Dr. Johnny Ryan:

I thank the Senator. In the early days of the GDPR, our DPC and its staff very often used the refrain that the GDPR is risk-based. The idea there is a sensible one, that is, that the things that cause the most risk and the deepest harms to the most people deserve the most scrutiny. However, those things are hard to do and it is easier to go after the small fry. That is a problem. It is why we need independent consideration of how to fix this problem.

One thing I have noticed at this hearing is that our colleagues at the DPC will, it seems, reject any criticism as unfounded. Criticism is political if it comes from another authority. It is tied to stories about tax and so forth, even though it was not. It is improper if it comes from the European Parliament. If an Advocate General of the European Court of Justice has opined about "persistent administrative inertia" of Facebook's lead authority, which is the DPC, that criticism is also rejected, contrary to fact. We are all concerned that fundamental rights are hanging in the balance and the real hazard that we slide towards a dystopia. We must engage with these matters. The Senator is asking a question that appears to need an independent look.