Privacy – cearta.ie

The sooner the government changes tack on the #psc, the better for Ireland’s international reputation – updated

22 September, 201927 September, 2019

On Tuesday of this week, belatedly and with very bad grace, the Department of Employment Affairs and Social Protection published the Report of the Data Protection Commission (DPC) on the Public Services Card (#PSC), which concluded that the government’s implementation of the PSC infringed data protection legislation. The government has refused to accept or comply with the Commission’s findings, and has instead, for reasons beyond understanding, gone to war with the DPC on this issue.

In my view, the Government’s unjustified defiance of the DPC imperils Ireland’s tech reputation; and I argue in an OpEd in today’s Sunday Business Post (sub req’d) (update: you can download it from the links in update 3 below) that this unseemly standoff must be resolved as quickly as possible, before irreversible damage is done to our international standing as a good location in which international tech companies can establish their European headquarters:

Dealing from bottom of the deck on the Public Services Card

The government is clinging to its legal advice on the PSC data fiasco. It needs to admit it was wrong and change course immediately

… The DPC’s report is very clear; its fundamental conclusions will undoubtedly survive legal challenge; and the government will eventually be as surely taken to task in the courts in Dublin and Luxembourg as it has been his week in the court of public opinion.

…

The legal basis of the US$170m fine on Google for YouTube’s infringement of children’s privacy

10 September, 2019

| No Comments

| GDPR, Privacy

FTC NYAG Google YouTube logos

At the end of last week, the media was full of stories that Google had been “Fined $170 Million for Violating Children’s Privacy on YouTube” (that’s a headline from the New York Times; see also, for example, NPR | BBC | RTÉ | Silicon Republic). In this post, I want to sketch the legal background to, and consequences of, this fine; and, at the end, I will say a few words about the equivalent position in Europe.

In the US, the Children’s Online Privacy Protection Act of 1998 (15 USC §§ 6501–6506; hereafter: COPPA), and the Children’s Online Privacy Protection Rule (16 CFR § 312; hereafter: the COPPA Rule) made under it, regulate unfair and deceptive acts and practices in connection with the collection and use of personal information from and about children on the internet. In particular, 15 USC §§ 6502(b)(A) COPPA, and 16 CFR § 312.3 COPPA Rule, require the operator of any website or online service directed to children that collects personal information from children, or the operator of a website or online service that has actual knowledge that it is collecting personal information from a child,

(i) to provide notice on the website of what information is collected from children by the operator, how the operator uses such information, and the operator’s disclosure practices for such information; and
(ii) to obtain verifiable parental consent for the collection, use, or disclosure of personal information from children; …

Giving further effect to the second paragraph here, 16 CFR § 312.5(b)(1)…

The Great Hack and the dysaguria of Cambridge Analytica

24 July, 201919 August, 2019

| 3 Comments

| Digital Rights, Dysaguria, Media and Communications, Privacy

The Great Hack has just dropped on Netflix (IMDB | Rotten Tomatoes | wikipedia | poster left). It is a documentary that explores “how a data company named Cambridge Analytica came to symbolize the dark side of social media in the wake of the 2016 US presidential election”. Much has already been written about the Cambridge Analytica scandal (eg ICO here and here (pdfs) | Carole Cadwalladr in The Guardian), and a great deal more will be written as the movie is reviewed in the coming days. I don’t propose to add to those torrents here. Rather, I simply want to observe that there is a word for a company that symbolizes the dark side of social media.

Reacting to Thomas More’s coinage of “utopia” as the “perfect state”, from the Greek “eu” meaning “good”, and “topos” meaning “place”, John Stuart Mill coined “dystopia” as the “frightening state”, from the Greek “dys” meaning “bad”, and (again) “topos” meaning “place”. But, whilst “dystopia” is perfect to describe a “frightening state” and its frightened society, it is not particularly apt to describe a “frightening company” and its frightened society. Indeed, we don’t really have the words for when a corporate society goes bad; “dystopia” and “dystopian” have been pressed into service (even in the context of reviewing The Great Hack: “Watching this film, you literally start to wonder if history has been warped towards a sickening dystopia”); but the warped society in that movie is very different to the warped society in classic dystopian fiction (such as, to take the obvious example, Orwell’s 1984).…

Cliff Richard v BBC – Part II – Media speech and publication in the public interest

23 July, 201827 July, 2018

| 1 Comment

| Freedom of Expression, Privacy

The record man said
‘Don’t let it go to your head, I’m gonna make you a star’
… So mama please don’t worry about me, I’m nearly famous now.

Sir Cliff Richard OBE in Greenwich 2017 (via Flickr) (element) 1. Introduction
The words above are in the first verse of “I’m Nearly Famous”, the title track of an album released in 1976 by Sir Cliff Richard [Sir Cliff], pictured left rocking Greenwich, UK, in 2017. Six weeks earlier, the South Yorkshire Police [SYP] had admitted that their tip off to the BBC that he was being investigated in respect of allegations of historic sex abuse infringed his privacy (see, eg, Richard v BBC [2017] EWHC 1648 (Ch) (26 May 2017)). On foot of that tip off, the British Broadcasting Corporation [the BBC] gave those allegations and the search of Sir Cliff’s property in Sunningdale, Berkshire prominent and extensive television coverage. Last week, in Richard v BBC [2018] EWHC 1837 (Ch) (18 July 2018) Mann J held that that the BBC’s broadcasts also infringed Sir Cliff’s privacy, and awarded him £210,000 damages. In a previous post, I have considered Mann J’s analysis that Sir Cliff had a reasonable expectation of privacy under Article 8 of the European Convention on Human Rights [the ECHR] in respect of the police investigation.…

Cliff Richard v BBC – Part I – Police investigations and reasonable expectations of privacy

20 July, 201827 July, 2018

| 1 Comment

| Freedom of Expression, Privacy

I just got to tell someone about the way I feel,
Shout it from the rooftop to the street,
And if I spread the word please tell me who’s it gonna hurt …

1. Introduction
The words above are the opening lines of “Can’t Keep this Feeling In“, released in 1998 by Sir Cliff Richard [Sir Cliff], pictured left in a mellow pose at a concert in Sydney, Australia in February 2013. In August of the following year, arising out of an ongoing investigation into allegations of historic sex abuse, the South Yorkshire Police [the SYP] searched a property belonging to him in Sunningdale, Berkshire; and – on foot of a tip off from the SYP the previous month – the British Broadcasting Corporation [the BBC] gave the allegations and the search prominent and extensive television coverage. Sir Cliff was never arrested or charged; and, in June 2016, the Crown Prosecution Service [the CPS] decided that Sir Cliff would not face any charges. This decision was re-affirmed by the CPS the following September, following a full review of the evidence.

Meanwhile, in July 2016, Sir Cliff commenced legal proceedings against the SYP and the BBC, arguing that SYP’s leak to the BBC in July 2014, and the BBC’s coverage of the raid in August 2014, invaded his privacy and breached his data protection rights.…