Sir, – Richard Corbridge, the chief information officer of the HSE, in response to Elaine Edwards's "Government continues data-sharing projects despite EU ruling" (Technology, December 8th), makes the baffling assertion that Irish domestic law is not surpassed by EU legislation or rulings of the European Court of Justice interpreting said legislation (December 15th).
This apparent lack of understanding of how EU laws work, and the requirement under EU treaties for domestic legislation to give effect to the right to data privacy in the EU’s Charter of Fundamental Rights, and the requirement for the processing of data in the public sector to be compatible with the EU data protection directive, as implemented in Ireland under the Data Protection Acts, is astonishing. It is particularly so given Mr Corbridge’s frequent and public debates on the matter on Twitter and on other forums with a number of experts in data protection law and practice in which this has been explained to him at length.
It is doubly astonishing given the submission made by my company on the matter to the review of the privacy impact assessment for the health identifiers system (a submission that was dismissed as being “strategic” in nature), which addressed, among other things, the implications of the Court of Justice’s Bara ruling on data sharing and what was required to address it.
It is triply astonishing given the Data Protection Commissioner’s relatively clear guidance on the interpretation of the Bara ruling and what is required of public sector organisations to comply.
A brain can only process so much astonishment before breakfast.
However, perhaps this serves to explain why the Irish public bodies continue to roll out expensive projects that ignore fundamental requirements of data privacy rights and data protection practices, and to award prizes for such initiatives. Perhaps they do not understand the rules or believe they do not apply to them? If so, this is unfortunate and must be addressed through investment training and culture change, or through regulatory action.
Valuable and appropriate data-sharing requires a clear basis of trust and trustworthiness. Trust begins with understanding and working within the parameters of the law and individual rights, rather than shutting one’s eyes and hoping they will go away. – Yours, etc,
DARAGH O’BRIEN,
Managing Director,
Castlebridge, Dublin 9.