On Tuesday of this week, belatedly and with very bad grace, the Department of Employment Affairs and Social Protection published the Report of the Data Protection Commission (DPC) on the Public Services Card (#PSC), which concluded that the government’s implementation of the PSC infringed data protection legislation. The government has refused to accept or comply with the Commission’s findings, and has instead, for reasons beyond understanding, gone to war with the DPC on this issue.

In my view, the Government’s unjustified defiance of the DPC imperils Ireland’s tech reputation; and I argue in an OpEd in today’s Sunday Business Post (sub req’d) (update: you can download it from the links in update 3 below) that this unseemly standoff must be resolved as quickly as possible, before irreversible damage is done to our international standing as a good location in which international tech companies can establish their European headquarters:

Dealing from bottom of the deck on the Public Services Card

The government is clinging to its legal advice on the PSC data fiasco. It needs to admit it was wrong and change course immediately

… The DPC’s report is very clear; its fundamental conclusions will undoubtedly survive legal challenge; and the government will eventually be as surely taken to task in the courts in Dublin and Luxembourg as it has been his week in the court of public opinion.

Read More »

At the end of last week, the media was full of stories that Google had been “Fined $170 Million for Violating Children’s Privacy on YouTube” (that’s a headline from the New York Times; see also, for example, NPR | BBC | RTÉ | Silicon Republic). In this post, I want to sketch the legal background to, and consequences of, this fine; and, at the end, I will say a few words about the equivalent position in Europe.

In the US, the Children’s Online Privacy Protection Act of 1998 (15 USC §§ 6501–6506; hereafter: COPPA), and the Children’s Online Privacy Protection Rule (16 CFR § 312; hereafter: the COPPA Rule) made under it, regulate unfair and deceptive acts and practices in connection with the collection and use of personal information from and about children on the internet. In particular, 15 USC §§ 6502(b)(A) COPPA, and 16 CFR § 312.3 COPPA Rule, require the operator of any website or online service directed to children that collects personal information from children, or the operator of a website or online service that has actual knowledge that it is collecting personal information from a child,

(i) to provide notice on the website of what information is collected from children by the operator, how the operator uses such information, and the operator’s disclosure practices for such information; and
(ii) to obtain verifiable parental consent for the collection, use, or disclosure of personal information from children; …

Giving further effect to the second paragraph here, 16 CFR § 312.5(b)(1) COPPA Rule provides

An operator must make reasonable efforts to obtain verifiable parental consent, taking into consideration available technology.

Read More »

From the report embedded above (with added links):

Tech companies’ reign over users’ personal data has run largely unchecked in the age of the internet. Europe is seeking to end that with a new law

… the European Union enacted the world’s most ambitious internet privacy law [the General Data Protection Regulation (the GDPR)], even winning support from the CEO of the biggest tech company in America, Apple’s Tim Cook. …

Max Schrems: The default under the European system is you’re not allowed to use someone else’s data unless you have a justification. …

Jeffrey Chester: Americans have no control today about the information that’s collected about them every second of their lives. …

Today, if one of the big tech companies chooses to ignore Europe’s new data protection law it could cost them 4 percent of their global revenues, which for the biggest companies would mean billions of dollars. Those decisions will likely be made here in Dublin, … Ireland’s data protection commissioner Helen Dixon says it’s not going to be business as usual.

Helen Dixon: U.S. internet companies have no doubt that this law is serious, it has serious bite. And all of them are eager to avoid any engagement with that.

Read More »