Dr. Rob van Eijk discusses how Europe treats privacy as a fundamental right under the GDPR, contrasting it with the United States’ largely consumer-protection approach. He explains the distinction between pseudonymized and truly anonymous data, the principles of data minimization and purpose limitation, and how European authorities audit and penalize organizations for unlawful collection, tracking, and sharing. The conversation also explores cookie-consent fatigue, targeted advertising, AI privacy risks, and the advantages of narrow, purpose-built AI models over resource-intensive general systems. Broader topics include the environmental and social costs of data centers, Europe’s push for digital sovereignty, the value of open-source technology, AI-enabled cybersecurity threats, and uncertainty surrounding the continued viability of EU–US data-transfer arrangements as American regulatory independence weakens.
Podcast: Play in new window | Download
If you want to look into the servers, where that information ends up in, obviously you need the power of law to go on the location and to do a spot check. And this is what the DPAs [Data Protection Authorities] are for. I’ve been on those teams as well in my previous life. And then you can basically take samples from databases and ask questions about “what does the script do?” “How long do you keep this data?” “To what extent do you consider this data anonymous or personal data?” “What about your compliance here?” “Did you do a privacy impact assessment?” Etc. , etc. Depending on the complaint, obviously, it matters which legal article is being examined and zoomed in on. But that’s typically what’s happening. So DPAs do have the ability and sometimes also they have to act. I mean, we had a lot of cookie complaints all over Europe. And some of these actually lead to fines, hefty fines as well.
Links
- Guidelines 03/2026 on web scraping in the context of generative AI – European Data Protection Board
- “No, Trump v. Slaughter does not undo the EU-US data-transfer redress mechanism” – International Association of Privacy Professionals (IAPP)
- Data sovereignty
- Rob van Eijk: Hyper-Nudging – Previously on Plutopia News Network