My noble friend has a long-standing interest in small and medium-sized businesses. The White Paper says categorically that the regulator will have a duty to promote innovation and to take account of small businesses. We expect it to be proportionate, which means, as I said, that large companies will be held to a different—although always reasonable—standard from that for small start-ups; for example, we expect that, as in financial services, the regulator will have a regulatory sandbox that small start-ups could work in.
As far as the penalties are concerned, we absolutely want to have the ability to hold the largest companies to account. That means the potential of serious penalties. My noble friend talked about 4% of global turnover. That would be a direct copy-over from the GDPR. We have not said that. We are consulting about some of the further, more serious penalties, such as holding individual directors to civil or criminal liability personally, but that is something that we would want to talk about. We would be interested in hearing my noble friend’s views on that. We want serious potential penalties but we want the regulator to be proportionate in their use.