September 29, 2019
"I am appealing all eight findings" | The Cat Herder, Volume 2, Issue 37
| |
| September 29 · Issue #53 · View online |
|
|
Minister to contest everything, even findings that went in her favour, because sure why not?
😼
|
|
|
It seems everyone who’s anyone wants an illegal biometric database these days. It’s a must have.
|
Vimeo Slapped With Lawsuit Over Biometrics Privacy Policy | Threatpost
Vimeo is under fire for allegedly collecting and storing users’ facial biometrics in videos and photos without their consent or knowledge.
|
|
|
|
|
|
|
|
|
“The Public Services Card will be the only way for parents to claim childcare benefits from late October, despite the Taoiseach claiming that “an option will be available” for those who do not wish to register for a card. A spokesperson for the Department of Children and Youth Affairs has confirmed to the Irish Examiner that a PSC will be “required to apply online only” for the new National Childcare Scheme.”
|
The National Childcare Scheme is being promoted with a nationwide media campaign. There are billboards up advertising it. There are bus shelter ads. This expensive outdoor media campaign points the curious to a dedicated website, ncs.gov.ie, which looks very smart and is bee-themed. When the curious scroll their way down to the bottom of the page there is an alluring link titled ‘Data Privacy’. That brings us to a page called ‘Data Privacy’. This page has two links.
|
Department of Children and Youth Affairs - Data Privacy Statement An Roinn Leanaí agus Gnóthaí Óige - Fógra Príobháideachta
|
These two links respectively point to two PDF files on the Department of Children and Youth Affairs website
|
https://www.dcya.gov.ie/documents/aboutus/20180822_DCYADataPrivacyNotice.pdf https://www.dcya.gov.ie/documents/aboutus/20180822_DataPrivacyGaeilge.pdf
|
Neither of these files appear to exist on the server. The curious visitor who clicks on either of these links is instead redirected to a profile of the Department of Children and Youth Affairs on the Department of Public Expenditure and Reform website. For those who are both curious and determined, scrolling to the bottom of this page we find a link titled ‘Privacy policy’. Following this link leads to an extremely inadequate data protection notice containing factual errors - per Breyer (2016) IP addresses are personal data in certain circumstances - which relates to use of the DPER website only. |
You’d think they’d double and triple check they had everything related to data protection, and transparency in particular, entirely correct before launching a nationwide advertising campaign, wouldn’t you?
|
|
|
On Monday Digital Rights Ireland launched their #No2PSC campaign. The GDPR specifically and deliberately provides for this type of campaign in Article 80 and Recital 142, recognising that many voices united as one are stronger than the sum of their parts, especially when individuals are attempting to exercise their data protection rights. If you’re interested in joining the mass action you can do so here. Over 400 people already have. |
|
|
|
|
A senior civil servant in Foreign Affairs told colleagues from the Department of Public Expenditure and Reform (DPER) and the Department of Employment Affairs and Social Protection (DEASP) in October 2018 that making the PSC a requirement would also “seriously undermine” its plans for people to renew their passports online.
|
This really doesn’t seem to be streamlining government services from the point of view of the service users, does it?
|
|
|
On Wednesday Regina Doherty defended and answered questions about the project in an eyebrow-raising performance in the Dáil. Before we go any further, recall that Minister Doherty is ostensibly the person in charge of this whole shebang.
|
Some of the things we learned included: Just like the rest of us, Minister Doherty first finds out in the media about planned future uses for the biometric database her department is a joint controller of. The civil servants behind this project don’t even send her a note telling her what they’re up to. How rude. [ link] |
Regina Doherty: I was not aware of any plans to extend the medical card until I read about them in the newspaper, which is presumably where the Deputy read about them as well. I cannot answer a question about plans of which I was not aware in the first instance.
|
The minister will be appealing all eight findings of the Data Protection Commission’s report. Even the one which found in her department’s favour. No, really. [ link] |
Catherine Connolly: Is the Department appealing all the findings? I presume it will not challenge the first finding, which finds in its favour, but is it appealing the other seven?
Regina Doherty: In response to the second question, I am appealing all eight findings. However, I am not currently in a position to appeal anything as nothing in the report is legally challengeable. At this stage, all we can do is say we disagree with all eight findings as presented to us on 15 August.
|
When asked about her department’s histrionics in response to a Freedom of Information request the minister gave us a glimpse into how the department regards the public interest test which is supposed to be applied. [ link] |
Regina Doherty: The people who reply to FOI requests do so in the best interests of the Department and according to the established legal plan that sets out our response.
|
The minister was obviously instructed by advisers to keep repeating the line that the card is popular. This comes from an opinion poll they commissioned themselves, so that can be taken with a grain of salt. Furthermore, popularity does not make something lawful. That the state is attempting to fight a PR battle over this points to their full awareness of the weakness of their position.
|
|
|
Helen Dixon appeared before the Public Accounts Committee on Thursday. She was confident that no matter which costly further byways the government steers its misbegotten project down, the result will be the same. |
The Government will eventually be forced to comply with the Data Protection Commissioner’s ruling on the public services card (PSC), the Public Accounts Committee has heard. Commissioner Helen Dixon has said she stands over the report which ruled that it was unlawful to require the card for any benefits or services beyond those offered by the Department of Social Protection. It also stated it was illegal for the State to keep data on the over three million people who have the card.
|
In a shot across the bows of the Department of Children and Youth Affairs, Dixon said |
“The Department of Children and Youth Affairs appears to be pressing ahead with a requirement for the new childcare scheme that individuals use a public services card to apply online,” she said. “The only alternative option that appears to be offered is a manual paper-based application that won’t be ready until the new year and won’t provide back-payments. So clearly this is completely at odds with the findings of our report.”
|
So that’s where we stand at the end of another baffling week. Still no sign of the “incredibly strong” legal advice Regina Doherty received either.
|
|
|
Chinese scientists have developed an artificial intelligence (AI)-enabling 500 megapixel cloud camera system able to capture thousands of faces at a stadium in perfect detail and generate their facial data for the cloud while locating a particular target in an instant.
|
Scientists invent super camera - Global Times
|
|
|
|
|
|
|
This seems like something an enterprising journalist could follow up on in Ireland, just in case this actually could be happening here.
|
|
|
- The judgement of the ECJ in the latest round of the Google / Right to Be Forgotten case.
- “Amazon has announced a new “home” mode for its Ring surveillance cameras that it says will prevent recording when users are in the house—which is another way of saying Amazon could potentially have the ability to track when users are going in and out of their homes. (We have no indication it plans to do so, but concerns have lingered over other smart home devices with similar features before.) It’s also rolling out the Ring Fetch, a tracking device for pets, who while in the company of their owners will keep track of them as well.” Dell Cameron on Amazon’s interpretation of the word privacy, for Gizmodo.
- Presumably writing for a North American audience, Scott Ikeda covers another data leak at Instagram for CPO Magazine. “At the consumer end, all that can be done is due diligence on the companies that are trusted with personal contact information.” This illustrates the power imbalance between individuals and data controllers which the Article 80 mechanism in the GDPR mentioned above was introduced to counter.
——
|
|
|
|
|
Barring a disaster we’ll be in your inbox again next weekend. If you know someone who might enjoy this newsletter do please forward it on to them.
|
|
Did you enjoy this issue?
|
|
|
|
In order to unsubscribe, click here.
If you were forwarded this newsletter and you like it, you can subscribe here.
|
|
|
|
Privacy Kit, Made with 💚 in Dublin, Ireland
|
|
|
Minister to contest everything, even findings that went in her favour, because sure why not?
😼
It seems everyone who’s anyone wants an illegal biometric database these days. It’s a must have.
Vimeo is under fire for allegedly collecting and storing users’ facial biometrics in videos and photos without their consent or knowledge.
Why not pair that with a system which can identify you by the “geometry of your ear canal”?
What happened this week in the land of u-turns, backflips and logical somersaults that is the Public Services Card megashambles, you wearily ask? When we left off last week no less a person than the Taoiseach himself had told the Dáil that applicants for the new National Childcare Scheme would not have to get a Public Services Card to apply for their entitlements under the new National Childcare Scheme. So one could draw the reasonable conclusion that the Department of Children and Youth Affairs had joined its siblings the Department of Foreign Affairs and the Department of Transport in wisely avoiding entangling itself any further in the megashambles DPER and DEASP have created.
By Monday that position had changed entirely.
The National Childcare Scheme is being promoted with a nationwide media campaign. There are billboards up advertising it. There are bus shelter ads. This expensive outdoor media campaign points the curious to a dedicated website, ncs.gov.ie, which looks very smart and is bee-themed. When the curious scroll their way down to the bottom of the page there is an alluring link titled ‘Data Privacy’. That brings us to a page called ‘Data Privacy’. This page has two links.
These two links respectively point to two PDF files on the Department of Children and Youth Affairs website
Neither of these files appear to exist on the server. The curious visitor who clicks on either of these links is instead redirected to a profile of the Department of Children and Youth Affairs on the Department of Public Expenditure and Reform website. For those who are both curious and determined, scrolling to the bottom of this page we find a link titled ‘Privacy policy’. Following this link leads to an extremely inadequate data protection notice containing factual errors - per Breyer (2016) IP addresses are personal data in certain circumstances - which relates to use of the DPER website only.
You’d think they’d double and triple check they had everything related to data protection, and transparency in particular, entirely correct before launching a nationwide advertising campaign, wouldn’t you?
—
On Monday Digital Rights Ireland launched their #No2PSC campaign. The GDPR specifically and deliberately provides for this type of campaign in Article 80 and Recital 142, recognising that many voices united as one are stronger than the sum of their parts, especially when individuals are attempting to exercise their data protection rights. If you’re interested in joining the mass action you can do so here. Over 400 people already have.
—
On Tuesday The Journal reported that “introducing the Public Services Card (PSC) as a mandatory requirement for all passport applications would have a “significant negative impact” on processing times.”
This really doesn’t seem to be streamlining government services from the point of view of the service users, does it?
—
On Wednesday Regina Doherty defended and answered questions about the project in an eyebrow-raising performance in the Dáil. Before we go any further, recall that Minister Doherty is ostensibly the person in charge of this whole shebang.
Some of the things we learned included:
Just like the rest of us, Minister Doherty first finds out in the media about planned future uses for the biometric database her department is a joint controller of. The civil servants behind this project don’t even send her a note telling her what they’re up to. How rude. [link]
The minister will be appealing all eight findings of the Data Protection Commission’s report. Even the one which found in her department’s favour. No, really. [link]
When asked about her department’s histrionics in response to a Freedom of Information request the minister gave us a glimpse into how the department regards the public interest test which is supposed to be applied. [link]
The minister was obviously instructed by advisers to keep repeating the line that the card is popular. This comes from an opinion poll they commissioned themselves, so that can be taken with a grain of salt. Furthermore, popularity does not make something lawful. That the state is attempting to fight a PR battle over this points to their full awareness of the weakness of their position.
—
Helen Dixon appeared before the Public Accounts Committee on Thursday. She was confident that no matter which costly further byways the government steers its misbegotten project down, the result will be the same.
In a shot across the bows of the Department of Children and Youth Affairs, Dixon said
So that’s where we stand at the end of another baffling week. Still no sign of the “incredibly strong” legal advice Regina Doherty received either.
The speed at which things happen these days. Last weekend Sky News reported that 50,000 students in the UK were using a mental health wellbeing test called AS Tracking developed by a company named Steer.
By Friday a researcher had discovered that “versions of the apps developed for pupils and teachers alike contain hardcoded login credentials – posing a security risk to the most sensitive mental health data and information of the most vulnerable children.”
This seems like something an enterprising journalist could follow up on in Ireland, just in case this actually could be happening here.
- The judgement of the ECJ in the latest round of the Google / Right to Be Forgotten case.
- “Amazon has announced a new “home” mode for its Ring surveillance cameras that it says will prevent recording when users are in the house—which is another way of saying Amazon could potentially have the ability to track when users are going in and out of their homes. (We have no indication it plans to do so, but concerns have lingered over other smart home devices with similar features before.) It’s also rolling out the Ring Fetch, a tracking device for pets, who while in the company of their owners will keep track of them as well.” Dell Cameron on Amazon’s interpretation of the word privacy, for Gizmodo.
- Presumably writing for a North American audience, Scott Ikeda covers another data leak at Instagram for CPO Magazine. “At the consumer end, all that can be done is due diligence on the companies that are trusted with personal contact information.” This illustrates the power imbalance between individuals and data controllers which the Article 80 mechanism in the GDPR mentioned above was introduced to counter.
——
Endnotes & Credits
Find us on the web at myprivacykit.com and on Twitter at @PrivacyKit. Of course we’re not on Facebook or LinkedIn.
Barring a disaster we’ll be in your inbox again next weekend.
If you know someone who might enjoy this newsletter do please forward it on to them.
