Anna Morgan

I'm a partner in Bird & Bird's International Privacy and Data Protection Group, based in the Dublin office where I'm head of the Irish Privacy & Data Protection practice. My unique background combining litigation, regulation and data protection means I bring a fresh and different perspective when helping clients find solutions.

My practice areas span both advisory/compliance data protection matters, as well as contentious data protection work - in particular I have significant experience of data protection focused litigation. I advise organisations on the broad spectrum of privacy, data protection, data retention and data security issues. I have a special interest, and significant expertise, in matters involving the processing of children's personal data, and I also advise clients on the related areas of online safety and content moderation.

Prior to joining Bird & Bird in June 2022, I was a Deputy Commissioner and the Head of Legal Affairs (General Counsel) in the Irish Data Protection Commission ("DPC") where my role included representing the DPC on a regular basis at plenary and expert sub-group meetings of the European Data Protection Board ("EDPB"). As part of this European-level work I was the lead rapporteur for the EDPB's Guidelines on Transparency under the GDPR. Separately, I established the DPC's Children's Policy function and led the DPC's work on children's data protection issues. I was also responsible for managing all litigation involving the DPC and overseeing a number of complex and significant cross-border inquiries conducted by the DPC.

Prior to working at the DPC, I was in private legal practice for 10 years specialising in data protection, commercial litigation and regulatory litigation, most recently at one of the top five Irish law firms. Arising from my background as a commercial litigator and data protection expert, I'm particularly interested in the evolving field of data protection and privacy-oriented litigation, especially the growing trend of collective data protection actions. My practice areas include advising organisations which are subject to such litigation on both the strategic and technical aspects of such claims.

I've spoken at numerous data protection conferences including the IAPP Global Privacy Summit (USA), the Irish Centre for European Law Annual Data Protection Conferences, the Computers Privacy and Data Protection Conference (Brussels), the Bitkom Privacy Conference (Germany), as well as events organised by CIPL, PRIVO, Common Sense, academic institutions, and other leading law firms. I've also appeared as a witness (on behalf of the DPC) before a number of Irish parliamentary (Oireachtas) Committee hearings, including most recently in relation to pre-legislative scrutiny of the General Scheme of the Online Safety and Media Regulation Bill.

Additionally, I'm a regular guest lecturer at a number of academic institutions including the Law Society of Ireland, the Honourable Society of King's Inns and Trinity College Dublin. I'm also currently a doctoral candidate at Trinity College Dublin undertaking my Ph.D. research on how to operationalise children's data subject rights under the GDPR.