,
47 tweets,
14 min read
Read on Twitter
Thread. The Data Protection Commissioner is before the Justice Committee right now and we expect the committee will be raising the #PublicServicesCard and the DPC’s investigation into it. Tune in here to watch: oireachtas.ie/en/oireachtas-…
While waiting for the public session, I'll congratulate @thekhrc for their Moday win when Kenya’s high court suspended the mandatory roll out of NIIMS. The #NIIMSCase deals with a national identity registration system with parallel data protection concerns to the #PSC @INCLOnet
For those hoping to understand identity systems more generally, @privacyint has a handy three part explainer: privacyinternational.org/explainer/2669…
In India, the constitutionality of the Adhaar, India's biometric ID card, was also challenged in court. The outcome was a blow for privacy and data protection rights and worth a read. livelaw.in/aadhaar-read-t… @hrln_india
Back to Ireland, where @ICCLtweet and @DRIalerts have been campaigning against the roll out of the #PSC. Read the ICCL's written submissions to the Joint Committee on Employment Affairs and Social Protection here: iccl.ie/wp-content/upl…
The @ICCLtweet is hopeful that today the committee will follow up on the Minister of Social Protection’s recent perplexing response to a PQ from Deputy Willie O'Dea: that the Department of Social Protection does not collect biometric data oireachtas.ie/en/debates/que…
The session is now public - they will be discussing data protection issues generally. oireachtas.ie/en/oireachtas-…
As it turns out, the Data Protection Commissioner is not present. Speaking is Anna Morgan, Deputy Commissioner at the DPC. Morgan is one of five Deputy Commissioners.
Deputy Commissioner Morgan notes significant change from previous regime – DPC is no longer required to draft or issue public decisions where complaints have not received amicable resolution. Heralds this as an efficient use of resources given increased volume of complaints.
'DPC has no regulatory competence to tackle fake news, online content moderation, or internet safety.'
The DPC commenced numerous statutory inquiries in 2018 considering systemic issues under corporate and public sector. Domestic statutory inquiries commenced included the use of CCTV.
Tl/dr the DPC is [paraphrasing] very very very busy.
DPC staffing numbers are now 135 – 160 expected by end of 2019.
On Facebook and Whatsapp: Deputy Commissioner Jennifer O’Sullivan says that DPC has opened 15 inquiries into ‘large multinational technology companies’. The DPC is focused on understanding the business models to assist the efficacy of their advice.
Breakdown of the DPC's 15 big tech inquiries: 7 - Facebook, 2 - WhatsApp, 1 - Instagram. No timeline offered regarding when these DPC inquiries will conclude.
Discussion re the proposed Digital Safety Commissioner legislation re online safety. Government is still exploring this legislation. @ICCLtweet in partnership with @CIVICUSalliance, has identified content moderation difficulties in eary legislation drafts iccl.ie/wp-content/upl…
DPC budget for 2019 is 15+ million, which has increased from 1.7 million in 2013. Again, anticipating 160 staff members by end of 2019 - a number which will continue to increase.
Via my inbox. Commissioner Helen Dixon is actually in Washington today at this event:
teachprivacy.com/international-…. I understand the Commissioner wasn’t able to meet with Zuckerberg yesterday in Dublin due to short notice - was there short notice for today's meeting as well?
teachprivacy.com/international-…. I understand the Commissioner wasn’t able to meet with Zuckerberg yesterday in Dublin due to short notice - was there short notice for today's meeting as well?
Deputy @wallacemick re subject access requests. Query re allegations that DPC slow to respond to complaints that data controller has ignored SARs.
Deputy Commissioner Jennifer O’Sullivan: length of time between DPC receipt of complaint and initiating activity is depending on level of resources applied. As we increase resources (recall that it’s 15+ million this year) response times will shorten.
The Public Services card is now ON!!!!
Deputy @wallacemick in what way are findings in DPC draft provisional report subject to change? Concerns that process involves a certain amount of collaboration between regulator and data controller.
The big questions of the day from deputy @wallacemick: How could it be in public interest to conceal aspects of DPC investigation into #PSC by only publishing summarised aspects of the report? Did the DPC instruct the Department not to publish as the Minister has said?
Anna Morgan, Deputy Commissioner at the DPC: We don’t collaborate, we are independent. The report is provisional because it allows the right to be heard by the Department. Provisional denotes opportunity for Department in relation to the report.
Yes, but what about the actual finalised report - why can't the public see that one either?
Re timeline, DPC is saying the investigation voluminous (lots of docs) and is also not static, facts have changed during course of investigation. Example given the changed requirement between June 2017 and aug 2018 #PSC no loner required for driver theory test.
Re publication, investigation launched under prior acts, and so, ulike 2018 act which allows express powers of publication there is no equivalent power of publication under previous acts. However, if Department consents DPC will publish.
To be clear: DPC is placing burden of publication on Department of Social Protection's shoulders. Say they will publish final report with Department's permission. You will recall up until now Department has said they will not publish without DPC's permission.
Unclear to me: If the previous legislation gives the DPC the power to publish with the Department's permission, how does this legislation preclude them from publishing either way??
On to biometric data and processing under Article 9 GDPR. DPC says it will come down to what type of processing is taking place and whether there is matching of personal data with other personal data including one's name etc...
Wait..is that it about biometric data and the #PSC?? We're on to CCTV and s38 of Garda Síochána Act 2005. Also important but...
Just another comment on the DPC report’s publication on their #PSC investigation. I don’t want to drop the issue given that the DPC has now seemingly transferred report publication responsibility to the Department at the time of their investigation's conclusion.
The @ICCLtweet welcomes independent legal analysis regarding the DPC’s power to publish their #psc report given they are empowered to publish under the existing Act and given the previous Acts (in effect when their investigation commenced) appears to be silent on this issue.
Deputy @ClareDalyTD Re the #psc report is it your position that you don’t have express powers to publish? Is there a legal impediment to your publication?
DPC reply: It is our legal position that we require permission from the department.
Deputy @ClareDalyTD You’ve been investigating the #psc since 2017. DPC on record in August '17 that this is a pressing matter. Nearly two years later this hasn’t concluded. The reason for delay is not satisfactory. 470 page response from Deprt isn’t enormous given time frame.
DPC: we have to be fair.
Deputy @ClareDalyTD: please provide committee information as to what government bodies are using SAFE2/ PSC processes currently.
Deputy @ClareDalyTD: Do you agree with Minister Doherty's statement that the PSC/SAFE2 doesn't involve biometric data processing. DPC reply: We can't comment on that currently.
I need to sign off and so will express my disappointment regarding the lack of substantive responses during this session. To summarise major points:
1. We have no answers regarding when the DPC investigation into the #psc will conclude. We know that the situation is dynamic and the at the DPC is very busy. We also know that they currently have 135 staff and a 15 million+ budget.
2. Unclear still is why the DPC cannot themselves publish their #psc investigation report in light of express powers to do so under the current Act and silence on this in the previous Acts.
3. It is clear that the DPC will publish their #PSC report if the Department of Social Protection authorises them to do so.
4. Deputy @ClareDalyTD has requested that the DPC provide a list to the committee of bodies currently using the PSC/SAFE2.
5. The DPC has not answered whether biometric data is processed for the purpose of SAFE2/PSC registration.
My summarised points. What did I miss?
