Bürgerrechtsorganisationen pochen auf Unabhängigkeit der irischen Datenschutzaufsicht

Mehr als 40 Nichtregierungsorganisationen sprechen sich in einem offenen Brief gegen die neuberufene irische Datenschutzbeauftragte aus. Zu den Unterzeichnern zählen unter anderem Access Now, ARTICLE 19, European Digital Rights (EDRi) und Statewatch. Ihren offenen Brief gegen die Ernennung von Niamh Sweeney zur dritten Datenschutzkommissarin der irischen Data Protection Commission (DPC) reichten die Organisationen gestern bei der irischen Regierung ein.

Die ehemalige Journalistin Sweeney arbeitete mehrere Jahre in unterschiedlichen Funktionen für den Tech-Konzern Meta. Sie war unter anderem die irische „Head of Public Policy“ von Facebook. Im September dieses Jahres hatte die irische Regierung sie zur Commissioner for Data Protection ernannt.

Bereits unmittelbar nach der Personalentscheidung regte sich Protest. Max Schrems von der österreichischen Nichtregierungsorganisation noyb kritisierte die Entscheidung als Selbstregulierung von und durch Big Tech:

„Wir haben jetzt buchstäblich eine Lobbyistin der US-Big-Tech-Branche, die die US-Big-Tech-Branche für Europa überwacht. 20 Jahre lang hat Irland das EU-Recht nicht wirklich durchgesetzt. Aber zumindest hatte die irische Regierung genug Schamgefühl, um die Durchsetzung heimlich zu untergraben.“

Die NGOs sehen in der Entscheidung ein „besorgniserregendes Level von Missachtung von europäischem Recht“. Sweeney habe sich vor wenigen Monaten noch für große Tech-Unternehmen eingesetzt. Auch fürchten die Unterzeichnenden, dass Sweeney an sogenannte Non-disclosure Agreements gebunden sein könnte, die sie dazu verpflichten, Geschäftsgeheimnisse etwa von Meta zu wahren. Ihre Ernennung stelle die Unabhängigkeit der DPC ernsthaft in Zweifel, so die NGOs.

Undurchsichtiges Auswahlverfahren

Auch das Auswahlverfahren von Niamh Sweeney kritisieren die Nichtregierungsorganisationen in ihrem Schreiben. Laut einem Bericht von Politico gehörte dem Ausschuss, der Sweeney rekrutiert hat, unter anderem der Anwalt Leo Moore an. Moore ist Partner bei der Kanzlei William Fry. Er vertritt nationale sowie multinationale Unternehmen in der Technologiebranche. Ein Mitbewerber Sweeneys hatte Moore Interessenskonflikte unterstellt, seine Beschwerde gegen die Zusammenstellung des Ausschusses blieb allerdings erfolglos.

Auch die DPC selbst wird von den NGOs kritisiert. „Das Fehlen einer wirksamen Durchsetzung ist mittlerweile systemisch geworden, wodurch Irland zum Nadelöhr bei der Anwendung der Datenschutz-Grundverordnung wurde“, schreiben die Bürgerrechtsorganisationen.

Um das Vertrauen in die DPC zu fördern, schlagen die NGOs zwei Maßnahmen vor. Sie fordern zum einen ein neues Auswahlverfahren, um die Stelle der Datenschutzbeauftragten mit einer Person zu besetzen, die nachgewiesenermaßen über ausreichend Qualifikationen bei den Themen Grundrechte und Datenschutz verfügt. Zum anderen drängen sie darauf, das bestehende Auswahlverfahren unabhängig prüfen zu lassen.

Der offene Brief in Wortlaut

Date 14-10-2025

Re: Concerns Regarding the Independence of the Irish Data Protection Commission Following Recent Appointment

For the attention of Michael McGrath, European Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection.

Dear Commissioner,

We, a large group of civil society organisations are writing to you to express our extreme concern regarding the recent appointment of the new Commissioner at the Irish Data Protection Commission (DPC). The person in question has held a long-standing senior public affairs position at one of the largest technology platforms that the DPC is mandated to regulate, and indeed in her latest role (which ended only last August) continued to advocate on behalf of these platforms. All this raises serious questions about the perception and reality of the DPC’s independence at a time when its impartiality is of critical importance for the entire Union.

The GDPR requires, under Article 52, that supervisory authorities act with full independence. Equally, Article 41 of the Charter requires that procedures are handled ‚impartially‘ and ‚fairly‘. This principle is fundamental to the credibility of the Regulation and to the rights it is designed to protect. Its importance is amplified in Ireland, where the DPC has responsibility as lead supervisory authority for many of the world’s largest technology companies. Indeed, the importance of independence has already been affirmed by the Court of Justice in Case C-288/12 Commission v. Hungary, where the premature ending of a data protection supervisor’s mandate was found to have violated EU law. This precedent underlines both the necessity of safeguarding supervisory authorities‘ independence and the Commission’s role in ensuring compliance.

Concerns about enforcement are long-standing and ongoing. At the Irish DPC, investigations against major companies have been seldom in the last several years, with critical decisions often only materialising, if at all, under pressure from the European Data Protection Board (EDPB) and other Member State authorities, or indeed even after intervention by the Court of Justice of the European Union (CJEU). Patterns of delayed or limited enforcement continue to undermine trust in the DPC as an effective enforcer of the law.

Furthermore, recent revelations have confirmed that intimate data, including sensitive information about survivors of sexual abuse, is still being traded through real-time bidding systems with the case having been discussed at a session in the Irish parliament in the last weeks. That this continues today is the direct result of years of inaction by the Irish DPC, despite clear evidence of unlawful practices. This failure is not limited to one case. Since 2017, civil society organisations have filed highly important and strategic complaints in Ireland, yet these cases have either not been treated or have faced years of delay. The absence of meaningful enforcement has become systemic, making Ireland the bottleneck in the application of the GDPR.
The appointment of a Commissioner with such close ties to an industry under investigation threatens to only reinforce perceived distrust in the Irish DPC at precisely a time when even greater assurances of independence are needed given wider geo-political events. Any contractual obligations, such as non-disclosure agreements with entities regulated by the DPC, would exacerbate these risks from the outset.

The broader context only further compounds these concerns. Across the Union, data protection is increasingly under pressure, with proposals to weaken safeguards under the guise of simplification. Enforcement of the GDPR has too often been treated as a secondary priority, despite being essential to the protection of fundamental rights. The credibility of the EU’s digital rulebook depends on strong, impartial, and effective supervisory authorities.

We therefore respectfully urge the European Commission to:

• Assess whether the independence of the Irish DPC can be guaranteed under Article 52 GDPR and Article 41 CFR in light of this appointment;
• Clarify the steps the Commission will take if the independence of a supervisory authority is compromised, including the initiation of infringement procedures where appropriate;
• Develop a work programme to demonstrate how the task entrusted to you in this mandate – the effective enforcement of the GDPR (as set out in your mandate letter) – will be put into practice as a political priority, including EU-level safeguards to prevent conflicts of interest in supervisory authorities, including transparent appointment processes and revolving-door restrictions.

Ensuring that supervisory authorities are independent, impartial, and effective is not only a legal requirement but also a political necessity for safeguarding rights and maintaining public trust. Undermining supervisory authority independence also risks weakening protections guaranteed under the Charter of Fundamenta Rights. We remain at your disposal for further discussion and would be glad to contribute to the Commission’s reflections on this matter.

Yours sincerely,

Access Now
AI Accountability Lab, Trinity College Dublin
AI Forensics
Albanian Media Council
Alliance4Europe
ARTICLE 19
Asociația pentru Tehnologie și Internet (ApTI)
Balanced Economy Project
Bits of Freedom
Center for Countering Digital Hate
Civil Liberties Union for Europe
Coalition for Women In Journalism
Corporate Europe Observatory
Defend Democracy
Ekō
Electronic Frontier Norway
European Digital Rights (EDRi)
Global Witness
HateAid
Homo Digitalis
Hope and Courage Collective
ICCL
Irish Network Against Racism
IT-Pol
Lie Detectors
LobbyControl
New School of the Anthropocene
noyb
Open Markets Institute
Panoptykon Foundation
People Vs Big Tech
Politiscope
The Good Lobby
SOMI
Statewatch
SUPERRR Lab
Uplift, People Powered Change
Vrijschrift.org
Waag Futurelab
WHAT TO FIX
Xnet, Institute for Democratic Digitalisation