European privacy advocates are hopping mad at what they see as an attempt by the Irish government to draw a veil over the activities of the country’s data protection authority—which has jurisdiction over many of Big Tech’s activities in the European Union, and which has been heavily criticized for failing to crack down on the likes of Meta fast or hard enough.
Last year, the Irish government proposed a rather innocuous piece of legislation called—please stay awake—the Courts and Civil Law (Miscellaneous Provisions) Bill 2022. Having passed through most of the legislative process, the bill will see its final debate in Ireland’s lower house of parliament on Wednesday, but last week the government dropped in a last-minute amendment, triggering a row that broke out today.
The change would allow the Data Protection Commission (DPC) to declare as confidential the information it gives complainants and companies about its investigations and handling of privacy complaints. Those people and companies would then be banned from making that information public while the DPC does its work. (You can find the details starting on page 7 here.)
The activist lawyer Max Schrems has had many public clashes with the DPC over its handling of his hugely consequential complaints about Meta—he’s the reason Facebook and Insta may soon have to pull out of Europe. Schrems and other privacy advocates say they’re the intended targets of this change, and claim journalists would also be caught in the fallout.
“You cannot criticize an authority or big tech companies if you are not allowed to say what’s going on in a procedure. By declaring every tiny [piece of] information ‘confidential’ they try to hinder public discourse and reporting,” Schrems said in a statement this morning. He told me that, had this law been in place over recent years, he would have been unable to tell the public about the DPC and Meta holding “10 meetings on how to bypass the GDPR” (the DPC strongly disputes that such meetings took place.)
The Irish Council for Civil Liberties also weighed in this morning, saying the DPC should be “holding public GDPR hearings” but the Irish government was instead “attempting to make DPC decision-making even more opaque.”
Irish data protection lawyer Simon McGarr wrote on Twitter that the amendment would block people involved in DPC complaint procedures from “alerting the public or speaking out,” and would “further undermine the DPC[’s] effectiveness and reputation.” The U.K.-based tech law professor Lilian Edwards called it “a simple license for total secrecy.”
Not so, insists the Irish Department of Justice, which added the last-minute amendment to the bill. The government line is that the change would “bolster the integrity” of DPC investigations, and people are misinterpreting it.
“Breaches of confidentiality during an investigation can undermine the ability to effectively regulate data processors and allow breaches to go unsanctioned,” said spokeswoman Rachel Breen in an emailed statement. (I then asked for an example of this happening, but have not yet received a response.) Breen also noted that the confidentiality provision would only apply during the DPC’s procedures—once an investigation is closed, all those details would then come out—and said the department had indicated last October and November that it would be making changes to the Irish Data Protection Act’s confidentiality provisions.
And no, the change “does not impact on media reporting,” Breen added.
This is clearly a complicated and nuanced matter, so introducing the amendment so late in the game does seem counterproductive at best. It seems clear that the new confidentiality rule would make life easier for the Big Tech companies that bring so many jobs and tax euros to Ireland—they and the Irish regulator would be shielded from their adversaries’ running commentary as cases progress. Whether the change would be good for efforts to hold those firms accountable is another matter.
(P.S. Our third quarterly Fortune @ Work playbook just dropped today, and it’s all about generative A.I. in the workplace. Check it out here!)
More news below.
Want to send thoughts or suggestions to Data Sheet? Drop a line here.
David Meyer
Data Sheet’s daily news section was written and curated by Andrea Guzman.
