The Court of Appeal (CoA) has dismissed a claim that the Data Protection Commission (DPC) failed to fully investigate a complaint made to it several years ago about an alleged massive data breach by the internet giant Google.
The complaint about Google's processing of personal data was made by Dr Johnny Ryan, who is a senior fellow of the Irish Council for Civil Liberties.
Dr Ryan filed his complaint in 2018 regarding a system, allegedly used by Google, called 'Real Time Bidding' or RTB, which underlies the targeting of individual data subjects for online advertising based on their personal data.
Last year, Mr Justice Garrett Simons in the High Court dismissed the action on the grounds that the DPC was entitled to conduct its own inquiry into the alleged data breach, which the commission has opted to do, before resuming its investigation into Dr Ryan's complaint.
That ruling was appealed to the CoA, which in a judgement published on Monday upheld the lower court's findings.
The DPC, represented by Joe Jeffers SC, had opposed the appeal. Google Ireland was a notice party to the proceedings.
Giving the CoA's decision, Mr Justice Donald Binchy, sitting with Mr Justice Seamus Noonan, and Ms Justice Una Ni Raifeartaigh, said that the central ground of the appeal was the High Court erred in determining the DPC’s decision to defer consideration of Dr Ryan’s complaints of breaches GDPR pending completion of the own volition inquiry was lawful.
In particular, it was argued by Dr Ryan that the High Court failed to apply properly the provisions of the GDPR and the relevant judgments of the Courts of Justice of the European Union on issues of data control, the CoA said.
Mr Justice Binchy said that he could "find no error in the conclusion of the High Court judge that the decision to prioritise the inquiry and defer the handling of the complaint is proportionate, and well within the margin of appreciation allowed to a supervisory authority".
All other grounds of the appeal were either deemed to have not been made out or were not pursued, the CoA added.
Complaint
In September 2018, Dr Ryan filed a complaint to the DPC about RTB systems he claims are used by Google and involve the unauthorised, as well as the potentially unlimited, disclosure and processing of large volumes of personal data to other third parties.
He also raised issues about Google's alleged inability to demonstrate their compliance with the GDPR requirement that personal data be processed lawfully and fairly, and that the processing of personal data be kept to a minimum.
He claimed there was a failure to investigate the matter, which breaches the requirements of both the 2018 Data Protection Act and GDPR.
While the DPC had opened its own volition inquiry in 2019 into the alleged breach, Dr Ryan was concerned the issues identified by him were not being considered as part of the DPC's own probe.
He claimed that his complaint has not been properly or adequately investigated by the DPC.
Arising out of his concerns he brought proceedings seeking a declaration from the court that the DPC has failed to carry out an investigation into the complaint with all due diligence within a reasonable time.
The DPC, which is the state's supervisory authority in respect of GDPR, opposed Dr Ryan's action.
It denied all of Dr Ryan's claims against it, including that it has delayed in investigating issues raised in what it said were submissions from the plaintiff in 2018.
The DPC says it opened an inquiry on its own volition in 2019, which it says is ongoing, and will complete its own inquiry before examining Dr Ryan's complaint.
This, the DPC argued, will ultimately result in a faster and more effective handling of the complaint.
It also argued that the proceedings against it were premature and its decision to open an inquiry, and the manner of how that probe has been operated, were matters within the sole discretion of the DPC.
Dr Ryan rejected the DPC's arguments.
