Ms Jennifer O'Sullivan:

The Deputy is right that we have seven inquiries into Facebook, two into WhatsApp and a further inquiry into Instagram, which is also owned by Facebook. That represents a significant proportion of our formal inquiries. Some of the inquires were in response to complaints, as the Deputy said, but others we undertook of our own volition having examined the context and wider situation. On the timeline, my colleague outlined the very structured, formal, robust and consistent approach we need to take to these inquiries. The latter elements of the process include engagement with our colleagues around the EU in the format of the European Data Protection Board. We are obliged to consult with those colleagues as we near the decision-making process. We must submit a draft decision to those colleagues which they are entitled to examine and submit reasoned and relevant objections on. We must take account of those objections, consider whether they have a bearing on our draft decision and seek consensus. That process takes time in its own right.

The decision of our French colleagues on the Google case involved a somewhat different situation. Google only established itself as a controller in Ireland in January 2019. Prior to 22 January 2019, any data protection authority around Europe with competence could have examined a complaint brought to it and taken enforcement action. That is what our colleagues in the French data protection authority, the CNIL, did. A complaint was submitted to them at the end of May and at the time the GDPR came into effect. The CNIL engaged in collaboration and discussion with ourselves and other members of the European Data Protection Board to ensure we carefully examined the question of competence given that Google had not established a data controllership in the EU at all. After that careful examination, we concluded that it was a matter for the CNIL to take up directly. However, because it did not come under that definition of cases that are examined under the one-stop-shop model, the CNIL did not have to go through those stages of consultation with colleagues around the EU and EEA on the case. It was a much shorter process which is why it was able to announce its decision on 21 January this year. With the inquiries under way here, we are facing into that consultation process with those colleagues.