Purpose & Means Newslatter - Issue 5, October 2026

Issue 5 of the Purpose and Means newsletter. Subscribe here to receive future issues by email.

1 - From the desk #

Something I have been thinking about building for a long time goes live today, and you are seeing it first.

It is called Policy Bonfire. The idea is simple: paste in a piece of corporate legalese - parts of a privacy notice, a training document, an internal policy - and burn it. If you want, ask for a plain-English rewrite first, or use one of the personas for fun. Then burn that too, for catharsis.

There is a serious side to this. Privacy notices are a very visible symptom: dense, lawyerly, written to reduce enforcement risk rather than to inform anyone. Research is consistent on this - people do not read them, and why would they? They are not written for the very people that companies need to be transparent towards. The problem runs deeper than privacy notices, of course. The same pattern turns up in training materials, in internal policies, in the documents that govern how companies behave. Written by lawyers, for lawyers, at the expense of everyone else.

Policy Bonfire is not a regulatory answer to that. It is built to highlight the issue in a light-hearted manner. It is a small act of catharsis, with an optional translation tool attached. The translation runs on an AI model hosted in Germany - EU infrastructure, nothing leaving Europe. Your burns are private to you. Nothing you paste is stored on the server.

Go and burn something: policybonfire.eu

2 - Data Protection Hero #

The living document. A DPIA that gets filed is a DPIA that stops working.

3 - Main piece #

The DPIA everyone writes and no one uses - Part 5: The heat map has to go #

Part 5 of a short series. Just joining us? Part 1, Part 2, Part 3 and Part 4 are here.

The heat map is the default risk visualisation in quite a few of the DPIAs I have seen. Likelihood on one axis, severity on the other, a colour band from green through amber to red. It is clean, it is familiar, and it does not work.

This is not a critique of risk matrices in general. In operational risk, in health and safety, in project management, they serve a purpose: communicating relative risk across a portfolio where the categories are stable and the scoring criteria are shared. Neither condition holds for a DPIA.

The measurement problem #

R. Jason Cronk, author of Strategic Privacy by Design (IAPP, 2022), captures the problem head on. He imagines a privacy analyst looking at a completed DPIA and thinking:

“These three risks are rated medium, and if we spend money and effort on controls, they will still be medium. But which medium is more medium than the other mediums? How do we prioritize our spends?”

The frustration is real. Ordinal scales - low, medium, high - are not numbers. Multiplying them as if they were produces the appearance of precision while hiding the actual uncertainty behind a coloured square. Two DPIAs can both land residual risk in the amber zone and represent completely different situations: one is a mailing list update, the other involves profiling a population that includes unaccompanied minors. The matrix cannot tell you which deserves more of your budget, your attention, or your time.

The consolidation problem compounds this. When a data protection leader tries to roll up risk entries across teams, each team has scored their risks differently. The result is, as I have heard it put, comparing apples, bananas, and cucumbers. The heat map that looked informative at the project level becomes meaningless at the programme level.

What Cronk proposes instead #

Cronk adapts the FAIR model (Factor Analysis of Information Risk) from its original information-security context to focus specifically on risk to individuals. His definition is precise: privacy risk is the frequency of privacy threats and the magnitude of harms for the at-risk population. Not a grid cell. A rate and a magnitude, both of which can be estimated from evidence, compared across scenarios, and tracked over time.

The goal, as he puts it is not certainty but “a logical and defensible range.” Using Solove’s taxonomy of privacy harms to categorise what can go wrong for real people, and the FAIR decomposition to analyse how often and how severely, an assessor can produce something that supports genuine prioritisation: this population, this harm category, this frequency range is a greater risk than that one.

Bare in mind that Cronk’s framework has a US orientation and that the EU context is broader - GDPR Article 35 requires assessing risk to rights and freedoms in the full sense of the EU Charter, not only privacy harms. But his core argument applies directly: qualitative labels are not a risk assessment. They are a risk register that has decided in advance not to measure anything.

What Snap’s five DPIAs tell us #

In March 2023, the UK’s ICO (now named Information Commission) began informal engagement with Snap about its My AI chatbot. The feature processed personal data of millions of users, including teenagers. By May that year, the ICO had issued a formal information notice requesting DPIAs.

Snap’s early DPIAs were not fit for purpose. The ICO found serious risk-recording errors repeated across multiple drafts. Snap initially failed to provide unredacted documents when requested. The ICO raised the threat of an enforcement notice.

I made this infographic for a client last year that explains the gist of the case:

It took five iterations before Snap produced a DPIA that met UK GDPR requirements - one that addressed risk to minors in depth, mapped data flows accurately, documented mitigations specifically, and demonstrated that access controls actually reflected the assessed risk. Only then did the ICO close the case without sanctions.

The heat map in Snap’s early submissions told the ICO nothing useful. What the ICO eventually required was evidence of reasoning: that Snap had understood the risks to specific, identifiable groups of people, had implemented safeguards that responded to those risks, and had a process for keeping the assessment current as the product and the regulatory landscape changed. That is not a grid. It is a documented chain of analysis that a regulator can follow.

What a living DPIA looks like #

Article 35(11) requires controllers to review the DPIA at least when there is a change in the risk represented by the processing. That is a continuous obligation, not a sign-off date. A DPIA that works has a version history, defined review triggers - a change in processing or technology, a significant incident, a relevant regulatory decision, a change in the affected population - and named owners who are accountable for monitoring.

The Snap case did not produce a good DPIA because the ICO asked for one five times. It produced one because Snap was eventually forced to think carefully, revise its analysis based on new information, and document that process in a way a regulator could follow. A heat map cannot do that. A well-maintained, living document can.

Part 6 continues the series.

4 - Tag of the issue: #records-of-processing #

The DPIA and the RoPA are companion documents. A DPIA identifies what the risks to the rights and freedoms of individuals are in a specific processing activity. The RoPA records that the processing exists at all. Both share the same fatal flaw when companies treat them as one-time compliance exercises rather than living documents.

If your RoPA has not been updated on an ongoing basis, it is not a record of what your company processes. It is a record of what your company used to process. This matters not only when the Supervisory Authority comes calling, or when you need access to up-to-date processing information whilst handling a personal data breach, or when you need to assess the impact of new laws covering international transfers, or when a new vendor is to be onboarded, or when…

An updated RoPA is a must at all times.

Explore all posts tagged #records-of-processing

5 - Field Talk - November 2026 #

Registrations are coming in thick and fast #

Field Talk is a free, practitioner-led online conference for data protection professionals - no sponsors, no sales pitches, just practitioners talking to practitioners. After opening registration a couple of weeks ago I have been pleasantly surprised by the constant flow of registrations across all three days. If you have not done so yet, please visit and consider registering for individual sessions, individual days, or the entire event.

Koen Hostyn is a data protection officer with extensive experience in GDPR compliance and NIS2 implementation across the Belgian public sector. He is the founder and director of Privacy for All, a consultancy serving private sector organisations in Belgium, the Netherlands, and the United States.

Fernanda Nones is a privacy and technology professional who built RD Station’s privacy programme from the ground up, developing over 40 privacy features to help 50,000 companies run compliant marketing and sales strategies. Currently, she serves as RD Station’s Data Protection Officer and Privacy Manager at TOTVS (TOTS3). Her work is driven by the belief that privacy and technology can expand together, and by a commitment to changing how people relate to their own data.

See the full programme and register at fieldtalk.eu. Free to participate and free from vendor influence.

6 - What caught my eye #

Five things from the past two weeks worth your time.

Margaret Hamilton, 1936-2026 - The woman who wrote the software that put humans on the moon died on 30 September, aged 90. She was the first programmer - and first woman - hired on NASA’s Apollo flight software project at MIT. Minutes before Apollo 11 landed, the onboard computer raised an alarm. The crew continued: her software was detecting a hardware fault and compensating for it in real time. “There was no choice but to be pioneers; no time to be beginners.” I have added Margaret to my interactive Women in AI and Computing Timeline. (The Guardian, 8 October)

Amazon’s “About You” page shows you how it has categorised you - Amazon’s advertising profile page lets you see exactly how the algorithm has filed you for targeting purposes. Emma Beddington went looking and found out Amazon pegs her as someone who “values specialised fitness nutrition products” and “maintains premium coffee brewing setup.” Her piece is funny. The underlying point is not. Worth ten minutes of your time as a practical exercise in understanding what “legitimate interest” looks like at scale, from the inside. (The Guardian, 11 October)

Researchers warned about this months ago. French supermarkets did not listen. - Attackers hit the refrigeration systems of French supermarkets - exactly the kind of OT/ICS vulnerability that security researchers had documented well before it happened. “It is just a freezer” turns out to be an operational risk, not a technical footnote. Useful reading if you work anywhere near critical infrastructure or have clients who do. (The Register, 15 October)

Meta just gave itself permission to scrape your website - From 30 October, Meta’s updated commercial terms authorise it to crawl any website “associated with” a business account - which means virtually every news publisher and business with a Facebook, Instagram, or WhatsApp presence. Three legal experts reviewed the terms for Nieman Lab and found the language could override robots.txt, create test credentials to bypass registration walls, and be used to train Meta’s AI. “Publishers either have to trust that Meta does not mean the full extent of what these terms say, or they have to stop,” said James Grimmelmann of Cornell Law School. No opt-out is available before the deadline. (Nieman Lab, 15 October)

The bigger AI election threat is not deepfakes - it is data poisoning - Political scientist Thessalia Merivaki of Washington State University makes a case that gets harder to dismiss: the most serious AI risk to elections is not synthetic content aimed at human eyes, but “algorithmic manipulation” - flooding the internet with low-quality material designed for AI crawlers to pool and serve to voters using chatbots for election information. Local election jurisdictions publish so little authoritative content that data voids form naturally, ready to be filled. The antidote Merivaki’s research points to is specific: detailed, process-focused communications from election officials, explaining exactly how elections work, build resilience before it is needed. (The Markup, 10 October)

Hire me #

I work with organisations and practitioners on a project basis - consultancy, training design, and workshop facilitation. No long-term lock-in. If you want to talk through a project, a DPIA process, or a Data Protection Day plan, drop me a line or book time directly.

Subscribe to the Purpose and Means newsletter to receive future issues by email.