Category: Uncategorized

I posted yesterday about my complaint to the Irish Data Protection Commission about the cross border data transfers of an international not-for-profit organisation.

This is a topic I’ve looked at myself in the past in some detail when I was volunteering with a similar organisation doing similar things. About five years ago I mapped out the considerations and what needed to be done to ensure certainty (this was in the wake of Schrems I and long before Schrems II).

Working out what had to be done meant thinking some previously unthinkable things. It encountered huge resistance in the organisation. Ultimately, despite getting some early wins (data localised to EU, role based access on database that would allow access to personal data to be restricted by geographic region if required, EU-based processors engaged for development work and application support, and other stuff), we didn’t get fully to a point where I was happy that the compliance risk was fully mitigated. The internal resistance became to much to overcome as the objective that was being pursued became conflated with other internal politics in the organisation. For example, setting up an “Operations Entity” in the EU to manage all the back-end data processing activities was something that didn’t happen, because it required significant changes to the bylaws and governance structures of the organisation.

So, I can understand why organisation might struggle with these things if they are constrained in their resources. It does mean having to think long and hard about your information architecture and processes. And it can effectively amount to a a perceived shift in the organisation’s internal power dynamic if suddenly “head office” has become a figure-head function and the real work is being done elsewhere. It does mean having to consider the impact and implications for your brand if your compliance is called into question.

There is another strategy that I might pursue now if I had the time over again. But I don’t, and frankly I don’t think I’d put myself in that thankless (unpaid) position again.

But I do think this is something that global membership organisations need to start thinking about. I just seem to have been thinking about it a bit longer than others. The problems raised by the IAPP in their webinar and that I have raised in my complaint are not new. We just need to get around to solving them. And that means thinking outside the box and rising above any internal “toy-town” politics that might exist in an organisation.

As I write this I am listening to an IAPP webinar on LinkedIn Live discussing Article 49 derogations for data transfers outside the EU.

There is some consternation in the discussion about the narrow interpretations that are applied in relation the derogations under Article 49. It’s great to see the IAPP discussing the limitations of these derogations. A few key points jumped out at me…

1. Ruth Boardman was very clear that the “compelling legitimate interest” basis could not be relied upon for repetitive transfers and was really something you looked to if nothing else could be identified. “This is likely to be fairly limited”.
2. Consent as a basis for transfer was generally viewed as a challenge as it pushed the issue onto the data subject, and it also raised issues of the elements of consent having to be met. In addition, Recital 111 of GDPR was identified as a challenge given it requires transfers to be “occasional and necessary” for both consent based transfers and transfers on the basis of contractual necessity.
3. For “direct collection” of information by organisations based outside the EU/EEA (the example given on the webinar was a podcast subscription service), the point was made (by Omer) that this wouldn’t necessarily be a transfer as the Controller is targetting data subjects in the EU for products and services directly and is collecting the data directly and must comply with GDPR, but the situation is very unclear. However, Ruth Boardman pointed out that, even if the direct collection argument stacks up, this just defers the problem as the organisation then has to deal with any transfers of data to 3rd party hosting, payment processors, contract administrative staff etc. Personally… I still think this raises a challenge for organisational and technical controls to ensure compliance with GDPR under Article 5(2) and Article 24 where the 3rd country doesn’t offer essentially equivalent protections for personal data as per the line of jurisprudence in the Schrems cases.

Omer Tene discussed the how the question of ‘direct collection’ has rattled around the EDBP agenda for a while now, and notwithstanding the view of the EU Commission that this wouldn’t be a transfer outside the EU/EEA, the important decision rested with the Supervisory Authorities. Also, Recital 114 can’t be ignored: there remains a requirement for a controller to make use of solutions that provide data subjects with enforceable and effective rights regarding the processing of their data once it has been transferred.

A Key Takeaway

The key takeaway is that the question of derogations is both straightforward (they are limited scope exceptions to the norm) and complicated (those exceptions have to be interpreted narrowly, because they are exceptions). Much of the coverage on the IAPP website of derogations makes this very point, particularly in the wake of DPC v Facebook & Schrems. Even the reported remarks of AG von Danwitz, the rapporteur on the Schrems II case at the CJEU, that indicate Article 49 derogations might be an option worth considering are not entirely without caveat (particularly as he didn’t want to prejudge any cases that might arise on this topic).

An Action

As this is a key issue that requires clarification from the EDPB, and as it seems that something needs to be done to move the discussion from an abstract agenda item at the EDPB to a more tangible decision making process that has a consistency and co-operation mechanism where each Supervisory Authority can submit their reasoned opinions on interpretation.

Therefore, back in January I filed a complaint with the Irish Data Protection Commission about transfers of data to a 3rd country (the US) by an organisation that has its headquarters in the United States but operates an EMEA headquarters in Brussels and has market presence in many of the EU member states. I am a customer of this organisation. They rely on consent, contractual necessity, or compelling legitimate interests (all of which were discussed on the IAPP’s webinar and all of which have ‘issues’ that need to be addressed).

Interestingly, this organisation (at the time I submitted the complaint) was referencing Article 41 and Article 44 of GDPR as the basis for their transfers. This has now been amended to correctly identify Article 49 GDPR as the basis for transfer. But… AT THE TIME OF MY compliant they had it arse ways. So it’s a good job I saved the version of the data protection notice for posterity to the Internet Archive and included a screenshot in my complaint.

I thought this provided a good live case to test a number of the issues which might be relevant in this context, including questions of establishment, the appropriate lead supervisory authority when the organisation has a nominated establishment in an EU member state but has a point of presence in others, as well as providing a real scenario to test the specific guidance of the EDPB on the interpretation of and application of the Article 49 derogations.

My complaint specifically addresses many of the points that the IAPP raised on the webinar today, for which no easy answers were put forward. That means we need a DECISION!!

My complaint is attached below for anyone to read.

But well done to the organisation in question for taking the time in the last two and a half months to correct the reference to Article 44 in respect of derogations relied upon and correctly referencing Article 49. It’s a pity that they continue to reference Article 41 GDPR in the context of adequacy. Article 41 GDPR deals with Monitoring bodies for Codes of Conduct. I assume they meant Article 45.

Oh… and the organisation I complained about is the IAPP.

I’m sure they’ll agree that anything that moves this to a formal decision within a framework where each Supervisory Authority can make formal reasoned submissions to achieve a consensus on enforcement is important.

We are living in strange times. And I’m not just talking about Covid, forest fires, or the potential discovtaery of signs of alien life on Venus. No, I’m talking about the bizarro-world scenario of Max “Europe vs Facebook” Schrems joining common cause with (checks notes) Facebook against the Irish Data Protection Commission over (checks notes again) their decision to take an enforcement action against Facebook.

As I see it there are a few things going on that don’t seem to make sense.

(This blog post is my own personal opinion and does not necessarily reflect the postion of Castlebridge).

Hurry up, Go Slow!

Back in July Noby.eu announced that they had been granted leave to have a judicial review of the Data Protection Commission’s processes because Max believes the DPC is taking too long to reach decisions in cases he has filed complaints in. The only remedy he could be seeking here is for the DPC to speed things up.

A few days later, the CJEU issued its ruling in Data Protection Commissioner vs Facebook and Schrems. That case answered a range of procedural questions that the DPC had had referred to the CJEU from the Commercial Division of the Irish High Court (I’ve commented before elsewhere about how I think that that particular route to the CJEU was a bizarre choice, but I digress…). If you want to find out more about the questions raised, I wrote about them here last July.

A few weeks after that, the Data Protection Commission wrote to Facebook to advise them that an investigation had been opened on the DPC’s own volition under GDPR into Facebook’s use of Standard Contracual Clauses. Prior to this becoming public knowledge Max appeared at the LIBE Committee of the European Parliament. At this meeting he disclosed having received correspondence from the Data Protection Commission about their intention to carry out an own volition investigation and their preliminary decision. Schrems made a statement to the effect he expected it would take a number of years before the DPC would take any enforcement action.

However, the letter that Max received from the DPC set out their rationale clearly and set out the time period that Facebook were given to respond to the DPC’s preliminary position. That was 21 days. The DPC intention was then to make a draft decision for submission to the EDPB within 21 days for review as part of the consistency and co-operation mechanisms under GDPR.

Once the paperwork hit Facebook, they reacted as one would anticipate, and began a PR campaign and launched a judicial review to try and stop the DPC’s process in its tracks. Part of Facebook’s argument appears to be that the DPC has acted prematurely in this case. Which is odd, as there might have been the clue of seven years of Max’s pre-existing complaint and a CJEU court hearing which might have alerted them to the issue. Also, I don’t see anything in the Data Protection Act that requires the Commission to “Do a Denham” and give advance notice of an investigation (something which Facebook used last October to have the ICO investigation into them shelved).

The other odd thing is that Noyb.eu are also now challenging the DPC’s actions. And Max himself is commenting on how the DPC has put him in the position of being on the same side as Facebook.

Wanting to the DPC to slow things down. While at the same time wanting things to speed up.

Max’s argument…

I have some sympathy with Max’s position. His complaint was filed on the 1st December 2015. It has taken a long and winding road. However, the CJEU (as Max points out in his correspondence to the DPC) required that the finalisation of the matter referred to them be completed with all “due diligence”. The DPC has taken a narrow scope on this case, which is cause for criticism. The criticism is triggered by Facebook shifting the goal posts again in correspondence to rely on contractual necessity (one of the Article 49 derogations).

That doesn’t mean haste. And it also doesn’t mean “in the manner that any individual might desire”.

What it means is in the way that is most likely to deliver a robust result.

So, why an own volition investigation?

While Max argues that there is no rational reason for initiating an own volition investigation, I actually think there is if the DPC is trying to ensure that they are applying all due diligence to getting to the end result. The unfortunate fact (as Max keeps reminding us) is that his complaint was initiated pre 25th May 2018. Section 8 of the Data Protection Act 2018 requires the DPC to decide all cases initiated before 25th May 2018 under the old Data Protection Acts 1988 and 2003.

This is a problem. Or at least a potential pitfall.

Apart from the fact that the penalties under the old legislation were piss poor, there is the sorry fact that the DPC is currently facing an appeal and a judicial review by the Department of Employment and Social Protection in respect of an inquiry commenced under the old legislation with the decision issued post May 2018. So, it is probable that, in order to avoid falling into the same shithole on a second high profile case, the DPC took a prudent decision to move quickly on a new GDPR-based investigation focussing on the specific issues that were before the CJEU.

Another reason the DPC might want a ‘clean slate’ on things at this point is that the case, and the associated papers, will need to be brought under Article 60(3) to the EDPB. But the EDPB didn’t exist under the 1988 and 2003 legislation. And there was no consitency and co-operation mechanism. So moving forward with any disclosure of case details to other supervisory authorities under the ‘old rules’ could invite an automatic judicial review of the decision making processes of the DPC by Facebook, resulting in the whole thing being chucked.

But I’m speculating on that one. It’s just the way I’d have juggled this to ensure that the case was dealt with with all due diligence (which is legal speak for “avoiding fuck ups”).

But what would that mean for Max’s original complaint? Well, it’s still live. Which means that a result on this own volition investigation would clear the way for a simpler closure of his original complaint, because it could be dealt with locally but in a manner consistent with a parallel decision under GDPR.

Out of Sight Out of Mind?

The last few days have been good for Max. He is back at the centre of the media circle on this issue. The Data Protection Commission is constrained in commenting on active cases lest they make an arse of it like the ICO has a habit of doing. So it’s easy to make claims like it’ll take years to get a decision out of the DPC on their own case when they are not in a position to challenge it because they have to take the higher ground.

He has accused the DPC of leaking the news of their investigation to the Wall Street Journal. He has launched a Judcial Review of their process (another one), and he has found common cause with Facebook.

But he has made it all about him again. Rather than about the outcome. Which should be a long awaited decisive action against a large corporation with resources enough to keep the DPC in a pit of appeals and Judicial Reviews if the DPC were to act in haste without taking due diligence of the steps they are taking.

It’s a messy situation as the DPC has to navigate a number of mines in this minefield. But the far side would seem to be in sight. After all, the Article 49 contractual necessity argument put forward by Facebook is utter shite and fails at the first hurdle under both GDPR and the 1995 Directive/ DPA1988 & 2003, so it won’t take long to put that one to bed, leaving FB with no other angles (and Max with nothing else to complain about).

I know from personal experience that when you get into an adversarial posture with someone over a long time it can be difficult to step back and appreciate your common ground. You end up renting out space in your head to the ‘avatar’ of your counter-party. But if you don’t step back you might wind up with strange bedfellows.

It is odd that, in this case, the adage of “the enemy of my enemy is my friend” seems to have lead to Max ‘friending’ Facebook.

As the old saying goes in Irish, “déanann boscaí folmha an torann is mó“

So, 81 people attended a Golf Society event in a hotel in Clifden during a time when the country was losing control again on a pandemic, largely through community transmission.

At the time, the public health REGULATIONS (not guidance) were that events like this could permit a maximum of 50 people.

Weddings had been cancelled. Christenings postponed. Family reunions put on the long finger. But this Golf Society held its event regardless. In the time period that the event happened, three counties were put on ‘local lockdown’, embuggering local businesses who were just starting to get back on their feet.

That’s bad. It gets worse.

The Golf Society was the Golf Society of the Oireachtas, the parliament that had recently passed the very regulations that the legislation contravened. It was attended by a Government Minister (who sat at Cabinet and received the briefings from the National Public Health Emergency Team), an EU Commissioner, a former Attorney General (now a Supreme Court Judge) who had been involved in drafting the regulations that this event contravened. We also had a gaggle of Senators, and the CEO of the Irish Banking Federation.

Naturally, when the Irish Examiner broke the story, the people of Ireland were a bit annoyed (bear in mind, we call the Second World War an “Emergency”). Even the childhood favourite of middle-aged (good grief, I am middle aged now) people around Ireland, Bosco, found it necessary to comment on the ludicrousness of the situation.

If Grownups don’t do what they are supposed to do how can they expect everyone else to behave

Bosco, @boscoofficial on Twitter

Today, we awake to:

• A Government Minister resigning as a Minister (the second Minister for Agriculture to resign in as many months)
• A wave of form letter apologies on social media from other politicians who attended the event.

Mea culpa, mea culpa, mea minima culpa

Every TD and Senator who attended the Golf Society dinner apologizing on Twitter this morning

The apologies are meaningless as they:

1. Follow a suspiciously similar structure and phrasing
2. Cite the confusion about the new public health guidance that have come into effect this week, which glosses over the fact that the gathering was illegal under the regulations that existed at the time
3. Apologise for any offence or upset that was caused.

It is wonderful how humility can be found in the WhatsApp group of a PR handler but a backbone to actually consider the public health regulations and decide to forego attending an event that might breach public health restrictions.

The details of the event are apparently that there was a partition between groups in the venue. This gives us a supremely jesuitical position that there were actually two separate events of 46 and 35 people respectively, well under the 50 person limit. But they shared catering staff, the parties on the other side of the partition were able to take part in the “main event” and were referenced in speeches etc. it is reported. It is an arguable position legally, but a non-starter optically and morally.

It turns out that it was not Alexander Hamilton in the room where it happened, but rather A Large Partition. But Irish political leaders should know from history that introducing a partition into the equation as a workaround for an intractable difficulty just causes more problems.

Bosco called it clearly. If the grownups can’t follow the rules how can they expect the rest of us to. This whole situation is Brazen, Offensive, Stupid, Callous, and Objectionable. It’s gone the Full BOSCO, particularly when elected representatives apologies for the upset they have caused and not for the vainglorious double standard they have applied to respecting restrictions designed to curtail the spread of a serious public health threat.

Of course, the Minister and other grandees were probably in the big room at the big table. Spare a thought for the poor souls on the other side of the partition at the kids’s tables who are today facing the same anger and frustration from colleagues and constituents. If the erection of a partition to sub-divide the attendees at a single event turns out to be a valid defence legally it will mean that they were at the kids’ table, outside the room where it happened. And if this turns out to be a legally valid defence (and someone can surely ask the opinion of the former AG and current Supreme Court judge on that point), then it will be a further kick in the teeth to families who have cancelled weddings, birthdays, christenings, and other events because of restrictions on numbers.

And spare a thought for the front-line healthcare workers who have been battling this pandemic either on the wards or in the labs. This whole event is a kick in the face for them and their families.

We are all in this together. But some of us are more in it than others.

BOSCO.

Brazen, Offensive, Stupid, Callous, Objectionable.

It’s been just over a year since I wrote anything on this blog. That’s too long. So I’ll be writing some stuff today and tomorrow about my experiences using FOI to identify where mandatory procedural aspects of Data Protection law are not being followed by public bodies and the response of the Data Protection Commission to these.

Ultimately, good data protection practice starts with good governance and effective enforcement.

First up will be my write up of what happened when I asked Wexford County Council for a copy of their DPIA for the deployment of drones and the outcome of the DPC’s investigation.

These are things I’m doing as a private individual, not as part of my work in Castlebridge, so rather than clutter things up on the Castlebridge blog, I’ve nudged this blog back into life. (I’ll also be doing similar with iqtrainwrecks as the last few months have thrown up some fantastic case studies).

But for now, I’ve got some day job things to do…

Over the past few days, the Irish Times has carried a larger volume than usual of the “Data Protection Commissioner is evil” letters, giving out about her “nonsensical powers” because the bad lady won’t let them do things they want to do with data about people who are/might be alive.

I don’t always agree with the ODPC (more often than not we have “differences of opinion” on things). But when (against all the odds) they appear to be DOING THEIR JOB, I will defend them. So, I wrote a letter to the Editor. It is probably too long and will get gutted or not published at all. Here it is (with links to the original letters)

Sir –

Over the past few days your letters page has carried unchallenged comments about the Data Protection Commissioner and her “nonsensical powers”.

Robert Frewen states that Electoral register information is available in hard copy through libraries. This is true, but it differs from an on-line and searchable resource in a number of key ways, namely that each search is manual and laborious and the library staff can act as a foil against trawling for data – multiple searches will easily be spotted and librarians are a fearsome breed in my experience. He also states that electoral register information is available on-line. This is incorrect. Electoral registers are available to search online, but only if you have the exact name and address of the individual – so you are searching for information you already have in your possession, not trawling for new facts.

Claire Bradley writes that the DPC’s decision is “small minded” and that “most of the people eligible to vote in the 1940s would be dead by now”. Unfortunately, that means that some of the people eligible to vote in the 1940s (such as my own Grandfather) are still very much alive and continue to enjoy a fundamental right to data privacy. This fundamental right is what the DPC has acted to uphold. Far from being a small minded sectoral interest, the DPC has acted in support of a broadly based fundamental principle.  

The DPC has made similar decisions in relation to other genealogy resources, which have been widely reported by the Irish Times, and clear rules of thumb have been established for births, marriages, and deaths. Perhaps rather than bemoaning the application of fundamental human rights rules to personal data, Ms Bradley might contribute more constructively by suggesting a reasonable and proportionate rule of thumb for the publication of electoral registers in an open and searchable format. The DPC, in my experience, welcomes such constructive discussion. Perhaps a benchmark can be found in the release of the 1911 Census Records?

It is important to note that the DPC has not said that any records should be destroyed, just that they cannot be made available for an open and unrestricted search. Yet.

Finally, Cllr Lacey seems to bemoan the DPC’s recommendation to Local Authorities that they respect and comply with Data Protection principles such as ensuring access to data and processing of data is conducted with a specified and lawful purpose. I would suggest that rather than blaming the DPC for the loss of patronage and perceived power that Councillors may have experienced when their participation in housing allocation was curtailed, he instead address his complaint to the Department of the Environment and ensure that a clear and explicit statutory basis in primary legislation is created to clearly set out what data about Council tenants Councillors can have access to, why, and under what controls such access will operate.

The release of Electoral Register data from the 1960s, 1970s and 1980s constitutes the release of personal data of living individuals for a purpose unrelated to the purpose for which it was obtained, and brings with it a risk of identity theft. If Cllr Lacey believes that the release of this data is sufficiently important, he should seek to have every person communicated with to obtain their consent to the release of their data for this new and, at the time, unforeseen purpose.

It is rare in recent times that I find an opportunity to fall full square behind the DPC and the actions of her office. This is one. Their function is imperfect, and in a professional context as Data Protection consultant and trainer, I have more than ample grounds to be critical of their actions at times.  But far from being nonsensical, the powers of the DPC are woefully inadequate in many ways for the challenge that they face as one of the leading Data Privacy regulators in the world upholding and protecting a fundamental right. As the Oireachtas prepares the updated Data Protection Act to beef up the DPC in line with the requirements of the General Data Protection Regulation, one hopes that the many weaknesses of the DPC will be addressed to make them more fit for purpose.

“Wha!!! Data Protection laws make things hard!” is a dumb argument. Better for people who have valid interests to assess what the “win-win” outcome would be and strike an appropriate balance.

The General Data Protection Regulation (GDPR) is now in the home straight, with publication of final, final text expected in Q1 of 2016 (expect something to happen towards the end of January).

One of the small and subtle changes that is buried in the 209 pages of text in the most copy I have come into possession of is the apparent removal from the Regulation of any specific reference to personal liability of officers, directors or managers of bodies corporate where their actions (or inactions) cause an offence to be committed. This is a power that the Irish DPC has used judiciously over the past few years under current legislation (it is a power of the DPC under Section 29 of the Data Protection Acts and Section 25 of SI336 (ePrivacy Regulations), but which has served to focus the minds of managers and directors of recidivist offending companies when the sanction has been threatened or applied. The potential knock-on impact of such a personal prosecution can affect career prospects in certain sectors as parties found guilty of such offences may struggle to meet fitness and probity tests for roles in areas such as Financial Services.

The omission of this power from the GDPR weakens the enforcement tools that a Regulator has available, weakens the ability for Regulators to influence the internal organisational ethic of a body corporate when it comes to personal data, and invites officers, directors, and managers (particularly in larger organisations) to engage in “Mental Discounting” because the worst case scenario that can occur is a loss of “Other People’s Money”, not a direct impact to them.

I’ve written about this before on this blog in the context of organisations in compliance contexts weighing up “worst case scenarios” and assessing if the financial or other penalties are greater than or lesser than the value derived from breaching rules (search for “mental discounting“). However, the absence of a personal risk to the personal money of officers, directors, or managers also creates a problem when we consider the psychology of risk, given that our risk assessment faculties are among the oldest parts of our brain:

1. We are really bad at assessing abstract risk (we evolved to understand direct physical risks, not the risks associated with abstract and intangible concepts, like fundamental rights, data, and suchlike).
2. We are tend to down play risks that are not personalised (if there isn’t a face to it, the risk remains too abstract for our primitive brain. This is also the difference between comedy and tragedy… comedy is somebody falling off a ladder. Tragedy is me stubbing my toe).

So, when faced with a decision about the processing of personal data that has a vague probability of a potentially significant, but more probably manageable, financial penalty to an abstract intangible entity (the company we work for), with no impact of any kind on a tangible and very personal entity (the individual making the decision), invariably people will decide to do the thing that they are measured against and that they are going to get their bonus or promotion based on.

The absence of an “individual accountability” provision in the GDPR means that decision makers will be gambling with Other People’s Data and Other People’s Money  with no immediate risk of tangible sanction. If the internal ethic of a company culture is to take risks and ‘push the envelope’ with personal data, and that is what people are measured and rewarded on, that is what will be done.

In a whitepaper I co-authored with Katherine O’Keefe for Castlebridge, we discussed the role of legislation in influencing the internal organisational ethic. The potential for personal sanctions for acting contrary to the ethical standards expected by society creates a powerful lever for evolving risk identification, risk assessment, risk appetite, and balancing the internal ethic of the organisation against that of society. Even if only used judiciously and occasionally, it focuses the attention of management teams on data and data privacy as business critical issues that should matter to them. Because it may impact their personal bottom line.

Absent such a means of sanction for individuals, I fear we will see the evolution of a compliance model based around “fail, fail fast, reboot” where recidivist offender decision makers simply fold the companies that have been found to have committed an offence and restart with the same business model and ethic a few doors down, committing the same offences. Regulators lacking a powerful personal sanction will be unable to curtail such an approach.

After all, it’s just other people’s money when you get it wrong with other people’s data.

A few weeks ago I wrote a post here about Irish Water’s Data Protection Policy, which was very poorly written and had all the hallmarks of having been cut and paste from another document (for example references to numbered clauses that were not in the Data Protection Notice).

Today they have advertised on RecruitIreland.com for a Data Protection and Information Security Manager. Ignoring for a moment that this conflates two completely different but related skill sets, the advert on RecruiteIreland.com has all the hallmarks of being a cut and paste job from elsewhere. The clues are very obvious to anyone who knows about international data privacy law and practice. Like me.

Take this paragraph for example:

• Develop and implement Irish Water Information Security and Data Protection policies, processes, procedures and standards based on the existing Ervia framework, legislation and best practice (eg ISO 27000, other industry security standards such as PCI-DSS, NERC/CIP, and FERPA; HIPAA and other privacy/security legislation);

Lots of alphabet soup there that looks very impressive. But what does it mean?

• PCI-DSS  is a credit card processing data security standard. Scratch that… it is THE credit card processing data security standard.
• ISO27000 is the benchmark standards family for Information Security.
• NERC/CIP is a critical infrastructure security standard from the US for electricity networks. It’s used as a reference standard as the EU lacks equivalents at the moment (thanks to Brian Honan for pointing that nugget out)
• FERPA is not a standard. It is the Family Education Rights and Privacy Act, a US Federal law covering data privacy of student education records. It actually creates rights and duties not unlike the Irish Data Protection Acts, but it applies only to schools that receive funds under an applicable program of the U.S. Department of Education. So, unless Irish Water has a subsidiary teaching creationism in the boonies of Louisiana, it’s not entirely relevant to the point of actually being entirely irrelevant to an EU-based utility company.
• HIPAA is the Health Insurance Portability and Privacy Act. It is privacy law that applies to certain categories of patient data for patients of US hospitals and healthcare providers and processors of health data such as insurers. In the United States.

Reading through the rest of the job description, the role is weighted heavily towards Information Security professionals. The certifications and skills cited are all very laudable and valid information security certifications. But they are not Data Protection qualifications. Indeed, the only data protection qualification that is specified is an ability to “work the Data Protection Acts”. Work them? I can play them like a pipe-organ!

Given the range of qualifications that exist now for Data Protection practitioners such as the IAPP’s CIPP/E or the Law Society’s Certificate in Data Protection Practice (disclaimer: I helped design the syllabus for that course, lecture on it, and have  set and correct the assignments for it), it’s odd that there is no reference to appropriate Data Protection skills. The question I would pose is what would happen if a Data Protection specialist with experience in ISO27000 implementation, a formal data protection qualification, and experience in data governance applied for the job and wound up shortlisted against someone with a CISSP certification and no practical data protection/data privacy experience, who would get the job?

My reading of the job advert on RecruitIreland.com is that it was cut and paste from somewhere else with minimal review of the content or understanding of what the role of a Data Protection Officer is and how that is related to but different from an Information Security Officer role.

Perhaps it was cut and paste from this advert that appeared almost six months ago http://www.dole.ie/cache/job/3853096. It’s for an Information Security and Data Protection Manager in… Irish Water.

A few weeks ago I did a lot of research to find the specific section of legislation that authorised Irish Water to request PPSN details from people. It is Section 20 of the Social Welfare and Pensions Act 2014.

So, a bit of a law was done to do a thing. But could that thing actually be done? Were other things needed to be done to make the request of and processing of PPS numbers lawful?

Simon McGarr correctly points out that putting a body on the list of registered bodies is only part of the governance. A protocol is required to be in place governing the use of the data which needs to be approved by the Minister. http://www.mcgarrsolicitors.ie/2014/10/22/irish-water-ppsns-and-the-missing-ministers-agreement/

That protocol appears not to have been in place as of the end of September. After the forms were finalised and sent out. Any PPSN data obtained prior to the finalisation of such protocols was obtained unlawfully. This is a failure of Data Governance. A key Regulatory requirement appears to have been missed.

This is a good example of how doing “a bit o’law” to enable sharing of data is insufficient to ensure compliance. In the absence of a strong Data Governance function to ensure that the right things are done in the right way errors occur, disproportionate processing takes place, and groupthink takes hold. I discuss this at length in a submission my company Castlebridge Associates made in conjunction with Digital Rights Ireland to the Dept of Public Expenditure and Reform on a proposed Data Sharing and Governance Bill.

That document is here: http://castlebridge.ie/products/whitepapers/2014/09/data-governance-and-sharing-bill-consultation-submission