Dr. Johnny Ryan:

In the case of real-time bidding, strangely, this city is the crucible, along with Brussels. The IAB is regulated, under the general data protection regulation, GDPR, from Belgium, and Google is regulated, under the GDPR, from Dublin. The two regulators have appropriate law and massive legal authority. The Belgian data protection authority is investigating the IAB, while the Irish data protection authority is investigating Google. The Irish regulator received my complaint in respect of the issue well over a year ago. I understand she is hard pressed and it is difficult to process a large amount of work. Nevertheless, elections are approaching in various parts of the world and these are essential, life-and-death matters.

I suggest that the forum is, in fact, in this House, in the Chamber.

That is because our regulator can be scrutinised by no one other than Members of the Oireachtas. I can sue the Data Protection Commissioner if she does not effectively act on the complaint and evidence I have given her. That is something we have in reserve. A far better way of forcing action is to provide resources to regulators in both jurisdictions and to make sure there is appropriate scrutiny of the regulator for these critical things. I realise I am going over time. The whole idea of this regulation was that it was risk-based. We would focus on the key and important players and leave the greengrocer, for example, alone. In that case, this biggest data breach we have ever had in digital history should be the number one item and it does not seem to be.