Sky Views Personal Data as a Potential Weapon in IPTV Piracy War

Ireland's Data Protection Commission (DPC) says it has been "engaging with Sky for some time" over the use of personal data to crackdown on streaming piracy, including IPTV services accessed via set-top boxes. Ongoing engagement and a meeting between the DPC and Sky in two weeks time, will focus on the lawful sharing or processing of personal data outside the company under the GDPR. From: TF, for the latest news on copyright battles, piracy and more.

Jun 22, 2025 - 16:20

Sky Views Personal Data as a Potential Weapon in IPTV Piracy War

skypour1s Sky’s war on TV piracy has raged for well over thirty years and despite the passing of time, the goal remains the same.

In broad terms, pirates retain their original goals too, but how that can be achieved is always subject to change, largely depending on who has taken the lead in an increasingly complex arms race.

News emerging from Ireland suggests that Sky’s use (or proposed use) of a valuable asset to boost its fight against piracy, has led to a powerful Irish authority “engaging” in the process for quite some time. Only very rarely are the stakes this high.

Data Protection Commission “Engaging With Sky”

The Data Protection Commission (DPC) is the national independent authority responsible for ensuring that Irish citizens have their personal data protected to the standards required under the European Union’s General Data Protection Regulation (GDPR).

In an RTE report published this week, the DPC is described as “engaging with Sky on the company’s efforts to clampdown on so-called TV ‘dodgy boxes’,” a catch-all term for pirate devices that enable unauthorized access to premium content.

RTE confirmed that DPC’s contact with Sky concerns the broadcaster’s use of personal data for the purpose of taking action against illegal streaming.

Fighting Fraud “In an Appropriate, Ethical Manner”

In comments to RTE, Commissioner for Data Protection Des Hogan said that companies may have legitimate reasons for taking action against fraud. The issue for DPC turns on whether the use of protected data meets the standards required.

“[T]he use of personal data would be the question for us, and whether that’s been done in an appropriate, ethical manner,” Hogan said.

“We have been engaging with Sky for some time, and we’re going to be meeting them in two weeks time, and I expect that we’ll be bringing things forward with them at that point in time.”

Nothing Solid Given Away, But Plenty of Fuel For Speculation

The finer details of the “engagement” will presumably appear at a later stage but until then, recent comments may put some extra meat on the bones.

In the Irish Independent (paywall) this week, Sky Ireland CEO JD Buckley warned of “consequences” for operators of pirate IPTV platforms, and those tempted to use them.

“We continuously evolve our investigative strategies to crack down on illegal streaming and protect consumers from risks including malware, fraud and identity theft. Further action will follow with consequences for those identified as operating illegal services and for those who watch them,” Buckley said.

700,000 Subscribers, 400,000 Dodgy Box Users

An unnamed spokesperson for Sky confirmed that the company was “exploring various options” including “ongoing engagement” with the DPC. While vague statements have a tendency to fuel the rumor mill, depending on what Sky has in mind, the potential for impact could be significant.

Towards the lower end, Sky may be considering a significant expansion of its existing investigation footprint. Targeting a large number of individuals would necessarily mean the collection of evidence, including personal data. Ensuring every last detail of that process had been ‘vetted’ by DPC in advance, would reduce risk of a successful challenge by an individual on data protection grounds, undermining a whole campaign.

At the higher end are less likely options. If Sky as an ISP, and Sky as a broadcaster, saw no benefit from barriers restricting the ability to act publicly, on intelligence obtained from a figurative commingling of the companies’ knowledge of pirate activity, that would be a game changer. Complex legal issues aside, ISP records are nevertheless a potential goldmine of information.

To what extent intelligence sharing already happens is unknown, but a number mentioned by the Irish Independent – 400,000 users of “dodgy boxes”- can’t be casually brushed under a carpet. Figures quoted in Irish media estimate that Sky Ireland has around 700,000 subscribers.

Partners in Crime (Fighting)

While there was no explicit reference to Sky, it seems unlikely that Hogan would mention the GDPR and a particular type of data sharing, if that wasn’t directly relevant to the matter in hand.

“Any sharing of personal data, or processing of that personal data outside a company has to be done in a lawful manner under the GDPR,” Hogan said.

With whom Sky may have shared, or intends to share, personal data for piracy-fighting purposes, receives no mention, much less the type and volume of personal data involved. If this is more about collection of personal data concerning investigations, the sky’s the limit; pirates are hardly in short supply.

Under Article 35 of the GDPR, a Data Protection Impact Assessment (DPIA) must be carried out when a new activity “is likely to result in a high risk to the rights and freedoms of natural persons to other people’s personal information.”

Whatever the specifics of the engagement, the issue appears to be sufficiently important to place in the public eye. Sky’s privacy policy makes it quite clear that it reserves the right to take anti-piracy action.

From: TF, for the latest news on copyright battles, piracy and more.