Ms Helen Dixon:

Regarding the co-operation between data protection authorities, we have excellent fora but there is huge room for improvement. For example, the general data protection regulation provides for something new called joint enforcement operations. We have not really got them off the ground yet in the EU in terms of data protection authorities lending resources to one another that can be authorised on investigations, so there is lots of room for improvement there. Regarding co-operation with the big platforms, the relationship is one of regulator to regulated entities. The regulated entities are obliged under the GDPR to co-operate with investigations conducted by the data protection authority. To date, the 21 big tech organisations in respect of which we have large-scale investigations open are engaging and co-operating. With equal measure they are challenging at every turn and seeking constant clarifications on due process. They are obliged under various measures under the GDPR, for example, to conduct data protection impact assessments in certain circumstances and to consult with us as a data protection authority where they identify high risks they can mitigate and so on. Again, that form of co-operation with, or submission to, the regulator is already in effect. What remains to be seen is how the investigations we currently have open will conclude and whether there will ultimately be compliance with the outcomes of those investigations or whether they will be subject to lengthy challenge and so on. The big question of whether we will be able in the near term to drive the kinds of outcomes we want is still open and awaits us as a data protection authority to put down the first final decisions in a number of cases.