A data privacy campaigner has told an Oireachtas committee that systematic infringement of fundamental rights is going unchecked by the Data Protection Commission (DPC).
Dr Johnny Ryan, Senior Fellow at the Irish Council for Civil Liberties, claimed that in the three years since the General Data Protection Regulation (GDPR) came into force, the DPC has delivered decisions in four of 196 cases it has asserted a lead role as EU regulator in.
This includes a complaint made three years ago by Dr Ryan around Real-Time Bidding - a practice that allows data brokers to build profiles of individual users based on private things they do online - which the activist claims is illegal.
"That means Ireland is the bottleneck of GDPR investigation and enforcement against Google, Facebook, Microsoft, and Apple, everywhere in the EU," said Mr Ryan in an opening statement lodged with the Oireachtas Joint Committee on Justice, at which he will give evidence this evening.
"ICCL has warned Government that the DPC's failure to uphold the rights of 448 million Europeans creates strategic economic and reputational risks for Ireland."
Dr Ryan claimed that because of the lead role the DPC plays in regulating big technology firms across the EU, the GDPR gave Ireland the chance to become "the key location for digital regulation."
"But the DPC draws criticism from the European Court of Justice, the European Parliament, the authorities of Germany, France, Spain, Italy, the Netherlands, Austria, and Hungary, and last week, the CEO of the UK Competition Authority, too," he said.
"DPC inaction has forced other EU Member States to sidestep Ireland. If this continues, we will lose our relevance as a regulatory centre."
"It also jeopardises a European Commission proposal that Ireland become the super regulator for another key part of the digital economy."
Dr Ryan said that in the US a draft Bill has just been introduced to designate jurisdictions with inadequate data protection enforcement as unfit to receive US data.
"We know from the drafters that this intentionally targets the DPC's enforcement failure," he said.
"If Ireland is so designated, then every significant company here must stop processing data of customers in the US until they obtain an export license from the US Department of Commerce."
Dr Ryan has called on the Government to appoint two new Commissioners and appoint a chair of the DPC.
He has also claimed that an independent review is required to look at how the DPC should be reformed.
The ICCL will appear before the committee later today, along with solicitor Fred Logue, Austrian privacy campaigner Max Schrems and representatives from the Data Protection Commission.
