Peter Craddock: How ambitious is the Digital Omnibus?
With Peter Craddock, tech, data and cyber law expert.
This episode of EU TECH LOOP Radio features Peter Craddock, a Brussels-based data, cyber, and tech lawyer and Partner at Osborne Clarke. In this episode, we discuss the recently published Digital Omnibus - the EU's major review of data and related rules, which has already drawn fiery criticism from all sides.
#1 What is the Digital Omnibus?
But let's start with the basics: people outside of the Brussels bubble, the policy bubble, are increasingly confused about all the omnibuses that we have. We had the AI Omnibus, we have the Digital Omnibus, some people call it the "Data Omnibus," etc. So, could you please briefly introduce us to what the Digital Omnibus is about?
Of course. The reason for the confusion is actually very simple, because initially we were talking about the Digital Omnibus on the AI, and then the one on the GDPR, and so on. So gradually, they became the AI Omnibus, the Digital Omnibus.
But basically, the Digital Omnibus is the one about trying to consider amendments to the GDPR, to the ePrivacy Directive (which is mostly known for its cookie provision, but it also covers a number of telecom aspects), and then also a range of other laws, in particular, the Data Act and the Data Governance Act basically have some similar functions, but a different audience. And it's about trying to merge them. So really, this is why we talk about the Digital Omnibus, because these are digital regulation tools, and it's about trying to basically see: can they be improved going forward?
#2 Strengths and shortcomings of the Digital Omnibus
Very recently (we're talking on Friday, October 23), the Council of the EU published a final text on the Digital Omnibus, which will now move to the negotiation phase. Does the final text, in your opinion, match the EU Commission's declared or initial ambition to simplify data-related rules and make them more workable for European businesses and startups, also adding to European competitiveness in general?
Well, this is indeed fresh off the press, given that this was yesterday, on the 22nd. But the Council's position, I'd like to say, is a fairly reasonable approach.
I find it unfortunate that it's moved away from some of the really interesting parts of the Commission's initial proposal, which was trying to find a way to address some of the practical concerns that have arisen in practice. By now, we're at year eight of actual enforcement in practice of the GDPR. There's been a lot that's come out of that over the seven years before the Digital Omnibus proposal came out, and the Council's position is taking a couple of steps back, but it's also trying to keep some really interesting elements in there. It's pedaling back on a couple of the more, I want to say, forward-thinking parts of the Commission's proposals, but it's keeping a lot of the essentials that were, anyway, very important to have.
Some of the practical examples: the issue of notifications across different jurisdictions. If you have a personal data breach that covers different countries, or if you have a data protection impact assessment, you're trying to figure out what the rules are according to one country or another. A lot of these things are actually very, very difficult for organizations of whatever size to deal with today. And so, in that respect, the fact that we're seeing some confirmation of the initial proposal, that's a good sign.
But we do have a bit of pedaling back on some other aspects that is a bit more unfortunate. And one thing that I'm slightly more pleased about is that there was a part in the Commission's initial proposal regarding the cookie rule, the ePrivacy aspects I was mentioning. That was going to cause a lot of problems in practice. And there, the Council has decided to take a more interesting and, I want to say, more future-proof approach to that. So, there are some positives in there.
Some of the unfortunate things that I think have disappeared over the past few months relate to, notably, the whole discussion regarding pseudonymization. There was an initial interesting proposal regarding the definition of personal data - a fairly controversial one for reasons that actually have never been properly analyzed - but there was a lot of positive in that initial proposal, and that's been set aside because of the controversy. And then instead, we're seeing some resurgence of more reactive and maybe even a bit too conservative approaches regarding the notion of pseudonymization.
And so, there are some positives and negatives. I'm hoping that the level of discussion with Parliament might lead to some readjustments, but we've seen that at the level of Parliament, you have a lot of different questions and concerns coming from different groups. And so, it's very hard to predict at this stage in which direction it might go.
#3 Pseudonymization and the definition of personal data
Let's dig a little deeper into the topic of pseudonymization. Initially, the Commission proposed that after personal data has been sufficiently pseudonymized, it shouldn't be considered personal data. This has drawn a lot of criticism. And as far as I understand, this topic is completely out. Could you briefly explain the current status quo?
So, the point about pseudonymization is that there are two components. The first one is the definition of personal data. And the second one is what happens when you're trying to assess whether something is within the scope of that concept or not.
So, the definition of personal data is the part that has been removed from the Omnibus. It was a suggestion to amend the definition to actually integrate some of the teachings of case law of the Court of Justice. I've always been a big proponent of that because it makes some case law that is fairly complex clearer, and you really need to understand the area of data protection law. You need to basically be a lawyer specializing in that to really understand what the Court of Justice has dealt with over the past few years. And so, I thought integrating that within the definition would be great for everyone because then you have more clarity. It is about making the case more accessible.
But it has led to some controversy, because there was one point where the Commission was taking a slightly different approach compared to some of the suggestions of the Court of Justice in one case.
And instead, what we've now got is the second part, which is about: how do you apply the notions? And this is because personal data is ultimately information relating to an identified or identifiable natural person. And so, if I know that this concerns Peter, okay, identified. But what if I say, "Well, this is something that concerns a male between the ages of..." (give myself a bit of room) "...between 30 and 50, and trying to figure out, maybe living somewhere in Belgium," that kind of stuff. That doesn't yet identify me as such. If you know more about the context or have additional data, maybe you can tie that to me, because let's say this is the information that's been revealed as part of our interview and so on. And then you suddenly start to attach that.
Without that information, it's pseudonymized data from your perspective, because you are collecting that information and you still have the key that links this information to Peter Craddock. But if that goes to someone else, if they don't have any way of connecting that to me as an individual, then from their perspective, it's anonymous data. And so, the whole idea of pseudonymization is a relative one. It's basically taking a look at the perspective of the person.
And so, what we had in the Commission's proposal was trying to say, you know, if you send over the interview to a contact of yours and they then see, "Well, Peter Craddock, his name is appearing in there, so I can actually link that to Peter," that's fine. Then we know it's personal data. What if the name doesn't appear in the interview? There's just my face on there, you don't see my name appearing. Well, then you'd need to have additional data at your disposal to be able to reconnect that to Peter.
And so, the question has been: what if you send data that is pseudonymized to a recipient? That recipient might then send it onwards to someone else. If the second recipient has access to the identifying data, is it actually personal data along the entire chain? So, also for that first recipient who sent it to the second one? Or is it only personal data for the second one?
Now, this sounds fairly complex, and it is, because it has massive repercussions. If you're dealing with clinical trials, you have patient data that is then used for scientific research, if that's passed along to another institute, another research institute, and they don't have a means of connecting that to someone, well, then they shouldn't have to deal with data protection rules. But if they themselves can pass it along to someone else capable of re-identification, then actually, they would have to comply with the entire apparatus of the GDPR. And this becomes really complex to put in place.
And so, what the Commission tried to do was, "Well, let's actually limit that risk."
What the Council has now agreed to do is go less far, because we're emphasizing the role that regulators can play in basically giving some more precision to the notion of pseudonymization. So, it's actually not as helpful as the Commission's proposal. They're going back towards the direction of more powers to certain regulators, which I find a bit unfortunate because we had an occasion to put that in the law, which is unique and gives more clarity to everyone. And instead, we're relying more on something that could create more legal uncertainty. So that, I think, is unfortunate.
#4 Fragmented interpretation and implementation of the GDPR across the EU
One criticism we always hear from startups, for example, is that if they want to scale or grow in Europe, they have to deal with complex, highly fragmented implementations and interpretations of the GDPR across EU member states. Would you agree that this is the case, and is the Digital Omnibus somehow addressing this issue, or would you say it's not?
The Omnibus is delivering on a couple of fronts - well, at least if it makes it in that form also past the Parliament - because the harmonization aspect is critical in relation to some things like: what is a personal data breach? What is a personal data breach that I need to notify? What kind of processing activity requires a data protection impact assessment? And here, we do have fragmentation.
DPIAs, the Data Protection Impact Assessments - I once did a compilation, and I had, for something like 20 EU countries, 220 scenarios in which a DPIA is required. And they weren't consistent. I ended up having more criteria in common across those 220 scenarios than the European Data Protection Board's official list of criteria. And so, there's an inconsistency there that is actually problematic.
And so, the Digital Omnibus could really simplify things for any organization, including startups, by creating greater certainty. But if you let regulators say, "Well, I can decide what this notion means; I have to issue guidelines on this or an opinion on this," then, actually, you aren't fostering as much certainty. Because those instruments can be adopted by the European Data Protection Board, we're not entirely sure what their legal value is. There are still question marks surrounding that.
And so, it would be much better if that was in the law. If it's not in the law, at least we have to find a way to provide feedback in a useful manner and challenge them if they are contrary to the law. And so, that fragmentation, I think, is disappearing slightly thanks to the Omnibus, if it gets adopted in the same form, but it could have been better.
#5 How could the GDPR be enforced better?
The EU Commission is specifically talking about how the EU will increasingly have to move away from directives towards regulations because this helps with regulatory certainty, increases harmonization, reduces fragmentation, and reduces gold-plating. But the GDPR is a regulation, and we are not exactly seeing harmonization, nor are we really preventing EU member states from either taking too much action or taking no action. Which is also possible and enshrined in the GDPR, for example, under the legitimate interest basis, where the GDPR recitals allow you to create legal exemptions for certain areas that are societally valuable, such as fighting fraud. So, what would be your response to that?
Well, you may think that it is a bit of a controversial topic, but I'm not so sure. A regulation can actually take different forms. You can have a regulation in which you say, "We are going to have a central, EU-wide institution in charge of enforcement." And so then, you automatically have centralized interpretations, centralized enforcement. If you have a regulation that says, "Let's leave national authorities in charge of certain questions," then you inevitably have fragmentation. And so, there are two kinds of regulations.
And in my view, a regulation that institutes a global form of interpretation and enforcement is better in terms of EU harmonization than one that leaves more power to national authorities. Now, what you could perfectly have is a bit of a combination, like saying, for instance, if you have a more local activity, that you basically only have to deal with one local authority. But the moment something is cross-border, then it goes to the EU-wide level, and not some kind of complex one-stop-shop type of approach that we've got under the GDPR and so on. You can basically have two levels if you really want to.
What we have in the GDPR is not that at all. We have national levels. Even in Germany, you obviously have the different Länder. And then we have one body that is not an authority, that is actually saying, "This is the line that everyone has to adopt." It's basically a secretariat. The European Data Protection Board is a secretariat; it has a small service, a small amount of staff, and then you basically are plugging in resources from national authorities to basically say, "Let's work together on a consensus basis on coming up with common positions." And so, that's not the same thing as saying we have a central body imposing a certain vision.
So I don't think the GDPR is a failure; I think the enforcement side and the interpretation side are one way we could actually improve things quite a bit.
#6 The Data Act and trade secret protections
Another important subject is the Data Act. The Data Act has, to my knowledge, only recently, a few years ago, been enforced fully - or not even fully; it was supposed to be enforced gradually by 2027, if I'm not mistaken. And it is already being reviewed. The Open Data Directive, Data Governance Act, and Data Act are being merged under the umbrella of the new Data Act. We've seen some countries like Germany advocating for stronger trade secret protections in the new Data Act. What is your opinion about the final outcome that we see in the Council's position? And does it balance the needs of large and small companies, or not really?
Well, with the evolutions regarding the Data Act, you basically have to go back to the origins of the Data Act and the Data Governance Act, which are basically about fostering the data economy, encouraging the data economy's development by forcing more situations in which data of one authority or undertaking has to be made available to others.
The Data Governance Act was the kind of public-authority version, where you have data at the public-authority level that someone else might find interesting. And then you have the Data Act, which is for more private undertakings, in a number of scenarios where you are creating data that may be valuable to others as well. And so, from a logical perspective, it makes sense to bring them under the same framework because, ultimately, they're pursuing a similar goal.
Now, the issue is that when you are a company, and you are forced to make certain proprietary information available, what kind of information is it, and could it be that it covers trade secrets? Because we know that proprietary data has value, it creates a competitive advantage. And so, you don't want to share your proprietary data. You basically are now being forced to kind of make it available to other parties. Why would you want to do that? Because it could actually damage your own position. So the counterargument has always been, "Well, you know, if you're opening your data to others, others have to do the same. So you might be able to actually find value in each other's data." But still.
What about trade secrets? If I have something that gives me a competitive advantage, that is of real value to my business, then actually, you are forcing me to disclose a trade secret. And then, as a result of that, I lose my competitive edge. I might actually lose value; it might have a huge impact on my business, etc. And so then, the whole idea of competitiveness actually gets brought into question, because it's not about fostering more competition. Suddenly it becomes, "Are you destroying my business as a result?"
So, the concerns that were presented regarding trade secrets really have to do with the idea of: how can we add layers of protection so that my trade secrets remain mine, that they are protected even if I am forced to make certain information available? So, what the Council has done is add, here and there, some tweaks to say, "Well, actually, there needs to be some level of guidelines from the Commission on what can be done in terms of safeguards, in terms of creating some kind of backstop so I do not need to reveal everything." And so, the suggested changes really have to do with trying to give those safeguards, give that a level of reassurance, in particular in relation to industrial trade secrets.
So, it's things like adding the fact that this really is only insofar as actually necessary that this disclosure has to take place, and so on. Those safeguards are interesting, and they seem to have convinced in particular Germany to cross the line and say, "OK, now we can agree to this."
We'll have to see what the implications are in practice, because it's not just the Data Act that has to deal with trade secrets. We've seen in case law of the Court of Justice that there are situations where trade secrets have to be disclosed to data protection authorities when assessing certain things. In particular, this was about things like automated decision-making and so on. And so, you actually have situations where you might be protecting trade secrets when there's a forced disclosure towards third-party beneficiaries of the Data Act in general (the new one), but you don't yet have the same safeguards in place when it comes to mandatory disclosure to certain authorities. So, we still have some inconsistencies in practice that we're seeing, that are not being talked about in the context of the Omnibus because it's something that's a bit outside of the initial scope. But you see that actually, we still have some tensions.
So, I think that the evolutions regarding the Data Act are positive. They give businesses more certainty that, if they are forced to open up their data to third parties, they do benefit from certain protections. But at the same time, we're not yet there in terms of the global protection of trade secrets as we should be.
#7 AI as a legitimate interest basis
Another important aspect is the AI development-related article. We've seen a lot of pushback from critics against the Commission's initial proposal. Some were saying that it opens up a pathway for foreign tech companies to basically grab all of our personal data for AI development, etc. In the meantime, European founders are saying they really need this and that it would be very valuable for developing homegrown AI solutions, services, and products. What's the status quo with that article?
So, the idea of this was trying to see how the use of data in the context of AI training can be facilitated. It's not just about the development of AI models, it's also about the operation. This is a very important point because, ultimately, when you are collecting data to feed an AI system, you don't necessarily want it to be stuck in time. You want it to be able to evolve based also on additional data that you're getting through its use.
One practical example is the fraud you mentioned earlier. Well, if I am doing some tests in the way that I'm handling fraud in a test environment with people around from the company that is developing that, well,then we all have our own preconceived notions. We have certain ideas, but that group of people is not going to represent all of the potential for misuse. And so, they're going to have some ideas, but they might not know everything. So part of the interest in using data, if we focus on the more negative side that models are trying to anticipate and prevent (anti-fraud, anti-malicious use, and so on), you have a number of scenarios that cannot be found kind of in a lab, that you need to basically get real-life data to actually be able to tackle.
Same thing with languages. You have situations where, if a model has been trained on a corpus of text and content that is predominantly, for instance, in English or in Chinese or whatever, then actually, if you're trying to suddenly face, "Well, what are the concerns of people in a smaller linguistic community?" For instance, the Basque Country, Wales. And so, you have a number of much smaller communities in linguistic terms that do not have as much information available online and so on. So then, you actually need to be able to feed some data regarding usage in order to improve capabilities in relation to those languages.
You have a number of scenarios where usage data is actually critical in order to help an AI system become more relevant, become better. What we had in the approach initially adopted by the Commission was really an attempt to say, "Well, it should be possible to do this kind of training at the development stage, at the usage stage, based on legitimate interest as a legal ground under the GDPR."
Now, what the Council has done is not depart from that completely. What they've done is they've said that there still is the same principle; it's still possible to do this on the basis of legitimate interest, but it doesn't affect certain obligations to basically take appropriate measures and so on. And so, it's not getting rid of the Commission's proposal, it's refining it.
Some are saying, "Well, this is a bad idea altogether; we need to get rid of it." Well, first, if you get rid of it, it doesn't change the fact that the law today already permits this in principle. That even data protection regulators have tolerated this, have recognized the fact that it is possible, because they realize that actually basing everything on consent is unworkable, that there have to be situations where you can still rely on legitimate interests as a legal ground.
The approach by the Council is a fairly reasonable one. The Commission's approach was, in my view, already reasonable, but the Council seeks to be slightly more cautious in certain respects.
We'll have to see what different stakeholders think about it, whether the organizations that are training large models are very happy with this, and the ones training smaller models as well. But ultimately, it is a fairly reasonable position that is being provided by the Council. It's not excluding it; it's saying there are certain safeguards that have to be in place, and so that is basically what is today anyway the case. So it's not actually fundamentally changing anything in that respect.
#8 Messages for different Members of the European Parliament
Now we'll see the start of negotiations with the European Parliament. Different political groups have commented very differently on the Digital Omnibus. Normally, Members of the European Parliament on the center-left are a little more critical of any form of simplification they often call "deregulation," fearing foreign interference and a snowball effect that could lead to a collapse of the GDPR. Whereas the center-right is more willing to address the issues European companies' data economy faces currently. What would be your messages for different members of the European Parliament and different political groups as the negotiations start?
I think that the first overall message for everyone is: laws that do not work in practice are useless. So, you need to have workable laws. And I think what we've seen over the past eight years of GDPR enforcement is that the GDPR is a good piece of legislation, but certain excesses regarding its interpretation have actually made certain things completely unworkable.
The same with the ePrivacy Directive. The initial intent was really good: the cookie rules, about protecting against spyware and stuff like that. And then it's been expanded upon to the point that anti-fraud measures - you don't even know whether you require consent for them- which doesn't make sense because a fraudster is never going to give consent anyway. The same with the GDPR, transfers of data. That's a topic not on the agenda for the Omnibus, but one of the big questions remains: is a data transfer even possible?
But more generally, what you have with the GDPR interpretations nowadays is that a lot of it has been pushed towards absolutism, where if you have a certain approach, basically you are not able to justify it because the regulator has said, "This is black or white, and there's never a gray." And that means that you have a number of situations that just don't work.
One example that I like to give is in relation to the notion of pseudonymized data. We were talking about clinical trials. If I am the recipient of data regarding a clinical trial and I have no way of knowing who something relates to, how can I actually satisfy a data subject request? How can I even provide useful information in a data protection notice? There are certain questions that just don't work. What happens if there's a data breach? How do I know if something is likely to be a risk for the data subject?
So everyone has been proceeding on the basis of hyper-precautionary approaches, which has actually created fear of applying the GDPR. When, in fact, the GDPR's intent is to enable the responsible use of data. I keep on saying that if the intent was to block the processing of personal data, we just needed one article: "Processing of personal data is not permitted." And then maybe you say, "not permitted without consent," add some provisions on consent, and then it's the end of it. Instead, we have a regulation that is all about encouraging the responsible use of data. So let's continue enabling that and ensuring that there is a responsible framework around it.
So then, if we think about the specific concerns that certain groups might have. Some might say, well, on the left side of the aisle, we often hear the argument: "Well, this deregulation is bad; it's actually damaging to data subject rights; it's bad for fundamental rights." First, the GDPR regulates an interference with the fundamental right to data protection. So, the GDPR is the source of the interference. So you can't say that you're actually encouraging an interference. The GDPR is there to allow that interference.
And so, what we want to make sure of is that the suggested changes to the GDPR enable a better way to take into account reasonable concerns, but that does not mean, "Let's block AI training, let's block the idea of pseudonymization, everything is subject to the GDPR." Because if that happens, then you're actually killing the GDPR.
Let's explain why. If you say that everything is personal data because one person on the planet is able to link this to someone, well, basically you can't ever share any information that has to do with a natural person, because you might be violating the GDPR with every email you send, with every sharing of information online, etc. So that just doesn't work. So, we need a more reasonable approach, which is what the Court of Justice has sometimes tried to do and what the Commission was trying to do. And so, the idea of having a good approach to pseudonymization, something workable, where we have the consecration of the relative notion of personal data - this isn't about removing information from the scope of the GDPR. It's about ensuring that the right information is covered and that, in situations where GDPR obligations just don't make sense and are unworkable, we don't try to force them within the GDPR framework.
Next, we have some practical issues regarding scientific research that the Omnibus addresses. This is stuff where we're trying to see: what is scientific research? In which circumstances can we consider that the further use of data that has already been handled in a certain way - ideally anonymized, if not pseudonymized, and if not as personal data - what are the safeguards that we need in order to be able to say this can be used for scientific research?
I think no one in their right mind is going to challenge the idea that scientific research is good for Europe. So the question is: what are those safeguards, and not what scientific research is? If we say scientific research has to be non-profit, or has to require disclosure of the outcome, then actually, you're killing a whole bunch of types of research that do rely on data and that are ultimately beneficial to Europe.
So we have to be a bit proportionate in our approach. So I think the key message on that side is: do not see everything as a dilution of rights, but see everything as a way of ensuring that rights are properly used, that data subject rights are properly used and not misused, that data protection principles are used in a workable manner.
If we look further to the right side of the aisle, you often see an excessive approach to deregulation. I don't like the term deregulation because I think that actually, the simplification attempt is not removing any rules. I think it's actually adapting certain rules, sometimes in a more complex way. But I think the idea is you need to be careful that you do not get rid of rules simply because you're trying to simplify. You always have to take an objective approach to what needs to be simplified and why.
If there are practical concerns that organizations see in practice in the way that they're handling data, and they see that certain rules objectively harm a good and responsible use of data, and that they prevent it, then it's worth tackling them. But if the rules are actually okay to deal with, if we see in practice there isn't much controversy about them, if we see in practice that they have led to better use of data in general, then you don't necessarily need to adapt them.
And so there's no need, for instance, in my view, to get rid of certain notions like, "Let's get rid of the role of the DPO entirely." That doesn't make sense. The role of the DPO makes a lot of sense in many organizations. But do all organizations need one? No.
Same goes for the notion of data protection impact assessments. We know that data protection impact assessments are very, very document-heavy. They're very annoying to do because it's a lot of exchange of information. But ultimately, if you do that, you actually learn a lot about the processing activity. You're able to take certain risks into account in a better way. So there's something positive to them as well. You don't need to get rid of the DPIA idea. You have to ensure that the DPIA is workable.
And so, I think that is always the aspect: again, on one side, try not to say that everything is a dilution of rights, on the other hand, do not say that everything is a dilution of organizations' competitiveness. There's a good middle ground to be found in reasonable, workable legal solutions.
#9 Estimated timeline for further negotiations
What is your estimate? How long will the upcoming negotiations last this time, and what is the timeframe for our listeners on either side of the political spectrum to engage with their Members of the European Parliament and other officials?
Wow, well, I love this kind of crystal-ball exercise because it always makes me think about what happened before. And we ignore history at our peril. And I think the one thing I hope is that this does not become the same as the ePrivacy Regulation, where we ended up with negotiations that took years and ultimately failed.
What I do not want, either, is a lack of substantive discussion, because this is how bad laws are adopted. If the idea is that there will be some negotiations over the next couple of months about this topic... This is one of the fundamental topics of the entire digital economy! It is: what can you do with data?
Now, obviously, a lot of the provisions we've talked about more generally have been the GDPR ones, so personal data. But the whole Data Act component is not just about personal data, it's about data in more general terms as well. And so this is why this is fundamental to the digital economy in general.
We could say that the AI Omnibus was focused on the AI Act, and therefore there was a particular focus on certain kinds of AI systems, because it was focused on certain levels of obligations and so on. So it was already more narrow than just the use of AI in general. Whereas here, this is about all data in the digital economy. So it needs proper consideration.
When I say proper consideration, I don't mean let's talk about every comma consistently for four months. I think what we need to have is, hopefully, to wrap this up within one year. I think that three months would probably be a bad result, because we've already seen fairly different views within the Parliament, and I want to make sure there's enough debate. So hopefully the good ideas can actually be discussed properly, and that we can have civilized debates about all of the big topics.
A year? Hopefully not too close to that. My hope is basically six to nine months, but obviously with the summer break looming in, once we have a final position, the negotiations would start in March potentially, or maybe a bit sooner. If we then think six months... September. I'm hoping that by November - two years after the initial proposal came out -that we actually have a law that is adopted. But it's still a crystal ball exercise.
And then we'll have a couple more years for enforcement. So, for those of our listeners expecting very fast decisions and rapid changes in how the GDPR or Data Act works for you, that's not going to be the case. Peter, thank you so much for joining us today. Really important insights. Let's hope that Europeans on both sides of the political spectrum keep your advice to focus on the middle ground. Thank you so much.
You're welcome.
