THE DATA PROTECTION Commission (DPC) raised concerns of the risk of getting taken to court and how a “negative outcome” for them could damage their reputation and drain their resources.

The DPC also raised concerns over a potential failure to secure and retain funding for its work and the challenges posed by a rapid expansion in its staff numbers.

The commission – which has previously admitted to being “acutely strained” by data protection cases involving giant multinationals – identified eight separate challenges in its latest risk register.

The risk that scored most highly was difficulty in securing enough government funding and getting sanction for “key items of expenditure”.

The register said this would affect their ability to achieve strategic objectives and meet their obligations under law.

Also deemed of higher risk were difficulties stemming from a rapidly expanding workforce, with staff numbers more than doubling over the past five years.

This risked putting strain on their accommodation, internal systems, and strategies according to the register, which was released under FOI.

The document also warned of the challenges of recruiting and then retaining key staff with the corporate and regulatory knowledge to carry out its role.

The DPC said this was being tackled through targeted recruitment for general and specialist roles and that they were developing in-house HR capacity and expertise.

It added: “Analysis at senior management level to forward plan staffing requirements across all levels and in each area to meet strategic objectives [is also taking place].”

The risk of losing a high-profile court case was also flagged in the register both because of its “draw” on resources and the impact that failure would have from a “reputational perspective”.

The DPC said they had robust procedures in place to mitigate negative outcomes along with a legal services contract for complex cases.

It also recommended “recruitment of senior specialist staff to the legal unit to increase its capacity and in particular to create a senior litigation oversight role”.

The risk register warned as well of failures to effectively communicate their work leading to “misperceptions” about its effectiveness.

They said this had the ability to cause reputational damage both within Ireland and internationally because of its broad role in monitoring Big Tech.

The DPC said controls in place included ensuring “proactive communications” about their work here and abroad, as well as regular involvement in speaking events and other public engagements.

The register added: “Protocols [are] in place surrounding release of information regarding the work of the organisation across all levels.”

Also identified in the document was the risk of failing to put in place effective governance that could lead to missed targets and ineffective control of projects.

Asked about the register, the Data Protection Commission said they had nothing to add.