Ireland has failed to regulate Facebook on behalf of Europe

New EU rules will allow data-protection organisations to oversee the work of the DPC in Dublin

Whistleblower Christopher Wylie, who helped set up data analytics firm Cambridge Analytica, says that he believes the company developed techniques capable of having an impact on elections. Video: Reuters

 

Last year the north side of Fitzwilliam Square was the ninth most profitable place in Dublin to clamp cars, generating almost €42,000 in clamping fees. The principle is clear: if you park here illegally you must pay a fine to get your car back.

Different principles seem to apply on the other side of the square which has been the home of the Dublin office of the Irish Data Protection Regulator (DPC) since 2015 .

For the last seven years – following a complaint from Austrian privacy campaigner Max Schrems – Ireland’s regulator has been “engaging” with Facebook through meetings and audits on whether its business practices adhere to or breach EU law.

Because Facebook and other tech giants have their international headquarters in Ireland, the Irish regulator has front-line responsibility for policing them. At no point has Facebook feared the DPC.

Instead the social network shares the view of many European data regulators who liken Ireland to George Orwell’s Animal Farm: the larger and more powerful you are, the less likely the DPC is to clamp you.

Among its caseload for 2011, the DPC tackled a veterinary practice for disclosing a dog owner’s personal data; censured a leisure centre that requested excessive personal data from patrons; and warned a marketing company to stop calling numbers on the national opt-out register.

We still don’t know if EU citizens’ data were sucked up by the app linked to Cambridge Analytica

Another case came on its radar that year: Facebook. Unlike those quick, snappy rulings on small Irish businesses, the DPC – seven years later – it is still grappling with the social media giant on behalf of its 374 million active users in Europe.

EU law

After the Cambridge Analytica scandal broke, Irish data regulator Helen Dixon said she would “follow up” on a 2011-12 audit into Facebook. This investigation included a complaint by Schrems that Facebook’s Dublin operation was operating outside EU law.

In one prescient point he argued that “third-party consent”, cited by Facebook as the legal basis for data collection by third-party apps, had no basis in EU law. Leading data protection figures across Europe share this view.

In its audit reports, however, the DPC – apart from a few minor quibbles – appears to side with Facebook. Your personal data can be sucked up by apps not installed by you – but by a Facebook “friend” – to be stored and sold by a company you’ve never heard of.

You may not have known this was happening, but Facebook argues you should have.

And if you had a problem with this, you should have switched off the default “share” setting in your Facebook profile.

We still don’t know if EU citizens’ data were sucked up by the app linked to Cambridge Analytica. But, given thousands of such apps exist, it’s likely many EU Facebook users had their data grabbed by others on the DPC’s watch.

Facebook chief executive Mark Zuckerberg speaks at a summit in San Francisco, California. Photograph: Josh Edelson/AFP/Getty Images
Facebook chief executive Mark Zuckerberg. "Because Facebook and other tech giants have their international headquarters in Ireland, the Irish regulator has front-line responsibility for policing them." File photograph: Josh Edelson/AFP/Getty Images

You may not know them, but these companies now know everything about you – from your political to your sexual preferences. The vast consequences are only beginning to become clear.

Loophole

Taoiseach Leo Varadkar insisted this week, somewhat disingenuously, that the loophole allowing for this “was closed in 2015”. This was because of a Facebook systems update, not because it felt any urgency to respond to non-existent DPC pressure.

In other words, the horse was kind enough to close the door as it bolted. This is data-protection regulation Irish-style.

In 2013, when I visited the DPC headquarters in Portarlington, Co Laois, then regulator Billy Hawkes insisted his consensual approach to regulating Facebook – viewed critically by many EU peers – was more effective than waving a regulatory stick because “it is good to use powers of persuasion backed up by enforcement powers”.

From a European perspective, the Cambridge Analytica scandal is not a series of unfortunate events but a new low point in a long narrative of deliberate neglect in Ireland

In 2014, as Cambridge Analytica was culling information it says handed Donald Trump the White House, Hawkes insisted to me that Facebook “is in compliance with its obligation under Irish and European data-protection law”. Really?

Now that the extent – and consequences – of its data-trading have become public, Facebook is shocked – shocked – by what happened.

In reality, Facebook is shocked because it was caught out. It walked into this with its eyes open, allowing problematic – possibly illegal – data-collection via third-party apps. And it earned money in the process from data-collecting app developers it knew it couldn’t control.

And yet Facebook is simply doing what it was programmed to do. Contrary to its soft-soap PR, Facebook is not here to heal the world Michael Jackson-style. Altruism is a happy by-product of its main mission: to make money by digitising people’s DNA and selling it to the highest bidder.

Until 2014,when Cambridge Analytica went to work, Facebook’s motto was “move fast and break things”. We now know it may have helped break US democracy. Oops.

New low point

From a European perspective, the Cambridge Analytica scandal is not a series of unfortunate events but a new low point in a long narrative of deliberate neglect in Ireland.

Ireland’s “consensual” regulation of Facebook has failed – spectacularly. From May new EU rules will allow data-protection organisations around Europe to oversee the work of the DPC in Dublin

The message from Europe to Ireland’s DPC is clear: regulate or you will be regulated. Clamp or you will be clamped.

Because failing to stop powerful companies breaking data-protection law is not regulation, it is complicity.

Derek Scally is Berlin Corespondent

The Irish Times Logo
Commenting on The Irish Times has changed. To comment you must now be an Irish Times subscriber.
SUBSCRIBE
GO BACK
Error Image
The account details entered are not currently associated with an Irish Times subscription. Please subscribe to sign in to comment.
Comment Sign In

Forgot password?
The Irish Times Logo
Thank you
You should receive instructions for resetting your password. When you have reset your password, you can Sign In.
The Irish Times Logo
Please choose a screen name. This name will appear beside any comments you post. Your screen name should follow the standards set out in our community standards.
Screen Name Selection

Hello

Please choose a screen name. This name will appear beside any comments you post. Your screen name should follow the standards set out in our community standards.

The Irish Times Logo
Commenting on The Irish Times has changed. To comment you must now be an Irish Times subscriber.
SUBSCRIBE
Forgot Password
Please enter your email address so we can send you a link to reset your password.

Sign In

Your Comments
We reserve the right to remove any content at any time from this Community, including without limitation if it violates the Community Standards. We ask that you report content that you in good faith believe violates the above rules by clicking the Flag link next to the offending comment or by filling out this form. New comments are only accepted for 3 days from the date of publication.