The Privacy Partnership Podcast with Robert Bateman

Send us Fan MailIn Like Company v Google (C-250/25), Advocate General Szpunar considers whether AI companies can use copyrighted material to train their models and generate chatbot responses.The case raises four questions concerning AI training, the text and data mining (TDM) exception, retrieval-augmented generation (RAG), and liability for AI-generated outputs.We examine the AG's largely provider-friendly opinion, its implications for AI developers and news publishers, and why the CJEU may leave some of the biggest questions unanswered.Source: AG Szpunar's opinion, 3 November 2026 (C-250/25)Clarify the case’s central legal disputeAdd a clearer audience-facing takeaway

Send us Fan MailIn this episode of the Privacy Partnership Podcast, Robert Bateman unpacks the record 92 million NOK (€8.6 million) fine issued by the Norwegian Data Protection Authority (Datatilsynet) against advertising technology company Xandr. With the regulator confirming on 3 November that Xandr has not appealed, the decision is now final.Robert explores the complexities of real-time bidding, the processing of special category data, and the legal dangers of relying on a partner's invalid consent mechanism. We break down why Xandr was deemed a joint controller, why a strict B2B contract wasn't enough to save them, and what the EDPB guidelines actually require when you rely on third-party consent.Key Topics CoveredThe Final Decision: A look at the conclusion of the Norwegian proceedings against Xandr and the mechanics of how user data flows through the real-time bidding (RTB) ecosystem.Context is Everything: How seemingly standard digital breadcrumbs—like IP addresses and ad IDs—transformed into special category data concerning sexual orientation when linked to Grindr.The Limits of Contracts: Why Xandr’s contractual provision prohibiting Grindr from supplying special category data did not excuse the unlawful processing that actually occurred in reality.Joint Controllership: Why Xandr's active role in shaping the advertising platform meant they could not hide behind a "processor" defense.The Consent Trap: Grindr’s historical consent mechanism was fundamentally flawed. We explain why Xandr's reliance on it meant they lacked a valid Article 6 lawful basis and an Article 9 exception.Practical Takeaways: "Compliance can never be outsourced." What your privacy team needs to verify—from user interfaces to EDPB naming requirements—before relying on another company to collect consent on your behalf.Resources & LinksDatatilsynet: Microsoft company fined NOK 92 million for unlawfully sharing personal data (Xandr decision)Datatilsynet: The Court of Appeal upholds the fine against Grindr (October 2025)EDPB Guidelines 05/2020 on consent under Regulation 2016/679Get in TouchIf your organisation needs help navigating the complexities of data sharing agreements, joint controllership, or adtech compliance, reach out to the team at Privacy Partnership.Subscribe to the Privacy Partnership Podcast for more updates on global data protection law.

Send us Fan MailCould the GDPR's 72-hour breach reporting deadline soon be a thing of the past? On 21 October 2026, the Council of the EU agreed on its negotiating mandate for the Digital Omnibus, officially setting out the member states’ position on the Commission’s proposed GDPR reforms.In this episode of the Privacy Partnership Podcast, host Robert Bateman breaks down the Council's marked-up text. We explore what has changed from the Commission’s original proposal, what protections have been retained, and whether these revisions actually deliver meaningful simplification for privacy teams.In this episode, we discuss:The Definition of Personal Data: How the Council dropped the Commission's amendments to Article 4, instead introducing a new Article 25a that clarifies when pseudonymised data might not count as personal data for a third party.AI and Legitimate Interests: The retention of "legitimate interests" as a lawful basis for AI development, the removal of the unconditional right to object, and the strict new guardrails for incidentally processing special category data.Cookie Rules and Consent Fatigue: Why device-access rules are staying in the ePrivacy Directive, the death of the mandatory machine-readable preference scheme, and the reduction of the consent "cooling-off" period from six to four months.Breach Reporting Thresholds: A rare point of consensus! We look at the proposed extension of the notification deadline from 72 to 96 hours and the crucial shift requiring controllers to notify regulators only when a breach presents a "high risk."Data Subject Access Requests (DSARs): The introduction of the “abusive intention” standard, giving controllers firmer statutory grounds to charge proportionate fees or refuse excessive requests.Please note: The GDPR has not changed just yet! This text represents the Council's negotiating position. The European Parliament must agree on its own position before trilogue negotiations over the final text can begin.Host: Robert Bateman, Senior Partner at Privacy Partnership.

Send us Fan MailIn this episode of the Privacy Partnership Podcast, Robert Bateman unpacks the massive gap between a UK regulator having legal authority and actually forcing an overseas company to comply.Sparked by Ofcom’s admission that it won't be able to recover every fine issued under the Online Safety Act—and 4chan's subsequent declaration of victory—we explore the harsh realities of cross-border enforcement. What happens when a British regulator fines an American company with no UK assets? And more importantly, what does this mean for the enforcement of the UK GDPR?In this episode, we cover:The Ofcom vs. 4chan Standoff: Why Ofcom demanded risk assessments and issued a £540,000 fixed penalty to 4chan, and why 4chan argued that the First Amendment protects them from UK law.The US Federal Court Ruling: A look at the recent Washington, DC lawsuit dismissal based on "foreign sovereign immunity" and the glaring loophole it left for collecting "foreign penal judgments."Implications for the UK GDPR: How Article 3(2) applies to overseas processing, and the practical difficulties the ICO faces when trying to collect fines from companies with no UK footprint.Regulatory Toolkits: A comparison of Ofcom's ability to seek UK access restrictions versus the ICO's powers (erasure, processing restrictions, and transfer suspensions).Real-World Precedents: We examine Imgur geoblocking the UK during an ICO children's privacy investigation, and the ongoing, multi-year legal battle over the ICO's £7.5m fine against Clearview AI.The Three Core Questions: Why winning on jurisdiction doesn't automatically mean a regulator can change a company's behaviour or secure a remedy for past breaches.

Send us Fan MailSo you just bought a pair of Meta Ray-Bans, and you're ready to start publicly streaming your morning coffee run. Not so fast. According to a new statement published on October 13th by the European Data Protection Board (EDPB), stepping outside the household exemption with wearable tech puts you on the hook for the full range of applicable GDPR obligations.In this episode of the Privacy Partnership Podcast, Robert Bateman explores the somewhat absurd reality of applying enterprise-grade data protection laws to a pair of consumer sunglasses. We break down the EDPB's guidance and look at three highly impractical ways smart glasses wearers can try to stay on the right side of the law without turning into a walking compliance department.Key Topics Covered in This Episode:The Household Exemption: Why merely stepping outside your front door doesn't automatically void your exemption, but streaming to a public audience or using your glasses commercially definitely does. (And why wearing them in your living room with the curtains drawn is your safest bet).Consent on the High Street: The comical practicality of pausing your recording to brief passing strangers, collecting their affirmative opt-ins, and being ready to halt recording the second they withdraw it.Legitimate Interests & Pavement Objections: How to handle bystanders who object to being recorded, requiring you to halt processing right there on the pavement while you balance your interest in recording your pastry against their fundamental rights."In-the-Moment" Transparency: Why a standard website privacy notice or a QR code on your shirt isn't enough, and why you might need prominent badges, audible announcements, and business cards instead.Retention & Data Subject Rights: The headache of managing storage across your device, phone, and cloud accounts, plus how to handle access requests that could leave you digging through footage and blurring out other strangers.The Provider Gap: The EDPB notes that tech giants acting as controllers can't just push their compliance obligations onto the user, but they stop short of explaining exactly how a hardware provider and a consumer are supposed to practically allocate these responsibilities.Resources Mentioned:EDPB Statement on the Data Protection Challenges of Smart Glasses (Adopted 13 October 2026)Get in Touch:If your organisation—or your wardrobe—needs help navigating the practicalities of wearable tech and data protection, we can help. Reach out to the Privacy Partnership team to discuss how to keep your cutting-edge tech compliant.Don't forget to subscribe to the Privacy Partnership Podcast on your favorite platform so you never miss an episode!

Send us Fan MailJust yesterday, the ICO announced a £200,000 settlement with DSG Retail, finally bringing an end to nearly seven years of legal wrangling over a massive 2017 cyberattack that compromised more than 5.6 million payment cards.But beyond the shrinking fine, this case resolved a fascinating legal debate about the "relativity" of personal data: If a hacker steals your customers' information but lacks the means to actually identify who it belongs to, does your statutory duty to protect that data still apply?In this episode, Robert Bateman breaks down the procedural marathon of DSG Retail v ICO, the critical software patch that was left half-finished, and why the UK Court of Appeal drew directly on the CJEU's landmark EDPS v SRB judgment to determine the scope of a controller's security duties.In this episode, we cover:The Timeline of a Breach: How the 2017-2018 attack on Currys PC World and Dixons Travel led to a maximum £500,000 penalty under the DPA 1998, and its eventual reduction to £200,000.The Unfinished Patch: Why outsourcing your IT security doesn't outsource your liability, and the devastating consequences of failing to complete step two of a critical 2014 Microsoft software patch.The "Relativity" of Personal Data: DSG's argument that the stolen card numbers weren't personal data to the hackers—and why the Upper Tribunal initially agreed.The Court of Appeal's Reversal: Lord Justice Warby’s reasoning on why a controller cannot escape its security duties just because an attacker can't identify the victims. (Hackers don't need to know who you are to maliciously encrypt or delete your records!)The EDPS v SRB Connection: How the CJEU's ruling on the Single Resolution Board and pseudonymised data directly shaped the UK Court of Appeal's approach to controller obligations.Practical Takeaways: Why privacy professionals must remember that security extends beyond confidentiality. Pseudonymisation and encryption are great, but neither stops an attacker from deleting your data.

Send us Fan MailSeven years after former Information Commissioner Elizabeth Denham told MPs that a probe into TikTok would conclude "in the fall," the enforcement saga has finally come to an end.This week on the Privacy Partnership Podcast, Robert Bateman breaks down the history of the ICO's £12.7 million penalty against the social media giant following the company's unexpected decision to withdraw two appeals.We explore the original investigation into underage users, TikTok's highly creative "artistic purposes" legal defence, and why the sudden withdrawal of a second appeal means one historic chapter is closed while a brand new regulatory investigation gets unblocked.In this episode, Robert discusses:The timeline of the investigation: A look back at the historic window (May 2018–July 2020) during which up to 1.4 million UK under-13s were bypassing TikTok’s age gates, and the internal documents that caught the ICO's attention.From £27m to £12.7m: Why the ICO ultimately deprioritised its Article 9 (special category data) investigation, bringing the final penalty down from the original notice of intent.Consent vs. Contractual Necessity: A deep dive into the application of Article 8 (children's consent) and why the ICO rejected TikTok's argument that its core service relied on contractual necessity for under-13s.The "Artistic Purposes" Defence: A breakdown of TikTok's inventive attempt to use the DPA 2018's "special purposes" protections to stall the penalty, featuring expert testimony from an Oxford professor of the philosophy of art.The Upper Tribunal's Ruling: How the courts drew a firm line between a platform distributing artistic content and an algorithm processing personal data for an artistic purpose.What’s Next for TikTok: We explain the significance of TikTok dropping its second appeal against an information notice, and how this unblocks a separate, ongoing ICO investigation into how the platform's recommender systems use the data of 13- to 17-year-olds.

Send us Fan MailHow does a data protection regulator decide whether to hand down a multi-million euro fine or issue a simple reprimand? In this episode, Robert Bateman breaks down the European Data Protection Board’s (EDPB) newly published draft Guidelines 04/2026. Adopted for public consultation on 17 September 2026, these guidelines replace the 2017 Article 29 Working Party guidance and aim to heavily harmonise the enforcement playbook across Europe.We explore how the EDPB has baked recent CJEU case law directly into a new, five-step methodology that regulators will use to determine the appropriate corrective measure for GDPR infringements. Whether you are a controller, processor, or DPO, this episode is essential listening for understanding your organisation's true liability surface.Key Topics Covered:The New 5-Step Methodology: A comprehensive walkthrough of the EDPB’s structured test for imposing administrative fines.Closing the Article 24 Loophole (Step 1): Why certain obligations missing from Article 83 won't give you a free pass, and how regulators use the Article 5(2) accountability principle.Direct Corporate Liability (Step 2): Why management doesn't need to know about a violation for the company to be liable, and why blaming a "rogue employee" might still leave you on the hook under Article 32.The "Unwritten" Rule of Culpability (Step 3): How recent CJEU judgments have established intent or negligence as a prerequisite for fines, why the bar for "negligence" is remarkably low, and why blindly trusting external legal advice won't save you.Defining a "Minor" Infringement (Step 4): Understanding when an infringement warrants a reprimand instead of a fine, the danger of "repeated" minor infringements, and why having no previous infringements is not a mitigating factor.The Threat of Enforcement (Step 5): The balancing act of effectiveness, proportionality, and dissuasiveness, and why a penalty must present a credible prospect of actually being imposed.Cases and Resources Mentioned:EDPB Draft Guidelines 04/2026 on the application of the power to impose administrative fines (Adopted for public consultation, 17 September 2026)EDPB Guidelines 04/2022 on the calculation of administrative finesCJEU Case: Deutsche Wohnen (C‑807/21)CJEU Case: Nacionalinis visuomenės sveikatos centras (C‑683/21)

Send us Fan MailIn this episode of the Privacy Partnership Podcast, Robert Bateman looks at the mounting regulatory scrutiny and public backlash across Europe regarding Meta’s Ray-Ban smart glasses. Is data protection law actually equipped to handle a world where consumers wear data-scraping AI devices on their faces?From striking guerrilla protest ads on the London Underground to a 55-page technical and legal teardown by the Hamburg Data Protection Authority, Robert breaks down the current legal landscape. He explores Hamburg's argument that ordinary users could be considered "joint controllers" with Meta, the practical nightmare of Article 26 compliance, and why Norway's data protection leadership is questioning if the GDPR is fit for purpose when it comes to consumer AI hardware.Key Takeaways:Introduction: Public backlash and guerrilla ads on the London transport network.The Hamburg DPA Report: A look at the 55-page teardown of the Gen 1 Wayfarers published on 10 September 2026.The Household Exemption: When does private use cross the line into commercial processing?The Joint Controller Problem: Why capturing and transmitting third-party data to train Meta's AI could theoretically make you a joint controller—and the glaring absence of an Article 26 arrangement.Transparency and Notice: Why a tiny LED light isn't a privacy notice. Could commercial wearers really be expected to wear high-vis warning vests?The European Landscape: How Luxembourg's CNPD and Sweden's IMY are attempting to map existing CCTV and filming rules onto new behaviours.A Call for New Rules? Norway’s Datatilsynet leadership questions the feasibility of policing thousands of private individuals and suggests we look at product requirements and sale restrictions instead.

Send us Fan MailIn this episode of the Privacy Partnership Podcast, Robert Bateman unpacks Grindr's recent agreement to pay £26 million to settle a major UK data privacy lawsuit. The UK is currently viewed as a highly conservative, even hostile, environment for mass privacy claims. So how did a payout of this magnitude happen?Robert breaks down the historical data sharing allegations, the regulatory backdrop, and the critical procedural differences that set this actively managed group litigation apart from recent representative action failures.Key Topics DiscussedThe £26 Million Settlement: An overview of Grindr’s agreement to settle UK High Court proceedings brought by approximately 12,000 users. The claims concerned pre-2020 data practices (under former owner Kunlun) and included allegations of the unauthorised sharing of highly sensitive information, such as HIV status and testing dates.Grindr's Position: Grindr disputes the allegations, and the settlement includes no findings or admission of liability. The company says it has overhauled its privacy programme since 2020 and agreed to pay the £26 million in two installments by March 2027.The Regulatory Backdrop: A look back at how regulators have previously handled Grindr’s adtech practices, including a 2022 reprimand from the UK’s ICO and a 65 million NOK fine from Norway’s Datatilsynet (upheld on appeal in October 2025).The UK Litigation Landscape: Why the UK is currently a tough jurisdiction for mass privacy claims. Robert explores how the landmark Lloyd v Google Supreme Court decision blocked uniform damages for "loss of control" under the Data Protection Act 1998 without proving individual damage or distress.Why This Case is Different: Why didn't this claim fail like the representative action involving sensitive medical records in Prismall v Google? We discuss how claimant firm Austen Hays gathered 12,000 signed-up individuals to bring specific allegations of distress, and why the immense cost and complexity of defending a bifurcated trial likely drove a pragmatic settlement.Cases & Regulatory Actions MentionedGrindr High Court Settlement (Sept 2026): £26 million settlement for UK users represented by Austen Hays.Lloyd v Google (2021): Supreme Court ruling effectively blocking opt-out representative actions for uniform data protection damages under the DPA 1998.Farley v Paymaster (Aug 2025): Court of Appeal ruling establishing that claims for compensation based on a fear of third-party misuse must be "well-founded" and assessed case-by-case. (The Supreme Court appeal is listed for 7-8 October 2026).Prismall v Google: High Court case demonstrating that representative actions involving even highly sensitive data (medical records) will fail if they attempt to bypass individual assessments.Datatilsynet vs. Grindr (2021/2025): 65 million NOK fine for unlawful behavioural advertising disclosures, upheld by the Borgarting Court of Appeal.ICO Reprimand (July 2022): UK regulator's finding against Grindr regarding transparent privacy information.Get in TouchIf your organisation needs support navigating adtech compliance, data protection litigation, or evaluating its financial exposure, reach out to us at Privacy Partnership.