I. Introduction
The EU Digital Omnibus, announced by the European Commission in November 2025, was presented as a targeted exercise in regulatory streamlining, with reducing compliance burdens and enhancing the competitiveness of the EU’s digital economy as its ultimate objective.Footnote 1 Framed as a set of operational and procedural adjustments rather than as a substantive reworking of core regulatory commitments, the Proposal seeks to amend selected elements of the EU’s increasingly dense digital regulatory framework, including aspects of the General Data Protection Regulation (GDPR). Notwithstanding the ostensible modesty of this stated ambition, the Omnibus has provoked a polarised response within the data protection community.
Much of the opposition to the Proposal has been grounded in concerns about the constitutional status of EU data protection law. Critics have warned that even limited and prima facie modest amendments to the GDPR risk substantive regression of hard-won protections, friction with fundamental rights, and a loss of coherence across the EU’s digital acquis. According to such perspectives, the Omnibus can be considered a potential destabiliser of a relatively settled and normatively significant regulatory framework rather than as a minor legislative adjustment. At the same time, a parallel and long-standing body of criticism has emphasised that the operative reality of the existing data protection framework is far from unproblematic. Persistent uncertainty surrounding central concepts, the perceived ineffectiveness of key provisions, and a growing overlap with adjacent regulatory regimes have all prompted claims that resistance to reform risks entrenching structural deficiencies and inhibiting regulatory adaptation. The resulting debate has increasingly taken on polarised characteristics, with reform proposals being framed, either implicitly or explicitly, by some as covert attempts at deregulation, and opposition to reform dismissed by others as obstructionist.
The central concern addressed in this article is an apparent emerging tendency, observable in parts of the above-mentioned debate, to treat data protection reform as normatively suspect or presumptively illegitimate in and of itself. If this is the case, and reform of this area of law becomes understood as inherently incompatible with the protection of fundamental rights and interests, rather than as a contingent or evaluative exercise, there is a risk that necessary institutional self-correction could be displaced into less accountable and intelligible forms. Against this background, the core argument advanced in this article is that the principal challenge raised by the Digital Omnibus is the question of how reform of data protection law within the EU can be pursued in a manner that confronts its general structural and operational weaknesses while preserving its legitimacy and normative foundations, rather than whether it should be reformed per se. The article does not defend the Omnibus as such; nor does it deny many of the concerns raised against it. It does, however, argue that treating reform of data protection law itself as illegitimate risks delaying the maturation of a regulatory regime that is already heavily strained.
The article comprises five parts. Section II explains the significance of the Digital Omnibus within its broader legal and institutional context, focusing on the omnibus legislative technique and the central role of data protection law in the EU’s digital acquis. Section III examines a selection of the most salient proposed amendments to the GDPR and explains why they have generated significant contestation. Section IV then advances the article’s central argument, analysing the risks associated with treating reform itself as normatively suspect and explaining why this stance is particularly problematic in the data protection context. The conclusion (Section V) then draws these strands together and reflects on the implications for the future development of EU data protection law.
II. The legal and institutional context of the Digital Omnibus
The Digital Omnibus is best understood as an example of a particular legislative technique rather than as an individual regulatory intervention. Omnibus legislation, typically used to amend multiple pieces of legislation simultaneously, usually with the intention to implement coordinated policy objectives, is a familiar feature of EU lawmaking.Footnote 2 When viewed in a favourable light, the grouping of amendments together can be seen as a potentially effective means for promoting legislative efficiency and facilitating coordination across related instruments that would otherwise require separate, and potentially diverging, legislative processes and timelines. In areas that are characterised by dense, complex, and overlapping legal frameworks, such as data protection law and digital regulation more generally, the appeal is obvious.Footnote 3
Concurrently, however, the omnibus method is not without controversy. By aggregating changes across multiple pieces of legislation, the prospect of decreased visibility of individual amendments increases. Consequently, it necessarily becomes more challenging for legislators and other relevant stakeholders, as well as the public, to assess their cumulative impact. Deliberation may, for example, become compressed or unduly narrowed, with attention becoming predominantly focused on the ‘overall package’ rather than on the normative implications of specific changes. In a similar vein, contestation, whether legislative, judicial, or societal, may potentially be impeded where amendments are framed as technical adjustments within an exercise of legislative streamlining rather than as substantive policy choices capable of fundamentally reshaping existing legal rights and obligations. These risks are, of course, in no way unique to the Digital Omnibus. They are, however, self-evidently particularly salient and concerning where the legislative instruments affected perform a constitutional, or at least quasi-constitutional, role within the EU legal order. This is especially the case in relation to EU data protection law.
The GDPR occupies a focal position within the EU’s digital acquis. It simultaneously establishes a comprehensive regulatory framework that governs the processing of personal data, and functions as a mechanism through which fundamental rights (most notably the rights to respect for a private and family life and the right to protection of personal data)Footnote 4 can be operationalised in practice. Many of the core tenets of the GDPR, such as the concepts of personal data, lawfulness, necessity, fairness, proportionality, transparency, and accountability, are replicated, relied upon, or implicitly incorporated within a range of adjacent EU regulatory regimes, including the Digital Services Act, the Digital Markets Act, and the Artificial Intelligence Act. To this end, the extent to which amendments to the GDPR are likely to remain confined to the field of data protection is somewhat doubtful. Changes to data protection law particularly have the potential, for example, to resonate across other domains such as artificial intelligence (AI) governance, where data processing underpins the development and deployment of automated systems, and platform regulation, where data practices intersect heavily with regulatory obligations associated with content moderation activities.
The significance of the Omnibus is brought into even sharper focus by virtue of the fact that, as alluded to already, it does not concern data protection law in isolation. The Proposal forms part of a broader programme of regulatory recalibration extending across multiple areas of EU digital governance, including data-sharing frameworks, platform regulation, cybersecurity, and AI-related governance structures. To this end, the wider context within which the Digital Omnibus itself has emerged is also important. The Proposal forms part of a broader shift in EU regulatory discourse that has been driven by growing concerns regarding competitiveness, innovation, and digital sovereignty. In recent years, for example, policymakers have increasingly expressed anxiety over the prospect of the EU’s expanding digital regulatory framework imposing burdens on regulated actors that are difficult for European businesses to absorb, particularly when competing against firms operating in jurisdictions which have a lower appetite for regulating in these areas and which have traditionally adopted more market-orientated approaches to digital innovation, such as the United States.Footnote 5 These concerns appear to be especially pronounced in relation to the regulation of AI and other emerging digital technologies, where fears have arisen that excessive regulatory complexity may inhibit investment and development within the European market.Footnote 6
Concurrently, growing attention has been directed towards the EU’s objective of achieving greater digital sovereignty and reducing strategic dependence on non-European technology providers and infrastructure.Footnote 7 In particular, concerns regarding the concentration of technological capability, cloud services, and AI development within a relatively small number of predominantly US-based firms have increasingly prompted calls for the EU to strengthen its own digital capacity and competitiveness.Footnote 8 To this end, the policy objective of reducing regulatory complexity and friction has become inextricably intertwined with wider ambitions to promote technological self-sufficiency and European leadership in strategically important digital sectors. With this being the case, these broader geopolitical, economic, and strategic considerations provide further indication of why the Omnibus can be characterised as being part of a broader political and economic debate concerning the striking of an appropriate balance between fundamental rights protection, regulatory effectiveness, and economic competitiveness, rather than as an exercise in technical refinement or administrative housekeeping.
III. The proposed amendments and the sources of contestation
The Digital Omnibus introduces a potentially consequential set of amendments to the GDPR which aim to modify the practical operation of numerous existing provisions. These changes target numerous areas that have historically been identified as generating considerable friction or uncertainty in practice and, in so doing, have contributed to broader concerns regarding the coherence and practical effectiveness of the GDPR as a whole. This section focuses on a number of the most salient and contested proposals which have attracted particular attention from observers, and which illustrate why the Omnibus has generated such a polarised response.
At a high level, several of the proposed amendments are intended to codify or clarify positions that already have some foundation in the case law of the Court of Justice of the European Union (CJEU). The proposed clarification of the notion of identifiability as a constituent element of the concept of personal data (ie, the GDPR’s foundational jurisdictional trigger that determines whether it applies at all, and which in turn activates the full suite of rights, obligations, and enforcement mechanisms) is perhaps the most notable example of this. The Proposal amends Article 4(1) GDPR to clarify that information will not automatically be personal data for every person or entity merely because another entity can identify the data subject from it.Footnote 9 In so doing, the Proposal essentially seeks to codify a relative entity-specific approach to identifiability developed in cases such as Breyer Footnote 10 and EDPS v SRB.Footnote 11
In a similar vein, aspects of the proposed amendments to Article 22 GDPR (which governs the permissibility and limits of decisions based solely on automated processing of personal data and delineates the scope of data subject protection in such contexts) seek to address divergent supervisory interpretations of when automated decision-making may be regarded as ‘necessary for the performance of a contract’, but do not dismantle or remove the incumbent prohibition on solely automated decisions or the associated safeguards set out in Article 22(3).Footnote 12 From this perspective, parts of the Proposal can prima facie be understood as an attempt to stabilise contested areas of interpretation rather than to lower standards per se.
Nevertheless, a recurring theme in academic and expert commentary is that these changes, although manifestly presented as exercises in clarification or simplification, would have material effects on how core data protection obligations operate in practice.Footnote 13 In particular, there are worries that formalising more permissive interpretations of scope and exception-based provisions risks entrenching narrower conceptions of protection that were previously contested, thereby recalibrating the balance between regulatory reach and individual protection in ways that may amount to substantive regression when assessed against the GDPR’s original protective ambitions and the long-fought-for rights guaranteed under the Charter of Fundamental Rights of the European Union, as well as other data protection safeguards developed through decades of iterative legislative development and associated jurisprudence.Footnote 14
Another area of concern is the proposed amendment to the rules concerning personal data breach notifications. The current rule under Article 33 GDPR is that data controllers must notify the competent supervisory authority of a breach without undue delay and, where feasible, within 72 hours of becoming aware of it unless the breach is likely to result in a risk to the rights and freedoms of natural persons. The Proposal suggests raising the notification threshold to ‘high risk’ and extending the notification deadline to 96 hours, thereby likely significantly reducing the volume and immediacy of supervisory notifications.Footnote 15 The significance of this point lies with the fact that, as others have noted, since its inception the GDPR breach notification rules have served as an important mechanism for raising supervisory awareness, early intervention, and systemic detection of harmful data-handling practices.Footnote 16 To this end, the concerns espoused simultaneously relate to a possible reduction in breaches being declared and to supervisory authorities losing an important source of visibility into problematic behaviours or practices, thereby necessarily risking weakening enforcement capacity in contexts where resources are already stretched.Footnote 17
Comparable anxieties arise in relation to the proposed limitations to transparency rules and data subject access rights, set out in Articles 12–15 GDPR, which establish the core obligations of data controllers to provide clear information about processing activities and to enable individuals to access personal data relating to them. While the Proposal does not abolish these provisions, it expands the circumstances in which data controllers may limit or refuse to provide information and access on grounds such as ‘reasonable grounds to assume’ prior knowledge, disproportionate effort, or abusive requests.Footnote 18 Academic commentary and CJEU jurisprudence have long emphasised that transparency rules and access rights play a central role in enabling individuals to test the lawfulness of personal data processing and trigger regulatory oversight.Footnote 19 Against this background, critics have warned that widening controller-assessed limitations to these rights and obligations risks severely diluting their scope and reframing them as exceptional rather than foundational safeguards.Footnote 20
Finally, the proposed transfer of terminal equipment processing rules into the GDPR, which would bring the storage of, or access to, information on end-user terminal equipment within the GDPR framework insofar as such activities involve the processing of personal data, has attracted a different but also noteworthy set of concerns.Footnote 21 Academic literature on ePrivacy has historically tended to treat the regulation of terminal equipment as involving distinctive normative choices that are not necessarily reducible to data protection norms. For example, Article 5(3) of the ePrivacy DirectiveFootnote 22 requires prior user consent for the storage of, or access to, information on terminal equipment regardless of whether personal data are processed. In this regard, the provision is concerned with the confidentiality and integrity of users’ devices and communications environments, and with protecting individuals against unwanted tracking and surveillance practices in a general sense, rather than with the protection of personal data per se.Footnote 23 With this being the case, it is perhaps questionable whether the protection provided by Article 5(3) can be fully preserved once incorporated into a regulatory framework whose scope and operation are primarily constructed around the processing of personal data, and critics have unsurprisingly warned that relocating these rules into the GDPR risks subtly altering their normative foundation, narrowing the circumstances in which protection applies, and reducing the distinctiveness of safeguards historically associated with terminal equipment and communications confidentiality. More broadly, concerns have also been raised in relation to the way in which the Proposal would effectively resolve numerous politically contested issues that plagued the now withdrawn ePrivacy Regulation, doing so indirectly through GDPR amendment rather than through dedicated legislative consideration of the specific objectives and values that have traditionally underpinned ePrivacy law.Footnote 24
IV. The dangers of making reform itself suspect
Plainly, the concerns discussed in Section III are prima facie grounded not in opposition to reform of EU data protection law as such but in apprehension about how reform is being pursued and what practical effects may follow. However, while the concerns outlined concerning substantive regression and systemic coherence are entirely legitimate and deserve serious engagement, steps must be taken to ensure that opposition to particular proposals (eg those contained within the Digital Omnibus) does not become generalised into a presumption that reform of the EU’s data protection framework in any form would be inherently suspect. For several reasons, such a stance would carry its own significant normative and institutional costs.
Nevertheless, one apparent inference that can be drawn from elements of the above-mentioned debate is the emergence of growing discomfort with the idea of legislative reform per se. In several public statements and commentaries, notably those made by prominent civil-society organisations and digital rights advocacy groups, the Omnibus proposals for GDPR amendment have been characterised as inherently regressive, with ‘simplification’ sometimes apparently framed as a necessary euphemism for deregulation, and reopening the Regulation portrayed as a precursor to inevitable systemic erosion of the protections it provides.Footnote 25 Other observers, even, for example, those who have otherwise expressed openness to limited or carefully calibrated reform, have responded by defending the GDPR on the basis that its core architecture and normative foundations ‘ain’t broke’, arguing that attempts to revisit or recalibrate its foundational regulatory pillars risk unjustifiably introducing instability.Footnote 26 The usage and tone of such language, whether intentionally or not, implicitly idealises the existing framework and downplays its shortcomings. While such caution reflects entirely understandable concerns over hard-won rights protections and similar, this form of discourse necessarily implies, to a degree at least, a presumption either that legislative reform of EU data protection rules is intrinsically undesirable or harmful, or that the existing framework is sufficiently robust as to render reconsideration unnecessary. These are assumptions that, for reasons expanded upon in this section, are difficult to sustain in light of its persistent structural and operational deficiencies.
Against this background it becomes necessary to ensure that discursive tendencies to equate reform with legal and regulatory rollback do not narrow the space for principled legislative evaluation. If, in any area of law and regulation, reform itself is to become seen as presumptively illegitimate as opposed to contingently acceptable depending on nuance and context, scope for meaningful institutional self-correction will necessarily become inhibited. The possible narrowing of reform-related debate is particularly problematic in the immediate context, given that, whatever one’s views of the Digital Omnibus itself, and contra to claims that it ‘ain’t broke’, the existing data protection framework exhibits numerous genuine deep-seated conceptual and operational weaknesses. There are too many such issues to be exhaustively catalogued here, but three fundamental features of the current framework are sufficiently salient to illustrate the scale and significance of the problem.
First, the conceptual breadth and elasticity of key GDPR notions have generated persistent uncertainty in practice. The most significant example in this regard is the central concept of personal data itself which, as noted earlier, operates as the primary jurisdictional and regulatory trigger for the application of the GDPR’s substantive rules, and whose definitional indeterminacy has long contributed to inconsistent interpretation and uneven enforcement across sectors and Member States. Questions concerning whether information either constitutes or does not constitute personal data in many contexts admit no straightforward answers and instead depend on highly contextual assessments of identifiability, available means of identification, technological capabilities, and the relationship between multiple actors involved in data processing operations. As a consequence, the threshold question upon which the entire EU data protection framework depends has itself become a recurring source of legal uncertainty, making it difficult for organisations to determine with confidence when the GDPR applies and what obligations follow.Footnote 27 In practice, this uncertainty has weakened, and if not addressed will likely continue to weaken, the coherence, predictability, and enforceability of the framework as a whole and has prompted wider debate as to whether anchoring the scope of data protection law primarily to the concept of ‘personal data’ remains conceptually or operationally sustainable. Critics have argued, for example, that the boundaries of the concept are inherently unstable, particularly in an age that has become characterised by large-scale data collection and aggregation practices, inferential analytics, and rapidly evolving re-identification techniques.Footnote 28 As a result, the personal data trigger increasingly struggles to perform the gatekeeping function upon which the material scope of the GDPR depends, raising legitimate questions about whether alternative or supplementary regulatory approaches may ultimately be required.
A related concern in this regard is the way in which many GDPR provisions operate according to what is in practice a ‘one size fits all’ or ‘all or nothing’ binary logic. Once a data controller processes personal data (assuming that the above-mentioned definitional difficulties can be negotiated) the full suite of core GDPR obligations is engaged, irrespective of the nature, scale, or sensitivity of the processing in question. Obligations ranging from those concerning transparency of processing operations, and record-keeping, to identifying a lawful basis for processing, and adherence to the data protection principles, therefore will apply uniformly across potentially radically different processing environments regardless of their level of risk, complexity, or scale, or the types of personal data involved. For example, it is conceivable that a small local charity maintaining a modest mailing list would be subject to many of the same foundational compliance requirements as a multinational technology company engaged in large-scale behavioural profiling and algorithmic decision-making. While the GDPR formally contains some risk and context-sensitive mechanisms, critics have long questioned whether these are sufficient to prevent excessive complexity, over-regulation, compliance formalism, and the imposition of disproportionate compliance burdens, particularly in relation to smaller organisations and seemingly low-risk processing activities.Footnote 29 In so doing, by using personal data as the principal trigger for regulatory intervention to the processing of personal data and tethering that trigger to a broadly uniform set of obligations, the ‘one size fits all’ nature of framework has contributed to concerns that the GDPR prioritises procedural demonstrations of compliance over substantive risk mitigation and effective protection of data subjects.Footnote 30
Second, an examination of the position of the individual within the framework reveals further concerns. While the GDPR is formally structured around both individual rights and extensive controller-side obligations, its provisions regarding the doctrine of consent as a lawful basis for personal data processing have been routinely criticised as ill-suited to the structurally imbalanced or take-it-or-leave-it contexts that are frequently observable in online environments. Relatedly, data subject rights often prove difficult or even impossible to exercise effectively owing to factors such as complexity, information asymmetries, and a lack of awareness on the part of data subjects themselves that such rights exist or how they may be meaningfully exercised in practice.Footnote 31 In a similar vein, doubts also continue to arise in respect of the practical effectiveness of the accountability-oriented obligations the GDPR imposes on data controllers, including those which require the implementation of data protection by design practices and the undertaking of data protection impact assessments.Footnote 32 As such, there is a significant and persistent gap between the formal existence of provisions intended to empower individuals and protect them from harm and their practical realisation and effectiveness in many contemporary data-processing environments.
Third, the rapid expansion of the EU’s digital regulatory landscape has produced increasing overlap between data protection law and newer regimes governing digital services, digital markets, and AI. These interactions have raised difficult questions regarding consistency of standards, allocation of regulatory responsibilities, and the cumulative burdens placed on regulated actors operating across multiple compliance regimes.Footnote 33
Recognition of these very real problems should not be mistaken for an endorsement of deregulation or the dilution of existing legal protections. Quite the opposite, they in fact highlight just how, in certain respects at least, the EU’s current data protection framework underperforms relative to its aspirations. For reasons that should be obvious, any regulatory regime that is conceptually overextended risks generating formally expansive yet functionally under-realised (ie, performative) rules and rights, and is increasingly entangled with adjacent legal and regulatory instruments, risks generating opacity and vagueness rather than clarity and stability. Given the above-mentioned structural pressures, discussions over potential reform should be embraced rather than reflexively repressed. Done right, critical engagement with reform should become a means of improving the status quo rather than damaging it.
Conversely, where formal legislative adjustment is de facto presumed to be normatively suspect, pressures for change do not disappear. They instead tend to be displaced into less visible and less accountable forms. One possible consequence, for example, is informal reinterpretation of regulatory rules and obligations in ways that may depart from foundational principles or legislative intent, as both regulators and regulated actors seek to reconcile doctrinal indeterminacy with practical necessity, often leading to unsatisfactory outcomes. Another possibility is the gradual expansion of soft law, whereby guidelines, recommendations, and voluntary codes of conduct incrementally reshape the meaning of legal obligations (or at least the perceived content and expectations of compliance, if not the formal legal rules themselves) without the safeguards and institutional solidity associated with formal legislative amendment.
A further risk lies in the emergence of a fragmented, inconsistent, or excessively context-specific jurisprudence, as courts are left to resolve systemic difficulties and tensions on a case-by-case basis in the absence of clear legislative direction. In this regard, the role of the CJEU is particularly significant. In recent years, in the absence of legislative clarification, the Court has become increasingly responsible for resolving foundational conceptual tensions concerning core GDPR notions, such as identifiability, data controllership, and legitimate interests as a lawful basis for personal data processing.Footnote 34 While judicial development of the law is, of course, inevitable and constitutionally valuable, reliance on litigation as the primary, or even prominent, means for resolving systemic ambiguity and uncertainty risks the emergence of a piecemeal and reactive evolution of the data protection framework shaped by the factual contingencies of individual cases rather than by comprehensive legislative consideration of broader policy objectives and questions surrounding regulatory effectiveness. It is not especially difficult to see how each of these dynamics, both those associated with incremental judicial development and those arising from interpretive drift and soft-law expansion, over time, could come to exacerbate existing weaknesses within EU data protection law and further compound the structural problems identified earlier. As an illustrative case in point, to some extent elements of both phenomena are already observable in the context of both pre- and post-Brexit UK data protection law, where persistent uncertainty in case law concerning the anonymisation of personal data has been addressed largely through layers of regulatory guidance and non-statutory advisory material, which have come to exert considerable practical influence over data protection compliance despite the absence of definitive legislative intervention or comprehensive judicial resolution of the underlying conceptual difficulties.Footnote 35
Paradoxically, such displacement can also, in some instances, pose greater risks to existing legal protections than transparent and principled reform, reflecting the adage that presuming that maintaining the status quo should be prioritised over conscious change is frequently without empirical foundation.Footnote 36 Legislative amendment, no matter how controversial, is subject to democratic scrutiny, institutional checks, and explicit justification. By contrast, change initiated via interpretative drift, soft-law accretion, or piecemeal jurisprudence will usually lack these procedural safeguards and accountability mechanisms. To this end, the wider systemic and distributive effects of such changes may remain obscured or insufficiently examined, and may privilege certain institutional actors or national contexts over others. In this regard the avoidance of reform, whatever the context and whatever the area of law, patently has the potential to undermine stability rather than preserve it.
Beyond purely practical considerations, treating reform itself as inherently illegitimate can also result in the incurrence of broader normative costs. It necessarily narrows and chills the scope of permissible debate and encourages polarisation rather than deliberation, directly undermining the fundamental premise that reasonable and well-intentioned actors may disagree in good faith (ie, ‘honest people can differ’). In such circumstances there is a danger that that proposals for reform will be presumed to be covert attempts at deregulation, and resistance to change presumed to be mere obstructionism, leading to the emergence of an ‘us versus them’ dynamic, whereby stakeholders who share an interest in the effective functioning and legitimacy of the regulatory framework are positioned in opposition to one another. This is in nobody’s best interests and serves only to weaken the quality of regulatory dialogue and impede the capacity of the EU legal order to reconcile continuity with adaptability. As aptly remarked elsewhere, any regulatory framework cannot be regarded as fully mature if it is capable only of defending its foundational commitments but not of confronting and correcting its own structural shortcomings, since resistance to reform risks delaying the maturation of the regulatory regime itself.Footnote 37
V. Conclusion
For all the reasons provided in this article’s final substantive section, the question of data protection reform in the EU cannot responsibly be reduced to a binary choice between preservation and rollback. As considered in this article, while most observers do not explicitly articulate the debate in such stark terms, it is nevertheless possible to infer a possible tendency within parts of the discourse to treat reform itself as presumptively suspect, or as inherently aligned with deregulatory intent. If options for possible reform are to be considered in good faith, they must be evaluated against the actual performance of the existing framework rather than against an idealised or romanticised conception of it. When assessed in these terms, the current operation of the EU data protection framework reveals several objectively identifiable shortcomings and sources of concern. To this end, these issues require confrontation, not deflection. As reiterated throughout this article, concerns about regression are legitimate, but so too is the need to examine whether the current regulatory architecture functions as effectively and coherently as its constitutional significance demands. Difficult as discussions about these concerns may be, these are issues that need ventilating.
Open access
