LAST UPDATE | 28 Aug 2023

THE HIGH COURT has dismissed a claim that the Data Protection Commission (DPC) failed to fully investigate a complaint made to it five years ago about an alleged massive data breach by the internet giant Google.

The complaint about Google’s processing of personal data was made by Dr Johnny Ryan, who is a senior fellow of the Irish Council for Civil Liberties (ICCL).

In a written judgement delivered this morning, Mr Justice Garrett Simons dismissed the action on the grounds that the DPC was entitled to conduct its own inquiry into the alleged data breach, which the commission has opted to do, before resuming its investigation into Dr Ryan’s complaint.

The complaint by Dr Ryan, whose role with the ICCL includes raising concerns about data protection, concerns the operation of a system, allegedly used by Google, called ‘Real Time Bidding’ or (RTB) which underlies the targeting of individual data subjects for online advertising based on their personal data.

He claimed that there was a failure to investigate the matter, he claims, breaches the requirements of both the 2018 Data Protection Act and GDPR.

While the DPC had opened its own volition inquiry into the alleged breach, Dr Ryan was concerned that issues identified by him were not being considered as part of the DPC’s own probe.

The DPC, which is the state’s supervisory authority in respect of GDPR (General Data Protection Regulation), which is the EU’s privacy and data protection requirements and in respect of data controllers whose main establishments are in Ireland, had opposed Dr Ryan’s application.

It denied all of Dr Ryan’s claims against it, including that it has delayed in investigating issues raised in what it said were submissions from the plaintiff in 2018.

The DPC, represented by Joe Jeffers SC, said that it opened an inquiry on its own volition in 2019, which it says is ongoing.

The DPC said it will complete its own inquiry before resuming Dr Ryan’s complaint.

The Commission said that its approach would ultimately result in a faster, and more effective handling of the complaint.

It also argued that the proceedings have been brought outside of the legal time frame allowed to bring a judicial review, and that arguments raised in the proceedings are premature.

It further claims that its decision to open an inquiry, and the manner how that probe has been operated are matters within the sole discretion of the DPC and are not matters that are amenable to judicial review proceedings.

Dr Ryan rejected the DPC’s arguments.

However, in his judgement Mr Justice Simons said the DPC’s decision to prioritise the own-volition inquiry was “proportionate” and “within the margin of appreciation allowed to it” under GDPR.

The DPC he added is engaged in a “complex and time-consuming inquiry into the advertising industry”.

It was he added “entirely proportionate for the Commission to have decided to complete the own-violition inquiry first, before resuming its investigation of Dr Ryan’s complaint”, he added.

The judge said that his provisional view was that the DPC was entitled to have its legal costs paid by Dr Ryan, given that it was “entirely successful” in the proceedings.

In his action, Dr Ryan had raised various concerns about the RTB systems used by Google, which he claims involves the unauthorised, as well as the potentially unlimited disclosure and processing of large volumes of personal data to other third parties.

He also raised issues about Google’s alleged inability to demonstrate their compliance with the GDPR requirement that personal data be processed lawfully and fairly, and that the processing of personal data be kept to a minimum.

The DPC opened an inquiry into RTB in May 2019, under its own violation, and there had been detailed correspondence between Dr Ryan and the DPC over the matter.

However, Dr Ryan claimed that his complaint has not been properly or adequately investigated by the DPC.

He brought judicial Review proceedings seeking a declaration from the court that the DPC has failed to carry out an investigation into the complaint with all due diligence within a reasonable time.

He also sought an order directing the DPC to proceed with the investigation of he that part of the complaint not addressed in the in its inquiry, namely data security, without delay.

A similar complaint regarding an alleged data breach made by Dr Ryan about another data controller, IAB Europe, had been considered and processed by the Belgium Data Protection Authority, it was argued.

In a statement issued this afternoon, a spokesperson for the ICCL thanked the Court for the consideration given to this case but expressed disappointment at the outcome.

“When the Data Protection Commission defers for five years an investigation in to the biggest data breach in history, even though that data breach continues, there are significant issues that need to be considered further,” said the ICCL spokesperson.

“We will therefore carefully study the judgement and consider whether to appeal,” they added.

Comments are closed for legal reasons.