The Privacy Partnership Podcast with Robert Bateman

The ICO has yet MORE draft guidance, this time on the UK's upcoming changes to the law on cookies (etc). At the same time, it's running a "call for views" about whether it should enforce that law in certain contexts.

The updated cookies guidance includes a new chapter on the consent exceptions provided by the Data Use and Access Act (DUAA).

We also get new material reflecting the ICO's view that a &...

An individual has been criminally prosecuted for "ignoring" or having "blocked, erased, or concealed" a subject access request. A rare (perhaps unprecedented) case, but Rob wonders if this behaviour is more common than we might think.

This care home director was prosecuted under Section 173 of the Data Protection Act 2018, which makes it a criminal offence to "alter, deface, block, erase, destroy or con...

All over EU and UK law, we see a requirement to report certain stuff "without undue delay", often coupled with a hard deadline period (e.g., within 72 hours). A CJEU case from last month explored what these dual obligations mean in practice.

IL v Veracash (Case C‑665/23, 1 August 2025) concerned the old Payment Services Directive (PSD). 

The PSD requires cardholders (consumers) to notify payment services provider ...

More draft ICO guidance! This time, about one of the Data (Use and Access) Act's most important concepts: "Recognised legitimate interests". 

The "recognised legitimate interests" are data processing activities that, frankly, the government would like you to do more of.

Unlike regular old legitimate interests, you won't need to conduct a "balancing test" before processing personal data for thes...

In advance of new obligations under the Data (Use and Access) Act, the ICO has published some draft guidance on handling data subject complaints. This episode breaks down some of the ICO's expectations in this area.

As always, the ICO sets out three tiers: 

• "Must": Legal duties, for example, under UK GDPR or DPA 2018. 

• "Should": Good practice stuff that you should do unless there's a good re...

Some parts of the Data (Use and Access) Act (DUAA) take effect today! This is our first chance to see how the Act is actually going to operate in practice. In this video, I'll talk you through the relevant provisions.

Many of these provisions are quite technical. So to make sense of them, Rob breaks them down into three categories: 

• New powers for government and regulators 

• Institutional reforms

• Amendments to existing data p...

The Online Safety Act is why you might have been asked for your driver's licence on Reddit, X, and some... other websites. In this video, I explain how the OSA works and how it raises tensions with the UK GDPR.

The OSA applies to "user-to-user" and search services with "links to the UK". This covers websites from social media giants to tiny online message boards.

Through a series of risk a...

Are you using an in-house tool powered by an AI model from OpenAI, Google, or Meta to produce marketing copy? You might soon be responsible for watermarking your AI-generated content.

In this episode of the Privacy Partnership Podcast, Rob explores a common scenario, where a company fine-tunes a general-purpose AI model and builds a simple internal tool for staff to generate copy in its own brand voice. 

While the company might think...

Last week, the ICO fined Scottish charity Birthlink £18,000 for destroying around 4,800 adoption records. In this video, Rob explains why this is such an interesting case.

Birthlink is an Edinburgh-based charity that maintains the Adoption Contact Register for Scotland. It provides specialised support for people involved in adoptions.

At the heart of this case are the "linked records": Manual paper files created when a succ...

I spoke to Boris Wojtan, Senior Privacy Counsel at Privacy Partnership Law, about "Access to Customer and Business Data" under Part 1 of the UK's Data (Use and Access) Act.

This has been on my "get to grips with this" list for absolutely ages.

Like me, you're probably familiar with the DUAA's amendments to the UK GDPR, the DPA 2018, and PECR.

But that's just one part of the legislation, and the ...