German jeers at Irish data privacy may help us
Published 31/05/2015 | 02:30
'Of course Facebook would go to a country with the lowest levels of data protection. It's natural they would choose Ireland."
These were the comments last week of a former German federal data protection commissioner, Peter Schaar.
They weren't meant as a compliment.
This kind of sneering is becoming a regular thing. Ireland, we are told, is a soft touch for US companies intent on pillaging our personal data. But how much substance is there to it?
It is certainly true that US companies like Ireland's data regulation approach. This is what Facebook's director of public policy Richard Allan said recently about why they prefer dealing with the Irish regulator's office.
"They provide advice and guidance, that means that we fix things so that they don't have to bring out the big stick," said Richard Allan. "We're not scared to go and see them because they will drag us into court the next day. If they were merely a 'big stick' regulator, frankly, we would be incentivised not to take things to them."
Facebook's experience is not unique. US companies are now actively choosing Ireland as a data regulation home in Europe.
"A lot of US firms think that Europe is over the top when it comes to data protection, but they like the approach that Ireland takes and this is why many choose to be regulated here," said John Whelan, head of the A&L Goodbody's Silicon Valley office.
"The amicable resolution approach that the Irish data protection office has is very attractive to US companies. The Irish office has huge regard within Silicon Valley. It's one of the reasons that companies are choosing to be regulated here."
There is another side to this, however. There are a few concrete factors fuelling critics of the Irish set-up. Underfunding of the office is near the top. While the Government is now doubling the office's budget (to €3.6m), it has been inadequately resourced for a crucially formative period. It has likely meant, for example, that the data protection office has been unable to get stuck into scheduled data audits of Apple, Adobe and Yahoo's operations here. It probably also added fuel to the fire of Max Schrems, the Austrian student currently litigating before the European Court Of Justice in a case that escalated from his complaints to the Data Protection Commissioner's office over the regulation of Facebook.
In many European circles, underfunding is tantamount to a strategic choice by a country's government.
This is why critics of Ireland still use photos of the Commission office above a Centra in Portarlington as a punchline at European data protection conferences. (New offices in Dublin are currently being procured.)
And despite the funding boost this year, some continue to argue that the Irish office is still inadequately resourced, given the size of the sector it takes on in the guise of lead EU regulator.
Organisations such as the European Commission take this kind of stuff seriously. It's not long since the Commission took Austria to the European Court of Justice for setting up a data protection office that it thought wasn't sufficiently independent. And the Commission won the case.
"Data Protection Authorities should be free from any external influence, whether direct or indirect," said a statement from the Commission after it won.
In Ireland, those looking closely at the independence issue may argue that the recruitment of staff through government departments - such as last week's tender for public relations consultancy through a Department of Justice public tender - also sends mixed messages as to ultimate control of staffing. Others will regard it as a moot point that doesn't impact on independence.
The real question, though, is whether anything substantive is to come from all of this grumbling and sniping. If new companies moving here is the metric, there is little sign of any damage being done.
"The pipeline remains pretty good," said Goodbody's Whelan. "I'm seeing a lot of companies considering a move over here."
If 'Safe Harbour' does fall in the European Court of Justice, there may even be a rush among data-rich firms to relocate to Ireland, given the regulatory approach that appears to find favour with industry. Twitter and Dropbox have both done so in recent weeks, while Yahoo made the move last year.
Just like Apple's tax affairs in Ireland, then, it appears that making a brouhaha over data protection differences may have the effect of reminding the world that Ireland is the industry's choice to locate to.
Sunday Indo Business