Irish Water, transfer of data, and WTF

TJ McIntyre was on Morning Ireland this morning talking about Irish Water and their use of PPSN. The Irish Water representative, Elizabeth Arnett was on a few minutes later.

In the course of the Irish Water commentary on their use of data, the question was asked about what would happen to PPSN data if Irish Water was ever sold. The assurance was given that Irish Water cannot be sold under legislation and that the reference to any such sale or transfer in the data protection notice was just the use of “standard clauses”.

And therein lies the nub of (part) of the problem – a Data Protection Notice is supposed to inform people about what YOUR organisation is going to do with the data provided to YOU. Cutting and pasting might give you a template, but you need to invest a little time and effort working through the Information Asset Life Cycle (Plan, Obtain, Store/Share, Maintain, Apply, Dispose) to ask some key questions so you can build a truly accurate and reflective Data Protection statement that is, for want of a better term, TRUE. Plagiarizing some other organisation’s policies is not a recommended practice.

(As an aside, in the day job at Castlebridge Associates I’m fortunate to have hired someone whose previous career involved them checking for academic plagarism, so when we audit data protection policies we can pretty quickly find out where the cut and paste bits were sourced from).

So, today we learned that Irish Water can’t be sold. Which means that all the guff in the Data Protection notice about the transfer of data on the sale of the business or the purchase of another business is utter claptrap.

Unless of course the situation is that Irish Water can’t be sold NOW. I started my career in Data Governance in a semi-state company that we were assured couldn’t be sold and wouldn’t be sold. That company is now heading to its second IPO, having been flipped more times than a pancake on Shrove Tuesday. So perhaps I’m a little cynical about the management of State utility companies.

If Irish Water can’t be sold, that’s great. The Government and Irish Water need to make that explicitly clear and the Data Protection notice should be amended to have a positive declaration that Irish Water will not be sold. However, if there is a possibility that it might be sold then that should be clarified (even if a legislative change would be required for it to be sold) and the Data Protection notice should clarify what data would be transferred (for example, would PPS numbers be transferred, and if so why).

As I said on WLRFM earlier in the week – if a glass of water was put in front of me that was as murky and opaque as the current Data Protection notice from Irish Water I would refuse to drink it.