Saturday, August 26, 2017

Letter regarding the Public Services Card

I'm very grateful to my colleagues who have signed a letter expressing concern at the growing use of the (supposedly optional) public services card as a mandatory requirement for essentials as passports and social welfare, creating a de facto national ID card or Ireland without public debate.

The full text of the letter and the signatories are below.

Monday, May 15, 2017

Oversight of phone tapping in Ireland: still inadequate

Following allegations of abuse of phone tapping by Irish police, I have an opinion piece in today's Irish Independent explaining why oversight mechanisms in this area are ineffective. Here's a flavour:
The reaction of the Department of Justice and An Garda Síochána to the latest phone-tapping scandal has been a predictable circling of the wagons. As usual, those bodies have refused to address the details of the allegations. We have seen generic statements, asserting that there is a legal basis for phone tapping and that it is subject to judicial oversight. 
The problem with that response is simple: it is clear that both the Irish law on phone tapping and the way it is implemented fail to meet fundamental international standards. 
Take the most basic starting point: who decides whether a phone tap should take place? International human rights law requires that interception of communications be authorised by a judge or an equivalent independent body. In Ireland, however, this power is given to the Justice Minister - leaving it open to allegations of political motivation. 
Irish law also falls down on the question of who can have their phones tapped. Contrary to international standards, there are no safeguards on phone tapping targeting lawyers, journalists or parliamentarians. 
Unusually for a Western democracy, Ireland does not have separate security and police agencies. Instead, both roles are combined in An Garda Síochána. The result is a blurring of the boundaries between the two functions which means that all surveillance ends up being concealed in unnecessary secrecy. 
The Irish oversight system is also out of line with international practice. In almost all EU member states, there are parliamentary committees which can oversee surveillance by security agencies. Ireland is one of only four EU states which does not make its security agency accountable to parliament. Instead, in security matters the Garda Commissioner answers only to the Justice Minister - the same person who is responsible for decisions to tap phones in the first place.
I've written more about the issue in the chapter "Judicial Oversight of Surveillance: The Case of Ireland in Comparative Perspective" (2016), full text online at the UCD research repository.

Back in the saddle

I'm delighted to be able to say that starting this week I'll be working as a consultant with FP Logue Solicitors. The partners - Fred Logue and Niall Rooney - have an excellent track record in business law, with a focus on brands, intellectual property, technology law and information law generally, making for a great fit with my own areas of interest. I greatly enjoy practice as well as research and teaching, and I've always found that each informs the other. Obligatory press release and group photo.

Wednesday, April 06, 2016

Search warrants and privacy in Ireland - CRH, Irish Cement & Lynch v. CCPC

The High Court gave a very important judgment yesterday ( story) on the issues raised by the use of a search warrant to seize an entire email account where many of the emails in the account were not caught by the terms of the warrant. To grossly simplify a complicated decision, Barrett J. held that where the Competition and Consumer Protection Commission (CCPC) had seized an entire email account it was not itself entitled to carry out a "sifting" exercise to determine which emails fell within the scope of the warrant - instead, this had to be done by some impartial vetting process. In the lack of a suitable statutory mechanism, this could be done by agreement between the parties.

The full decision isn't yet on the site, but courtesy of the CCPC I've uploaded a scanned copy to Scribd. The full decision will need careful consideration, but at first glance it's a very privacy protective decision which may have far reaching consequences in other areas of criminal procedure. Notably, it cites with approval the 2013 Canadian Supreme Court decision in R. v. Vu on the special privacy issues presented by searches of computers. (And, I'm glad to see, the Digital Rights Ireland litigation.) By requiring specificity in what is seized and how that material is then examined, it puts a question mark over other search powers - such as those under s.48 of the Criminal Justice (Theft and Fraud Offences) Act, 2001 - which are generally used so as to seize an entire computer and not merely specific records.

Wednesday, March 16, 2016

Destroying the history of those victimised by the State

Fiona de Londras has a letter in the Irish Times today, co-signed by a range of prominent lawyers, highlighting an injustice about to be done by the Irish state. The letter is worth quoting in full:
As human rights lawyers we note with great concern the proposal that records of applicants to the symphysiotomy payment scheme would be shredded after March 20th.
This would reinforce the harm done to women by the physical and symbolic destruction of official medical records attesting to the abuse and harm they experienced. Furthermore it would lead to the destruction of vital records and evidence that might be of assistance in future legal, historiographical and political processes of recording the symphysiotomy in Ireland and ensuring accountability for these instances of inhumane and harmful treatment.
The UN Human Rights Committee has called for a “prompt, independent and thorough investigation into cases of symphysiotomy” leading to prosecutions where appropriate.
It is likely that Ireland is under a positive obligation to hold such an inquiry under the European Convention on Human Rights
That these records would be returned to the applicants to the scheme is, thus, of paramount importance.
We note that applicants to this scheme were obliged to provide “relevant supporting records”. They were not informed that these records would be destroyed, that they should send or retain certified copies, or that by applying to the scheme through submission of these records they were at risk of losing this documentary evidence of their medical mistreatment
The limitations of data storage at hospitals are such that such records, if destroyed, might not be capable of retrieval elsewhere, and in some cases processes for accessing records can be so difficult to navigate as to be almost inaccessible.
Thus, we call on Ms Justice Harding Clarke to reconsider this, and to ensure that all records are returned to the applicants to the scheme, by registered post, at the earliest possible date. Under no circumstances should they be destroyed.
We also endorse the call from Marie O’Connor of Survivors of Symphysiotomy that applicants to the scheme be asked for their consent to these records being archived. 
Quite apart from the collective harm involved, the destruction of these records will be a significant wrong to the individual women. They were told that "the Assessor  shall,  where  reasonably possible, arrange  for  the  return  to  the  Applicant  or  her  Solicitor  of  any  documents submitted". The plan to shred these documents is a direct breach of this promise and makes it likely that the women will not be able to get copies of those documents from other sources.

The issue is urgent. The documents will be destroyed unless "an option letter" is received by 20th March. However, there is an interim solution for those affected: a subject access request under the Data Protection Acts will, in effect, stop the clock. Daragh O'Brien has details of the steps to take.

Thursday, November 12, 2015

How trustworthy is Microsoft's "data trustee"?

Yesterday Microsoft announced a radical new structure for some of its European data centres. In an attempt to put customer data beyond the reach of the US government, it has entered into a relationship with Deutsche Telekom which will operate new European facilities on its behalf and act as "trustee" for data held there. The aim is that:
[Microsoft] employees will have no access to the data held at the facilities without the German company’s permission. The companies believe this arrangement means Microsoft will not have to respond to governmental demands for information held in these data centres, forcing official requests to go through German authorities instead.
This is a direct response to the ongoing US litigation asserting that the Stored Communications Act has extraterritorial effect and captures data which Microsoft holds in Dublin or anywhere else worldwide. The harm to its European cloud operations has forced Microsoft's hand - rather than waiting for the result of the appeal in that case (or proposed amendments which would cut back the extraterritorial effect of US law) it has opted to put itself in a position where it simply can't comply with US demands.

But how trustworthy is Microsoft's trustee? Deutsche Telekom looks like an unfortunate choice. It's probably best known in privacy circles for systematically using its phone records to spy on journalists writing critical stories about it - including tracking journalists' movements using mobile phone data. It's deeply ironic that Deutsche Telekom now sees privacy as a selling point when it previously spied on its users not in response to government demands but simply for its own commercial advantage.

Tuesday, October 13, 2015

Law Society Annual Human Rights Conference

I spoke at the Law Society's 2015 Annual Human Rights Conference last Saturday about privacy and surveillance online in light of recent CJEU decisions - a particularly topical area following the decision in Schrems. I was joined on my panel by Karlin Lillington, the journalist whose advocacy was responsible for data retention being treated as a civil liberties issue in Ireland, and the session was chaired by Michael McDowell who as Minister for Justice was responsible for introducing data retention in Ireland in 2005 and was one of the main proponents behind data retention at a European level. As you would expect with this range of views, there was a full and interesting discussion of privacy generally and the specific area of state surveillance. Unfortunately there's no recording of the conference, but I've embedded my own slides below.

The Law Society will be making available other slides/papers from the conference - including hopefully the very interesting papers from Olivia O'Kane on privacy and the media and Judge Michael O'Reilly on prisoners' rights - and I'll link to those once they are put up.

Tuesday, September 15, 2015

Whitewashing your internet profile: political edition

Irish politicians are getting nervous. Although the government still insists it will serve out its full term, insiders are muttering about the possibility of a post-budget snap election. It's no coincidence, therefore, that they are now looking to clean up their online presence and two stories from this week are particularly telling.

First Alan Kinsella, of the invaluable Irish Election Literature website, tweets:

Second, an anonymous user from an Oireachtas IP address attempted a systematic (but ultimately unsuccessful) whitewashing of the Wikipedia entry for Senator Jim Walsh, deleting all reference to various gaffes by him through the years.

There's nothing new about attempts to suppress unfavourable information about Irish politicians - and the current stories are nowhere near the seriousness of the recent incident in which the aide to Derek Keating TD dumped several thousand copies of a local freesheet containing a critical story about his boss. But these examples still raise interesting issues for lawyers. In the case of the Irish Election Literature website - should politicians be able to invoke what would presumably be a copyright argument in order to conceal their past promises? In the case of Wikipedia, should edits made by TDs, Senators or their staff about themselves be disclosed? (Wikipedia certainly thinks so.) More generally, how should Irish law deal with sites such as Politwoops which archive deleted tweets from politicians? Is Twitter correct in saying that politicians should be able to delete their ill thought out tweets without that fact being highlighted - or should we accept that what politicians say is inherently newsworthy?

The Irish courts have yet to confront most of these issues - but it will be interesting to see what happens in an ongoing case brought by a Dublin election candidate who has invoked the "right to be forgotten" against online discussion of his election literature. Hopefully this will result in a judicial statement affirming the strong public interest in political discussion.