The High Court has dismissed a claim the Data Protection Commission (DPC) failed to fully investigate a complaint made to it five years ago about an alleged data breach by the internet giant Google.
The complaint about the company’s processing of personal data was made by Dr Johnny Ryan, who is a senior fellow of the Irish Council for Civil Liberties (ICCL).
In a written judgment delivered on Monday, Mr Justice Garrett Simons dismissed the action on the grounds the DPC was entitled to conduct its own inquiry into the alleged data breach, which the commission has opted to do, before resuming its investigation into Dr Ryan’s complaint.
The complaint by Dr Ryan, whose role with the ICCL includes raising concerns about data protection, concerns the operation of a system, allegedly used by Google, called Real Time Bidding, which underlies the targeting of individuals for online advertising based on their personal data.
He claimed there was a failure to investigate the matter, which, he says, breaches the requirements of both the 2018 Data Protection Act and GDPR.
While the DPC had opened its own volition inquiry into the alleged breach, Dr Ryan was concerned that issues identified by him were not being considered as part of the DPC’s own probe.
The DPC, which is the State’s supervisory authority in respect of GDPR (General Data Protection Regulation) – the European Union’s privacy and data protection requirements – and in respect of data controllers whose main establishments are in Ireland, had opposed Dr Ryan’s application.
It denied all of Dr Ryan’s claims against it, including that it had delayed in investigating issues raised in what it said were submissions from the plaintiff in 2018.
The DPC, represented by Joe Jeffers SC, said that it opened an inquiry on its own volition in 2019, which it says is ongoing. The DPC said it will complete its own inquiry before resuming Dr Ryan’s complaint.
The Commission said its approach would ultimately result in a faster and more effective handling of the complaint.
It also argued the proceedings have been brought outside of the legal time frame allowed to bring a judicial review and that arguments raised in the proceedings are premature.
It asserted that its decision to open an inquiry, and the manner how that probe has been operated, are matters within the sole discretion of the DPC and are not matters that are amenable to judicial review proceedings.
Dr Ryan rejected the DPC’s arguments. In his judgment, however, Mr Justice Simons said the DPC’s decision to prioritise the own-volition inquiry was “proportionate” and “within the margin of appreciation allowed to it” under GDPR.
The DPC, he added, is engaged in a “complex and time-consuming inquiry into the advertising industry”.
He said it was “entirely proportionate for the commission to have decided to complete the own-volition inquiry first, before resuming its investigation of Dr Ryan’s complaint”.
The judge said his provisional view was that the DPC was entitled to have its legal costs paid by Dr Ryan, given that it was “entirely successful” in the proceedings.
In his action, Dr Ryan had raised various concerns about the RTB systems used by Google, which he claims involves the unauthorised, as well as the potentially unlimited, disclosure and processing of large volumes of personal data to other third parties.
He also raised issues about Google’s alleged inability to demonstrate their compliance with the GDPR requirement that personal data be processed lawfully and fairly, and that the processing of personal data be kept to a minimum.
The DPC opened an inquiry into RTB in May 2019, under its own violation, and there had been detailed correspondence between Dr Ryan and the DPC over the matter.
