Cianan Brennan: Lackadaisical approach to data law is going to have real-life consequences
Ireland’s recent adherence to marquee European laws, which we are duty-bound to adopt, is at best lackadaisical, at worst wilfully, appallingly non-conformist.
The ongoing saga surrounding Ireland’s data retention laws gives the lie to the notion that the Irish are good Europeans.
We may wish to give off that impression, particularly in the era of Brexit, when having the bloc stood firmly behind us is of great comfort. We are good Europeans when it suits us.
But in practice, Ireland’s recent adherence to marquee European laws, which we are duty-bound to adopt, is at best lackadaisical, at worst wilfully, appallingly non-conformist. And it is happened too many times at this stage to be a coincidence.
This stick-in-the-mud approach to our EU obligations was put in sharp relief by the Government going toe-to-toe with the fundamentals of GDPR in the case of the controversial Public Services Card.
Despite every privacy expert in the country stating ad infinitum that what the State was trying to do in making the card mandatory for accessing public services was most likely illegal, the Department of Social Protection chose to fight the Data Protection Commission’s 2019 ruling, which stated precisely that.
Rather than accept reality, the Government chose the legal route, the political equivalent of kicking a particularly problematic rugby ball into touch, only to fold its case ignominiously two years later in December 2021, at a cost to the taxpayer of God-knows what. And that particular saga is far from finished.
It seems a peculiarly Irish characteristic — when faced with a problem, the action taken is to take no action at all, until desperately trying to address a problem when it is far too late, when the dumpster fire in question has raged entirely out of control.
You can see it in the current pickle facing the Government, that of the eviction ban and its decision to put a stop to same at the apex of a crippling housing crisis.
On the face of it, that decision appears to be literally mad. Why would any administration wilfully take such a damaging political position, one they could end up being despised for. And the answer is ‘because they have no choice’.
When you have been in bed with institutional investors and professional landlords for years, and let a housing crisis grow from tiny shoots into a full-blown sequoia, at that stage it is too late. Perhaps they literally do not know of any other way to approach a problem other than to do that which they have always done.
Regardless, this phenomenon of ‘wait-and-seeism' is played out to an almost-ludicrous extent in the issue of data retention.
Why does this matter? It’s easiest to illustrate the point via the case of Graham Dwyer, the notorious murderer convicted in 2015 — on the back of entirely circumstantial evidence — for the horrific murder of Dublin woman Elaine O’Hara.
The most crucial evidence against Dwyer came from mobile phone records pinpointing device locations, data obtained by the gardaí from mobile phone companies, as per Ireland’s 2011 Data Retention Act.
The problem was, that act had already been held to be incompatible with European law, illegal in effect, following a case taken by advocacy group Digital Rights Ireland to the Court of Justice of the EU (CJEU) in 2014.
That decision has been upheld by the same court on umpteen occasions since. Which means Ireland has been relying on a law which we knew well was not fit for purpose for nearly nine years.
This is the key factor in Dwyer’s appeal against his conviction, which has yet to be decided upon. But it is also pertinent to thousands of other convictions that were secured in a similar fashion.
An Garda Síochána has taken the decision on board and has relied less on such mobile phone data in these cases.
The road to Damascus has been a longer one for the Department of Justice, however. As far back as November 2017, the department acknowledged to its own Oireachtas committee that the law was not fit for purpose.
A replacement bill was drafted that same year. It was never enacted.
In November 2020, the Irish Supreme Court was informed by the CJEU that any decision it were to make regarding the mobile phone data used to convict Dwyer was likely to be in his favour.
We asked the Department of Justice at the time what it planned to do about that, and were told no new legislation would appear before the European court’s decision.
Last summer, the Irish Supreme Court dismissed the State’s appeal against a ruling in favour of Dwyer, clearing the way for him to appeal his conviction.
Suddenly, the Department of Justice found its sense of urgency, and succeeded in having emergency data retention legislation updating the 2011 act drafted and passed in just over a month, with the bare minimum of opposition scrutiny.
Well, at least they finally got the law fixed, you might think. But you would be wrong. Despite the breakneck pace at which that law was enacted, it has never been commenced. In other words, to all intents and purposes, it does not exist.
A further complication raised its head last December when this paper pointed out to the department that the law likely should have been run by the European Commission’s TRIS procedure.
TRIS demands that laws with the potential to interfere with the single market be submitted to the commission in their draft form to ensure buy-in from our fellow members of the bloc.
The department responded that it did not think it had to apply to the EC in that manner. Then quietly, when it thought no one was looking, it did apply two weeks later, four days before Christmas.
On Sunday, the reported that the EC had since replied to the department, essentially saying it should have applied to TRIS when the law was in its draft stage last year, and that because it did not, the new legislation was likely “unenforceable”.
When we pointed this fact out to the department, it continued to state that its intention is to commence the law “at the earliest possible date” (which given the EC’s TRIS standstill period of three months can be no earlier than March 22, nine months after its enactment), while adding that “engagement” at a European level was “ongoing”.
That would seem to be a deeply charitable appraisal of the situation. Another would be to say that to describe the management of this law as being akin to a flaming clown car would be an insult to the roadworthiness of such festive automobiles.
The State is finally, embarrassingly, out of road on this one. It is a national humiliation, and one with real consequences. And still the department will not admit it.
The taxpayers in whose name this is being done deserve better. In this case, it is time to start being more European and significantly less Irish.
CONNECT WITH US TODAY
Be the first to know the latest news and updates
