The Privacy Partnership Podcast with Robert Bateman

What happens when a Silicon Valley cybersecurity founder takes the reins at one of the world's most powerful privacy regulators? In this special edition of the Privacy Partnership Podcast, Robert Bateman is joined by Tom Kemp, Executive Director of CalPrivacy (the California Privacy Protection Agency). They dive deep into California’s aggressive new enforcement strategies and the technical to...

Did the US Supreme Court just sign the death warrant for the EU-US Data Privacy Framework (DPF)? In this explosive episode of the Privacy Partnership Podcast, Robert Bateman breaks down yesterday's monumental 6-3 SCOTUS decision in Trump v. Slaughter , which fundamentally rewrites the rules of the American administrative state. By confirming the President's authority to fire FTC Commissi...

The Irish High Court has just delivered a massive judgment in TikTok’s appeal against the Data Protection Commission (DPC). The court upheld a staggering €530 million fine—but surprisingly tore up the regulator’s order to suspend TikTok's data transfers to China. Who actually won this case, and what does it mean for the future of international data flows? In this episode of the Privacy Partne...

John Edwards has abruptly resigned as the UK Information Commissioner via a LinkedIn post, leaving behind a rather complicated legacy. In this episode, Robert Bateman looks back at Edwards’ four-and-a-half-year tenure. We unpack an era defined by massive platform fines, jurisdictional ping-pong, a highly convenient alignment with Home Office surveillance goals, and a surprisingly lenient approach...

f you’re going to encrypt European personal data before transferring it to a high-risk jurisdiction, the golden rule is simple: don't leave the encryption keys on the exact same server. In this episode, Robert Bateman unpacks a staggering €100 million fine handed down by the Dutch Data Protection Authority (AP) against MLU B.V., the legal successor to the operator of the Yango ride-hailing ap...

Can an employer use AI to read its employees' Slack and Teams messages to diagnose their stress levels? Under the EU AI Act, that sounds like a clear violation of the ban on workplace emotion recognition. Yet, one AI company, Myndoor, just survived a regulatory investigation by the Italian Data Protection Authority (the Garante) for doing exactly that. In this episode, Robert dives into this...

The internet’s worst-kept secret is that basic digital advertising operations involve breaking privacy laws millions of times a day. But instead of dropping the enforcement hammer, the ICO is proposing a novel solution: just make it legal. In this episode, Robert Bateman unpacks the ICO's surprising new advice to the UK government (DSIT) on creating fresh exceptions to Regulation 6 of PECR. R...

The European Commission just dropped its highly anticipated first set of draft guidelines on high-risk AI classification under the AI Act—all 150 pages of them. Published for stakeholder consultation on May 19th, 2026, this document is the closest thing we have to a compliance manual for navigating Article 6 and Annex III of the Act.  In this episode of the Privacy Partnership Podcast, Robert Bate...

How do you knock 40% off a looming data protection fine? In this episode of the Privacy Partnership Podcast, Rob Bateman breaks down the recent £963,900 penalty handed down by the ICO to South Staffordshire Plc and explores the fascinating procedural mechanics that kept the final invoice under the one million pound mark. In this episode, we cover: How a single malicious attachment led to the exfil...

The Court of Appeal has ruled that consent under the UK GDPR and PECR is objective. A data subject's hidden vulnerabilities are not, in themselves, decisive, and even a controller's constructive knowledge of those vulnerabilities is not a stand-alone qualifier. In this episode, Robert Bateman breaks down the judgment in RTM v Bonne Terre [2026] EWCA Civ 488, handed down on 21 April 2026....

On 15 April 2026, the European Data Protection Board adopted Guidelines 1/2026 on the processing of personal data for scientific research purposes. The 66-page document is now out for public consultation. In this episode, Robert Bateman breaks down what the guidelines mean for pharma companies, AI developers, universities, and anyone relying on the GDPR's scientific research provisions. The G...

In this episode, Rob looks at the newly published European Data Protection Board (EDPB) annual report for 2025. We are skipping the usual backward-looking statistics to focus entirely on the regulator's pipeline for 2026 and the massive multi-front litigation war currently playing out in the European courts. From new harmonised templates to high-stakes legal battles with Big Tech and fellow r...

Are your hiring managers quietly letting an algorithm bin hundreds of job applications while claiming a human is technically in charge? This week on the Privacy Partnership Podcast, Rob unpacks a massive structural shift in the UK’s framework for Automated Decision-Making (ADM). We dive into two major new releases from the ICO: the highly revealing Recruitment Rewired report and the newly updated...

Are you seeing a rise in "copy-paste" Data Subject Access Requests (DSARs) designed primarily to extract a quick financial settlement? In this episode of the Privacy Partnership Podcast, Robert Bateman unpacks a highly practical new judgment from the Court of Justice of the European Union (CJEU) that offers controllers a potential shield against abusive access requests. Looking at the fa...

A €746 million GDPR fine gets completely annulled by a Luxembourg court. A massive, unmitigated victory for big tech, right? Not exactly. In this episode of the Privacy Partnership Podcast, Robert Bateman dissects the highly anticipated March 12, 2026 judgment from the Luxembourg Administrative Court concerning an anonymised e-commerce giant ("Company AA", clearly Amazon) and a record-br...

Can you hide an indestructible, imperceptible signature inside a basic marketing blog post? The European Commission seems to think you should try. Following the release of the Second Draft of the Code of Practice on Transparency of AI-Generated Content this Tuesday, Robert Bateman dives into the technical and regulatory headaches awaiting providers of generative AI text systems. We look at the Com...

Are you a data broker? You might not think so, but European regulators could soon be looking at your business model and concluding otherwise. In this episode of the Privacy Partnership Podcast, Robert Bateman breaks down a revealing market study commissioned by the Belgian Data Protection Authority through the EDPB’s Support Pool of Experts. Designed to identify and map the data broker ecosystem,...

The ICO has issued a £14.47 million fine against Reddit for alleged children's privacy failures, officially signaling the end of the road for the age verification "honour system." But with the full penalty notice yet to be published, what can privacy professionals actually glean from the regulator's press release? In this episode of the Privacy Partnership Podcast, Robert Batem...

Rob presents a few highlights from the EDPB's latest Coordinated Enforcement Framework report on the "right to erasure". - Poor storage limitation and retention schedule practices are leading to issues satisfying erasure requests. - Too many people still conflating anonymisation and pseudonymisation, and thus incorrectly relying on the latter as an erasure method. - Controllers are...

In this episode of the Privacy and Partnership podcast, Rob discusses a significant ruling from the CJEU regarding WhatsApp's legal challenge against the European Data Protection Board (EDPB).  The CJEU's decision allows companies to directly challenge binding decisions made by the EDPB. Rob explores the implications of this ruling, particularly how it affects the relationship between te...

Rob discusses the recent letter from the Information Commissioner's Office (ICO) to UK government officials, highlighting the ICO's focus on economic growth and innovation.  The ICO plans a statutory code of practice for AI and an "experimentation regime" for data protection. There will also be a review of low-risk online advertising activities, and new support for SMEs.

On Data Protection Day 2026, Rob talks us briefly through the history of data protection in the UK: From the "data users" of the Data Protection Act 1984 to the "recognised legitimate interests" of last year's Data (Use and Access) Act.

Along with plans to "simplify" the GDPR, there's an AI Digital Omnibus that proposes amendments to the AI Act. In a new Joint Opinion, the EDPB and EDPS say they support the objective to simplify the law, but they don't seem to like any of the Commission's ideas. For example, they don't like the Commission's proposal to allow bias detection processing for all AI...

Rob looks at the ICO’s newly released guidance on international transfers and what it means for UK privacy professionals. • The “Three-Step Test” for identifying restricted transfers • Why UK processors returning data to overseas controllers are no longer “initiating” transfers • Clarifications on transfers between branches and employees within the same legal entity • How the guidance incorporates...

The ICO and the UK Government have come to an understanding: "No surprises", "supportive challenge", and a seat at the table for the Commissioner. A Memorandum of Understanding signed today between the ICO and the UK Government formalises an already pretty cosy relationship between the regulator and its largest stakeholder.  While the MoU explicitly preserves the ICO's ind...