More than 200 people joined the 11th Nordic Privacy Arena (NPA), the Nordic region’s largest annual event on data protection, in Stockholm and online.
The theme of NPA 2026 was Innovation and Compliance in the Era of Cloud, AI and Geopolitical Uncertainty – Because Accountability Can’t Be Outsourced.
This is the second article in a three-part series on presentations and discussions from the event. It covers Max Schrems’s day-one talk on collective action and the future of data protection, and Tim Turner’s opening keynote on day two, which explored how AI is changing requests for access to personal data.
Max Schrems: collective action and the future of data protection
Schrems outlined two priorities for noyb, his privacy rights organisation: collective legal action and the data omnibus.
Collective action could change the financial risks
Schrems criticised slow and ineffective enforcement of the General Data Protection Regulation (GDPR). He also raised concerns about industry influence over regulators, highlighting that a former Meta lobbyist had become an Irish data protection commissioner.
He argued that fines can amount to little more than a “tax” on breaking the rules, rather than an effective deterrent. Collective redress, which allows organisations to seek compensation for many people together, could change that calculation.
He described noyb’s Austrian case against a credit-scoring company that largely relies on people’s addresses rather than their financial circumstances. Noyb gathered around 40,000 scores through requests for access to personal data to examine how the scoring worked.
Its approach combines evidence gathering, court action to stop unlawful practices, and compensation claims. Schrems explained that action to stop unlawful practices can also prevent the legal time limits for bringing compensation claims, known as statutes of limitation, from expiring.
With around 7,500 people joining and noyb seeking €500 per person, he argued that collective claims could create stronger financial pressure than fines. Noyb is also developing a case against Germany’s credit-scoring agency, Schufa.
The data omnibus: more than simplification
Schrems warned that the data omnibus could fundamentally weaken privacy protections under the banner of simplifying rules.
He supported clearer guidance on high-risk processing and browser settings that could replace repeated cookie banners. However, he said Google had opposed automated privacy choices, and that opposition among member states had subsequently grown. He argued that allowing people to automatically refuse tracking threatened companies’ preferred approach to collecting consent.
His concerns also included restrictions on access rights, broader research exemptions, and changes to the definition of personal data. He warned these could allow more data reuse without people knowing and leave significant processing outside GDPR protections.
His strongest criticism concerned proposals facilitating personal data use for artificial intelligence. He argued that using AI should not itself justify processing that would otherwise require stronger safeguards.
He called for carefully considered, stable legislation rather than political signals about supporting innovation.
Tim Turner: when AI makes access requests harder, not better
While Schrems focused on collective action and the future of privacy protections, UK data protection consultant Tim Turner turned to how people exercise their rights in practice, and how AI assistance can sometimes get in the way. People use artificial intelligence to help with many writing tasks, including asking organisations for access to their personal data. But does AI help them get the information they need?
A better request, or just a longer one?
Turner suggested that people often turn to AI because they have never made an access request before. They trust it to write something more effective than they could themselves.
Yet the result can stretch to 18 pages. Requests repeat demands, specify search terms, list staff and systems to investigate, and sometimes cite invented legal precedents.
They also routinely demand metadata, which describes records, and logs showing who accessed information or changed it.
Turner explained that these details can serve specific purposes. Someone might suspect that staff accessed their records inappropriately or altered a document about them.
The difficulty comes when AI includes every possible demand, rather than tailoring the request to the person’s concern. Turner acknowledged that he did not know why AI consistently produced this style of request.
The result can work against the person seeking information. Instead of making their needs clearer, AI can make their request harder to understand and answer.
Why the UK debate has become confrontational
Turner said UK discussions increasingly describe access requests as “weaponised”. Some organisations interpret lengthy, AI-written demands as deliberate attempts to overwhelm them.
He challenged that assumption. People may simply believe AI will help them exercise their rights. Treating them as hostile risks making access harder.
Focus on what the person needs
Turner advised organisations to identify the actual request and avoid debating irrelevant errors or invented legal claims.
He warned against refusing requests simply because their wording feels overwhelming. He also questioned whether AI-generated replies would create an exchange between machines that leaves the person behind.
Drawing on his local government experience, he described helping adults understand their childhood experiences in care through their records.
His message was to preserve that human purpose: helping people understand information about their own lives.
Note from the author of the article
Since Schrems gave his talk, on 28th of September, there has been a further development on the data omnibus. On 21 October 2026, the Council of the European Union agreed its negotiating position. The Council is one of the EU’s legislative bodies and represents the governments of the member states. Read the Council’s announcement of its position.
Noyb has published a statement criticising the Council’s position, particularly its proposed rules on the use of personal data for AI.
The European Parliament is now working on its own position before negotiations with the Council can begin. Readers can follow the proposal’s progress in the European Parliament. The Council’s agreement is a negotiating position, not a final change to the law.