Discord's photo ID breach: Are the UK GDPR and Online Safety Act to blame?
The Privacy Partnership Podcast with Robert BatemanShow Notes
Send us Fan Mail Discord's recent data breach exposed photo IDs used to verify users' ages. Should we blame the Online Safety Act, the Children's Code, or the UK GDPR? It's complicated. (Please excuse the unsightly cut on my forehead in this one). While this breach probably just boils down to vendor security, I wanted to consider whether Discord was obliged to collect users' ID documents, and whether it should have been retaining them. This story does involve some competing obligations un...
More from The Privacy Partnership Podcast with Robert Bateman
Send us Fan Mail In this episode of the Privacy Partnership Podcast, Robert Bateman unpacks the massive gap between a UK regulator having legal authority and actually forcing an overseas company to comply. Sparked by Ofcom’s admission that it won't be able to recover every fine issued under the Online Safety Act—and 4chan's subsequent declaration of victory—we explore the harsh realities of cross-border enforcement. What happens when a British regulator fines an American company with no UK as...
Send us Fan Mail So you just bought a pair of Meta Ray-Bans, and you're ready to start publicly streaming your morning coffee run. Not so fast. According to a new statement published on October 13th by the European Data Protection Board (EDPB), stepping outside the household exemption with wearable tech puts you on the hook for the full range of applicable GDPR obligations. In this episode of the Privacy Partnership Podcast, Robert Bateman explores the somewhat absurd reality of applying ente...
Send us Fan Mail Just yesterday, the ICO announced a £200,000 settlement with DSG Retail, finally bringing an end to nearly seven years of legal wrangling over a massive 2017 cyberattack that compromised more than 5.6 million payment cards. But beyond the shrinking fine, this case resolved a fascinating legal debate about the "relativity" of personal data: If a hacker steals your customers' information but lacks the means to actually identify who it belongs to, does your statutory duty to pro...
Send us Fan Mail Seven years after former Information Commissioner Elizabeth Denham told MPs that a probe into TikTok would conclude "in the fall," the enforcement saga has finally come to an end. This week on the Privacy Partnership Podcast, Robert Bateman breaks down the history of the ICO's £12.7 million penalty against the social media giant following the company's unexpected decision to withdraw two appeals. We explore the original investigation into underage users, TikTok's highly creat...
Send us Fan Mail How does a data protection regulator decide whether to hand down a multi-million euro fine or issue a simple reprimand? In this episode, Robert Bateman breaks down the European Data Protection Board’s (EDPB) newly published draft Guidelines 04/2026. Adopted for public consultation on 17 September 2026, these guidelines replace the 2017 Article 29 Working Party guidance and aim to heavily harmonise the enforcement playbook across Europe. We explore how the EDPB has baked recen...