Sign in Subscribe

Topic

Data & privacy

What a system can infer, beyond the data you hand over: the editions on privacy, data protection and inference risk.

Consent governs what a system collects. The value, and increasingly the law, sit at what it infers afterwards. These editions follow that shift: from the record to the prediction, and from the prediction to the graph nobody consented to.

Start with this

Your Data Isn't the Asset. The Inference Is. 27 August 2026. The thesis in one edition: three rulings of the Court of Justice of the EU moved the regulated object from the record to the inference, the Commission's €200 million fine on Meta under the Digital Markets Act punished the combining of data across services rather than the collection, and the contract, not the privacy notice, is the one place a buyer still decides who controls the inference.

The path

  1. Whether you like it or not, your data will fuel AI 10 July 2025. Where the argument starts: the data is already collected, opting out of training is not opting out of collection, and Meta's move to legitimate interest as the legal basis turned the choice into an objection that covers future data only. The edition argued for informed participation over the illusion of control.
  2. ChatGPT and the Reporting Dilemma: When AI Becomes an Informant 2 October 2025. A conversation with a model has no professional privilege. By OpenAI's own account, flagged conversations go to human review and may be referred to law enforcement, and its CEO conceded that there is no legal confidentiality yet for what a user tells ChatGPT. The confidant is also a channel.
  3. Your Data Isn't the Asset. The Inference Is. 27 August 2026. The unit of value moves from the record to the prediction. In OT, Lindenapotheke and SCHUFA the court treated what can be deduced as the thing the law protects; in Meta v Bundeskartellamt a competition authority was allowed to judge consent. Three clauses to insist on before signing.
  4. Delete the Tie. The Inference Stays. 3 September 2026. The inference you cannot withdraw: the graph is built from everyone else's data, so deleting a tie does not delete what it revealed, and anonymisation fails because a node's neighbourhood is a signature. The same map, drawn over your own vendors, finds the intermediary that holds the dependency.

What changed

In July 2025 the question was still whether to let your data train models, and the honest answer was that the choice was smaller than it looked. By October the model itself had become a reporting channel. By August 2026 the argument had left the record entirely: Europe's courts were already treating what can be deduced as the protected object, and a competition regulator had fined the combining step. September closed the loop. The inference that matters most is built from other people's data, and the only party that can inspect it is the one holding the map.

Questions to take into a meeting

  • Which rights does the vendor hold over what it can infer from our data, separately from what it may collect? Are they in the agreement, or on a policy page the vendor can rewrite?
  • What does "we anonymise" leave inferable? Ask about linkage across datasets, not about names.
  • Can the vendor combine our data with other customers' data? If so, we are contributing to an inference asset we will later pay to access. Is that the deal we want?
  • Which single intermediary sits on hosting, model, pipeline and identity at once? If removing it forces everyone else to renegotiate, that is the gatekeeper, whatever the contract map shows.
  • Which conversations in the company now happen with a system that owes nobody confidentiality?
Language