Ireland blocks the world on data privacy

>As far back as 2014, the question of how Ireland would handle the new privacy rules under the GDPR was on the minds of Facebook’s leaders. As it happened, Ireland was in the process of choosing a new chief data regulator to replace Hawkes. Sandberg took it on herself to investigate the matter, lobbying then-Irish Prime Minister Kenny on the sidelines of the World Economic Forum in Davos and also at her offices in Menlo Park, California.

According to emails obtained by the Irish Independent via Freedom of Information requests, Sandberg wanted to know that Hawkes’ successor would be “as strong as” he had been in the role. But if the wrong choice was made, Sandberg suggested, there would be consequences for Ireland’s attractiveness as a destination for tech investment.

“The risk is that companies will revisit their investment strategies for the EU market,” she wrote in a June 2014 email to Kenny, adding that Ireland’s regulator should be a person who would “establish a strong collaborative working relationship with companies like ours.”

The choice of Dixon, a former Irish civil servant with a law degree but no background in law enforcement or regulatory investigation, was in line with Sandberg’s wishes. Before she became one of the most important privacy regulators in the world, Dixon had spent four years working for U.S. software company Citrix, followed by a stint at the business-friendly Irish Department of Enterprise, Trade and Innovation.

https://www.politico.eu/article/facebook-ireland-investigati...

I live in Denmark, our data-protection agency has only recently gotten cases to a point where they could roll out fines. And that’s just for the small-scale offences that were legally easy to handle.

Some of the larger breaches will take many years to handle before a case is strong enough to be brought to the police. It’s also worth noting, that breaches of the GDPR don’t automatically lead to legal action. It’s only if organisations systematically abuse data or if they fail to fix whatever problems a GDPR audit points out to them, that legal action is the end result.

If you have a breach, like if a supplier forget to exclude an API key from their GitHub repository and I it leaves your employee names vulnerable to the entire world. But you find it, report it, fix it and tell the affected parties ie comply with the GDPR procedures. Then you’ll have breached the GDPR, but won’t have broken the law.

E.g. I think one of the recent fines was put in effect by the french privacy commissioner, even though, going by headquarters, the irish one would have been responsible. However, because french citizens were affected, the french commissioner was allowed to overrule. (At least that was my understanding how it worked)

I mean, Ireland's unwillingness to regulate internet companies is not exactly news. I imagine it was well-known when the regulation was designed (whether or not it actually influenced the design).

Sure, Ireland drags its heels but that does not prevent the data regulators in other countries from taking action.

"“We need to be careful and ensure that the margin for maneuver given by the GDPR doesn’t lead to an attractiveness competition between EU countries, as is already the case for taxation,” Marie-Laure Denis, France’s new chief privacy regulator, warned the French parliament in January, in a clear reference to Ireland."

The meta-problem here is (jurisdiction for international matters) is acute.

It totally hamstrings corporate imcome tax as a category of taxation. In the modern economy, that's a big problem. The winner-loser disparity is such that taxing company profits is the ideal strategy. The alternative is taxing revenue/sales, which is far less efficient. A Google or FB could pay a pretty hefty corporate tax without affecting their output much. They literally make more profit than they know what to do with... it's piling up. A VAT alternative doesn't distinguish between them and (eg) auto manufacturers. It also doesn't tax export revenue...

That's a done deal at this point. Politician planning on funding stuff through corporate income tax changes is a sign of naiveté and haplessness. ... international jurisdiction problems are just too unsolvable.

A regulator shopping regime for privacy regulations basically takes regular on off the table, as a viable tool.

It'll bleed into other areas as well.

https://gdpr-info.eu/art-60-gdpr/

...do they? I'm an American, and I sure wish the GDPR would crawl back from whence it came. The only thing it does for me is show me gratuitous popup messages that I have to mindlessly click through.

Of course the big and wealthy countries in the EU want to make sure that the smaller countries aren't attractive for businesses. It reminds me of Macron's proposal to screw over truckers from Eastern Europe.

These regulators knew that GDPR was going to have an effect like this. Why are people acting surprised now? Whenever I see talk that pertains to the Irish not doing enough with the tech companies it's always politicians from countries like France and Germany. I'm guessing that they don't like that tech companies set up shop in a country that isn't theirs.