Mastodawn

Some thoughts on this #ArtsCouncil story in the Indo today https://m.independent.ie/irish-news/arts-council-asked-for-sexual-identity-and-religion-of-those-seeking-grants/a909106926.html. First off: DPC can’t “grant an extension” on data breach notifications under Article 33. 72 hours is a hard deadline. After that data controllers (like the Arts Council) got some ‘splainin’ to do. I suspect this is what has happened. Also: highly likely this breach only on DPC radar because of (waves hands) all the other things.

Arts Council asked for sexual identity and religion of those seeking grants

The Data Protection Commissioner (DPC) has written to the Arts Council asking for further details on the “nature and content” of questions asked of artists when they were applying for bursary grants earlier this year.

Irish Independent

Show thread

Cbridge_Chief Jul 15, 2025

Now. The second thing. My immediate response when I saw they were asking for things that are very much Article 9 special category data was “WHAT”? Followed quickly by “the actual fook?!?”

Unless the Arts Council’s legislation *requires* them for the execution of their public function to ask these questions this was (checks notes) dumb. It’s Article 9. There needs to be a *Substantial public interest* and the data must be *strictly necessary* for that purpose.

Show thread

Cbridge_Chief Jul 15, 2025

“Ah, but it was in a grant application form and they got consent!” I hear people cry. To which I respond: hush silly person and listen…

Explicit consent under Article 9 is tricky. It is standard consent on steroids. Less a “yes”, more an emphatic “F*ck Yes!!”. That’s why it’s *explicit* consent. But even “standard” consent has a duress test built in. If people feel (rightly or wrongly) they’ll be denied something by not giving the data, consent doesn’t work.

Show thread

Cbridge_Chief Jul 15, 2025

This is particularly the case where there is an imbalance of power. Say like when you are a funding body giving out cash and the person filling out the form is a struggling artist who needs funding to do their art and buy supplies, or beans, or pay rent for things like a studio (painting place or sleeping place, you decide).

So, the Arts Council relying on consent is “tricky”.

Show thread

Cbridge_Chief Jul 15, 2025

I am left to wonder:

1) Did the Arts Council have a DPO?
2) Where they asked about these questions before the form went out?
3) If the answer to either of these is “No”, go to question 5.
4) If the question to the first two is “yes”, was the DPO an outsourced provider who got the tender on the basis of lowest cost? If yes, go to Q5
5) What were they thinking?