Ms Helen Dixon:

I thank the Chair and members of the committee for inviting me to be here today. I am pleased to have the opportunity to share details of the role of the Irish Data Protection Commission, DPC, and position in relation to the regulation of online platforms.

There is no doubt that despite the great benefits and access to more and more information the Internet has provided all of us with, it also presents significant challenges to our rights and freedoms in how it now operates. The challenge of combating disinformation in many contexts, such as during electoral cycles or in, for example, public health scenarios is a pressing issue of our time given the negative consequences for democracies and societal well-being.

Issues of harmful and-or illegal content and disinformation are issues that stretch well outside of the scope of the data protection legal framework. Data protection is predicated on a fundamental right of individuals to have their personal data protected and, as a result, the remedies individuals may avail of under the general data protection regulation, GDPR, require the personal data of that specific individual to have been processed.

The DPC is very pleased to have an opportunity for interaction during this panel with the Minister for Communications, Climate Action and Environment as the DPC has this year responded to his consultation on the regulation of harmful online content and the implementation of the audiovisual media services directive. In the context of making a submission to that consultation, the DPC clarified that it supported the Irish Law Reform Commission’s recommendation in their 2016 report on harmful communications and online safety that a dedicated office with a statutory responsibility to promote online safety and to oversee and regulate a system of takedown orders for harmful digital communications should be considered.

The DPC, however, has responsibility for a number of areas of regulatory activity that relate directly to the theme of the hearing and are relevant to the panel.

First, it is possible that content relating to a specific individual posted online may be harmful to the individual or may contain false information about the individual. In such circumstances, the individual may be able personally to exercise his or her data protection rights, in particular to erasure and rectification. In circumstances where a platform does not comply with a request to exercise data protection rights by an individual, the individual may make a complaint to the DPC, following which we will take the matter up as appropriate on his or her behalf. Equally, however, it is worth recalling that Article 85 of the GDPR requires a reconciliation of the right to freedom of expression with the exercise of data protection rights, and therefore they are not absolute rights. The majority of complaints the DPC receives in respect of platforms are complaints about erasure.

Another issue of significance is the role that personal data play in a social media context through facilitating the so-called micro targeting of individuals with specific content, thereby amplifying any harmful effects of disinformation. In such a scenario, the profile a platform has created of a user and the categorisation of that user as being of a certain lifestyle, passion or habit may allow an undecided voter in an election context to be pushed in one direction or the other. All of this may happen without the user being aware his or her data are being deployed to reinforce the individual’s existing viewpoint rather than the individual being in a position to take an objectively informed stance based on an understanding of both sides of an issue. Given the rates of online users who consume their news exclusively on social media, this is a concern. As a data protection authority, we have a number of ongoing investigations into how the online behavioural advertising system operates and whether in all respects it is in compliance with the GDPR, especially in respect of lawfulness and transparency to users. In this regard, we have investigations open into platforms, data brokers and advertisement exchanges, which will conclude in 2020.

The issue of children and other vulnerable Internet users being subject to disinformation and harmful content somewhat overlaps with the protection of children’s personal data in an online context. To protect children, whether in respect of their personal data or to protect them from harmful content, presupposes that children can be identified as such on the Internet. To date, a systemic solution to age verification online that protects younger users but leaves the Internet open and accessible to all has been elusive. The DPC has watched with interest the attempts in the UK under the Digital Economy Act 2017 to impose age verification measures for access to legal online pornography. That the legal provisions have not proceeded to implementation simply underlines how difficult it is to find a solution that meets all requirements. The DPC has run a consultation over the past year on the protection of children’s data, including a consultation directly with children through their schools and youth centres. The DPC will next month publish a guidance note based on the outcomes of that consultation, proposing ideas and criteria that data controllers need to take into account when implementing mechanisms to identify and protect children online.

Finally, I raise an issue of interest to the committee, namely, that of how to foster international collaboration. As an EU data protection authority, the commission is bound in close legal co-operation with all other European Economic Area data protection authorities. Indeed, we meet in Brussels weekly. In addition, the DPC is a member of the Global Privacy Assembly, has signed memoranda of understanding with a number of global data protection authorities, and this year we have been visited at our Dublin offices by a large number of other commissioners, including the New Zealand, Icelandic, Australian and UK commissioners. The dialogue and the opportunity to discuss regulatory approaches and solutions to issues of common concern are invaluable in shaping better outcomes in our regulatory role.

I look forward to the panel discussion and questions from committee members.