Advertise on podcast: The Privacy Partnership Podcast with Robert Bateman

So you just bought a pair of Meta Ray-Bans, and you're ready to start publicly streaming your morning coffee run. Not so fast. According to a new statement published on October 13th by the European Data Protection Board (EDPB), stepping outside the household exemption with wearable tech puts you on the hook for the full range of applicable GDPR obligations. In this episode of the Privacy Partnership Podcast, Robert Bateman explores the somewhat absurd reality of applying enterprise-grade data protection laws to a pair of consumer sunglasses. We break down the EDPB's guidance and look at three highly impractical ways smart glasses wearers can try to stay on the right side of the law without turning into a walking compliance department. Key Topics Covered in This Episode: The Household Exemption: Why merely stepping outside your front door doesn't automatically void your exemption, but streaming to a public audience or using your glasses commercially definitely does. (And why wearing them in your living room with the curtains drawn is your safest bet). Consent on the High Street: The comical practicality of pausing your recording to brief passing strangers, collecting their affirmative opt-ins, and being ready to halt recording the second they withdraw it. Legitimate Interests & Pavement Objections: How to handle bystanders who object to being recorded, requiring you to halt processing right there on the pavement while you balance your interest in recording your pastry against their fundamental rights. "In-the-Moment" Transparency: Why a standard website privacy notice or a QR code on your shirt isn't enough, and why you might need prominent badges, audible announcements, and business cards instead. Retention & Data Subject Rights: The headache of managing storage across your device, phone, and cloud accounts, plus how to handle access requests that could leave you digging through footage and blurring out other strangers. The Provider Gap: The EDPB notes that tech giants acting as controllers can't just push their compliance obligations onto the user, but they stop short of explaining exactly how a hardware provider and a consumer are supposed to practically allocate these responsibilities. Resources Mentioned: EDPB Statement on the Data Protection Challenges of Smart Glasses (Adopted 13 October 2026) Get in Touch: If your organisation—or your wardrobe—needs help navigating the practicalities of wearable tech and data protection, we can help. Reach out to the Privacy Partnership team to discuss how to keep your cutting-edge tech compliant. Don't forget to subscribe to the Privacy Partnership Podcast on your favorite platform so you never miss an episode!

Just yesterday, the ICO announced a £200,000 settlement with DSG Retail, finally bringing an end to nearly seven years of legal wrangling over a massive 2017 cyberattack that compromised more than 5.6 million payment cards. But beyond the shrinking fine, this case resolved a fascinating legal debate about the "relativity" of personal data: If a hacker steals your customers' information but lacks the means to actually identify who it belongs to, does your statutory duty to protect that data still apply? In this episode, Robert Bateman breaks down the procedural marathon of DSG Retail v ICO, the critical software patch that was left half-finished, and why the UK Court of Appeal drew directly on the CJEU's landmark EDPS v SRB judgment to determine the scope of a controller's security duties. In this episode, we cover: The Timeline of a Breach: How the 2017-2018 attack on Currys PC World and Dixons Travel led to a maximum £500,000 penalty under the DPA 1998, and its eventual reduction to £200,000. The Unfinished Patch: Why outsourcing your IT security doesn't outsource your liability, and the devastating consequences of failing to complete step two of a critical 2014 Microsoft software patch. The "Relativity" of Personal Data: DSG's argument that the stolen card numbers weren't personal data to the hackers—and why the Upper Tribunal initially agreed. The Court of Appeal's Reversal: Lord Justice Warby’s reasoning on why a controller cannot escape its security duties just because an attacker can't identify the victims. (Hackers don't need to know who you are to maliciously encrypt or delete your records!) The EDPS v SRB Connection: How the CJEU's ruling on the Single Resolution Board and pseudonymised data directly shaped the UK Court of Appeal's approach to controller obligations. Practical Takeaways: Why privacy professionals must remember that security extends beyond confidentiality. Pseudonymisation and encryption are great, but neither stops an attacker from deleting your data.

Seven years after former Information Commissioner Elizabeth Denham told MPs that a probe into TikTok would conclude "in the fall," the enforcement saga has finally come to an end. This week on the Privacy Partnership Podcast, Robert Bateman breaks down the history of the ICO's £12.7 million penalty against the social media giant following the company's unexpected decision to withdraw two appeals. We explore the original investigation into underage users, TikTok's highly creative "artistic purposes" legal defence, and why the sudden withdrawal of a second appeal means one historic chapter is closed while a brand new regulatory investigation gets unblocked. In this episode, Robert discusses: The timeline of the investigation: A look back at the historic window (May 2018–July 2020) during which up to 1.4 million UK under-13s were bypassing TikTok’s age gates, and the internal documents that caught the ICO's attention. From £27m to £12.7m: Why the ICO ultimately deprioritised its Article 9 (special category data) investigation, bringing the final penalty down from the original notice of intent. Consent vs. Contractual Necessity: A deep dive into the application of Article 8 (children's consent) and why the ICO rejected TikTok's argument that its core service relied on contractual necessity for under-13s. The "Artistic Purposes" Defence: A breakdown of TikTok's inventive attempt to use the DPA 2018's "special purposes" protections to stall the penalty, featuring expert testimony from an Oxford professor of the philosophy of art. The Upper Tribunal's Ruling: How the courts drew a firm line between a platform distributing artistic content and an algorithm processing personal data for an artistic purpose. What’s Next for TikTok: We explain the significance of TikTok dropping its second appeal against an information notice, and how this unblocks a separate, ongoing ICO investigation into how the platform's recommender systems use the data of 13- to 17-year-olds.

How does a data protection regulator decide whether to hand down a multi-million euro fine or issue a simple reprimand? In this episode, Robert Bateman breaks down the European Data Protection Board’s (EDPB) newly published draft Guidelines 04/2026. Adopted for public consultation on 17 September 2026, these guidelines replace the 2017 Article 29 Working Party guidance and aim to heavily harmonise the enforcement playbook across Europe. We explore how the EDPB has baked recent CJEU case law directly into a new, five-step methodology that regulators will use to determine the appropriate corrective measure for GDPR infringements. Whether you are a controller, processor, or DPO, this episode is essential listening for understanding your organisation's true liability surface. Key Topics Covered: The New 5-Step Methodology: A comprehensive walkthrough of the EDPB’s structured test for imposing administrative fines. Closing the Article 24 Loophole (Step 1): Why certain obligations missing from Article 83 won't give you a free pass, and how regulators use the Article 5(2) accountability principle. Direct Corporate Liability (Step 2): Why management doesn't need to know about a violation for the company to be liable, and why blaming a "rogue employee" might still leave you on the hook under Article 32. The "Unwritten" Rule of Culpability (Step 3): How recent CJEU judgments have established intent or negligence as a prerequisite for fines, why the bar for "negligence" is remarkably low, and why blindly trusting external legal advice won't save you. Defining a "Minor" Infringement (Step 4): Understanding when an infringement warrants a reprimand instead of a fine, the danger of "repeated" minor infringements, and why having no previous infringements is not a mitigating factor. The Threat of Enforcement (Step 5): The balancing act of effectiveness, proportionality, and dissuasiveness, and why a penalty must present a credible prospect of actually being imposed. Cases and Resources Mentioned: EDPB Draft Guidelines 04/2026 on the application of the power to impose administrative fines (Adopted for public consultation, 17 September 2026) EDPB Guidelines 04/2022 on the calculation of administrative fines CJEU Case: Deutsche Wohnen (C‑807/21) CJEU Case: Nacionalinis visuomenės sveikatos centras (C‑683/21)

In this episode of the Privacy Partnership Podcast, Robert Bateman looks at the mounting regulatory scrutiny and public backlash across Europe regarding Meta’s Ray-Ban smart glasses. Is data protection law actually equipped to handle a world where consumers wear data-scraping AI devices on their faces? From striking guerrilla protest ads on the London Underground to a 55-page technical and legal teardown by the Hamburg Data Protection Authority, Robert breaks down the current legal landscape. He explores Hamburg's argument that ordinary users could be considered "joint controllers" with Meta, the practical nightmare of Article 26 compliance, and why Norway's data protection leadership is questioning if the GDPR is fit for purpose when it comes to consumer AI hardware. Key Takeaways: Introduction: Public backlash and guerrilla ads on the London transport network. The Hamburg DPA Report: A look at the 55-page teardown of the Gen 1 Wayfarers published on 10 September 2026. The Household Exemption: When does private use cross the line into commercial processing? The Joint Controller Problem: Why capturing and transmitting third-party data to train Meta's AI could theoretically make you a joint controller—and the glaring absence of an Article 26 arrangement. Transparency and Notice: Why a tiny LED light isn't a privacy notice. Could commercial wearers really be expected to wear high-vis warning vests? The European Landscape: How Luxembourg's CNPD and Sweden's IMY are attempting to map existing CCTV and filming rules onto new behaviours. A Call for New Rules? Norway’s Datatilsynet leadership questions the feasibility of policing thousands of private individuals and suggests we look at product requirements and sale restrictions instead.

In this episode of the Privacy Partnership Podcast, Robert Bateman unpacks Grindr's recent agreement to pay £26 million to settle a major UK data privacy lawsuit. The UK is currently viewed as a highly conservative, even hostile, environment for mass privacy claims. So how did a payout of this magnitude happen? Robert breaks down the historical data sharing allegations, the regulatory backdrop, and the critical procedural differences that set this actively managed group litigation apart from recent representative action failures. Key Topics Discussed The £26 Million Settlement: An overview of Grindr’s agreement to settle UK High Court proceedings brought by approximately 12,000 users. The claims concerned pre-2020 data practices (under former owner Kunlun) and included allegations of the unauthorised sharing of highly sensitive information, such as HIV status and testing dates. Grindr's Position: Grindr disputes the allegations, and the settlement includes no findings or admission of liability. The company says it has overhauled its privacy programme since 2020 and agreed to pay the £26 million in two installments by March 2027. The Regulatory Backdrop: A look back at how regulators have previously handled Grindr’s adtech practices, including a 2022 reprimand from the UK’s ICO and a 65 million NOK fine from Norway’s Datatilsynet (upheld on appeal in October 2025). The UK Litigation Landscape: Why the UK is currently a tough jurisdiction for mass privacy claims. Robert explores how the landmark Lloyd v Google Supreme Court decision blocked uniform damages for "loss of control" under the Data Protection Act 1998 without proving individual damage or distress. Why This Case is Different: Why didn't this claim fail like the representative action involving sensitive medical records in Prismall v Google? We discuss how claimant firm Austen Hays gathered 12,000 signed-up individuals to bring specific allegations of distress, and why the immense cost and complexity of defending a bifurcated trial likely drove a pragmatic settlement. Cases & Regulatory Actions Mentioned Grindr High Court Settlement (Sept 2026): £26 million settlement for UK users represented by Austen Hays. Lloyd v Google (2021): Supreme Court ruling effectively blocking opt-out representative actions for uniform data protection damages under the DPA 1998. Farley v Paymaster (Aug 2025): Court of Appeal ruling establishing that claims for compensation based on a fear of third-party misuse must be "well-founded" and assessed case-by-case. (The Supreme Court appeal is listed for 7-8 October 2026). Prismall v Google: High Court case demonstrating that representative actions involving even highly sensitive data (medical records) will fail if they attempt to bypass individual assessments. Datatilsynet vs. Grindr (2021/2025): 65 million NOK fine for unlawful behavioural advertising disclosures, upheld by the Borgarting Court of Appeal. ICO Reprimand (July 2022): UK regulator's finding against Grindr regarding transparent privacy information. Get in Touch If your organisation needs support navigating adtech compliance, data protection litigation, or evaluating its financial exposure, reach out to us at Privacy Partnership.

n this late-summer roundup episode of the Privacy Partnership Podcast, host Robert Bateman unpacks a massive €825 million GDPR fine, the immediate impact of the EU AI Act taking effect, and a wave of enforcement actions across the UK, Europe, and the United States. In this episode, we cover: Mind the Gap (UK ICO Enforcement): Why the disconnect between an organisation's written privacy policies and its actual practices is a major regulatory red flag. Robert discusses recent reprimands for the Metropolitan Police Service and ACRO Criminal Records Office, highlighting the dangers of ignored mandatory training, unpatched software, and inadequate logging. Automated Decision-Making Under Fire: A deep dive into the Dutch DPA's record-breaking €825 million fine against Uber for automatically deactivating drivers' accounts without human review. Plus, we look at similar Article 22 enforcement actions by the Italian Garante against energy suppliers, and noyb's data retention challenge against SCHUFA. The EU AI Act Meets the GDPR: The AI Act reached its general application date in August. We break down the immediate impact of Article 50's transparency rules for generative AI and deepfakes. Furthermore, a recent Italian Garante ruling on satirical deepfakes of a journalist serves as a stark reminder that complying with the AI Act does not mean you can ignore the GDPR. US Privacy Updates: A quick-fire roundup of major transatlantic developments, including California's regulatory action against unregistered data brokers, New Jersey's new Kids Code Act, the FTC's consultation on the privacy implications of personalised pricing, and TikTok’s massive $400 million children's privacy settlement with the DOJ. Resources & Links Links to all the regulatory decisions, enforcement notices, and legislation discussed in this episode are available in the September Privacy Partnership newsletter, delivered directly to our clients.

France’s Constitutional Council has struck down the central provision of a new law that would have banned under-15s from accessing social media. In this episode, Robert Bateman looks at why the Council found the measure disproportionate, focusing on two fundamental rights: freedom of expression and the right to private life. The decision also highlights a longstanding problem with age assurance: to identify children online, platforms may need to establish the age of everyone else too. Topics covered include: France’s proposed under-15 social media banThe Constitutional Council’s decision of 14 August 2026Freedom of expression and access to online servicesThe privacy implications of universal age assuranceWhy this was a constitutional ruling, rather than a GDPR judgmentThe difficulty of balancing children’s safety against privacyWhether privacy and child protection sometimes involve a genuine trade-off

In this episode of the Privacy Partnership Podcast, Robert Bateman dives into a fascinating and highly creative legal defense recently mounted by TikTok. Facing a £12.7 million fine from the UK Information Commissioner's Office (ICO) for processing the data of underage children, TikTok attempted to use a jurisdictional trump card: the "special purposes" exemption under Section 156 of the Data Protection Act 2018. Did TikTok’s recommender algorithm process user data for "artistic purposes"? Should the platform be shielded by freedom of expression laws? And how did a philosophy professor from Oxford end up testifying at a data protection tribunal? Robert breaks down the Upper Tribunal's July 2026 ruling, explaining why tech platforms can't retrofit a fundamental rights defense onto an engagement-driven algorithm. Key Topics Covered: The £12.7m Penalty: The background of the ICO's enforcement action against TikTok for age-gating failures and processing the data of under-13s without parental consent. The "Special Purposes" Exemption: A look at Section 156 of the DPA 2018, which provides procedural safeguards (including court approval) before a regulator can penalize processing done for journalistic, academic, literary, or artistic purposes. The "What is Art?" Debate: TikTok's argument that its platform facilitates artistic expression, and why the Upper Tribunal decided to sidestep the philosophical debate entirely. Algorithm vs. Intent: Why the Upper Tribunal ruled that an engagement-driven recommender system—which is completely indifferent to whether a video is actually "art"—cannot be said to be processing data for an artistic purpose. The Underage Contradiction: The fatal flaw in TikTok claiming to facilitate the artistic expression of under-13s while simultaneously banning them in their own Terms of Service. Articles 12 & 13 as Procedural Obligations: Why the Tribunal rejected TikTok’s attempt to classify transparency and privacy notice failings as "processing" breaches.

Can you scrape the internet for AI training data without completely running afoul of the GDPR? The European Data Protection Board (EDPB) has finally offered an answer: Yes, but get ready to implement a massive amount of filtering. In this episode of the Privacy Partnership Podcast, Robert Bateman breaks down the EDPB’s newly adopted Draft Guidelines 03/2026 on web scraping for generative AI. Robert begins by exploring the political context behind this unexpectedly pragmatic guidance, discussing how the EDPB is effectively front-running the European Commission’s upcoming "Digital Omnibus" proposal to cement its authority over how privacy law applies to AI development. Then, Robert walks listeners through a practical, 10-point checklist for developers and privacy teams trying to navigate this regulatory minefield, from mapping out complex controllership arrangements to leveraging a fascinating loophole for the "incidental and residual" scraping of sensitive, special category data. Key Topics Discussed: The Digital Omnibus Context: Why the EDPB’s new guidance is "deceptively permissive" and how it serves as a strategic maneuver to preempt upcoming EU legislation. Controllership in the AI Supply Chain: How to define your role—whether you are dictating instructions to a scraper, co-determining collection criteria, or buying a pre-scraped dataset. Establishing a Lawful Basis: Why consent is a non-starter at this scale, how to lean on Legitimate Interests, and why a missing "robots.txt" file does not equal a green light. Designing the Collection: The end of indiscriminate web hoovering, the importance of data minimisation, and respecting technical barriers (like CAPTCHAs and ai.txt). Transparency at Scale: How to utilize the Article 14 "disproportionate effort" exception while maintaining a highly detailed, searchable public scraping notice. Cleaning and Accuracy: Applying syntax-based filters to weed out format-identifiable data on the fly, and utilizing synthetic data where feasible. The Article 9 Workaround: How the EDPB is applying the 2019 GC & Others CJEU search engine ruling to allow the incidental scraping of special category data—and the rigorous output filters required to justify it. Accountability: The massive documentation burden required to prove your technical measures and filters remain effective against the evolving state of the art.

This week, Robert Bateman breaks down the newly adopted EDPB Guidelines 02/2026 on Anonymisation. Dragging the ancient 2014 Working Party 29 framework into the age of generative AI and EU data spaces, these new rules are dense, highly technical, and will undoubtedly complicate your compliance programmes. Robert explores the new concept of "relative anonymity," explains the rebranded technical criteria, and discusses why making your data anonymous might actually trigger a 72-hour data breach notification down the line. In this episode, we cover: Relative Anonymity: What the EDPS v SRB case means for controllers, and how data can be anonymous to a recipient but still constitute personal data for the sender. The Assessment Gauntlet: Navigating the "contextual" vs. "simplified" approaches (and why the EDPB expects you to evaluate the capabilities of cybercriminals and foreign spies). The New Technical Criteria: A look at the replacement tests for anonymity: No Record Isolation, No Linkage, and No Inference. The AI Threat: How "membership inference" attacks against AI training data are raising the bar for the No Inference test. The Processing Trap: Why the sheer act of running an anonymisation algorithm is a processing activity requiring its own Article 6 (and potentially Article 9) legal basis. The Expiry Date on Anonymity: How a completely unrelated security incident on the other side of the internet can instantly turn your anonymous dataset back into personal data.

A longer edition of the podcast because Rob gets unreasonably animated about EU-US data transfers. On 29 June 2026 the US Supreme Court ruled that the Federal Trade Commission's protection from presidential removal is unconstitutional, overruling ninety years of precedent on independent agencies.  The ruling says nothing about data protection, but the EU-US Data Privacy Framework is built on the premise that the FTC is an independent supervisory authority, and campaigners are already demanding that the European Commission repeal the adequacy decision. In this 20-minute briefing, Rob Bateman of Privacy Partnership explains what has happened on the American side and what it means for anyone moving personal data across the Atlantic. Covered in this episode A timeline from the adequacy decision in 2023 to the Supreme Court's ruling and noyb's demand for repeal  The US machinery behind the DPF: Executive Order 14086, the FTC, the PCLOB and the Data Protection Review Court  What the Supreme Court actually decided, explained without assuming any US constitutional law  The four routes by which the adequacy decision could be invalidated, and their very different timescales  Whether the ruling's logic spreads to the DPRC, and why that question matters more than the DPF headline  The two scenarios for SCCs, including why standard contractual clauses could be a stronger fallback than they were after Schrems II The DPF remains in force and transfers under it remain lawful today. Nothing in this episode is legal advice for your specific situation.

What happens when a Silicon Valley cybersecurity founder takes the reins at one of the world's most powerful privacy regulators? In this special edition of the Privacy Partnership Podcast, Robert Bateman is joined by Tom Kemp, Executive Director of CalPrivacy (the California Privacy Protection Agency). They dive deep into California’s aggressive new enforcement strategies and the technical tools the state is building to make privacy rights frictionless for the average consumer. From massive potential fines for data brokers to mandated browser-level opt-outs and algorithmic risk assessments, Tom breaks down exactly what businesses need to know—and why simply relying on your GDPR compliance won’t be enough to keep you safe in the Golden State. In this episode, we cover: From Founder to Enforcer: How Tom's background in tech shaped his belief that privacy rights need to be scalable, not a "never-ending set of chores" for consumers. The DROP System: California's new Delete Request and Opt-Out Platform that allows users to delete their data from roughly 600 data brokers with a single click. $40 Million-a-Day Fines: The terrifying math behind California’s enforcement against data brokers. (Hint: the $200 fine is per incident, not per day). Data Minimisation in the US: Lessons from the recent General Motors enforcement action and Cal Privacy's focus on eliminating "dark patterns" and consumer friction. The Rise of OOPS: Why California is moving away from cookie banners and mandating that all web browsers natively support Opt-Out Preference Signals by 2027. The EU-to-California Pipeline: Actionable advice for UK and European businesses on configuring third-party tools, preparing for incoming cybersecurity audits, and handling Automated Decision-Making Technology (ADMT) regulations. Timestamps: [00:00] Intro: Welcome Tom Kemp, Executive Director of Cal Privacy. [01:09] Changing perspectives: Moving from building cybersecurity tech to regulating privacy. [04:30] Solving the data broker problem: How the new DROP system actually works. [09:34] Enforcement with teeth: Breaking down the massive fines awaiting non-compliant data brokers in August. [12:41] Common themes in Cal Privacy enforcement actions: Data minimisation, the GM case, and reducing friction. [18:06] Putting privacy "in the box": Mandating browser-level Opt-Out Preference Signals (OOPS) by 2027. [22:56] Practical advice for EU/UK companies navigating CCPA, risk assessments, and ADMT.

Did the US Supreme Court just sign the death warrant for the EU-US Data Privacy Framework (DPF)? In this explosive episode of the Privacy Partnership Podcast, Robert Bateman breaks down yesterday's monumental 6-3 SCOTUS decision in Trump v. Slaughter, which fundamentally rewrites the rules of the American administrative state. By confirming the President's authority to fire FTC Commissioners at will, the Court has stripped the FTC of its structural independence—a core pillar of the European Commission’s DPF adequacy decision. Robert explores the immediate fallout, the threat to US surveillance safeguards, and why Max Schrems and noyb are already demanding an "orderly exit" to prevent a catastrophic "Schrems III" compliance cliff. In this episode, we cover: The fall of Humphrey's Executor: How Trump v. Slaughter dismantled a 1935 precedent and placed the FTC under the direct control of the White House. The DPF's structural flaw: Why the European Commission's reliance on FTC independence (Recital 60) is now a historical artifact. Surveillance safeguards at risk: How the ruling threatens the independence of the Privacy and Civil Liberties Oversight Board (PCLOB) and the newly minted Data Protection Review Court (DPRC). A constitutional clash of laws: noyb's immediate letter to the European Commission, arguing that the US Constitution now prohibits the independent supervisory authority required by EU treaty law. What's next at the CJEU: Could the ongoing legal challenge by French MP Philippe Latombe sweep up these new constitutional issues? The UK Angle: Why the UK's adequacy regulations and the UK Extension to the DPF might survive (for now), but face serious legal complications ahead. Resources & References: The European Commission’s Implementing Decision (EU-US Data Privacy Framework) noyb’s open letter to the European Commission regarding the Slaughter ruling Background on French MP Philippe Latombe's ongoing CJEU challenge against the DPF Get in Touch: With the DPF on shaky legal ground, is it time to dust off those Standard Contractual Clauses (SCCs)? If you need help navigating this transatlantic uncertainty, the team at Privacy Partnership is here to help.

The Irish High Court has just delivered a massive judgment in TikTok’s appeal against the Data Protection Commission (DPC). The court upheld a staggering €530 million fine—but surprisingly tore up the regulator’s order to suspend TikTok's data transfers to China. Who actually won this case, and what does it mean for the future of international data flows? In this episode of the Privacy Partnership Podcast, Robert Bateman unpacks Mr Justice Rory Mulcahy’s highly technical ruling. We dive into the mechanics of remote access, the absolute floor for GDPR negligence, why catch-all phrases in privacy policies are no longer acceptable, and what happens when a regulator fails to "show its working" when assessing complex technical mitigations like TikTok's Project Clover. In this episode, we cover: The Mechanics of Remote Access: Why TikTok’s data localisation defence failed, and how data temporarily loaded into the RAM of an engineer's laptop in Beijing constitutes processing in China. Article 46 and Accountability: How TikTok’s failure to assess the specific technical risks of local caching in its Transfer Impact Assessments (TIAs) led to a massive infringement. Transparency and Article 13: Why the DPC fined TikTok €45 million simply for failing to explicitly name China in its 2021 privacy policy. The New Standard for Negligence: Why relying on expensive external counsel doesn't shield you from liability, and why the GDPR negligence threshold is currently "sitting on the floor." Fair Procedures and Project Clover: Why the High Court vacated the DPC’s suspension order, ruling that the regulator unlawfully ignored late expert evidence and failed to adequately explain why TikTok's new secure European data enclave was technically ineffective. Key Takeaways for Privacy Professionals: TIAs must reflect technical reality: Regulators are looking past server locations and examining endpoint devices. Your transfer assessments must account for temporary local processing, including RAM and CPU caching. Name names in your privacy notices: Boilerplate language about "third countries" or relying on SCCs/adequacy without specifying the actual destination countries is a major compliance risk. Regulators must justify technical rejections: While courts will defer to a regulator's technical expertise, Data Protection Authorities must provide detailed reasoning when rejecting a controller's supplementary measures.