The Irish Council for Civil Liberties (ICCL) has lodged a formal complaint with the European Commission, alleging that Ireland breached EU rules in appointing a new member to the country’s Data Protection Commission (DPC). The complaint challenges the independence and integrity of the appointment process that led to the selection of Niamh Sweeney, a former senior executive at Meta-owned companies Facebook and WhatsApp.
The ICCL claims that Ireland “failed to provide adequate safeguards for independence and impartiality” during the recruitment process, arguing that the selection of a former tech industry lobbyist undermines public trust in the watchdog tasked with regulating those very firms. Sweeney’s appointment, announced last month, adds a third Commissioner to the DPC, which oversees the enforcement of Europe’s strict data privacy laws, including the General Data Protection Regulation (GDPR).
In its statement, the ICCL said that the process lacked “procedural safeguards against conflicts of interest and political interference,” warning that the move could be perceived by the technology sector as “a signal of impunity.” Under EU law, national data protection authorities must be independent, impartial, and free from any appearance of bias.
The Council raised specific concerns about the makeup of the four-person panel responsible for selecting candidates, noting that one panel member was a State official while another worked in a sector that contributes significantly to Ireland’s economy. “This invites doubts about partiality and conflict of interest,” the ICCL said, adding that the panel also appeared to lack sufficient expertise in data protection law and enforcement.
The Council further criticised the outcome of the process, claiming that the new Commissioner “appears to have no technical, legal, or investigative expertise.” Instead, it argued, Sweeney’s previous work involved lobbying “against a high standard of protection of personal data and the objectives of the DPC.”
“The European Commission must intervene,” the ICCL stated, urging Brussels to review whether Ireland’s appointment process meets the EU’s requirement for independent data regulators.
The DPC, headquartered in Dublin, plays a crucial role in policing global tech companies that base their European operations in Ireland, including Meta, Google, and Apple. Critics have long accused the regulator of being too close to the tech industry, a claim the DPC has consistently rejected.
Several privacy and civil rights organisations have joined the ICCL in writing to the Irish Government to express their concerns over Sweeney’s appointment, calling for greater transparency and stronger safeguards to preserve the independence of the data protection authority.
