I am using it in the English sense. The noble Lord interrupted me, but I wanted to go on to say that, because of this, we can see no reason to distinguish information society services from any other type of data controller or processor.
Additionally, the definition of controller in the GDPR requires a case-by-case analysis to determine who the controller is, but it is likely that social media companies are controllers. Although the person posting personal data online is a controller, social media companies control personal data: in the context of activities which involve collecting such data; in retrieving, recording and organising it for indexing purposes; in storing it on their services; and in disclosing and making it available to users in the form of lists of search results. The Information Commissioner has also published guidance on this matter suggesting that, if a social media site’s operator has a moderating role over the site’s contents, then it is likely to be a controller.
In respect of Amendment 9, the recitals to the GDPR do not have normative effect—they are more akin to Explanatory Notes—and there is no requirement for the UK to enshrine them in legislation. In some places in the Bill we have adopted some language in the recitals to aid with clarity. For example, in Clause 8 we borrow from the recitals to make it clear that the consent of the holder of parental responsibility should not be necessary in the context of preventive or counselling services offered directly to a child. We will return to this later in Amendment 17 in another group. It is important to say that recitals do not contain substantive law, nor can they override the express language of a regulation. I hope my clarification on this issue is sufficient, and I urge the noble Lord to withdraw his amendment.