The Irish Times
Privacy activists query regulator’s software
The lead regulator overseeing big tech companies’ compliance with the general data-protection regulation has come under fire from privacy activists who argue its IT systems are ill-equipped for the task.
Freedom-of-information requests filed by the Irish Council for Civil Liberties found that the Data Protection Commission (DPC) has not implemented a new core system to cope with the demands of the European Union General Data Protection Regulation (GDPR), which became enforceable in 2018.
This is despite internal documents and public statements dating back to 2017 indicating that such an overhaul would be necessary to deal with the regulation, which adds substantially to the amount of data its systems must process.
The findings come as questions grow over the future of the “one-stop shop” model, which allows national regulators to handle GDPR investigations on behalf of the EU, but has increasingly been viewed as a bottleneck.
“The GDPR gives Ireland a central role in protecting data rights across all of the European Union but [it] is not configured for its digital mission,” said Dr Johnny Ryan, senior fellow at the council. “How can it be expected to monitor what the world’s biggest tech firms do with our data?”
The DPC’s core systems are used to track and handle complaints and investigations relating to GDPR. One former employee quoted by the council described the situation as akin to “trying to run your payroll system with an abacus”.
Graham Doyle, the deputy commissioner, said the regulator had “a functional and fit-for-purpose” case-management system that had been updated with new features over the years. However, he admitted it was now “dated” because of the limitations of the underlying technology, which made it hard to integrate it with the regulator’s new website and a platform linking European data regulators.
“Significant work in specifying the system and building its core modules has been completed,” said Mr Doyle. – Copyright The Financial Times Limited 2021