The Data Chronicles Podcast and Video Series

The Data Chronicles | Data Protection in the Asia Pacific region | Trends, enforcement, and what’s ahead

In this episode of The Data Chronicles, host Scott Loughlin is joined by Charmian Aw, a partner in the firm’s Singapore office, to explore the current state of data protection law across the Asia Pacific region. As countries throughout the region ramp up regulations around privacy, cybersecurity, incident response, and AI, it has become increasingly difficult for organizations to keep pace with the rapid developments. Together, Scott and Charmian provide a timely update on recent trends, enforcement activity, and what the future may hold for data governance in this complex and evolving landscape.

The Data Chronicles | AI issue spotting | AI's growing impact on U.S. antitrust regulation

With artificial intelligence rapidly reshaping industries, its implications for competition law are becoming more significant than ever. This episode of AI Issue Spotting dives into the evolving relationship between AI and antitrust law in the United States, under the new administration and more broadly. As AI continues to disrupt markets, understanding its influence on mergers and acquisitions, consumer protection, and competition is crucial. Scott Loughlin is joined by Logan Breed and Chris Fitzpatrick, senior leaders from Hogan Lovells' global antitrust and competition team, to discuss how AI is transforming legal frameworks and what it means for businesses navigating this new frontier.

The Data Chronicles | AI issue spotting | AI agents' data privacy and governance considerations

As AI agents become more integrated into business operations and products, understanding their impact is crucial. In this episode of AI Issue Spotting, Scott Loughlin is joined by Daniel Berrick, Senior Policy Counsel for Artificial Intelligence at the Future of Privacy Forum, to break down the growing significance of AI agents. They explore key questions around how AI agents function, their risks to data privacy and security, and the challenges they pose in terms of alignment and accuracy. Scott and Daniel discuss the novel issues surrounding data collection, disclosure, and the need for explainability and oversight as AI agents continue to evolve.

The Data Chronicles | Unlocking the EU Data Act | What it means for connected products and related services

With the EU Data Act, the landscape of connected products and the allocation of rights to product data is set to change. This episode of The Data Chronicles is the final installment in a three-part series on the EU Data Act, turning the spotlight onto connected products and related services. Scott Loughlin is joined by Christian Tinnefeld, a partner at Hogan Lovells’ Hamburg office, and together they dive into how the new law will affect everything from smart devices to wearables, from IoT to medical products. They explore key parts of the Act, highlighting the impact on data access, privacy, and product development. With deadlines fast approaching, they also discuss the steps businesses must take to navigate this shift and the challenges and opportunities it brings. 

The Data Chronicles | Unlocking the EU Data Act | Impact on cloud providers and cloud users

The EU Data Act is set to reshape the cloud computing landscape in the EU, but what does it mean for cloud providers and users in practice? That is the question this episode of The Data Chronicles seeks to answer. Scott Loughlin continues the discussion on the EU Data Act with Henrik Hanssen, counsel from Hogan Lovells’ Hamburg office, to explore how the cloud switching and interoperability requirements under the EU Data Act will affect cloud service product design, customer agreements and cloud business models. As cloud providers face the need to adapt, Scott and Henrik break down the challenges and opportunities that come with this significant regulatory shift. 

The Data Chronicles | Unlocking the EU Data Act | What you need to know

The EU Data Act is set to transform the digital economy—but what does that mean for businesses? In the first episode of our three-part series, host Scott Loughlin is joined by Hogan Lovells colleagues, Christian Tinnefeld, partner, and Henrik Hanssen, counsel to break down the Act’s key provisions, its impact on cloud computing, connected products, and data-sharing obligations, and what companies must do to comply before the looming deadlines. From data mapping to contract renegotiations, they explore the challenges and opportunities businesses must navigate. Tune in for a practical guide to understanding one of Europe’s most significant digital regulations. 

The Data Chronicles | The AI dilemma | Balancing GDPR and innovation in the EU

The Data Chronicles is checking in on the status of data protection law in Latin America. Whether it’s privacy, cyber, or AI, there is a lot going on throughout the region. Join host Scott Loughlin and fellow Hogan Lovells partner Guillermo Larrea as they discuss the challenges businesses face when complying with a wide variety of data protection laws, restrictions on cross-border data transfers, and the evolving standards for AI. They also cover topics such as emerging trends in enforcement, the region’s unique challenges for legal harmonization, and best practices for managing cybersecurity breaches impacting data subjects and businesses in Latin America. 

The Data Chronicles | Data protection in Latin America | Where we are and where we are headed

The Data Chronicles is checking in on the status of data protection law in Latin America. Whether it’s privacy, cyber, or AI, there is a lot going on throughout the region. Join host Scott Loughlin and fellow Hogan Lovells partner Guillermo Larrea as they discuss the challenges businesses face when complying with a wide variety of data protection laws, restrictions on cross-border data transfers, and the evolving standards for AI. They also cover topics such as emerging trends in enforcement, the region’s unique challenges for legal harmonization, and best practices for managing cybersecurity breaches impacting data subjects and businesses in Latin America. 

The Data Chronicles | Navigating global data transfer restrictions | U.S., EU, and China 

As global data transfer rules continue to evolve, Scott Loughlin is joined by fellow Hogan Lovells lawyers Eduardo Ustaran and Katie McMullan in this episode of The Data Chronicles to unpack the latest developments. From longstanding US policies and new DOJ rules to Europe's evolving stance, including the impact of the Trump administration and NOYB complaints regarding transfers to China, they cover many important topics. The trio also discusses the role of Transfer Impact Assessments (TIAs) and offers projections for the future of global data transfer restrictions, providing actionable insights for businesses on how to navigate these changes, including the use of Binding Corporate Rules (BCRs). 

The Data Chronicles | Checking in on India’s new data protection law | Where are we headed

This episode of The Data Chronicles features a conversation on the latest developments on India's Digital Personal Data Protection Act of 2023. With newly proposed rules providing details on implementation, Scott Loughlin and Stephen Mathias, Partner and head of the Bangalore office of Kochhar & Co and Co-Chair of the firm's Technology Law Practice, break down key requirements, including: the evolving standard for consent, notice obligations across 22 languages, cybersecurity and breach notification mandates, and more. Scott and Stephen also investigate the broader implications for global businesses, including compliance challenges and how multinational companies should prepare.

The Data Chronicles | The FTC’s focus on location data and the hidden collection of sensitive data

The Data Chronicles dives into the recent FTC action against data broker Mobilewalla, which highlights the Commission’s continued focus on the collection, use, and disclosure of sensitive consumer data, including by downstream data recipients in the ad tech ecosystem. Join Scott Loughlin and Hogan Lovells colleague Alaa Salaheldin as they unpack the implications of the FTC action and what it means for the future of data privacy, ad tech and location data.

The Data Chronicles | The 2024 year-end review and 2025 predictions episode

In this special year-end episode of The Data Chronicles, host Scott Loughlin is joined by Eduardo Ustaran, global co-lead of Hogan Lovells' Privacy and Cybersecurity practice, while they take a deep dive into the key developments of 2024 and offer insights into what’s ahead for 2025.

The Data Chronicles | A matter of national security — U.S. regulation of cross-border data transfers

Join us for a short series examining the DOJ’s recent Notice of Proposed Rulemaking (NPRM) on cross-border data transfers and its potential to reshape global data flows from the US to China and other “countries of concern.”  We’ll explore the NPRM’s implications for national security, compliance programs, data governance and the unique impact it will have on the health and life sciences sectors.

The Data Chronicles | U.S. data protection policy after the 2024 election

Recorded in December 2024, just weeks after Donald Trump’s election victory and the election of a Republican-controlled Congress, this episode explores how shifts in federal leadership could reshape the federal privacy framework. Scott is joined by Hogan Lovells colleagues Mark Brennan, Bret Cohen, and Harsimar Dhanoa. Together, they analyze the implications for businesses and consumers, highlighting the potential changes for privacy laws in the U.S.

One-click cancellations | Exploring the impact of the FTC’s new click-to-cancel rule

The FTC's new Click-to-Cancel rule is designed to simplify the process for consumers to cancel recurring subscriptions and memberships, requiring B2B and B2C businesses to evaluate their practices, user interfaces, and compliance measures. While the intent is clear, its implications are extensive, and the rule has already been challenged in court. Scott Loughlin is joined by Harsimar Dhanoa, who specializes in emerging regulations. Together, they explore the impact of the new rule in the broader context of user experience, data protection, and consumer rights, as well as the important role of data protection professionals in navigating these changes.

Behind the curtain | FDA and privacy considerations in clinical trial recruitment

Explore the challenges of clinical trial recruitment within the life sciences sector in this episode of The Data Chronicles. Successful clinical trial recruitment is critically important to any research sponsor, including pharmaceutical and medical device companies and this poses a number of complex FDA and privacy considerations. Host Scott Loughlin is joined by fellow Hogan Lovells lawyers Robert Church, a partner in the FDA practice, and Melissa Levine, counsel in our Privacy and Cybersecurity practice. Together, they discuss how organizations can navigate the regulatory landscape and address the unique hurdles that arise in attracting and enrolling suitable data subjects for clinical studies.

Did the 9th Circuit just say that DPIAs are unconstitutional?

In this Data Chronicles podcast, host Scott Loughlin is joined by Hogan Lovells colleagues Ryan Thompson and Harsimar Dhanoa to explore the clash between data privacy, regulation of online services, and the First Amendment as spotlighted in a recent Ninth Circuit decision on California’s Age-Appropriate Design Code Act (AADC). This ruling, which found that the AADC’s Data Protection Impact Assessment (DPIAs) requirements likely violate the First Amendment, could impact data protection policy more broadly as policymakers increasingly see DPIAs as a regulatory tool. Listen as they dissect the ruling’s implications for DPIAs and the future of using DPIAs as a component of kids policy.

Data minimization is a challenging opportunity

Data minimization is now a popular data protection requirement for policy makers. Whether it’s in established laws like HIPAA, GDPR or the CCPA or the emerging state laws, lawmakers increasingly expect that businesses will only collect, use and retain only the minimum amount of personal data. That’s easier said than done.

While the requirement seems straightforward, it is very difficult to implement or even to know where to start. Matt McClelland, Managing Director & IG Practice Leader at Ankura, joins host Scott Loughlin to explore data minimization strategies, including as part of larger data governance programs. While challenging, learning how to approach data minimization can create lasting value for data-driven businesses' AI and cyber risk management.

Fake reviews no more | The FTC’s new rule and what it means for AI and you

The FTC has concerns with user reviews.  As consumers explore a vast global marketplace, they increasingly depend on product and service reviews to make informed decisions. There are widespread questions, however, whether these reviews can be manipulated or become misleading, including through non-disclosed paid endorsements and AI-generated fake entries. To address both the importance of reviews and their integrity, the FTC is introducing new rules, which the FTC believes will enhance transparency and fairness in user reviews. Host Scott Loughlin, along with Hogan Lovells lawyers Lance Murashige and Harsimar Dhanoa, will explore how these regulations will impact ecommerce and create a new regulatory overhang for user reviews. This discussion will provide valuable insights into the impact of these changes on both businesses and consumers.

Existing and emerging individual rights across U.S. privacy laws

Host Scott Loughlin is joined by Hogan Lovells teammates Aaron Lariviere and Rachel Parrish to examine the evolving landscape of individual privacy rights under U.S. state laws in this episode of The Data Chronicles. Together, they discuss how differing privacy rights—such as access, deletion, and opt-outs—create compliance challenges for organizations operating under the disparate set of U.S. rules. This discussion provides valuable insights into navigating these intricate state-specific laws and implementing effective strategies for compliance.

2024 State legislative roundup

The dynamic legislative landscape takes center stage in this episode of The Data Chronicles. Across the United States, state legislatures have passed numerous bills relating to privacy, online safety, and data governance, contributing to the complex regulatory environment. This episode recaps the legislative changes in the first half of 2024, featuring insights from host Scott Loughlin and Harsimar Dhanoa, an associate dedicated to privacy and cybersecurity at Hogan Lovells. Join them as they discuss the implications of these new laws for businesses and consumers, and what lies ahead in the dynamic intersection of technology, law, and policy.

Insider Threats | Navigating hiring risks from foreign adversaries

This episode of The Data Chronicles focuses on insider threats in the hiring process. Recent reports have highlighted a concerning trend where North Korean nationals seek and sometimes secure jobs in the United States and other Western countries using sophisticated methods to evade sanctions restrictions and potentially steal data. These developments have reignited discussions on how organizations should handle insider threats from sanctioned countries during recruitment. Joining Scott Loughlin are Dan Ongaro, Hogan Lovells senior associate, and Landon Winkelvoss, co-founder of NISOS, a firm specializing in managed intelligence and digital investigations. Together, they share their insights, dissect the complexities of this issue, and propose strategies to enhance organizational security from insider threats, both foreign and domestic.

Navigating NIS2 | Cybersecurity in the EU

In this episode of The Data Chronicles, host Scott Loughlin is joined by Hogan Lovells counsel Dan Whitehead to dive into the evolving realm of cybersecurity regulation in the European Union (EU). Together, they explore the adoption of the Network and Information Security (NIS2) Directive, a cybersecurity framework set to impact a wide range of industries including tech, life sciences and other critical infrastructure provided both within and outside the EU. The discussion delves into the evolving nature of cybersecurity law, highlighting the implications on security governance, board-level oversight, and incident reporting, along with the GDPR-level fines for non-compliance. Listen as these regulatory changes are dissected and learn about how organizations are looking to comply with these new standards in practice. 

Bug bounties and legal considerations of security researchers

In this episode of The Data Chronicles, host Scott Loughlin is joined by Hogan Lovells senior associate Dan Ongaro to explore security researchers, in particular, how they differ from threat actors and best practices for handling security researchers effectively. Discussion includes bug bounties and other vulnerability disclosure programs to help organizations remain secure and responsive to legal implications of security researchers such as when researchers cross the line to potential incidents or breaches.

AI issue spotting – A mastery series for lawyers

Since the launch of The Data Chronicles podcast in August 2023, we have recorded over 50 episodes covering a wide variety of topics and issues. Unsurprisingly, a common issue popping in many of the episodes is artificial intelligence. With so much interest in AI and many of our listeners asked to advise on the many legal issues arising from its use, we have developed AI Issue Spotting – A Mastery Series for Lawyers — a special series dedicated to equipping lawyers with the essential insights needed to understand the issues arising from artificial intelligence across legal disciplines. AI continues to disrupt industries, and the legal profession is no exception.  AI lawyers now need to know aspects of every legal specialty. It’s a difficult task so the Mastery Series is here to help.

Rocky mountain high-risk AI – unveiling Colorado's AI Act

In this episode of The Data Chronicles, we explore the groundbreaking Colorado AI Act (CAIA), the first cross-sectoral AI governance law in the U.S. Host Scott Loughlin and Hogan Lovells senior associate Sophie Baum explore the implications of this pioneering legislation. Together they discuss the major provisions of the CAIA and highlight developer and deployer obligations, enforcement and rulemaking components of the bill and what companies need to do to prepare when CAIA goes into effect in February 2026.

The role of law enforcement in cybersecurity

In this episode of The Data Chronicles, we examine the role of law enforcement in cybersecurity. Host Scott Loughlin leads a discussion with Amit Kachhia-Patel, Assistant Special Agent in Charge (ASAC) overseeing the FBI New York Field Office’s cybersecurity squads, and Pete Marta, partner at Hogan Lovells, as they navigate how companies may leverage the expertise and resources of the FBI in a cyber crisis and explore the evolving landscape of cyber threats globally. Join us as we uncover the collaborative efforts between the private sector and law enforcement needed in combating cybercrime.

Net Neutrality alters the online ecosystem

The U.S. Federal Communications Commission is once again top of mind for players in the digital economy. The FCC has reinstated net neutrality rules as part of Chairwoman Rosenworcel's push to play a larger role in network, cyber, and national security issues. In this episode, host Scott Loughlin is joined by Hogan Lovells senior counsel, Charles Mathias, and counsel, John Castle, to discuss the privacy implications of the final rules, including how this policy could further restrict foreign access to data, and grant FCC authority over addressing cyber vulnerabilities and imposing other data protection obligations.

Rapid reaction | Maryland’s new kids code

Gov. Wes Moore made Maryland the second state to try to create strong limits on information collected on children by signing a new age-appropriate design code into law. In this rapid reaction episode, host Scott Loughlin is joined by Hogan Lovells associate Harsimar Dhanoa to discuss the new law, known as the Maryland Kids Code, and how it seeks to limit data that could be collected from children online and help keep children safe online.

Guarding your inbox | Navigating email cyberattacks

Email cyberattacks: a silent threat lurking in our inboxes. In this episode of The Data Chronicles, we dive into the dark world of email-based cyber threats, from phishing scams to misdirected wires. Host Scott Loughlin is joined by Hogan Lovells partner, Nathan Salminen, to discuss the tactics hackers use to deceive users and exploit mailboxes. Learn practical tips to safeguard your inbox and your data as we unravel the complexities of email security against digital adversaries.

Building the AI lawyer skillset – AI is now a competition issue

Predictions are that artificial intelligence will intersect with virtually every aspect of our lives and seemingly its impacting every legal discipline. With the issues so widespread and varied, AI lawyers seemingly need to know how to issue spot everything. Is that even possible? In this episode of The Data Chronicles, we examine relationship between US antitrust law and AI. Host Scott Loughlin leads the conversation with special guests Edith Ramirez, partner at Hogan Lovells and former chairwoman of the Federal Trade Commission (FTC), and Chris Fitzpatrick, senior associate at the firm. Together, they explore how AI is transforming market dynamics and how regulators see AI triggering antitrust legal concerns and obligations.

Maryland's comprehensive data privacy bill

Did you miss our analysis of the Maryland comprehensive privacy bill? If you prefer a quick podcast discussion, we have that too. Join Scott Loughlin, co-lead of the Hogan Lovells Privacy and Cybersecurity practice, and Hogan Lovells associate Harsimar Dhanoa in a rapid reaction episode discussing the newly passed bill.

The EU AI Act I What you need to know

In this episode of The Data Chronicles, we dive into the groundbreaking legislation of the European Union (EU) Artificial Intelligence (AI) Act. With artificial intelligence increasingly permeating various aspects of our lives, regulating its development and deployment has become the focus of many policymakers. Host Scott Loughlin is joined by Hogan Lovells partner and co-lead of the Privacy and Cybersecurity practice, Eduardo Ustaran, to break down the key components of the EU AI Act and explore its objectives, scope, and implications for businesses around the world. Through tactical insights and analysis, we aim to shed light on how this legislation is shaping the future of artificial intelligence in Europe and beyond.

(Human) AI lawyers I A new legal discipline?

Is AI law a new legal discipline for lawyer specialization? The Data Chroniclesis interested in knowing the answer. In this episode, host Scott Loughlin is joined by two AI attorneys, Tiffany Georgievski, AI, Data Privacy and IP attorney with SonyAI, and Peter Tsapatsaris, lead counsel of AI at Salesforce, as they discuss the role of an AI attorney, the essential skillset required for success, and whether AI law should be new category for the legal bar.

White House Executive Order introduces restrictions on U.S. data transfers

Host Scott Loughlin and Hogan Lovells partner James Denvil examine the recent Executive Order (EO) issued by the Biden Administration. Designed to limit access by countries of concern, including China, to personal data of Americans, this EO marks a significant development in cross-border data protection policy. Together, Scott and James explore the implications of the EO, shedding light on its potential impact on the digital ecosystem and how this game-changer in data governance will have far-reaching effects and challenges for businesses operating in the digital landscape.

Cookie consent in the EU | What you need to know

In this episode of The Data Chronicles, we exam complex legal frameworks for website cookies in the EU. Cookies, those little bits of data stored on our devices, play a significant role in shaping our online experiences, from personalization to tracking user behavior. However, with great power comes great responsibility, and cookies have found themselves at the center of various privacy and compliance debates relating to their lawful use. Host Scott Loughlin is joined by Hogan Lovells partners, Joke Bodewits and Gonzalo Gallego as they highlight the functionality, legality, and future implementation of regulations surrounding cookies in the EU.

Scraping the surface | What you need to know about data scraping

Data scraping, the automated extraction of information from websites, has become a ubiquitous practice in today's data-driven world. However, as organizations harness the power of scraped data to gain insights and drive innovation, questions arise regarding its ethical and legal implications. In this episode of The Data Chronicles, host Scott Loughlin is joined by Hogan Lovells partner Eduardo Ustaran, counsel Lauren Cury, and senior associate Alyssa Golay as they delve into the realm of intellectual property (IP) and privacy. As the appetite for data grows, so do concerns at safeguarding privacy and IP rights in an increasingly digitized world.

Privacy in the granite state | New Hampshire's upcoming privacy law

Live free or die can now can be applied to consumer privacy. New Hampshire is the latest state to pass comprehensive consumer privacy legislation. Listen in to join host Scott Loughlin and Hogan Lovells associate Harsimar Dhanoa for a rapid-fire analysis of the newly passed bill.

Health privacy | New state consumer health privacy laws

Several states have passed consumer health privacy laws that include unique obligations for a wide array of health-related data. In this episode, host Scott Loughlin is joined by Hogan Lovells counsel Donald DePass and associate Paige Papandrea to discuss the background of these laws, what requirements and trends are in motion, and the challenges that await.

Health privacy | Geofencing

In the post-Dobbs era, concerns have arisen regarding the potential for organizations or governments to gather data from smartphones, revealing information about individuals' visits to medical facilities. Join host Scott Loughlin in this episode as he delves into the pressing issue of geofencing with Hogan Lovells associate, Paige Papandrea. Together, they navigate through the landscape of emerging state laws concerning health privacy and explore the jurisdictions where these laws are emerging, and provide insights into the implications these new requirements hold for organizations navigating the intricacies of health data privacy.

Research data in the EU | Challenges and opportunities

Navigating the intricacies around the secondary use of research data in the European Union (EU) can be daunting. Building upon a previous episode on this subject under U.S. law, in this episode we delve into the EU regulatory landscape governing data usage in research. Scott Loughlin is joined by Hogan Lovells partner, Patrice Navarro, to unravel the complexities, shedding light on the nuanced rules governing data collection and its secondary use for research.

AI governance | What you need to know

Companies are excited about AI and the many benefits it can offer. Meanwhile, the many risks are real and legal teams are looking for ways to manage them. What’s the answer? It starts with AI governance, and that’s the focus of this episode of the Data Chronicles podcast. Host Scott Loughlin is joined by Kimberly Zink, a privacy professional with a long history in leading privacy, data governance and, now, AI teams. Together, they explore how businesses and their legal advisors can transition from merely assessing risks to actively addressing them at scale, including the establishment of the right internal infrastructure and processes to make responsible and risk-based use of AI.

Data protection in Africa

With more than 30 African countries adopting data protection legal frameworks and the rapid development of privacy laws in the Middle East,  organizations operating in the Middle East and African (MEA) region need to understand their obligations and compliance risks. On this episode of the Data Chronicles, host Scott Loughlin is joined by Hogan Lovells Senior Associate, Aissatou Sylla, to discuss the general overview for the data protection laws in place in the MEA region, highlight the key privacy considerations and obligations and spotlight enforcement trends for each jurisdiction with respect to consent, direct marketing, DPA registration, data transfers, localization, sensitive data, children's data, breach notification requirements, and more.

Rapid Alert | Responding to zero day found in popular VPN software

Addressing zero-day security vulnerabilities requires fast work. In this 10-minute episode, we highlight a newly announced vulnerability in Ivanti's Connect Secure VPN software that has the government and cyber professionals concerned. Since recording on January 15, 2024, this dynamic threat has rapidly evolved. Professionals report the potential for multiple waves of attempted exploitation. The Data Chronicles is here to help and provide you what you need to know to take action. Host Scott Loughlin is joined by Charles Carmakal, Chief Technology Officer at Mandiant, a prominent cybersecurity firm to discuss the vulnerability, the nature of the threat and immediate mitigation steps.

New Jersey's expected comprehensive privacy bill – instant reactions

Did you miss our analysis of the comprehensive New Jersey consumer privacy bill? If you prefer a quick podcast discussion, we have that too. Join Scott Loughlin, co-lead of the Hogan Lovells Privacy and Cybersecurity practice, and Hogan Lovells associate Harsimar Dhanoa in a quick reaction episode of The Data Chronicles. They discuss the bill, what’s new, what’s the same, what’s different and what you need to know.

Conducting secondary use of research data in the U.S.

Researchers and sponsors often want to use data from research studies for research not necessarily contemplated in the protocol or informed consent from the study. Scott Loughlin, co-lead of the Hogan Lovells Privacy and Cybersecurity practice, is joined by counsel Melissa Levine to discuss the complex interaction of U.S. federal and state research and privacy laws that affect the secondary use of research data. They tackle what organizations should consider when evaluating whether to proceed with a secondary research use, the compliance considerations, and approaches to obtaining consent for secondary use from the start of the study and ways to mitigate risk when the consent obtained does not cover the intended secondary uses.