Statement on remarks by Data Protection Commissioner on RTE Six One News on 22 May 2023

23 May 2023

ICCL responds to statement made on television news by Data Protection Commissioner

During an interview on Six-One on 22 May, statistics in ICCL's recent report on GDPR enforcement were put to the Data Protection Commissioner. The statistics concerned the number of times the DPC has been overturned in EU-level decisions by other EU Data Protection Authorities. The statistics excluded “amicable resolutions”.
In response, the Data Protection Commissioner said she rejected ICCL’s report, did not accept the characterisation of her office being 'overruled' by other European Data Protection Authorities, and described the figures contained therein by referring to the figures quoted as follows: “I'm not sure it is even a statistic”.
The “Dispute Resolution” process by which the Irish Data Protection Commissioner is overruled is set out in Article 65 of the GDPR: when there is an irreconcilable dispute between a lead data protection authority and other national data protection authorities, the European Data Protection Board votes by majority to upon a binding decision. That decision must then be carried out by the lead authority, and overrides the lead authorities’ own initial decision.
The statistic referred to in ICCL's report stated that 75% of the Irish DPC's initial decisions in EU cross-border cases have been overruled by the majority vote of the European Data Protection Board. In each case, the EDPB insisted on tougher measures.
Only one other country, in one single case, has ever been overruled in this manner.
This week the DPC announced a record 1.2 Billion Euro fine against Meta. The DPC had initially proposed no fine, but was overruled yet again by the EDPB. The EDPB Decision noted that the DPC’s initial decision to impose no fine at all “does not comply with the GDPR.
(See paragraphs of 271-5 of the EDPB decision.[1])
The figures used by ICCL in the preparation of its report for outcomes of interstate cases comes from the EDPB Register of Final One Stop Shop Decisions [2] (we also included three decisions published by the DPC that are not yet in the EDPB Register, in order to give the DPC the benefit of the doubt). The number of times the DPC has been overruled is from the EDPB list of Binding Decisions [3]