Thank you, Clive, for sharing this. I submitted my own response, but I have never before come across anyone sharing theirs. Your point about protecting a CSO who raises a concern or withholds sign-off is the one I keep thinking of. I mentioned it only briefly in mine response to consultation but I've since been thinking of comparing the protection of a data protection officers (DPO) in relation to CSOs: under Art. 38 UK GDPR (3), a DPO cannot be dismissed or penalised for doing their job. I haven't seen that comparison discussed for CSOs, and I'm curious whether people think a similar level of protection would work here. Regards PJ