Mr. Dale Sunderland:

Mr. O'Carroll referred to the GDPR codes of conduct and certification. The GDPR says that they are mainly industry-led but data protection authorities have a role to encourage the development of codes and certification. A code of conduct is not what we might traditionally know as a code in the sense that everyone signs up to behave themselves, but in a GDPR context, it is about taking a principle of transparency, for example, and saying at a more granular level, for voice assistant technology, what is the industry going to sign up to say how it delivers transparency for this type of technology. The GDPR then requires that there be an independent monitoring body and that the code of conduct be signed off by the relevant data protection authority or if it is a pan-European, cross-border code covering a number of jurisdictions, signed off by the European Data Protection Board. We are starting to gear up for the DPC and other data protection authorities to encourage the development of codes. An example is that the industry could come together to develop a code for voice assistant technology misactivations. It would go through a regulatory scrutiny process and be signed off in the context of voice assistance, because it would be a cross-border processing code, ultimately by the European Data Protection Board. We have been very proactive in that space in providing guidance. Mr. Cathal Ryan was the lead rapporteur on the codes of conduct paper that the European Data Protection Board published last year. That is an area we will progress in 2020. We have said in another context that we would focus on children and children's rights in the first instance. We will work with the tech companies and try bring them to the table to agree a code of conduct. There is lots more scope for that concept.