Ms Helen Dixon:

Any decision we will ultimately make is binding only on the data controller, against which we make the decision. However, I did mention in response to the last question that there is a demand from controllers of all types for more certainty as to what the correct objective standard in application of the principles looks like.

We anticipate that any of the decisions we make in these larger scale cross-border investigations will serve as a precedent and will be followed by others, not least because they will wish to avoid enforcement action subsequently being taken against them on similar issues. It is important to be aware that when we are applying the principles to something like online behavioural advertising, we must go back to what Mr. Rotenberg was saying about underlying business models. The GDPR is not set up to tackle business models per sebut to apply principles to data processing operations. When we come to look at something like advertising technology or online behavioural advertising, there is, therefore, a complexity in that we have to target multiple actors. I mentioned earlier that for that reason we are looking at publishers at the front end that start the data collection from users. It is when we first click on a website that the tracking technologies such as pixels, cookies and social plug-ins start the data collection that ultimately ends up categorising us for the purposes of sponsored stories or ad serving. We are looking at the advertisement exchanges, the real-time bidding system, the front-end publishers and the advertisement brokers that play an important part in all of this in combining offline and online sources of data. We will rigorously apply the principles against those data processing operations. When we conclude we will then have to see if that adds up to a changing of the underlying business model. The jury is out on that until we conclude.