Masters of Privacy

There are genuine substantive legal insights - particularly the UK Article 22 to 22A-C shift and the evolution from data protection to data protectionism - but these are interspersed with significant filler, generic AI commentary, and a wholly unsubstantive final segment on lawyer job displacement. The episode rewards patience but doesn't sustain a high density throughout.

“In the UK, it's no longer prohibited unless we're talking of this special category data. But for normal personal data, we've moved from what is effectively a prohibition to a situation where it is permitted subject to certain safeguards.”

“automated decision-making was already regulated by the original 1995 Data Protection Directive”

The 'data protection to data protectionism' reframe is a crisp and useful coinage, and the reminder that ADM regulation is 30 years old cuts against naive novelty claims about AI, but most of the episode's other positions - regulate important decisions, humans in the loop are philosophically contested, global cooperation is needed - are well-circulated takes in privacy circles rather than genuinely contrarian arguments.

“we've gone from data protection to almost data protectionism and technological protectionism”

“some of these things are not explainable by humans because machines are making the decisions in a way that perhaps humans cannot explain”

Eduardo Ustaran is legitimately among the most senior practising privacy lawyers globally - global co-head of Hogan Lovells' practice, directly involved in EU data protection framework development, and actively working on cross-jurisdictional transfer mechanisms. This is a genuine practitioner-at-scale, not a conference circuit thought leader, though the transcript does not fully exploit that depth.

“he is global co-head of the Hogan-Lovall's privacy and cybersecurity practice, widely recognized as one of the world's leading privacy and data protection lawyers and thought leaders. With over 30 years of experience”

“I am working quite actively in still securing mechanisms and opportunities for global companies and global organizations to operate in that way”

The episode earns its points through precise legal citations - Article 22 vs 22A-C, the 1995 Directive, Schufa, SRAM 1/2, DPF, cross-border privacy rules - but stops well short of concrete case outcomes, client data, enforcement numbers, or decision timelines; it stays comfortably at the level of legal concepts rather than operational evidence.

“Article 22 of the GDPR which in the UK has become Article 22A to C”

“I look at create scoring, for example, the Schufe scenario in the EU or create scoring in the US”

The host is clearly expert - references Schufa, SRAM cases, and the UK DUAA by name - and frames reasonably sharp comparative questions, but there is no genuine pushback or pressure-testing of the guest's positions, the final lawyer-displacement question is generic, and several questions are long, leading, and partially self-answering.

“do you think that there really is a long-term viability for humans in the loop and explainability for every single use of AI within, again, for example, what's in the EU, everything that affects our freedoms and fundamental rights?”

“are lawyers as we know them poised to disappear in the face of ever improving A models?”