 I'm going to make three claims about this judgment which we have, which is ostensibly only about generalised search engines and the internet ecosystem as a whole. In some ways I'm following on from all as excellent presentation this morning in some of these claims, but hopefully there'll also be some differences and a difference of emphasis as well. So the first claim is that Google Spain in fact solidifies or largely solidifies at least the fallout from Google Spain in terms of how DPAs have responded to it. It solidifies a dominant data protection paradigm, a paradigm which is dominant legally and even more so is dominant amongst data protection authorities. And that paradigm has serious implications not just for generalised search engines but for almost every type of internet actor. And you might say well how can that be in the sense that Google Spain is seen as being so novel and so distinctive and in a way so narrowly cast on one particular actor? Well I think it's because there's a huge gap between legal interpretation, the interpreted stance including of data protection regulators and enforcement. Enforcement has been extremely limited and sporadic, so extremely limited and sporadic that much of the internet community until the Google Spain decision was virtually unaware that any of these things in principle could apply. So what is this paradigm I'm talking about? Well it's composed of four key pillars I think, some of which map on to all those various elucidations. The first pillar is that not much is excluded on the internet from data protection and that has two elements to it. The key terms of the directive have an extremely broad scope and we know this right back from the Lindquist case where simply referring on an internet page to working conditions or hobbies of an identifiable person was processing of personal information. Didn't matter that it was an unstructured page, it didn't matter that the information was relatively trivial. Fast forward to Saturn Media and the claim there was, oh but there must be some kind of public domain exception. At least if the material has already been published in the media, surely there's some kind of exception for media published material. And the court said absolutely not, personal information is any information relating to an identified or identified person, processing is virtually anything you can do with data and regulated processing anything on the digital type device. It's always covered. The second element of not much being excluded is that the exemptions are exhaustive and extremely limited. Again Lindquist showed the way on this, dealt with the scope of EU law being an exemption and the court said well that's only about state authorities performing highly specific state-like functions like national security. Even that we now see much more debate about. Private and family life they said could never relate to indeterminate publication, could never relate to publication generally on the internet. Saturn Media reiterated those precise claims and also dealt with the idea well aren't there some kind of implicit exemptions here. No the limitations on scope they said were exhaustive and they were narrow. That's the first pillar. But you might say well Saturn Media said okay we don't have the exemptions but we have the special journalistic and other expressive purposes so is there an issue? Well yes because the second pillar is that the special journalistic and other purposes are in no sense unbounded. They're not unbounded because even when they apply as Saturn Media said any derogation has to be only as strictly necessary so we're not dealing with an exemption we're dealing with a derogation. But more importantly for our purposes they are not unbounded because despite the language of Saturn Media saying disclosure to the public is a journalistic activity. That public is a collective public, it's disclosure to the body politic, it's trying objectively to contribute to a general public debate. That kind of activity is included but that does not mean that any form of indeterminate publication for individualised privatised purposes is covered. Again we kind of knew that from the Lindquist case where Paul Mrs Lindquist's website was clearly an indeterminate publication and the commission thought to come to her rescue by saying oh well her page is a literary and artistic work, it's a work of literary and artistic expression and should be treated as such. The court pointedly refused to accept that as valid and it didn't address it but it refused to say yes of course this is expressive purposes for the purposes of special purposes. Mrs Lindquist's site was not orientated to a collective public debate. The third pillar is that yes there might indeed be a need to balance state protection with other rights and even with the general principle of proportionality. And we again know this from the Lindquist case because effectively what the court said in Lindquist was we're not willing to say you're a journalist, we're not willing to say you're exempt, but by the way authorities and courts must take care to ensure that the directive isn't interpreted to be in conflict with freedom of expression and similar rights. But it's rather unclear because another strand and the last pillar of the data protection paradigm is that data protection norms are often overriding. There is no particular need to balance with freedom of expression. Any need for balance has already been accommodated within the data protection regime and the key case here is Bavarian Lager where you had a transparency request. The first instance court sought to say well we'll look to see if privacy and integrity are violated, we'll kind of eyeball it, we will not apply the rigours of data protection law if we don't think privacy and integrity are being affected very much. And the court said no, the court of justice eventually said no that's not what you should be doing. Any undermining of privacy and integrity must always be examined and assessed in conformity with all the legislation on personal data. You simply apply the statute, you apply the code. So that's the paradigm and it's shared by dominant legal interpretations but even more so it's shared as a dominant regulatory approach. If you ask DPAs as I did what their interpretive stance is, you will find very broad scope, a limited notion of what journalism and the like is and then a dispute as to when you balance and when you don't need to balance. And that broad contour applies broadly to all online operators from news archives. By the way there's an interesting debate about when the full rigours of the right to be forgotten apply because Google news as I understand it as an aggregator is considered to be fully within the right to be forgotten. But maybe the Times newspaper index for example isn't but at what point do you move over from one to the other? It's a complicated issue I would have thought. But anyway from news archives to bloggers to all forms of social networking to rating websites, street mapping as well as search engines. Every internet actor is in principle affected by this paradigm and I sought to test this empirically through a survey of European economic areas. The EU plus the three associated states data protection authorities and got a very good response of 80% of the national data protection authorities replied plus six operating at the sub national level mainly in Germany. So it's pretty authoritative results and I presented them with publication scenarios linked to all of those seven online media actors which I've been talking about. This was before the Google Spain decision was handed down and in terms of interpretive stance it backed up a very rigorous in principle interpretation of this paradigm. A maximum of only 12% of the standard answers as to these publication scenarios which by the way are in your handout in terms of the very precise questions which are asked. But they concerned everything from a blogger news archive through to a street mapping service. Across all the examples a maximum of 12% of the standard answers in any one case said that the activity was exempt from data protection. In terms of special expression a plurality of data protection authorities only considered that the journalistic or allied special purpose exemption applied as regards news archives. Much to my surprise even in the case of the individual blogger blogging about celebrity gossip there was not a plurality and support for the idea that the activity was journalistic or alike. And part from the news archive and the blogger where in the case of the blogger there was seem to be support for the idea you did need to be a balance need to have a balance with other fundamental rights. Between just under 50% and almost 100% of DPAs simply responded that data protection law had to apply in full. So you know really rigorous interpretation of the law in principle and not just for general search engines for pretty much all internet actors. So what about enforcement? I also ask them you know have you actually taken enforcement action in these areas and if they had actually they were there was also an element of the questionnaire which I won't go into about what enforcement action they had taken. And I think the results here were intriguing in a way with a flick side of the broad interpretive approach which I've been talking about because this was the very narrow nature of enforcement. Almost 25% of data protection authorities said oh well we might have this broad interpretive approach but we've never taken any enforcement action since the director has been in place which has been you know for decade you know 15 years plus. We've never taken any enforcement action against any of these actors in relation to publication. And then if you look at the next two along which are roughly 10% who've only taken action in one or two cases which might be saved for Google Street View. You're looking at a picture in terms of enforcement where almost a half of DPAs have effectively never really taken any significant enforcement action despite that being the paradigm. And there I think you begin to understand the dynamic where the internet community seems to be unaware that data protection is considered to apply. Well it's unaware because there's been so little enforcement of it. I asked about budgeting and the survey seemed to suggest that perhaps the average budget of a DPA is only around three and a half million euro which translates into roughly 30 cents euro cents per data subject or per capita actually per individual citizen resident of the jurisdiction. And I think you know you can see that that kind of level of resourcing is just of the total mismatch of the level of tasks the law sets data protection authorities because this is just one one relatively discreet area that DPAs are meant to be regulating. This is by no means the only part that's meant to be regulating. It's got to regulate the public sector, it's got to regulate all sorts of forms of data posting of which publication is just one. And three and a half million euro is certainly not going to come anywhere near performing that task. And we also tried to or I also tried to complete along with many research systems a sort of public domain analysis of enforcement which to be honest showed much less evidence of active enforcement. I mean what evidence there was showed very soft forms of enforcement and very limited forms of enforcement compared to what was being reported in the survey. So even less seems to be in terms of regular and active activity than those results I just showed you a moment ago. So just a few brief conclusions and looking to the future in a way because obviously these conclusions are sort of where I began with but is there any real reason to think that this will change? I think it will only change if it is recognised that it is dysfunctional to have a situation where the interactive stance of regulators is at such variance with the practice in terms of how that is in reality in force. It will only begin to change if we have a debate about the dysfunctionalities and costs for the rights people think they have for the responsibilities that controllers might have. If we start to have that debate about that balance and gap being a problem. And also it will only start to change if we begin to address the resources and budgeting that regulators have available in this area to perform what in an internet area are more and more important tasks of balancing people's rights to be protected against freedom of expression. Thank you.