5 things you need to know from the Data Protection Commissioner’s Annual Report

6 Jul 2015

The 2014 report showed that the DPC cooperated with her contemporaries worldwide last year

Ireland’s new Data Protection Commissioner (DPC), Helen Dixon, has issued her first annual report, for 2014. We look at five headline issues, including the DPC’s cooperation with global regulators, plans for upcoming audits and the expansion of the DPC’s staff and budget.

1. The DPC goes global

In 2014, the DPC actively engaged with her fellow EU data protection authorities (DPAs), as well as with DPAs from around the globe. These included Canadian, Australian and US authorities, with whom the DPC cooperated in relation to a global security breach. In the 2014 report, the DPC has underlined the importance of the memoranda of understanding with these global DPAs, noting the efficiencies resulting from these arrangements.  Given the growing cluster of US tech companies in Ireland, the DPC is aiming towards greater international cooperation and consultation. Indeed, one of Dixon’s stated goals for 2015 is “to improve international cooperation … in particular with [her] Article 29 ‘Working Party’ counterparts”.

2. Targeted audits

The DPC’s office has traditionally carried out substantial audits of multinational technology companies. Dixon’s predecessor, Billy Hawkes, led two of the office’s largest and most detailed audits – those of Facebook Ireland and LinkedIn Ireland. Given the dedicated resources required for large-scale audits of multinational tech companies, the DPC has stated that a “scope-and-risk” based approach will be taken for upcoming audits. As a result, audits may focus only on particular areas of concern, rather than being organisation-wide reviews. This appears to have arisen from the constraints in dedicating staff to audit functions, while also maintaining the office’s day-to-day functions.

3. Continued hands-on approach

The 2014 report details the extensive consultation and interaction that the DPC had with companies and organisations during 2014, particularly in the tech sector. The DPC acknowledges her position as “lead” regulator for the many multinational tech companies that have headquarters or a significant presence in Ireland. Details of the DPC’s interactions with companies such as Facebook, LinkedIn, Adobe, Microsoft and Apple are highlighted. These engagements demonstrate the DPC’s ongoing approach as a hands-on regulator. The 2014 reports suggests the DPC’s intention to continue this approach of proactive consultation and engagement with the breath of companies under the DPC’s remit.

4. Cracking down on illegal subject-access requests

2014 saw the introduction of rules against enforced subject-access requests. These are requests for access to an individual’s information, which a current or prospective employer obliges the individual to make. The results are then used as a way of checking on the individual’s background – a form of ‘vetting by the back-door’. In the 2014 report, the DPC has urged employers to examine their practices, reiterating her intention to focus on this issue in the coming year. The DPC has stated that she intends to “vigorously pursue and prosecute any abuse detected”.

5. Doing more with more

The DPC’s annual budget has been doubled to €3.65m, demonstrating the Government’s recognition of the growing demands on the DPC’s office. New staff members are currently being hired, with the office intending to increase its headcount to 50 during 2015 (up from 29 in 2014). The DPC will also open a Dublin office this year while maintaining its Portarlington base. Additionally, the appointment of a junior minister with responsibility for data protection further signals the importance attached by the Government to Ireland’s role in this space.

Tech Law is a weekly series brought to you by Irish law firm Mason Hayes & Curran, whose legal tech team advises the world’s top social media organisations and emerging start-ups. Check out www.mhc.ie for more.