Helen Dixon appointed as Data Protection Commissioner

Former companies registrar and Department of Jobs official succeeds Billy Hawkes

Irish Times, 10^th September 2014

The Government has announced the appointment of Helen Dixon as the new Data Protection Commissioner.

Ms Dixon, who has previously held senior management positions in the Department of Jobs, Enterprise and Innovation, succeeds Billy Hawkes, who retired last month.

He had been in the role since 2005, serving two separate terms.

In a statement, a Government spokesman said Ms Dixon brings “a wealth of experience and expertise to her new role, both in the public and private sectors”.

She was appointed registrar with the Companies Registration Office in December 2009 having previously held senior management positions in the Department of Jobs.

She served an 11-year career in two US IT multinationals with their EMEA bases in Ireland.

The new commissioner holds an honours undergraduate degree in Applied Languages (French and German), a Masters in European Economic and Public Affairs, a postgraduate diploma in Computer Science and a Masters in Governance from Queen’s University Belfast.

She was appointed an honorary fellow of the Institute of Chartered Secretaries and Administrators in 2014.

Ms Dixon is the first woman in the role. She will take up her appointment over the coming weeks.

Minister for Data Protection Dara Murphy, who was just recently appointed to the newly created Government position, welcomed the appointment.

“The role of the office of the Data Protection Commissioner as an independent body which has responsibility for safeguarding data in Ireland is of critical importance.

“As we move at an increasingly faster pace into the digital age, it is fundamental that we ensure that our data, which is becoming an increasingly valuable asset, is afforded the optimum level of protection,” he said.

“This is a function which the Data Protection Commissioner has performed since the role was established in 1988 and will become even more significant in the years ahead.”

Mr Murphy congratulated Ms Dixon on her appointment andwished her success in her “important new role”.

The appointment comes at a challenging time for the protection of individual privacy and at a major juncture in the development of European data protection law.

Ms Dixon will be responsible for the protection of the personal data of hundreds of millions of European citizens due to the fact that several US multinationals, including Facebook, Linkedin and Apple have based their EU headquarters in Ireland.

A case in which her predecessor, Billy Hawkes, refused to investigate claims of a mass transfer of personal data to US intelligence services via Facebook has been referred by the High Court to the Court of Justice of the European Union.

A decision is not expected in the case - which has implications for an agreement between the EU and the European Union on how such transfers of personal data may legally take place - before next year.

Tough challenges ahead for new Data Protection Commissioner

Never have the issues of data protection and personal privacy had such high profile

Irish Times 18^th September 2014

What does Ireland need from its new Data Protection Commissioner?

We now know who has replaced former Commissioner Billy Hawkes, who retired from the role in August: civil servant Helen Dixon, who up until now has been registrar with the Companies Registration Office.

Prior to that, she was a principal officer in the Department of Enterprise, Trade and Innovation. She also worked for US technology company Citrix at its Europe, Middle East and Africa office in Ireland, as manager of Technical Support Services.

Pivotal point

She comes to the role at a pivotal and daunting point. Never have the issues of data protection and personal privacy had such high profile. Along with media coverage of repeated breaches of data in this country and internationally, the general public has had more than a year of leaks from the trove of documents obtained by former US government contractor and whistleblower Edward Snowden.

Those – revealing a shocking degree of large scale surreptitious digital data gathering on ordinary citizens by US and UK surveillance agencies – have rattled international relations.

In particular, the revelations have spurred the EU to push for more restrictions on access to its citizens’ data and greater national and international oversight.

On the US side, elected representatives, privacy organisations and the general public have demanded explanations and more transparency in how law enforcement agencies acquire and use personal data.

And, somewhere in the middle, with their exact involvement still a mystery, sit many multinational companies – especially in the technology and online sector – which handle teraflops of data from customers and service users around the world, every day.

Some are known to have passed data to US agencies, with many of these continuing to request they be given permission from the US government to reveal more about what they are asked for, and when and how they complied. Others state they had no idea US and UK agencies were siphoning off their users’ data.

In this tense atmosphere, the EU has signaled that it will bring in a more restrictive and clearly defined Data Protection Regulation next year. This must by transposed directly, not piecemeal as had been the case with the existing directive, which came out of legislation in a pre-internet era.

All indications are that the EU will require data misuse complaints against companies be referred to the Data Protection Commissioner in the EU state in which the company has its European headquarters.

‘No data breach’ says Irish Water, despite sending 6,329 letters to the wrong address

The Data Protection Commissioner has not said whether a breach took place.

The Journal, 10^th September 2014

IRISH WATER HAS apologized for sending more than 6,000 letters with incorrect names to customers, but says it does not believe the mistake represents a data breach.

The semi-state company had been investigating the possibility of a data breach after it emerged that letters sent to 6,329 multiple home-owners this month were wrongly addressed.

Ironically, the letters had asked customers to confirm their personal details, to allow Irish Water to update their customer database before water charges come into force next month.

Responding to an enquiry from TheJournal.ie, a spokesperson from the office of the Data Protection Commissioner did not address whether or not a data breach had taken place.

In their statement this evening, Irish Water confirmed the mistake had come to their attention last Tuesday, and that they had reported it to the Data Protection Commissioner.

In line with this process, Irish Water has sent letters to owners of multiple properties asking them to confirm the details of properties they own. Irish Water is aware that incorrect names have appeared on correspondence issued to 6,329 of these individuals. This became apparent on 4th September.

Irish Water acted immediately to resolve this issue and all of the property owners affected have been advised accordingly.

On becoming aware of the issue, Irish Water also immediately informed the Office of the Data Protection Commissioner (DPC) and our understanding is that the issuing of the letters does not constitute a breach and that the Office of the DPC are satisfied with how Irish Water have dealt with the issue.

Our customer contact centre (1890 448 448) is available to respond to any customer queries or concerns.

Irish Water has apologised for any confusion and concern that this might have caused affected customers.

Despite an enquiry by TheJournal.ie, the Office of the DPC did not clarify this evening whether or not a data breach had occurred.

A spokesperson did, however, say the DPC had “concluded its investigation.”

Irish Water notified this office on 4th September of a potential data security breach…

Irish Water notified the affected individuals of the matter and sought return of the incorrectly addressed letters.

Irish Water have informed this office of the steps being taken to prevent a repeat of this type of incident.

On this basis, this office concluded its investigation into the matter.

Credit Unions will be pursued for data protection breach

The Irish League of Credit Unions has said that it will undertake a full review into the credit unions that used private investigators that illegally obtained personal data from the Department of Social Protection. The move follows the revelations regarding the use of so called tracing agents by four credit unions in Limerick, five in the midlands, two in Dublin and one in Meath. The branches face the prospect of being required to destroy any personal data handed over by private investigators, which are currently being probed by the Data Protection Commissioner. Prosecutions, which could result in fines for the private detective firms in question, are expected to follow.  

Have you been effected by the above breaches?

Have your data protection rights been breached by a Credit Union?

We have represented clients whose information has been disclosed by Credit Unions.

Credit unions who got stolen data may now be asked to destroy it

Irish Independent 19^th August 2014 

A full review is to be undertaken into credit unions that used private investigators who illegally obtained personal data from the Department of Social Protection.

The Irish League of Credit Unions (ILCU) announced the move yesterday as the minister with responsibility for data protection said he was “deeply concerned” by revelations in this newspaper.

The credit union network has been rocked by an Irish Independent investigation into the use of so-called tracing agents. The branches at the centre of the scandal face the prospect of being told to destroy any personal data handed over by private investigators who are being probed by the Data Protection Commissioner. These credit unions include four in Limerick, five in the midlands, two in Dublin and one in Meath. Assistant Data Protection Commissioner Tony Delaney is pursuing a number of firms who used false identities and blagging tactics to illegally obtain the information from the Department of Social Protection. While the credit unions who received the stolen data insist they were not aware of the methods used by the private investigators, the ILCU last night said a review into the use of the firms will take place.

Minister for Data Protection Dara Murphy said he was "deeply concerned" at the revelations. And Fianna Fail finance spokesman Michael McGrath called for the establishment of a code of conduct for financial 
institutions enlisting the services of private investigators. "The issues raised by the Irish Independent are very grave. The Central Bank must devise a code of conduct that would apply to the use of Private Investigators by financial institutions. Such a code is of paramount importance to ensure the integrity of people's personal data is protected at all times," Mr McGrath said. Meanwhile, the Central Bank last night said it expected all credit unions to fully co-operate with the Office of the Data Protection Commissioner. "The Central Bank expects that each credit union fully complies with all legal and regulatory obligations including all data protection requirements," a spokesperson said. "The Central Bank will assess the need for correspondence with individual credit unions and/or the credit union sector in relation to specific issues arising from this matter. "The investigation by Assistant Commissioner Delaney was launched last July and established that state officials had been duped by private investigators hired by credit unions. In some instances, agents contacted welfare officials and obtained addresses and employment details through a single phone call. The agents struck up a rapport with the unsuspecting department officials who they continually contacted for personal data. They introduced themselves as fellow state officials, from departments north and south of the Border. At least 78 credit union customers had their information breached. However, it is believed reams of other data was obtained by agents who targeted other state agencies. Some credit unions paid out €50 per single address. The Irish Independent 
understands credit unions who are storing stolen data may be asked to destroy it. The Department of Social Protection has said it continuously reviews its internal controls and takes data protection responsibilities very seriously. In a statement to the Irish Independent, the ILCU confirmed that a review of the use of private investigators would take place. The umbrella body, with represents 374 credit 
unions nationwide, also said it would be seeking a meeting with the Office of the Data Protection Commissioner "to ensure best practice going forward for all credit unions using tracing agents or private investigators". "We take very seriously any allegation that a private investigator working for a credit union has obtained information on members illegally. The ILCU has written to our affiliated credit unions and reminded them of the guidelines issued by DPC in relation to best practice in this area," the organisation said. “Furthermore the ILCU's CU Learning & Development also provides training courses to support our credit unions in the areas of data protection and credit collection in the Republic of Ireland. These courses are available throughout the year. In addition we will commence a review of credit unions who may have enlisted the services of private investigators to 
pursue arrears. ‘

Opinion: ‘Right to be forgotten’ ruling opens a legal and ethical Pandora’s box

The Journal, 23rd July 2014

THE RULING BY the European Court of Justice just over two months ago that the citizens of Europe have a ‘right to be forgotten’ has opened a legal and ethical Pandora’s box. The original ruling, based on the case of a Spanish citizen who wished to have information about his financial woes a decade previously taken out of search results on Google, was vaguely constructed and left the door open for individuals, and maybe even organisations, to have damaging or embarrassing material about themselves no longer reachable through a Google search.

While the court said that the ruling would be applied only where it did not conflict with freedom of expression or of the press, it left the burden of proof and investigation of this up to the party running the search engine, i.e. Google, and not up to the person seeking to have his or her information “forgotten”. Google is currently receiving about 1,000 requests a day for links to particular pieces of information to be removed from its search results. Quite understandably, the company has begun simply to grant these requests on receipt of them, as there is no way the company could (or should) wade through the sheer volume of requests and check each one for compliance with both the ruling on forgetting information and with freedom of speech. The court’s insistence that it is Google’s job to do the leg-work on each request has led inevitably to the company letting through a lot of right-to-be-forgotten requests which are dubious, to say the least.

From corrupt referees in Scotland to bankers at the former financial institution Merrill Lynch who may have played a role in the financial crash, various individuals are coming forward to have unpleasant facts about their pasts erased. Then of course there are the convicted sex offenders and individuals convicted of crimes like assault who wish to have links to articles about their crimes taken down. This ruling is a godsend for anyone with a criminal past who wishes to scrub their own record clean.

Effective data protection

The ruling was based on the principle of ‘Data protection’ which was conceived as a way of protecting the data of private citizens when it is held by governments. It particularly applies to social services and other branches that keep large quantities of highly personal information about citizens. This is a crucial protection afforded to citizens against the one organisation whose processing of data needs to be closely monitored: their government. As exemplified by the ongoing activities of the NSA and other overly-powerful governmental organisations around the world, when it comes to government-held data, the citizen needs not just a right to be forgotten, but effective safeguards to ensure the government cannot get certain information in the first place. Data protection does not apply well to private companies. The information to which people are attempting to restrict access is public knowledge, shared freely over the internet. Just because information is relevant to someone does not mean they have carte blanche to restrict access to it.This is especially true with online articles and other documents which are made available in the public interest, and should not be censored, no matter how embarrassing their content. The function of the press is to spread information in the public interest. Sometimes this information may be detrimental to an individual’s reputation, but the fundamental freedom of the press to spread information should not be curtailed because of this.

Empowering governments

The wide-ranging ruling handed down by the European Court has a second danger concealed within its arguments. By empowering European governments to go after companies like Google whose servers are actually based outside European territory, the court is setting a dangerous precedent. If the European courts can prosecute Google and other search engine providers for not removing links to information stored in servers outside the continent, what is to stop the the process happening elsewhere? What if the United States government, for example, were to demand that information based on or provided by Wikileaks or Edward Snowden be deleted from European-based servers? Given that the European court said in its ruling that information could be deleted if it was “inaccurate”, “excessive” or “irrelevant” surely the US government would have grounds to demand that leaked documents be taken down from search engines or removed entirely, or even that newspaper articles relating to them be removed from Google search results.

The internet has given birth to an unprecedented free transfer of information in the modern world. It has broken down barriers and enhanced freedom across the globe. To start rowing back that freedom by way of a “Right to be forgotten” would undermine over two decades of progress. Information should be free, and not restricted by the arbitrary actions of individuals or unaccountable courts. It is time to forget about the right to be forgotten.

Private investigator to be tried over data breaches in October

Irish Times, 21st July 2014

A private investigator charged in relation to alleged breaches of data protection legislation will be tried in October. Michael J Gaynor, trading as MJG Investigations, Beatty Grove, Celbridge, Co Kildare, was before Dublin District Court this morning facing a prosecution by the Data Protection Commissioner. Mr Gaynor faced 72 criminal charges in relation to alleged breaches of data protection legislation, including illegally accessing and disclosing personal information on individuals held by An Garda Síochána and the ESB.

It is the first such criminal prosecution of its kind in the State. Mr Gaynor faces three charges of illegally accessing personal information held by An Garda Síochána and of disclosing it without authority, under the provisions of section 22 (1) of the Data Protection Acts 1988 and 2003.

He faces a further nine charges of illegally accessing and disclosing personal information held by the ESB under the same section of the Acts. Some 60 charges against him relate to illegally processing the personal data of a number of individuals without an entry in the register held by the Data Protection Commissioner for data processors.

The offences are all alleged to have occurred between May and October 2013. Counsel for Mr Gaynor, Justin McQuade BL, told the court today the issues had been “considerably narrowed” and that a trial would go ahead on three of the charges. He said one day would be sufficient to hear the case. Judge John O’Neill set the trial date for October 6th.