There is a type of room, Irish activist Johnny Ryan tells an audience the day before we speak, which exists in the small Irish houses his country built in a wave of construction in the 1960s: the biggest room at the front, usually unused, dust on the silver, fine linens. It is only opened when the priest comes for tea.
“Ireland’s presidency is like us getting the special room ready,” he says on stage at the Re:Publica conference in Berlin earlier this month adding: “This is the moment when Ireland is most interested in looking like something that, in this domain, it is not – a good European.”
Ryan runs Enforce, a litigation and investigation unit set up within the Irish Council of Civil Liberties (ICCL) to drag tech platforms through the regulatory system they are supposed to comply with.
He is unusually succinct for a critic of Big Tech – his crusade pretty much fits on a postcard: Europe’s digital enforcement crisis is, in essence, an Irish enforcement crisis.
The country that hosts almost every American tech firm’s European headquarters is also the country that has decided not to police them. And on 1 July this year, that country takes the rotating EU Council presidency and inherits the agenda-setting powers on the EU crown jewels of tech-laws: Digital Omnibus, the AI Omnibus, the implementing acts of the AI Act, the Cloud and AI Development Act, the Digital Networks Act, and the GDPR. All in one six-month run.
“That should make you worried,” Ryan says.
Ryan’s worries are not based on vibes or general misgivings. He blew the whistle on the online-ad industry’s real-time bidding system in 2017, from inside it, and filed the first formal GDPR (General Data Protection Regulation) complaints against Google’s ad-tech the following year.
Dr. Johnny Ryan is director of Enforce, a unit of the Irish Council of Civil Liberties that advocates, investigates, and litigates to protect people in the digital age. He is known for global campaigns against Big Tech surveillance, leading to major lawsuits and regulatory actions targeting the ad-tech industry.
Ireland’s job, by way of how the GDPR was drafted, is to defend the rest of Europe when it comes to the tech companies headquartered there. Whichever country a multinational picks for its European headquarters becomes the supervisor responsible for the data of citizens in every other member state – a hospital in Hamburg, a school in Lille.
Meta, Google, TikTok, Microsoft, LinkedIn, X, Apple all picked Ireland. So did most of their AI activity. Which means, in Ryan’s words: “Ireland is responsible for defending the rest of Europe when those companies abuse Europeans’ data.”
In short: if Dublin doesn’t move, nobody moves. “If the Irish enforcer doesn’t do anything, then other European countries cannot really act either.” One part of Enforce’s job is to break that paralysis, by dragging the Irish DPC, by complaint and litigation and public noise, into doing the work its own mandate requires. It’s a necessary job for reasons that will become obvious.
And also one, that in Ryan’s view, should lead Ireland to recuse itself from managing any digital files in its upcoming European Council rotating presidency.
The race Ireland won
“You have to applaud Ireland for winning the race to the bottom, until you realise that equates to selling out Europe,” he says, not mincing words.
The day before, on the stage in Berlin, he put the same indictment in a more rhetorical register: “Why can’t we protect our children? Why can’t we protect our politics? Why can’t we protect national security? Why can’t we make space in the market for innovators to scale? And the answer is Ireland. One word.”
Ireland: why, though?
A one-word answer to why EU lost control of Big Tech: Ireland
