Ms Helen Dixon:

No. To date, they have not been accessible and easy enough to use. For example, on the very case the Chair raised, the access to friend data on the app developer platform prior to the 2014 upgrade, there was in fact a user setting, an at app platform offsetting, which users could toggle. Nobody knew what it meant. There was no pop-up or bubble beside it to explain what it meant if one toggled it one way or another. It has been inadequate to date.

We have high hopes of what the GDPR is demanding in terms of obligations on data controllers. We have promises from all the major platforms that we are going to see something significantly new and different around transparency come 25 May 2018. We will be supervising this to ensure we see a whole new level of transparency.

The platforms tell us that they have been using new design methods in order to better engage users around privacy settings. There are also new principles in the GDPR such as privacy by design, privacy by default and data minimisation requirements, which will provide extra supervisory hooks for us in terms of how the platforms operate.

On European and Irish elections, it is important that users who engage on online platforms and consume their news mainly through these, engage with the control settings. If they choose to receive interest-based advertising, which some users legitimately choose, they have to be aware they may be subject to advertising which is pushing them in one specific direction and ensure they consume other types of news from other publishers, rather than relying solely on social media.

Regarding Irish elections, data protection laws and the GDPR are strong enough to prohibit personal data processing. The ground-breaking investigation the UK Information Commissioners Office is undertaking on novel uses of data analytics in the electoral context will provide useful policy outcomes which will have application across all EU member states. The UK commissioner has updated that she hopes to have some outputs from that investigation next month.

Senator Lombard correctly cited the level of fines under GDPR will be high. They can come to 20% of global turnover in certain cases. When one looks at the global turnover of the platforms, this could be a significant sum of money. I have attended several events recently at which the MEP and former European Commissioner who proposed the GDPR, Viviane Reding, has said these levels of fines are comparable to competition law fines because it is necessary to grab the attention of the industry, particularly regarding the importance of protecting personal data. Will we end up tied up in litigation processes challenging any decision we make to apply a significant fine? That is certainly a possibility. The stakes are going to be much higher in terms of the outcome of any investigation. We conclude the corrective powers we exercise and the sanctions we decide to apply.

We could look at recent examples from the competition law sphere. Last year, the European Commission fined Facebook WhatsApp €125 million concerning information it did or did not give the Commission during its assessment of its merger application in 2014. That was not appealed. The European Commission fined Google €2.6 billion in the summer of 2016, due to favouring its own shopping comparison website. That was not appealed either. It will be circumstantial in some cases as to whether the decisions are appealed. However, undoubtedly, there will be more litigation across the board regarding all types of sectors we regulate and where we seek to impose significant sanctions.