\n<\/p>\n
Fancy overseeing whether Big Tech is playing by European Union privacy rules? The Irish government has posted job ads<\/a> for two additional commissioners to lead the Data Protection Commission (DPC), which oversees scores of major tech firms\u2019 compliance with the region\u2019s data protection framework \u2014 and has the power to levy fines of up to 4% of global annual turnover for infringements of the regime.<\/p>\n The Irish DPC has a kingpin role in enforcement of the the pan-EU General Data Protection Regulation (GDPR) on account of how many tech giants opt to locate a substantial regional base in the country.<\/p>\n The incoming commissioners will join current commissioner Helen Dixon who will become chair under the new trio-of-commissioners structure. But she is set to depart the regulator next year, when her term expires, so a full leadership reboot is looming.<\/p>\n The DPC\u2019s change of structure was approved by the Irish government in July 2022<\/a>, following calls to beef up the capabilities of a watchdog with a massive and still growing case load overseeing multiple tech giants\u2019 GDPR compliance.<\/p>\n Companies that the DPC is the go-to for data protection oversight include Apple, Google, Meta, TikTok and X (Twitter). While, just recently, AI giant OpenAI opened a Dublin office<\/a> in what looks likely to be a bid to gain so-called \u201cmain establishment\u201d status in Ireland in the future \u2014 which would mean the DPC becoming its lead regulator for the GDPR too. So the new commissioners will be involved in oversight of a raft of familiar tech giants and, potentially, weighing in on major legal calls related to a new generation of AI-fuelled giants.<\/p>\n Candidates for the roles must have a range of qualifications including \u201ca comprehensive understanding of relevant legal systems and frameworks with an ability to demonstrate, or quickly acquire, knowledge and understanding of national and EU Law on data protection, human rights law, law enforcement procedures, and administrative law\u201d, per the job ad, as well as a \u201cdeep understanding\u201d (or the ability to quickly acquire one) of ICT and data processing methods and an \u201cexcellent knowledge and understanding of the data protection issues arising from their use\u201d.<\/p>\n The closing data for applications for the two commissioner roles is October 19. <\/span>The Irish Top Level Appointments Committee<\/a> (TLAC) will be responsible for making the appointments. The same committee reappointed Dixon as commissioner for a second five year term back in 2019<\/a>.\u00a0\u00a0<\/span><\/p>\n It\u2019s not clear why it\u2019s taken so long for the two new commissioner roles to be posted by the Irish government.\u00a0<\/span>\u201cIreland has a key role in enforcement of GDPR across Europe,\u201d it writes now. \u201cThis is due to the \u2018one stop shop\u2019 mechanism, which is a core element of the GDPR, providing for a central point of enforcement by a lead Member State supervisory authority. As many of the very large online platforms, search engines and technology enterprises that operate in the EEA [European Economic Area] have their European headquarters in Ireland, the DPC has lead supervisory authority responsibilities in respect of these bodies within the EEA.\u201d<\/p>\n Whoever the new commissioners are they will face a desk saddled with a lot of baggage. Not just in terms of existing case load \u2014 with major open cases against the likes of Google (location tracking<\/a>; adtech<\/a>) and no shortage of fresh complaints<\/a> and incoming issues\u00a0(not least how to regulate generative AI<\/a>) \u2014 but because the DPC\u2019s approach to GDPR enforcement on Big Tech has been the target of trenchant criticism for years.<\/p>\n Since the GDPR entered into application back in May 2018, privacy experts have regularly accused the regulator of \u2014 at best \u2014 sleeping on the job when it comes to applying the framework in a way that properly interrogates platform power and its deleterious impact on EU citizens\u2019 rights.<\/p>\n Dixon has always aggressively hit back at critics, arguing the DPC is working as fast as it can, given the case load and scale and complexity of multiple major investigations. And, latterly, the regulator has been able to point to a growing pipeline of big decisions announced out of Ireland, including (earlier this month<\/a>) a $379M fine for TikTok for failing to keep kids\u2019 data safe; (in May<\/a>) a $1.3BN fine for Meta for unlawful data exports; and (in January<\/a>) a $410M fine for Meta for failing to have a legal basis for tracking and profiling users for ad targeting.<\/p>\n However the DPC\u2019s draft decisions on high profile probes have regularly faced critical review and push-back from peer authorities and the European Data Protection Board<\/a>, a key GDPR steering body \u2014 leading, frequently, to more expansive breach findings and higher fines being levied on the likes of Meta, TikTok and X than the DPC had originally proposed. So its approach has looked like it\u2019s low-balling GDPR enforcement.<\/p>\n Privacy rights group noyb contends the DPC\u2019s aforementioned January penalty on Meta\u2019s ads processing actually let the company massively off the hook \u2014 arguing Meta should have faced an exponentially larger fine of over $4BN<\/a> \u2014 so the regulator stands accused of shrinking liability for the giants it oversees. Or, well, worse: Back in November 2021<\/a>, noyb even filed a criminal corruption complaint against the DPC accusing it of \u201cprocedural blackmail\u201d in relation to a complaint against Facebook\/Meta.<\/p>\n Last year<\/a> the Irish Civil Liberties Board (ICCL) also lost patience and sued the DPC for inaction on a long-standing complaint against Google\u2019s adtech \u2014 which still hasn\u2019t yielded a decision. While an\u00a0appearance by Dixon at a European Parliament hearing earlier this year<\/a> saw the commissioner fending off hostile questioning from EU lawmakers on the parliament\u2019s civil liberties committee.<\/p>\n The European Commission itself has been forced to dial up its monitoring<\/a> of how regulators including the DPC are enforcing the GDPR, following complaints lodged with its ombudsman which stemmed from criticism of the DPC. This summer the EU\u2019s executive also came out with a proposal for reforming procedural rules around GDPR enforcement<\/a> with the aim of making the handling of cross-border cases \u201cmore efficient and harmonised across the EU\u201d.<\/p>\n Changes to how the GDPR is enforced on cross border cases involving tech giants are clearly coming down the pipe at the high level \u2014 but a pair (and later a trio) of new brooms at the DPC could certainly make a mark. So these two new DPC commissioner appointments should be closely watched.<\/p>\n The ICCL has been pushing for years for the DPC to have more than one commissioner. It told TechCrunch it\u2019s pleased to see this step finally happening today. However it has also previously called for further reforms<\/a> and Dr Johnny Ryan, senior fellow at the organization, said it will be watching the appointment process carefully. \u201cWe will write to [the TLAC] shortly to urge that utmost attention is paid to conflicts of interest, and involvement of human rights experts,\u201d he added.\u00a0<\/span><\/p>\n