Greetings from Dublin!

Editor’s Note: This week’s European Data Protection Digest comes to you from Kate Colleary, the IAPP’s new Country Leader for Ireland.

As most people know, Ireland is the European home of many of the global data players and its Data Protection Commissioner, Helen Dixon, will become the lead supervisory authority in Europe responsible for regulating these organizations after the GDPR implementation in May 2018.

While regulating the data-heavy behemoths of the world, the Data Protection Commissioner is also vocal on the need for indigenous Irish corporations, SMEs and state institutions to comply with GDPR. For this reason, her office partnered with international privacy think tank CIPL to run a conference this week in Dublin, which was jam-packed with practical workshops and talks, targeted at Irish organizations.

On Tuesday morning, the conference kicked off with a welcome to the almost 500 delegates from Minister for Data Protection Pat Breen. He highlighted the work that is being done at government level to prepare state bodies for GDPR and repeated the government’s commitment to an independent and fully resourced Data Protection Commissioner.

Dixon then introduced the themes of the day, including the concept of accountability under GDPR. She reminded attendees that GDPR places responsibility for safeguarding personal data squarely back on the shoulders of organizations. The rest of the day aimed to provide practical guidance to help those organizations meet that responsibility.

In the first session of the day, representatives from HP and Accenture gave us an insight into their organizations’ GDPR projects. JoAnn Stonier, of Mastercard, asked us to stop thinking that full compliance with GDPR was an end state when it should be an ongoing issue. This reminds me that people often compare GDPR to Y2K. In my view, the difference is that GDPR doesn’t end on 25 May; it is only the start of a new era of accountability and transparency for organizations.

The focus on this conference was to move away from “legal speak” on GDPR and instead to concentrate on practical examples to bring real and meaningful assistance to attendees. In one session, Google’s William Malcolm spoke about risk analysis and brought us through a fictional case study DPIA on an electronic toothbrush (with associated app, of course!). Apple’s Jane Horvath reminded us that privacy is a fundamental human right and then she and Jason Novak led a fascinating session on how Apple developed Siri while adopting a privacy-by-design approach.

Other sessions covered how to handle a data breach and practical examples of delivering transparency, and Facebook’s team ran exercises on how language matters in drafting terms and conditions and notices.

With the dubious honour of being the last speaker of the day, I gave some practical advice on how to develop a data subject access request program, with insights from Anna Morgan of the Data Protection Commissioner’s office. Rob Corbett from Arthur Cox and Stephen Wright from John Lewis Partnership discussed their preparations for enhanced data subject rights under GDPR.

I find that I gain something from every conference I attend. No matter how much we think we know about data protection, all of us can benefit from understanding what our peers are doing and how they are dealing with thorny issues such as legitimate interests balancing tests or delivering a change program that is capable of demonstrating true accountability. This conference delivered that and more. It was met with typical Irish enthusiasm, and, particularly following Bojana Bellamy’s rousing closing speech, we left with a strong feeling that people were ready, and willing, to take real action to tackle GDPR.