On Tuesday of this week, belatedly and with very bad grace, the Department of Employment Affairs and Social Protection published the Report of the Data Protection Commission (DPC) on the Public Services Card (#PSC), which concluded that the government’s implementation of the PSC infringed data protection legislation. The government has refused to accept or comply with the Commission’s findings, and has instead, for reasons beyond understanding, gone to war with the DPC on this issue.

In my view, the Government’s unjustified defiance of the DPC imperils Ireland’s tech reputation; and I argue in an OpEd in today’s Sunday Business Post (sub req’d) (update: you can download it from the links in update 3 below) that this unseemly standoff must be resolved as quickly as possible, before irreversible damage is done to our international standing as a good location in which international tech companies can establish their European headquarters:

Dealing from bottom of the deck on the Public Services Card

The government is clinging to its legal advice on the PSC data fiasco. It needs to admit it was wrong and change course immediately

… The DPC’s report is very clear; its fundamental conclusions will undoubtedly survive legal challenge; and the government will eventually be as surely taken to task in the courts in Dublin and Luxembourg as it has been his week in the court of public opinion.

Read More »

At the end of last week, the media was full of stories that Google had been “Fined $170 Million for Violating Children’s Privacy on YouTube” (that’s a headline from the New York Times; see also, for example, NPR | BBC | RTÉ | Silicon Republic). In this post, I want to sketch the legal background to, and consequences of, this fine; and, at the end, I will say a few words about the equivalent position in Europe.

In the US, the Children’s Online Privacy Protection Act of 1998 (15 USC §§ 6501–6506; hereafter: COPPA), and the Children’s Online Privacy Protection Rule (16 CFR § 312; hereafter: the COPPA Rule) made under it, regulate unfair and deceptive acts and practices in connection with the collection and use of personal information from and about children on the internet. In particular, 15 USC §§ 6502(b)(A) COPPA, and 16 CFR § 312.3 COPPA Rule, require the operator of any website or online service directed to children that collects personal information from children, or the operator of a website or online service that has actual knowledge that it is collecting personal information from a child,

(i) to provide notice on the website of what information is collected from children by the operator, how the operator uses such information, and the operator’s disclosure practices for such information; and
(ii) to obtain verifiable parental consent for the collection, use, or disclosure of personal information from children; …

Giving further effect to the second paragraph here, 16 CFR § 312.5(b)(1) COPPA Rule provides

An operator must make reasonable efforts to obtain verifiable parental consent, taking into consideration available technology.

Read More »