Dr. Johnny Ryan:

I thank the Deputy for these questions. I will get into the question of the GDPR and whether it is strong enough. Our view is that it is very much strong enough. It has some useful tools, even before the AI Act, which we could use right away. For example, Article 9 of the GDPR lets us decide what specially protected personal data is. Anything that could reveal, for example, people's sexual life, ethnicity, political views or outlook, or any interesting data about them that lets us know what makes them tick so you can push their buttons, which is what we are talking about, falls into that category. We have strong protections, if they were enforced, for those data. We also have protections that relate to so-called automated processing. We have some useful law. We are just waiting to see it enforced. On the enforcement question, the ICCL has found it necessary to litigate directly. Luckily, the GDPR allows us to do that in Germany, Ireland, Luxembourg and Belgium, as we have this big deficit in enforcement. We are waiting for big news about the new leadership of the DPC today. Let us see what happens there.

On the question about the framework of legislation that applies and the role of Coimisiún na Meán, we have another important law at European level, namely, the audiovisual media services directive, AVMSD, which was last updated in 2018. That directive, together with the Digital Services Act, are bundled together domestically in the Online Safety and Media Regulation Act, which empowers Coimisiún na Meán. Under this binding code we have all spoken about at some point this morning, the coimisiún cannot do anything on Netflix in particular, in Professor O'Sullivan's example, but it is empowered to act on social media video platforms, which arises from the AVMSD. Its powers are very broad in that respect. We have got two players: the DPC and Coimisiún na Meán. We have tools to solve these problems.