method.- Con
CJEU: Private companies CAN sue the EDPB
Send us Fan MailIn this episode of the Privacy and Partnership podcast, Rob discusses a significant ruling from the CJEU regarding WhatsApp's legal challenge against the European Data Protection Board (EDPB). The CJEU's decision allows companies to directly challenge binding decisions made by the EDPB. Rob explores the implications of this ruling, particularly how it affects the relation
The ICO's planned 'experimentation regime' to attract AI firms to the UK
Send us Fan MailRob discusses the recent letter from the Information Commissioner's Office (ICO) to UK government officials, highlighting the ICO's focus on economic growth and innovation. The ICO plans a statutory code of practice for AI and an "experimentation regime" for data protection. There will also be a review of low-risk online advertising activities, and new support f
Happy Data Protection Day! A brief history of UK data protection law
Send us Fan MailOn Data Protection Day 2026, Rob talks us briefly through the history of data protection in the UK: From the "data users" of the Data Protection Act 1984 to the "recognised legitimate interests" of last year's Data (Use and Access) Act.
The EDPB and EDPS 'slam' AI Act reforms under the Digital Omnibus
Send us Fan MailAlong with plans to "simplify" the GDPR, there's an AI Digital Omnibus that proposes amendments to the AI Act. In a new Joint Opinion, the EDPB and EDPS say they support the objective to simplify the law, but they don't seem to like any of the Commission's ideas.For example, they don't like the Commission's proposal to allow bias detection process
Happy New Year? A look at the ICO's new 'international data transfers' guidance
Send us Fan MailRob looks at the ICO’s newly released guidance on international transfers and what it means for UK privacy professionals.• The “Three-Step Test” for identifying restricted transfers• Why UK processors returning data to overseas controllers are no longer “initiating” transfers• Clarifications on transfers between branches and employees within the same legal entity• How the guidance
'No surprises': The ICO and the Government come to an understanding
Send us Fan MailThe ICO and the UK Government have come to an understanding: "No surprises", "supportive challenge", and a seat at the table for the Commissioner.A Memorandum of Understanding signed today between the ICO and the UK Government formalises an already pretty cosy relationship between the regulator and its largest stakeholder. While the MoU explicitly preserves the
Christmas Special: The top 5 data protection CJEU cases of 2025
Send us Fan MailTime for the Privacy Partnership Podcast Christmas Special, where Rob looks at his top 5 data protection CJEU judgments for 2025. Here's the list of cases I summarise in this podcast, which span data transfers, non-material damages, data minimisation, and more:1. Bindl v European Commission8 January 2025Case T‑354/222. Mousse v CNIL (Mousse v Commission nationale de l'inf
The Accidental Americans v FATCA: Like the Schrems cases, but for tax
Send us Fan MailThe CJEU will soon hear the Belgian DPA's case against FATCA, the tax treaty that results in the systematic bulk transfer of data about thousands of "Accidental Americans" to the IRS.FATCA is a US law intended to prevent US citizens from hiding assets in foreign banks.But it also hits "Accidental Americans"—people who might have been born in the US and acqu
Did the CJEU just junk the EU's intermediary liability AND general monitoring rules? X v Russmedia
Send us Fan MailDid the CJEU just use the GDPR to junk the intermediary liability exemption and impose a general monitoring obligation? Here's a look at yesterday's Russmedia judgment.The facts are pretty grim: "X" saw an ad on an Russmedia's online marketplace falsely promoting her as a sex worker. She reported it, Russmedia took it down, but the ad had already been scrap
The 'final straw': Open letter calls for inquiry into the ICO
Send us Fan MailA coalition of organisations and experts sent an open letter calling for a Parliamentary inquiry into the performance of the UK ICO. What's the problem, and will this work?Full disclosure: I was asked to sign this letter, but I decided against it. Many people I know and respect are on the list of signatories, and while there's some stuff in here I'm not 100% behind,
It's here! Major proposed GDPR changes under the Digital Omnibus Regulation
Send us Fan MailIn this episode of the Privacy Partnership Podcast, Rob walks you through the most important aspects of the proposed Digital Omnibus Regulation. • A new Article 88c states that processing of personal data for the development and operation of AI systems may be pursued for legitimate interests (p85).• A new condition under Article 9 allows the processing of special category data for
GDPR's "death by 1000 cuts"? A look at the leaked Digital Omnibus draft
Send us Fan Mail"Death by a thousand cuts?" That's what the leaked Digital Omnibus proposals represent to the GDPR, according to noyb.eu. Here's a look at some of the most significant ideas, from the new definition of "personal data" to the narrowing of Article 9.--Note: This is an unconfirmed internal draft from the Commission’s DG CONNECT and not an official proposa
Up to 40% off UK GDPR fines! The ICO's draft enforcement guidance
Send us Fan MailThe ICO is offering up to 40% off UK GDPR fines under its new draft Data Protection Enforcement Procedural Guidance. Here's how to take advantage of this special deal!The draft guidance updates the ICO's Regulatory Action Plan, which has been in place since 2018.There are two particularly interesting bits:- New teeth available to the ICO under the Data (Use and Access) Ac
The TikTok China decision: A de facto ban on international data transfers?
Send us Fan MailThe DPC's TikTok decision is not that surprising if you understand the law, but it's actually a pretty huge deal to see this play out in reality. Are most international data transfers de facto illegal?TikTok enabled remote access to EEA users' personal data in China, purportedly for purposes like maintenance and user support.The DPC said: Remote access is a transfer.
The EDPB's long list of problems with UK data protection standards
Send us Fan MailThe EDPB just published its opinion on the UK's adequacy decision and it's pretty critical of the country's post-Brexit direction on data protection. But does the EDPB's opinion matter?Probably not—directly, at least.The Commission's draft adequacy decision now goes to a vote at the Comitology Committee and is very unlikely to be voted down, despite the EDP
What is going on between the ICO and Clearview AI? The UK GDPR's scope and the meaning of "monitoring behaviour".
Send us Fan MailWhat is going on between Clearview AI and the ICO?Actions against Clearview have been a test of how far digital regulation actually has extraterritorial effect. This month, we got an answer on this from the UK’s Upper Tribunal, and it’s an important judgment about the territorial reach of the UK GDPR—at least on paper.In May 2022, the ICO fined Clearview AI £7.5 million and ordered
Discord's photo ID breach: Are the UK GDPR and Online Safety Act to blame?
Send us Fan MailDiscord's recent data breach exposed photo IDs used to verify users' ages. Should we blame the Online Safety Act, the Children's Code, or the UK GDPR? It's complicated. (Please excuse the unsightly cut on my forehead in this one).While this breach probably just boils down to vendor security, I wanted to consider whether Discord was obliged to collect users'
Tractor Supply: The first CCPA case involving HR data
Send us Fan MailTractor Supply: The first CCPA case about job applicants' privacy (and the largest CPPA settlement yet). Don't forget: Unlike other states, California's privacy law applies to data about employees and job applicants.Tractor Supply settled for $1.35 million for failing to tell job applicants about their rights (among other, more commonplace violations—GPC, Do Not Sell
LinkedIn's AI training plans are back, but not all users are treated equally
Send us Fan MailLinkedIn's AI training settings don't affect all users equally. Did you notice that LinkedIn will share UK users' data with Microsoft, but not EEA users? In this video, Rob looks at the background, the broader context, and the details.LinkedIn first floated the idea of training its AI models on users' personal data last summer and has since encountered several b
The ICO is consulting on guidance on the new cookie rules—and whether to enforce them.
Send us Fan MailThe ICO has yet MORE draft guidance, this time on the UK's upcoming changes to the law on cookies (etc). At the same time, it's running a "call for views" about whether it should enforce that law in certain contexts.The updated cookies guidance includes a new chapter on the consent exceptions provided by the Data Use and Access Act (DUAA).We also get new materia
The first criminal prosecution for 'ignoring' a DSAR: More common than we think?
Send us Fan MailAn individual has been criminally prosecuted for "ignoring" or having "blocked, erased, or concealed" a subject access request. A rare (perhaps unprecedented) case, but Rob wonders if this behaviour is more common than we might think.This care home director was prosecuted under Section 173 of the Data Protection Act 2018, which makes it a criminal offence to &qu
What does 'without undue delay' ACTUALLY MEAN? IL v Veracash
Send us Fan MailAll over EU and UK law, we see a requirement to report certain stuff "without undue delay", often coupled with a hard deadline period (e.g., within 72 hours). A CJEU case from last month explored what these dual obligations mean in practice.IL v Veracash (Case C‑665/23, 1 August 2025) concerned the old Payment Services Directive (PSD). The PSD requires cardholders (consum
More ICO guidance! Recognised legitimate interests
Send us Fan MailMore draft ICO guidance! This time, about one of the Data (Use and Access) Act's most important concepts: "Recognised legitimate interests". The "recognised legitimate interests" are data processing activities that, frankly, the government would like you to do more of.Unlike regular old legitimate interests, you won't need to conduct a "balancing
How to handle data subject complaints: New draft ICO guidance
Send us Fan MailIn advance of new obligations under the Data (Use and Access) Act, the ICO has published some draft guidance on handling data subject complaints. This episode breaks down some of the ICO's expectations in this area.As always, the ICO sets out three tiers: • "Must": Legal duties, for example, under UK GDPR or DPA 2018. • "Should": Good practice stuff that yo
UK Data (Use and Access) Act: The first provisions take effect
Send us Fan MailSome parts of the Data (Use and Access) Act (DUAA) take effect today! This is our first chance to see how the Act is actually going to operate in practice. In this video, I'll talk you through the relevant provisions.Many of these provisions are quite technical. So to make sense of them, Rob breaks them down into three categories: • New powers for government and regulators • I
The Online Safety Act's tensions with the UK GDPR
Send us Fan MailThe Online Safety Act is why you might have been asked for your driver's licence on Reddit, X, and some... other websites. In this video, I explain how the OSA works and how it raises tensions with the UK GDPR.The OSA applies to "user-to-user" and search services with "links to the UK". This covers websites from social media giants to tiny online message bo
AI Act: Should you be watermarking your AI-generated content?
Send us Fan MailAre you using an in-house tool powered by an AI model from OpenAI, Google, or Meta to produce marketing copy? You might soon be responsible for watermarking your AI-generated content.In this episode of the Privacy Partnership Podcast, Rob explores a common scenario, where a company fine-tunes a general-purpose AI model and builds a simple internal tool for staff to generate copy in
The ICO's Birthlink Fine: Accountability, Integrity, and the 'Public Sector Approach' (?)
Send us Fan MailLast week, the ICO fined Scottish charity Birthlink £18,000 for destroying around 4,800 adoption records. In this video, Rob explains why this is such an interesting case.Birthlink is an Edinburgh-based charity that maintains the Adoption Contact Register for Scotland. It provides specialised support for people involved in adoptions.At the heart of this case are the "linked re
Access to Customer and Business Data Under the DUAA with Boris Wojtan
Send us Fan MailI spoke to Boris Wojtan, Senior Privacy Counsel at Privacy Partnership Law, about "Access to Customer and Business Data" under Part 1 of the UK's Data (Use and Access) Act.This has been on my "get to grips with this" list for absolutely ages.Like me, you're probably familiar with the DUAA's amendments to the UK GDPR, the DPA 2018, and PECR.But tha
