The Privacy Partnership Podcast with Robert Bateman

Episod

• 
  New EDPB guidance: When to issue a GDPR fine 23.09.2026 5min

  How does a data protection regulator decide whether to hand down a multi-million euro fine or issue a simple reprimand? In this episode, Robert Bateman breaks down the European Data Protection Board’s (EDPB) newly published draft Guidelines 04/2026. Adopted for public consultation on 17 September 2026, these guidelines replace the 2017 Article 29 Working Party guidance and aim to heavily harmonise the enforcement playbook across Europe. We explore how the EDPB has baked recent CJEU case law d...
• 
  Are Meta Ray-Bans legal under the GDPR? A roundup of regulatory positions 15.09.2026 5min

  In this episode of the Privacy Partnership Podcast, Robert Bateman looks at the mounting regulatory scrutiny and public backlash across Europe regarding Meta’s Ray-Ban smart glasses. Is data protection law actually equipped to handle a world where consumers wear data-scraping AI devices on their faces? From striking guerrilla protest ads on the London Underground to a 55-page technical and legal teardown by the Hamburg Data Protection Authority, Robert breaks down the current legal landscape....
• 
  Grindr settles for £26 million... But wait, what about Lloyd v Google? 08.09.2026 5min

  In this episode of the Privacy Partnership Podcast, Robert Bateman unpacks Grindr's recent agreement to pay £26 million to settle a major UK data privacy lawsuit. The UK is currently viewed as a highly conservative, even hostile, environment for mass privacy claims. So how did a payout of this magnitude happen? Robert breaks down the historical data sharing allegations, the regulatory backdrop, and the critical procedural differences that set this actively managed group litigation apart from ...
• 
  Summer Special: Privacy action you might have missed 02.09.2026 7min

  n this late-summer roundup episode of the Privacy Partnership Podcast, host Robert Bateman unpacks a massive €825 million GDPR fine, the immediate impact of the EU AI Act taking effect, and a wave of enforcement actions across the UK, Europe, and the United States. In this episode, we cover: Mind the Gap (UK ICO Enforcement): Why the disconnect between an organisation's written privacy policies and its actual practices is a major regulatory red flag. Robert discusses recent reprimands for the...
• 
  France fails to ban kids from social media: Age assurance remains privacy's "hard problem" 19.08.2026 7min

  France’s Constitutional Council has struck down the central provision of a new law that would have banned under-15s from accessing social media. In this episode, Robert Bateman looks at why the Council found the measure disproportionate, focusing on two fundamental rights: freedom of expression and the right to private life. The decision also highlights a longstanding problem with age assurance: to identify children online, platforms may need to establish the age of everyone else too. Topics ...
• 
  Is TikTok a patron of the arts? How an appeal under the "special purposes" exemption failed 06.08.2026 4min

  In this episode of the Privacy Partnership Podcast, Robert Bateman dives into a fascinating and highly creative legal defense recently mounted by TikTok. Facing a £12.7 million fine from the UK Information Commissioner's Office (ICO) for processing the data of underage children, TikTok attempted to use a jurisdictional trump card: the "special purposes" exemption under Section 156 of the Data Protection Act 2018. Did TikTok’s recommender algorithm process user data for "artistic purposes"? Sh...
• 
  Web scraping under the GDPR: The EDPB's uncharacteristically pragmatic solution 29.07.2026 7min

  Can you scrape the internet for AI training data without completely running afoul of the GDPR? The European Data Protection Board (EDPB) has finally offered an answer: Yes, but get ready to implement a massive amount of filtering. In this episode of the Privacy Partnership Podcast, Robert Bateman breaks down the EDPB’s newly adopted Draft Guidelines 03/2026 on web scraping for generative AI. Robert begins by exploring the political context behind this unexpectedly pragmatic guidance, discussi...
• 
  The EDPB's new anonymisation framework: 5 things you need to know 21.07.2026 4min

  This week, Robert Bateman breaks down the newly adopted EDPB Guidelines 02/2026 on Anonymisation. Dragging the ancient 2014 Working Party 29 framework into the age of generative AI and EU data spaces, these new rules are dense, highly technical, and will undoubtedly complicate your compliance programmes. Robert explores the new concept of "relative anonymity," explains the rebranded technical criteria, and discusses why making your data anonymous might actually trigger a 72-hour data breach n...
• 
  Rob rambles about Trump v Slaughter from a European perspective 15.07.2026 19min

  A longer edition of the podcast because Rob gets unreasonably animated about EU-US data transfers. On 29 June 2026 the US Supreme Court ruled that the Federal Trade Commission's protection from presidential removal is unconstitutional, overruling ninety years of precedent on independent agencies. The ruling says nothing about data protection, but the EU-US Data Privacy Framework is built on the premise that the FTC is an independent supervisory authority, and campaigners are already dem...
• 
  CalPrivacy Director Tom Kemp on how businesses should approach California's robust privacy regulation 09.07.2026 28min

  What happens when a Silicon Valley cybersecurity founder takes the reins at one of the world's most powerful privacy regulators? In this special edition of the Privacy Partnership Podcast, Robert Bateman is joined by Tom Kemp, Executive Director of CalPrivacy (the California Privacy Protection Agency). They dive deep into California’s aggressive new enforcement strategies and the technical tools the state is building to make privacy rights frictionless for the average consumer. From massive p...
• 
  The death of the EU-US DPF? Trump v Slaughter and the future of transatlantic data flows 30.06.2026 5min

  Did the US Supreme Court just sign the death warrant for the EU-US Data Privacy Framework (DPF)? In this explosive episode of the Privacy Partnership Podcast, Robert Bateman breaks down yesterday's monumental 6-3 SCOTUS decision in Trump v. Slaughter, which fundamentally rewrites the rules of the American administrative state. By confirming the President's authority to fire FTC Commissioners at will, the Court has stripped the FTC of its structural independence—a core pillar of the European C...
• 
  Data transfers at the Irish courts: A partial win for TikTok 25.06.2026 5min

  The Irish High Court has just delivered a massive judgment in TikTok’s appeal against the Data Protection Commission (DPC). The court upheld a staggering €530 million fine—but surprisingly tore up the regulator’s order to suspend TikTok's data transfers to China. Who actually won this case, and what does it mean for the future of international data flows? In this episode of the Privacy Partnership Podcast, Robert Bateman unpacks Mr Justice Rory Mulcahy’s highly technical ruling. We dive into ...
• 
  John Edwards resigns! A look back at his time at the ICO 19.06.2026 5min

  John Edwards has abruptly resigned as the UK Information Commissioner via a LinkedIn post, leaving behind a rather complicated legacy. In this episode, Robert Bateman looks back at Edwards’ four-and-a-half-year tenure. We unpack an era defined by massive platform fines, jurisdictional ping-pong, a highly convenient alignment with Home Office surveillance goals, and a surprisingly lenient approach to public sector data blunders. Was the Edwards-era ICO truly "innovation-friendly," or just inco...
• 
  Data transfers: How encryption and SCCs failed to save Yango Taxi from a €100 million fine 11.06.2026 5min

  f you’re going to encrypt European personal data before transferring it to a high-risk jurisdiction, the golden rule is simple: don't leave the encryption keys on the exact same server. In this episode, Robert Bateman unpacks a staggering €100 million fine handed down by the Dutch Data Protection Authority (AP) against MLU B.V., the legal successor to the operator of the Yango ride-hailing app. Despite taking a "risk-based approach" and relying on Standard Contractual Clauses (SCCs) and encry...
• 
  AI Act loophole? How one company navigated the ban on workplace emotion recognition 02.06.2026 5min

  Can an employer use AI to read its employees' Slack and Teams messages to diagnose their stress levels? Under the EU AI Act, that sounds like a clear violation of the ban on workplace emotion recognition. Yet, one AI company, Myndoor, just survived a regulatory investigation by the Italian Data Protection Authority (the Garante) for doing exactly that. In this episode, Robert dives into this fascinating ruling to explore how Myndoor legally bypassed the AI Act's Article 5 prohibitions through...
• 
  Regulating the reality of adtech: The ICO’s recommended PECR reforms 27.05.2026 5min

  The internet’s worst-kept secret is that basic digital advertising operations involve breaking privacy laws millions of times a day. But instead of dropping the enforcement hammer, the ICO is proposing a novel solution: just make it legal. In this episode, Robert Bateman unpacks the ICO's surprising new advice to the UK government (DSIT) on creating fresh exceptions to Regulation 6 of PECR. Robert discusses the strange optics of a privacy watchdog advising on deregulation, breaks down the sev...
• 
  Decoding the AI Act: A first look at the Commission’s "high-risk" draft guidelines 20.05.2026 6min

  The European Commission just dropped its highly anticipated first set of draft guidelines on high-risk AI classification under the AI Act—all 150 pages of them. Published for stakeholder consultation on May 19th, 2026, this document is the closest thing we have to a compliance manual for navigating Article 6 and Annex III of the Act. In this episode of the Privacy Partnership Podcast, Robert Bateman digs into the details to explain what the Commission considers "high-risk," how the ex...
• 
  Get 40% off an ICO fine! The South Staffordshire case and early settlements 15.05.2026 5min

  How do you knock 40% off a looming data protection fine? In this episode of the Privacy Partnership Podcast, Rob Bateman breaks down the recent £963,900 penalty handed down by the ICO to South Staffordshire Plc and explores the fascinating procedural mechanics that kept the final invoice under the one million pound mark. In this episode, we cover: How a single malicious attachment led to the exfiltration of 4 terabytes of sensitive data, including HR records and vulnerable customer info. ...
• 
  RTM v Bonne Terre: Court of Appeal redraws the line on consent 30.04.2026 6min

  The Court of Appeal has ruled that consent under the UK GDPR and PECR is objective. A data subject's hidden vulnerabilities are not, in themselves, decisive, and even a controller's constructive knowledge of those vulnerabilities is not a stand-alone qualifier. In this episode, Robert Bateman breaks down the judgment in RTM v Bonne Terre [2026] EWCA Civ 488, handed down on 21 April 2026. In this episode: The background to RTM's claim against Sky Betting and GamingMrs Justice Collins Rice's th...
• 
  What actually counts as 'scientific research'? Here's the EDPB's six-point answer 21.04.2026 5min

  On 15 April 2026, the European Data Protection Board adopted Guidelines 1/2026 on the processing of personal data for scientific research purposes. The 66-page document is now out for public consultation. In this episode, Robert Bateman breaks down what the guidelines mean for pharma companies, AI developers, universities, and anyone relying on the GDPR's scientific research provisions. The GDPR gives scientific research significant special treatment — a presumption of compatibility for furth...