Cianan Brennan: Dixon determined to face all challenges

Data Protection Commissioner Helen Dixon discusses the frustration she has experienced in the role so far, but says several cases are now nearing conclusion.

The 18 months since the EU’s General Data Protection Regulation took effect have seen the level of engagement with Ireland’s Data Protection Commission soar beyond recognition.

In that time, 7,215 complaints under GDPR have been received, with 49,500 contacts received from the public via phone, post, and email. That constitutes a near doubling of the DPC’s workload.

By contrast, just 1,000 complaints were received in 2014. Meanwhile, funding for the commission has increased by €5.1m since 2018, while the DPC’s workforce has ballooned from 31 in 2014 to 140 at the end of 2019.

Not that the commission has always been happy with the level of funding apportioned to it in the budget. The €1.6m received in last October’s budget was a fraction of what had been requested, prompting the unusualaction, on behalf of commissioner Helen Dixon, to express her “disappointment”.

Sitting down for an interview with the Irish Examiner, Ms Dixon lives up to her reputation as someone who chooses her words with the utmost of care.

Her role is one of the most important in the State in a modern context, both as head of the regulator-in-chief in the post-GDPR landscape and as the figurehead of the ‘one stop shop’ for regulation of the myriad giant data-based multinationals with offices in Ireland.

Nevertheless, on top of its massive workload, the DPC has found itself at loggerheads with the Government on any number of issues in recent times, the best known probably being the case of the public services card (PSC) — aspects of which the commissioner declared unlawful last August.

That led to a protracted legal battle with the Department of Employment Affairs and Social Protection, the next deadline for which will be a meeting in the Circuit Court next month.

Does she find it annoying that her rulings have not been met with immediate compliance at a statutory level in recent times?

“Of course it’s frustrating, and utilises more and more of our resources where there isn’t implementation of our recommendations. That’s frustrating because it means we have to keep engaging in that supervision activity, or ultimately in issuing anenforcement notice,” she said.

But there’s no point in being frustrated. Clearly we’d rather have a straight run and everyone followed what we say, but that’s not reality.

She acknowledges that her role, which she has had inhabited since late 2014, comes with a huge workload and heightened pressure, not least given the one stop shop attracts the scrutiny of media and professionals worldwide, who have not always been particularly complimentary about the perceived slow pace ofissuing fines under GDPR.

At present, this country stands as one of just seven in the European Economic Area which has yet to levy any fines under the regulation.

That may change in the immediate future — but ‘may’ is the watchword. While two of the 70 GDPR investigations in progress at the DPC at the end of 2019 (a further two into Google and Tinder were announced earlier this month) have now reached decision stage, it will be Ms Dixon who has the final say on whether thesubjects being probed have breached data protection law.

Some 21 of those 70 inquiries are into multinational technologycompanies, and 11 of those are into either Facebook itself or its subsidiaries, WhatsApp and Instagram.

The vast majority of those complaints concern whether or not the social mediabehemoth has observed its GDPR obligations regarding the safeguarding of its users’ personal data.

One thing is certain — the decisions handed down on foot of those inquiries will put the DPC in the eye of the storm internationally,regardless of Ms Dixon’s conclusions.

Given that level of pressure does she feel that the Government has her back?

“In terms of the disappointment that we expressed with the budget for 2020, we felt that we had made a strong and clear and compelling case in terms of the demands on the DPC,particularly around the lead supervisory authority role, but also in terms of theissues arising in becoming our own accounting officer,” she says.

That change was officially implemented in January of this year. Meanwhile, the commission struggles with having its operations split between two locations — Dublin and Portarlington,Co Laois.

It is set to consolidate its Dublin premises into one unit on Pembroke Row in the south inner city, which will remained coupled with its Portarlington outlet. However, that move is now not expected to happen before 2021 at the earliest.

“While we were disappointed, we did secure an additional €1.8m in funding for pay,” says Ms Dixon.

There were whispers that the denial of the commission’s requested budget allocation could have a political dimension, given the Department of Public Expenditure and Reform ultimately holds the purse strings — a department drawn into the protracted squabble over the PSC due to it initiating the expansion of the card’s mandatory remit. However, this was shot down, in no uncertain terms, in Ms Dixon’s report into it last August.

“I don’t think so,” she says when asked about same. “That’s certainly not my impression; there were clear imperatives around Brexit this year and there were choices that had to be made.”

Two of the DPC’s inquiries are at the conclusion stage. Decisions on those probes can be expected before the end of the year “as a certainty”, says Ms Dixon.

So Ireland may finally make its mark on the fines leader board in the not-too-distant future.

“Several other investigations are nearing conclusion,” she adds.

One non-GDPR investigation report that will soon see the light of day concerns Independent News and Media. That probe came on foot of the so-called INM 19 case, which saw the personal information of that grouping allegedly copied from the group’s servers and released to third parties in 2014.

Ms Dixon says the report had been planned for release in tandem with the DPC’s annual report, but has slipped “by just a few weeks”. Will it definitely be seen in short order?

“It depends on what interrupts me in the meantime” is the diplomatic response.

She won’t be drawn on her prospective conclusions, but acknowledges that, notwithstanding the “colourful characters” which formed the crux of the INM saga, at the heart of her own interests are the “very significant data protection concerns” raised.

Read into that what you will, but it doesn’t sound like the conclusions will be overly favourable towards the media group.

In terms of the SC itself, the commissioner’s hands are tied, to an extent, due to the ongoing legal nature of the issue. However, a recurring theme of the PSC among certain media personalities is that the issue amounts to much ado about nothing. Can Ms Dixon see that point of view?

“Ireland has signed up as part of the EU to a comprehensive set of data protection rules that are required to be implemented, whether we see it as a big deal or not.

I think perhaps those that have tried to get a passport and have had to take a day off to get a card and are still required to submit all the same supporting documentation are those that have seen the big deal.

“Those who don’t see it as a big deal are perhaps commenting on their view around an ID card, which is perfectly legitimate.

"But it doesn’t matter whether people feel it is a big deal or not. What it should perhaps tell the Government is that if they were to legislate for such an ID card that there could be a lot of people positively disposed towards it.”

The State’s objections to Ms Dixon’s PSC findings have been significant for the regulator, however.

“It has been a huge commitment of resources since the public statement from the minister last September that the Government intended to entirely reject the findings of the report,” she says.

Has she ever had doubts about her own conclusions?

“We’re entirely confident of the legal analysis and the care we took in delivering a decision backed up by case law. It doesn’t mean that everything is going to go our way.”