Mark Daly (Fianna Fail)
Link to this: Individually | In context | Oireachtas source

I welcome the Minister of State at the Department of Justice and Equality, Deputy James Browne, to answer his constituency colleague's question. I wish to advise that five minutes are allocated, comprising first of four minutes and then one minute after the Minister of State has given his response.

Malcolm Byrne (Fianna Fail)
Link to this: Individually | In context | Oireachtas source

I thank the Cathaoirleach for selecting my matter. Being in this Chamber feels like one's first day in school. Obviously, I am very happy to pose the first matter here to my Wexford colleague, the Minister of State, Deputy Browne. My matter focuses on data and data protection.I am a strong advocate for the effective use of data in terms of how it can inform public policy, but it also has the potential to grow into being a multi-billion euro industry in Ireland.

There are serious concerns however, about the potential misuse of data or the abuse of social media. These range from cyberbullying - a number of Senators here are aware of the so-called "Coco's law" which I hope will pass through the Oireachtas quite soon - to economic damage that can be caused by the misuse of data, such as the problems around surveillance capitalism and, as we have seen with the likes of Cambridge Analytica, a threat to democracy itself. As we are quite fortunate in Ireland to have so many of the social media giants located here and because we have so many data centres located here and we want data centres to continue to locate here, Ireland and our Data Protection Commissioner are right at the heart of all of the decisions that have to be made around these issues.

Last year, the Data Protection Commission, DPC, dealt with 10,000 individual cases. Some of these were quite small, but when it comes to data breaches, it can have a significant impact on the individuals concerned. In the past year, the number of breaches of data protection regulations trebled. Clearly, there remains a big problem in terms of the number of data breaches.

In addition to all those individual cases, the DPC here is now dealing with considerable global issues that are featuring on national and international news media. We are looking at, for instance, the fallout of the Schrems II judgment. We are also now seeing the face-off with Facebook. Obviously, I do not want the Minister of State to talk about the looming High Court case, but those kinds of cases will arise more frequently. We are looking at issues around micro-targeting by some of these companies and the lack of transparency in that area. There is the question as to whether or not the DPC will now have to regulate TikTok, if TikTok is based here. I have significant problems around TikTok. I do not propose to start to use it in this Chamber, but TikTok uses facial recognition and machine learning and it is owned by a company in which the Chinese Government has a significant share, and we have to ask what is purpose of the data that will be harvested by that company.

There are responsibilities on the DPC with regard to children's data and the specific category around children's rights and the harvesting of children's data, and around digital literacy which is about making all of us aware as citizens about what is happening in the area of artificial intelligence, AI, algorithmic decision-making and data privacy.

In the context of all that, the DPC has 150 staff. This is not a criticism of the staff but there is a serious shortage, given the scale of what it had to address, of the necessary legal investigators and technologies. It is not only about getting data protection lawyers. There is a need increasingly for administrative lawyers, corporate lawyers and competition lawyers. It is the range of skills that are available to the DPC.

There has to be, and there is, an obligation on the DPC to uphold the effectiveness of the data protection provisions. That means that the DPC has to be properly resourced. It is my view - the EU and the Government may need to start considering this - we need to look at limiting the market dominance in the area of data harvesting by a smaller number of global players. There is a role around digital literacy for all of us but that is also as important for us as legislators, and for others within the public service, because many people do not understand the challenges we face in this area.

I want it noted on the record that we have 150 staff in the DPC's office who are responsible effectively for overseeing the regulation of the data of half a billion European citizens. As I said, data represents a considerable opportunity for Ireland, but if we do not handle this properly and if we do not properly resource the DPC, over the next decade this will represent the biggest risk to Ireland's reputation.

James Browne (Wexford, Fianna Fail)
Link to this: Individually | In context | Oireachtas source

The Minister would like me to thank the Senator for raising these important matters. The Government position is reflected in our ongoing commitment in the programme for Government to "recognise the domestic and international importance of data protection in Ireland". Moreover, it is stated: "We will ... ensure that Ireland delivers on its responsibilities under the General Data Protection Regulation (GDPR)."

Under the general data protection regulation and the Data Protection Act 2018, the Data Protection Commission is completely independent in the performance of its tasks and the exercise of its powers. It does not report to the Department of Justice and Equality nor has the Department any oversight or enforcement powers in regard to the commission. The Department of Justice and Equality and the Government have shown their commitment by providing significant additional resources in terms of funding and staff resources to the DPC in recent years. The Department continues to engage with the DPC on an ongoing basis to service current sanctioned staffing requirements. A request for sanction for two additional director posts has been made to Department of Public Expenditure and Reform, with the support of the Department, based on the funding that the office of the DPC has available in its 2020 budget allocation.

This funding has been provided from the Exchequer each year in response to those needs identified by the DPC, including by way of meeting its staffing and expertise requirements. The budget of €16.9 million in 2020 is a 61% increase on the actual expenditure by the office of €10.5 million in 2019. While there have been some delays and underspends in completing the necessary public recruitment processes for reasons beyond the commission's control or that of my Department, the necessary funding to achieve this has been allocated.

The Minister is aware of the increased pressure the DPC finds itself under as a result of issues arising from the Covid-19 pandemic. The Minister would like me to convey her appreciation of the commitment of the Data Protection Commissioner and of all of the staff involved to continuing to deliver effective data protection regulation and protection of the data privacy rights of EU citizens during this challenging time. The Minister, Deputy McEntee, has every confidence in their ability to continue to do so, as do I.

The DPC operates an extensive social media strategy that includes disseminating information through social, national and international media. In addition, the DPC frequently updates its website with guidance, blogs and other publications for both organisations and individuals. The DPC also participates widely in events, nationally and internationally, as panellists or keynote speakers, including 180 such events in 2019. In addition to raising awareness at such events, the DPC emphasises the obligations of controllers to be accountable to the public in how they process personal data. The DPC has also undertaken a comprehensive consultation and actions on children's data protection rights with a wide range of adult and child stakeholders.

In regard to data privacy and algorithmic decision making, my Department is currently engaged in the Department of Business, Employment and Innovation-led process of developing a national artificial intelligence, AI, strategy. This work is at a very early stage, and the latest draft from the senior officials group on economic recovery and investment is due to be presented for further discussion. The DPC was consulted on the latest draft of this document, which addresses the areas of data privacy and the area of algorithmic accountability. The areas of "Trustworthy Data Governance for Al", "Ethical and Human Rights Frameworks for Al", and consideration of "high-risk" applications of Al, in line with the February 2020 EU White Paper on Al, figure prominently in this draft strategy document, as they did in the Government's submission to the public consultation on the EU Al White Paper. The public consultation stage concluded over the summer and the results of this are expected to be published in due course. Given the early stage of this work, the Department would be happy to engage with Senator Byrne or any Senator in developing this strategy further.

Malcolm Byrne (Fianna Fail)
Link to this: Individually | In context | Oireachtas source

I thank the Minister of State for his response. I appreciate that the Data Protection Commission is a separate agency. My point is that this is about the potential threat to Ireland's reputation, and part of the issue is around the adequate resourcing of the Data Protection Commission, for which the Government is responsible. This will require a whole-of-government response around issues of artificial intelligence and algorithmic decision-making so there is a clear, consistent policy across the whole of Government but also a responsibility to ensure that our citizens are digitally literate. While I am not criticising the work the Data Protection Commission has done in this area, I do not think it is enough and it should not just fall within the Data Protection Commission's remit. I am particularly concerned, and would like an assurance, that the Government realises the potential reputational risk to Ireland if we are not able to oversee data regulation effectively, which we have an obligation to do, especially given the number of social media giants that are here.These will be huge issues to face over the coming decade and we need the Data Protection Commission to be properly resourced if we are to address them. How we respond, with regard to both the economic perspective and the protection of our citizens' data rights, needs to be central to Government thinking.

James Browne (Wexford, Fianna Fail)
Link to this: Individually | In context | Oireachtas source

I assure the Senator that the Government takes this issue very seriously. As I informed him, the Government has shown its commitment by providing significant additional funding and staff resources to the Data Protection Commission over recent years. This was in recognition of the additional scope of responsibilities of the office. Its budget has increased from €3.6 million in 2015 to €16.9 million in 2020, which represents an almost five-fold increase. This is a very significant increase which will be put to use. That increase in budgetary provision further demonstrates the Government's continuing commitment to meeting the funding requirements of the Irish data protection authority and the importance of a strong regulatory data protection framework to underpin the continuing growth and expansion of Ireland's digital economy. The Data Protection Commission currently has 147 staff but this will increase to 180 by the end of this year, which is another significant increase in the number of staff provided to the Data Protection Commission.

The commission has underspent its budget by approximately €2.7 million as of the end of 2020. The full amount of any underspend to the end of the year will only be determined when the office carries out a full review of its non-pay expenditure for the remaining months of the year. While it is likely the underspend on payroll will exceed €2 million by the end of the year, this is mainly due to delays in recruitment and the full payroll budget will be required in 2021 in order to meet staffing targets, which should be fully met. I again assure Senators that the Government takes this issue extremely seriously.

Mark Daly (Fianna Fail)
Link to this: Individually | In context | Oireachtas source

I thank the Minister of State for his response and for his offer to have the Department engage with Senator Byrne and other Senators on this important issue.