Ireland is supposed to be the worldâs privacy policeman. Instead, itâs catering to Big Tech.
Last May, Europe imposed new data privacy guidelines that carry the hopes of hundreds of millions of people around the world â including in the United States â to rein in abuses by big tech companies.
Almost a year later, itâs apparent that the new rules have a significant loophole: The designated lead regulator â the tiny nation of Ireland â has yet to bring an enforcement action against a big tech firm.
Thatâs not entirely surprising. Despite its vows to beef up its threadbare regulatory apparatus, Ireland has a long history of catering to the very companies it is supposed to oversee, having wooed top Silicon Valley firms to the Emerald Isle with promises of low taxes, open access to top officials, and help securing funds to build glittering new headquarters.
Now, data-privacy experts and regulators in other countries alike are questioning Irelandâs commitment to policing imminent privacy concerns like Facebookâs reintroduction of facial recognition software and data sharing with its recently purchased subsidiary WhatsApp, and Googleâs sharing of information across its burgeoning number of platforms.
Interviews with scores of privacy experts, data watchdogs, academics and regulators in other countries reveal increasing concern that the landmark General Data Protection Regulation, the product of years of wrangling with data companies, is vulnerable because of the one provision on which the tech companies prevailed: That the lead regulator be in the country in which the tech firms have their âdata controllerâ â in most cases, Ireland.
âWe need to be careful and ensure that the margin for maneuver given by the GDPR doesnât lead to an attractiveness competition between EU countries, as is already the case for taxation,â Marie-Laure Denis, Franceâs new chief privacy regulator, warned the French parliament in January, in a clear reference to Ireland. âI donât want to see a race [between EU countries] to attract or keep the headquarters of the big tech actors.â
Irelandâs willingness to crack down on the companies that dominate its economy has long been questionable, even when its regulatory officials spot a potential violation. Such a situation developed with Facebook in 2011, in events detailed here for the first time.
Years before the social-media giant unwittingly released the personal data of 87 million users that made its way to Cambridge Analytica and the 2016 Trump campaign, Irelandâs data-privacy regulator found that it was failing to screen applications in a way that could have prevented the breach.
The then-head of Irelandâs Data Protection Commission recorded his complaint in a 2011 audit report that zeroed in on how Facebook was allowing outside app developers to gain access to oceans of âfriendâ data. Facebook pushed back on the finding, according to the agency, and the Irish regulator backed off, issuing an almost perfect score for Facebookâs privacy practices in a follow-up report a year later. The rampant exposure of data wasnât corrected until years later â too late to prevent the Cambridge Analytica breach.
Irelandâs failure to safeguard huge stores of personal information looms larger now that the country is the primary regulator responsible for protecting the health information, email addresses, financial records, relationship status, search histories and friend lists for hundreds of millions of Americans, Europeans and other users around the globe.
Already, regulators in other countries are expressing concern over Irelandâs failure this year to crack down on Facebookâs sharing of data with the messaging tool WhatsApp, which it purchased in 2014.
According to the EU, Facebook misled European officials into believing the two networks would not exchange information, thereby allaying concerns at the time of the merger that WhatsApp users could be drawn into Facebookâs web. In 2016, a German court found that the two networks were indeed sharing data, and barred Facebook and WhatsApp from exchanging information about German users. The ban became unenforceable when the GDPR took effect and Ireland became the lead supervisory authority. Now, German authorities say the sharing has resumed and Ireland must crack down. For their part, Irish officials said in a statement theyâre satisfied that Facebook and WhatsApp arenât sharing information for the purposes of âfriend suggestion or enhanced advertising.â
Meanwhile, Facebook took advantage of Irelandâs assumption of the lead regulator role last May to reintroduce its facial recognition tool, which had been banned in the EU out of fear that photos would be used to track people without their permission. Facebook says it will not utilize the photo data until it receives consent from individuals. But other EU regulators and privacy lawyers contend that merely storing the photographs amounts to an unauthorized taking of data under GDPR rules. Although Irish authorities have suggested they share many of the lawyersâ concerns and have begun a preliminary âexamination,â they have yet to launch a formal probe.
Google, meanwhile, aroused the ire of regulators in other countries last year by failing to obtain consent before sharing data among its fast-growing line of networks and products â from YouTube to Google Photos to Gmail and more. Irish regulators declined to open a probe against Google, which had consolidated most of its operations for Europe, Middle East and Africa in Ireland, arguing that the company had not yet finished the paperwork that would give Irish regulators âlead supervisory authority.â The paperwork was finished in January, but Ireland has yet to announce an investigation.
Critics, including German authorities, insist that the Irish Data Protection Commission had the authority to launch a probe without Googleâs consent, and should have done so. Meanwhile, France stepped in to issue its first-ever fine under GDPR against the company for âŹ50 million.
The head of the Irish Data Protection Commission, Helen Dixon, declined requests for interviews. Her spokesman, Graham Doyle, wrote in an emailed response to POLITICOâs questions that the commission takes its regulatory responsibilities seriously and has 16 investigations underway, probing complaints against networks including Twitter, WhatsApp, Instagram, LinkedIn, and Apple, along with seven probes involving Facebook.
The Irish Data Protection Commission is âone of the most strongly resourced data protection authorities in Europeâ and stands ready to impose âfines and firm remedies when appropriate,â he wrote.
Doyle said the commission, which earlier this decade was so obscure it was headquartered in a small office above a convenience store in the tiny village of Portarlington, is recruiting state-of-the-industry experts to join its staff of approximately 140 people currently working out of temporary offices in Dublin, with a goal of eventually employing 180 people.
He noted the agencyâs tough new enforcement powers include fines of up to 4 percent of a companyâs annual worldwide revenues and cited the agencyâs willingness to enforce privacy rules by pointing to a pre-GDPR case in which Irish regulators ordered LinkedIn to delete data on nonmembers.
He rejected any suggestion that the agency is being overly deferential companies under its purview, but added: âThose with an interest in data protection donât always agree on every point, and we respect that.â
Nonetheless, regulators in other EU countries, particularly Germany, remain skeptical, maintaining that Ireland is letting major complaints slide and creating the risk of a regulatory safe zone in Europe. So, too, are independent experts who are familiar with the actions of the Irish Data Protection Commission.
âItâs the appearance of an investigation rather than the substance of one,â said the independent Dublin-based data management consultant Daragh OâBrien, referring to the Ireland's data enforcement culture, which he scrutinizes closely.
Max Schrems, an Austrian privacy advocate behind some of the most successful legal challenges against major technology companies, said he believes Irelandâs approach to regulation is more or less unchanged since 2012.
âTheyâve basically gotten smarter about not doing things,â said Schrems, whose initial complaint about transatlantic sharing of data was thrown out by the Irish regulator in 2013, only to succeed in European courts, bringing down the transatlantic data flow known as Safe Harbor.
Ireland continues to take a more corporate-friendly approach to regulation than many of its EU counterparts, openly favoring negotiation over sanctions and lists of questions over on-site inspections.
For example, as of last October, the Data Protection Commission had yet to dispatch any regulatory agents to Facebookâs Dublin headquarters, despite its multiple investigations, according to a person close to the matter who spoke under the condition of anonymity. Rather than seek answers more aggressively, the regulator has been satisfied by âupdatesâ from Facebookâs headquarters that often reveal little more than whatâs been said in public statements. Both Facebook and the DPC declined to say whether any on-site visits had taken place since 2011.
Around the same time, France posted its own regulatory officers inside Facebookâs offices to monitor the networkâs efforts to police hate speech and terrorist content, a core concern in many countries where terrorists have connected via social media and hate speech encouraged racist or sectarian violence. But France has no authority to enforce standards beyond its borders.
Privacy watchdogs also voice concerns about the 2014 appointment of Dixon, an Irish civil servant with no prior experience in regulatory enforcement, to replace Billy Hawkes, the regulator who initially presided over the finding of Facebookâs over-sharing of data with researchers and developers of third-party apps.
If Ireland were serious about cracking down on privacy violations, some legal professionals said, it would have followed the lead of the United Kingdom and appointed an outside specialist with a history in law enforcement or regulatory investigation. Moreover, they said, Dixonâs budget is overseen by the Irish Justice Ministry, while other data regulators, like the U.K.âs, are financed through fees on the companies they oversee. That could make her, or any future chief regulator, more susceptible to interference by government officials, who have long cultivated close relationships with tech executives.
In 2014, Facebookâs chief operating officer, Sheryl Sandberg, personally lobbied Enda Kenny, then Irelandâs prime minister, over the selection of a data protection chief, according to emails revealed by the Irish Independent.
Now, just as some of its investigations should be wrapping up â with Dixon telling Bloomberg News in January that her office would announce decisions by midyear â the Data Protection Commission is launching an âinternational consultation on regulation strategyâ that some critics fear will be an invitation for corporations to critique its practices.
Doyle said the agency will reach out to a broad range of as yet unnamed parties to weigh in on how Ireland should apply regulation. Doyle declined to say whether those consultants would come from the tech industry, only specifying that the panel would be âinternational.â
The call for advice is symptomatic of what Dixonâs critics among privacy advocates, lawyers and other EU data protection authorities argue is a preference for resolving issues amicably over public enforcement actions, which Dixon, in speeches, has suggested might expose the regulator to extremely costly legal battles. Itâs a reasonable fear in a place where the tech companiesâ resources far outstrip the governmentâs. Googleâs market capitalization, by itself, is twice the size of Irelandâs gross domestic product. Facebookâs is larger by about a third.
âRegulation is a particularly fraught area for a country like Ireland because they have less leverage [over companies] than a bigger country,â said Josephine Wolff, a professor of public policy at the Rochester Institute of Technology. âIf Facebook announced tomorrow, âWeâve had it with Ireland, we are closing down our office,â that would be a huge deal with political and economic consequences for the whole country.â
Bringing Silicon Valley to Europe
The story of how a country known for poetry and dark ale ended up in the unlikely role of global tech policeman stretches back to the aftermath of World War II.
As a neutral power, Ireland had emerged physically undamaged from the war but with a sputtering economy and bleak prospects. It had limited access to U.S. reconstruction funds from the European Recovery Program, or Marshall Plan, due to its neutral position, and no industrial base to speak of, thanks largely to Britain's long-held interest in keeping Roman Catholic southern Ireland in a firmly agrarian state. (Ireland won independence from Britain in 1919.) There was little chance of jump-starting domestic manufacturing 250 years after the rest of Europe, so Irish leaders turned to the next best thing: nurturing ties with countries that had flourishing industries of their own.
Spurred on by an economist and central banker named Thomas Kenneth Whitaker, Irelandâs leaders oversaw an economic transformation starting in the late 1950s â away from protectionism, toward free trade and encouraging foreign investment. The most obvious partner was the United States, to which generations of Irish people had emigrated and whose Irish-origin population already far surpassed the population at home.
So began Irelandâs epic and enduring courtship of U.S. corporations. Via the Irish Development Agency, a powerful entity that acts as a sales office for the country, the Emerald Isle established missions across the United States, dispatching dozens of agents to start preaching the good word about Ireland to U.S. companies from New York to San Francisco.
One of these investment missionaries was Larry Mone, a former accountant who joined the IDA in the late 1970s because he was, in his own words, âreally bad atâ accounting.
After a brief stint in Chicago, Mone was sent out to join the IDAâs office in what was already known as Silicon Valley. In an office that overlooked a golf course, Mone and his colleagues spent their days trying to coax emerging digital giants â Microsoft chief among them â over to Ireland. Working from an alphabetical list of the important companies in the region, they spent their days cold-calling executives in an atmosphere he describes as âboiler room-like.â
âWe had an almost messianic zeal to bring jobs to Ireland,â Mone, whoâs now retired and lives in Palo Alto, said in a telephone conversation.
Moneâs section of the list covered companies with names from the letter G to the letter O and included giants like Microsoft and Intel, which would both go on to establish major footholds in Ireland. Apple set up its first manufacturing plant in Cork in 1980, setting off a wave of tech companies coming to the country.
The pitch, as Mone recalled, was âvery simple.â Any product exported from Ireland would be totally exempt from taxation. That was later updated, under EU pressure, to a 10-percent flat rate that could be offset in other ways. When added to the promise of cheap labor, cheap land and an English-speaking workforce, this amounted to an almost unbeatable argument for locating sales operations in Ireland, because it would allow U.S. firms to reach hundreds of millions of European consumers without facing the heavy corporate taxes in France, Germany or even the Netherlands.
The IDAâs approach had other refinements, like inviting top tech executives over to Ireland for country tours during which they would be entertained, fed whiskey and âsent home punch-drunk, in love with the country,â according to Mone. It didnât hurt that Ireland shares a common-law legal system with the United States.
But the basic argument â which remains Irelandâs unique selling point today, despite intensifying scrutiny of its tax practices by the European Commission â never varied: not having to hand over a significant portion of income to the Irish taxman.
âAt the end of the day, these are profit-drive companies, and they go where the offer is the most profitable,â Mone said.
Data regulation wasnât an issue at the time when most of the companies were recruited, but Ireland did everything in its power to create an industry-friendly landscape.
âBack in those days there really was not much thought given to regulation of the technology industry, more what could be done to foster its development and bring it on shore,â he said.
The pitch was so seductive that, over the next 30 years, Ireland morphed into what Mone calls âthe 51st state of the United States.â
Google and Facebook both landed in Ireland during the first decade of the new century. While the highly advantageous tax arrangements they enjoyed came under pressure from the European Commission (Apple was forced to pay the Irish government $13 billion in back taxes that Ireland had neglected to collect), regulation was just starting to become a concern.
Ireland's 1995 Data Protection Act lacked significant enforcement mechanisms â so much so that Billy Hawkes, then the head of the Irish Data Protection Commission, had no legal power to apply any sanctions or penalties against the companies he was regulating in the years leading up to the Cambridge Analytica scandal. His successor, Dixon, herself acknowledged the lax culture in 2015, one year into her job, mentioning the problem of âforum-shoppingâ and perceptions that companies locate where âsoft, incompetent or under-resourced regulators are.â
In the event that any regulatory issue should arise, as it did in the 2011 audit involving Facebookâs sharing of data with app developers, U.S. companies had a powerful insurance policy: access to top Irish politicians via direct contacts or through the American Chamber of Commerce Ireland in Dublin, which continues to play an outsize role in shaping the direction of Irish policy. Top tech executives had Hawkesâ cellphone number and could access him directly whenever they had a need, according to two people with knowledge of such calls.
This welcoming atmosphere explains why Facebook, in particular, kept doubling down on its Irish presence throughout the 2000s, according to Sandy Parakilas, former operations manager for Facebook who left the company in 2012.
âIt was simply the country with the least regulatory scrutiny,â he explained in a phone conversation from Los Angeles, where he is now senior product marketing manager, privacy, for Apple.
That statement was put to the test during Irelandâs 2011 audit of the company. Prompted by a groundswell of complaints against Facebook, Hawkesâ deputy, Gary Davis, undertook what is likely to have been the most in-depth review of Facebookâs privacy practices ever. In his capacity as lead regulator not just for Europeans but Facebook users worldwide, Davisâ staff spent three months scouring the companyâs machinery, including sending officers to its Dublin headquarters to investigate first hand.
His first report, published in December 2011, called for dozens of changes and upgrades to Facebookâs privacy practices, including its practices for screening third-party apps.
âWe do not consider that reliance on developer adherence to best practice or stated policy in certain cases is sufficient to ensure security of user data,â the report stated. âThis is not considered sufficient by this Office to assure users of the security of their data once they have third party apps enabled. We expect FB-I [Facebook Ireland] to take additional steps to prevent applications from accessing user information other than where the user has granted an appropriate permission.â
Parakilas, who was Facebook's âpoint personâ on privacy matters at the time, said the criticism did not rile the company. Facebook responded to the audit in a âprofessional mannerâ but did not feel pressure to make fundamental changes, he said. When Parakilas tried to escalate concerns about the key critical findings in the original audit report, he was brushed off by senior executives.
At the time, Facebook expressed its concern about the audit to Irish officials, according to later testimony by Dixon before a government committee. Afterward, the Data Protection Commission appeared to go out of its way to give Facebook a clean bill of health.
In a 74-page follow-up report published in 2012, the commission declared that âmost of the recommendations [had] been fully implemented to our full satisfaction.â On its call to improve screening of third-party apps, where major problems later emerged, the report stated: âSatisfactory response from FB-I.â A year later, Davis left the commission to join Apple as its chief privacy officer.
"They didn't go anywhere near as far as you would have hoped," Parakilas said, referring to the Irish commission. Parakilas, who left Facebook in 2012, added that he doubts Irelandâs approach to regulation has changed substantially.
âFacebook is certainly the one that has the leverage in that relationship,â he said.
Asked whether Ireland had done enough to stop the Cambridge Analytica scandal, Doyle said the commission had gone as far as it could, within its legal limitations, in simply flagging the problem with app developers and seeking changes to Facebookâs privacy practices. He pointed to comments Davis had made outside the report saying there were âstill a number of items on which progress has not been as âfully forwardâ as hoped,â although the issues flagged did not have to do with third-party apps. In 2017, Helen Dixon told the Irish parliamentary committee that Facebook âdid not agree with the recommendationâ for significant changes to its privacy rules in 2011, and that the changes were made only through an âiterative processâ 18 months later.
Facebook disputes that account.
In comments to POLITICO, a spokesperson said that the company had âcomplied fullyâ with all requested changes, and claimed that the Irish regulator had never requested any changes that would have prevented the Cambridge Analytica scandal.
Hawkes, who at the time was the top Irish regulator, declined to comment on the matter, according to a spokeswoman at the International Association of Privacy Professionals, a nonprofit association that brings together people working on data protection. Gary Davis did not respond to repeated requests for comment and a spokesperson for Apple, where Davis now works, did not respond.
Facebook flexes its muscles
The years that followed Davisâ audit brought Facebookâs relationship with Ireland to new levels of closeness.
In 2013, the commission dismissed Schremsâ claim against the company over data transfers to the United States, calling the suit frivolous. The company then won an award of funds from Irelandâs national asset management agency â the so-called âbad bankâ that took over assets on troubled lenders during the financial crisis â to build its Frank Gehry-designed headquarters in Dublin.
When the Cambridge Analytica scandal broke in 2018, the U.K. launched an investigation and fined the company, while Ireland merely issued recommendations. A few months after Facebook CEO Mark Zuckerberg appeared before the U.S. Congress and European Parliament to answer questions from lawmakers, the company announced the construction of a new 14-acre campus in Dublin and the opening of several new data centers in County Meath, north of Dublin.
As far back as 2014, the question of how Ireland would handle the new privacy rules under the GDPR was on the minds of Facebookâs leaders. As it happened, Ireland was in the process of choosing a new chief data regulator to replace Hawkes. Sandberg took it on herself to investigate the matter, lobbying then Irish Prime Minister Kenny on the sidelines of the World Economic Forum in Davos and also at her offices in Menlo Park, Calif.
According to emails obtained by the Irish Independent via Freedom of Information requests, Sandberg wanted to know that Hawkesâ successor would be âas strong asâ he had been in the role. But if the wrong choice was made, Sandberg suggested, there would be consequences for Irelandâs attractiveness as a destination for tech investment.
âThe risk is that companies will revisit their investment strategies for the EU market,â she wrote in a June, 2014, email to Kenny, adding that Irelandâs regulator should be a person who would âestablish a strong collaborative working relationship with companies like ours.â
The choice of Dixon, a former Irish civil servant with a law degree but no background in law enforcement or regulatory investigation, was in line with Sandbergâs wishes. Before she became one of the most important privacy regulators in the world, Dixon had spent four years working for U.S. software company Citrix, followed by a stint at the business-friendly Irish Department of Enterprise, Trade and Innovation.
While the regulatorâs statutes called for the appointment of three co-equal directors in order to properly separate the agencyâs enforcement and adjudication roles, the other two were never named.
TJ McIntyre, a law professor at University College Dublin who sued the government over the process under which Dixon was chosen, complained that sheâs ânot coming from that investigatory and enforcement perspective.â
Instead, he said, Dixon was chosen to supervise the DPCâs development into a more substantial regulator than the one housed above a convenience store in Portarlington, building a bureaucratic structure rather than targeting specific issues.
In speeches and interviews, Dixon has emphasized the need to engage with tech companies to help them understand the law, rather than cultivate adversarial relationships.
âWe are very committed to this approach of engaging with the multinationals,â she told the Irish Times in 2016. âWe do firmly believe the way in which we work with them produces much better safeguards for data subjects.â
That approach yields good results in terms of compliance, said Bojana Bellamy, who runs the Centre for Information Policy Leadership, an industry-backed privacy think tank whose members include Facebook and Apple.
âI do believe that constructive engagement is incredibly important to build that trust,â she said. âSticks and enforcement â that doesnât create the best behavior in the marketplace.â
Irelandâs more conciliatory approach is now fueling tension with other EU regulators. After Franceâs data watchdog fined Google âŹ50 million in January for failing to comply with GDPR, Germanyâs prominent Hamburg data regulator told the regulatory-analysis publication MLex that Ireland should be investigating the company. In a separate statement to POLITICO, the German watchdog underscored âdifferencesâ in the way Irish and German authorities interpreted and enforced EU rules, singling out âface recognition techniques by Facebookâ and the âexchange of data between WhatsApp and Facebook.â
âUnfortunately, it has not yet been possible to set up the data protection we have enforced in national court proceedings against Facebook at the EU level,â wrote professor Johannes Caspar, head of the Hamburg regulator. âAfter the transmission of user data between WhatsApp and Facebook was stopped, they [Facebook] took the entry into force of the GDPR as an opportunity to return to their former practice.â
Zuckerbergâs announcement of plans to merge WhatsApp, Facebook Messenger and Instagram messaging were also âreason for concern,â added Caspar, echoing the German Justice Ministryâs warning that such a merger would create a âmonopolyâ and call for enforcement of European antitrust rules.
While the Irish regulator said it would examine the implications of such a merger, France echoed the German concerns.
âIn general, in relation to Facebook, you have a pattern where other regulatory authorities have been much more active and found themselves thwarted by the fact that Facebook was headquartered in Ireland,â said McIntyre, adding that âenforcement has been lax.â
Jimmy Stewart, an adjunct professor of finance at Trinity Business School at Trinity College Dublin, said less rigorous regulation is part of Irelandâs strategy.
Google, Facebook, Twitter and other companies like them make their money by harvesting vast amounts of data on users that is used to target them more precisely with advertising. Thanks to the data collected on Facebook, an advertiser can pinpoint categories of users down to hyper-minute criteria including their age, sexual orientation, health issues or political beliefs. This technology has allowed tech platforms to corner the global market for online advertising, turning them into juggernauts worth hundreds of billions of dollars.
But those dollars could disappear if regulators interfere with the tech giantsâ ability to collect and hold that information.
âRegulatory arbitrage is an important part of the countryâs arsenalâ to attract tech companies âalong with tax incentives,â Stewart said.
Feuding over facial recognition
Irelandâs handling of new technologies such as Facebookâs facial recognition tool will go a long way toward determining how seriously it intends to scrutinize tech companies.
Last spring, just as the GDPR was about to take effect, Facebook prepared to reintroduce its banned facial recognition tool, this time promising to ask users if they wanted the tool switched on, so that the platform could match their names to photographs of them posted by friends online. But when senior executives, including Chief Data Protection Officer Stephen Deadman, disclosed the plans to a small group of privacy specialists and journalists in Dublin, the meeting did not go exactly as planned, according to multiple participants who asked not to be named out of respect for the meeting's private nature.
The journalists and privacy watchdogs peppered the executives with questions about whether the tool violated GDPR principles, suggesting that Facebook may be unlawfully âprocessingâ biometric data on users even if they chose to opt out of the tool, because the data was being gathered and stored anyway â a process that would go against GDPR rules.
"They are analyzing every photograph, even those where they donât have permission, and their argument is this is not processing biometric data because they donât take the final step of identifying the person,â said Dublin-based privacy lawyer Simon McGarr. âFrom a privacy standpoint, this is cloud cuckoo land.â
After a brief exchange, Facebook executives ended the meeting stating that they needed to catch planes, the participants said.
Facebook representatives told POLITICO last year that the meeting had gone as planned. They also said they had discussed the facial recognition tool with the Irish Data Protection Commission and not been informed of any concerns. Yet Doyle contradicted that account, saying that while no initiative was taken to halt the rollout, an âexaminationâ â as distinct from a statutory investigation â was launched.
âIt is standard practice to conduct an examination on this basis to determine whether a statutory investigation is warranted,â Doyle said in his email. âIn the case of FBâs facial recognition facility, that determination has not yet been made.â
In the following months, Facebook was rocked by a series of scandals, data breaches and PR disasters that included Zuckerberg being grilled by lawmakers on both sides of the Atlantic, and The New York Times revealing the firm had hired a public relations firm to attack critics, including by such dubious tactics as linking them to Hungarian-born investor George Soros.
Yet in Ireland, the going was relatively quiet. In early October, the commission announced the launch of its first official investigation of Facebook, over a data breach that compromised the private messages and data of an estimated 50 million users. The commission has since disclosed it is carrying a total of seven investigations into Facebook, which Dixon told Bloomberg were all âsubstantially advanced,â and should lead to the first decisions being taken in âJune or July.â
However, as of late October, it had yet to send any officers to visit Facebookâs Irish headquarters and was receiving its information mainly via âupdatesâ from the company, which often coincided with its disclosures to the public, a person close to the matter said. Asked whether any visits had taken place, both Facebook and the commission said such visits had taken place âin the pastâ but did not specify whether any had taken place in the past year. The last publicly disclosed site visits took place in 2011, under Billy Hawkes.
âWe visit companies being audited or investigated when we need to, and regular meetings often take place in the normal course of our supervised engagement with companies at their premises,â Doyle said. âSuch visits have taken place to Facebook Irelandâs offices in the past but we wonât be disclosing any details on these for operational reasons.â
For Daragh OâBrien, whose Castlebridge consultancy routinely carries out privacy audits on companies, not sending an officer to Facebook is the equivalent of âpolice investigating a crime from the doughnut shop.â
âYou miss the opportunity for someone to grab you and tell you something they canât do in writing ... It happens all the time, especially in the context of complex investigations,â he said.
Asked whether it intends to launch any probes into data-sharing by the various networks controlled by Google, the commission said that it gained jurisdiction over the search giant only on Jan. 22 and still is not the lead supervisory authority for Googleâs search engine and indexing service.
But Caspar, the German regulatory chief, said that Ireland had a responsibility to investigate any privacy complaint lodged in the European Union. (Google is appealing the French fine. In previous comments to POLITICO, a spokesperson for Google said the company had been under no legal obligation in 2018 to finalize the steps for its âmain establishmentâ in the European Union.)
As for the scandals that rocked Facebook over the past year, Doyle pointed to the commissionâs limited mandate as a regulator of data security as a reason to defer action or public communications. The spread of hate speech and the use of micro-targeting for online political advertising â both of which have been identified as major areas of concern by the European Commission â are outside its purview as a data regulator, Doyle said.
Yet such an interpretation of the regulatorâs role and responsibility does not sit well with privacy professionals. In addition to being responsible for compliance with data protection statutes, Dixon and her staff have an âethical dutyâ to lead debates on where and how regulation should be applied in response to emerging issues, OâBrien said.
âItâs not just about the letter of the law, but also anticipating where problems may be coming from,â he said, adding that the next big problems would crop up if and when facial recognition technology is combined with targeted ads to beam commercial messages at people in public spaces. âThe sort of scandals and breaches weâve seen over the past few years are just a prelude to what may be coming as 5G [next generation] networks come online.â
Iâm continuing to report on data privacy issues with Big Tech. If you have a tip for me, you can reach me at [email protected].
Article originally published on POLITICO Magazine
from Tiffany Favorites https://www.politico.com/story/2019/04/24/ireland-data-privacy-1270123
