Data protection watchdog in dispute with Dáil committee over 'inaccurate data' in report

Helen Dixon, the Data Protection Commissioner.

An Oireachtas Committee has told the Data Protection Commission it is “satisfied” with how it produced a report which the DPC has claimed, in a letter sent almost 18 months after it was published, contains “a number of inaccuracies”.

In the report, published in July 2021, the Oireachtas justice committee said it fears “citizens’ fundamental rights are in peril” and said it had “serious concern” over reports of “particularly slow progress of some cases being handled by the DPC”.

The DPC’s head of corporate affairs, media and communications Graham Doyle wrote to Oireachtas Justice Committee chair James Lawless on December 30 last.

Mr Doyle said given the committee’s “centrality” in overseeing policy, the DPC wanted to “correct a number of inaccuracies” in its 2021 report.

“Regrettably, the DPC was not provided with an advance copy of the report for its review, at which time it would have had the opportunity to review and correct inaccurate or incomplete data, of this nature, contained in its draft,” he said.

“The 2021 report also contained assertions that there may be 'slow progress of some cases being handled by the DPC' or that 'citizens' fundamental rights are in peril' in the arena of data protection. The simple truth is there is little to no basis in fact for these assertions.” 

Mr Doyle cited previous comments from the European Commissioner for Justice Didier Reynders and European Ombudsman Emily O’Reilly to support this, and statistics around the level of fines it has dished out to big tech firms in recent times.

“By judging the evidence, one fact is unarguable: by most important measures, the DPC is Europe’s best-performing data protection authority,” he said. 

“In contrast to some sources, as a statutory regulatory body, the DPC is bound in law to produce accurate and complete statistics about its work and its legal functions. It does so unfailingly.” 

Each of the 17 recommendations made by the Oireachtas committee are then addressed in turn by Mr Doyle in the nine-page letter.

In a response to the DPC sent by the committee on Monday, it noted the long gap between the publication of the report and the observations now being made by the DPC “almost 18 months later”.

It said the imminent publication of its 2022 annual report may present an opportunity for the DPC to come before the committee where it can put forward its point of view. It also said it is not common practice to provide advance copies of draft reports to stakeholders.

“The committee acknowledges that, in the course of the hearings, there were many different views expressed on the topic and this is reflected in the report and the recommendations,” it said. 

“The committee is satisfied with the process undertaken leading to its report and looks forward to engaging with the commission in the future.” 

The spotlight has been on the DPC in recent times, including this month after it announced significantly increased fines for Facebook owner Meta after disagreements at European level over the original level of sanction it had planned to impose.

A source on he committee said the letter from the DPC underlines the committee’s view that a fully independent review of the DPC is essential.

“This seems a desperate move by the DPC to be frank,” they said.

“Their decisions and procedures are been questioned more and more, by the Irish courts, by other European Data Protection Authorities, and by privacy campaigners. They are increasingly isolated and in response they choose to dig in and to pick a fight with an Oireachtas committee over an 18-month-old report.” 

The Irish Council for Civil Liberties senior fellow Dr Johnny Ryan said his organisation has repeatedly asked the Irish Government for a completely independent review of how to strengthen and reform data protection in this country.

“We need to steel the DPC to be able to protect and uphold the fundamental rights of everyone across Europe in the face of the most powerful companies in the world,” he said.

“Ireland views itself as a strong advocate for human rights. But here at home with the DPC, it is now essential that we restore confidence in Ireland’s ability to play its part and that requires an independent review of that agency.”