The High Court has refused to halt a probe by Ireland’s data watchdog into complaints about Google’s processing of users’ personal data during its sign-up process.
The search engine company asked the court to cancel an inquiry commencement notice issued by the Data Protection Commission (DPC) in October 2023.
The DPC began its inquiry on foot of six separate complaints made on behalf of users by consumer agencies in Spain, France, Slovenia, Norway, Greece and the Czech Republic.
In a ruling on Friday, Mr Justice Anthony Barr said he would cancel the commencement notice only insofar as it relates to the Czech complaint, as this individual had not signed up for a Google account and had not had her data processed by the company.
He said the “first and most fundamental criterion” is that a person’s personal data has been processed by the entity against whom they wish to lodge a complaint.
He found the commission had jurisdiction to issue the commencement notice in respect of the other five complaints.
The DPC’s inquiry, which was paused while this case is live, is examining whether the multinational firm has complied with transparency obligations that attach to its processing of users’ personal data input when registering for a Google account.
Investigators will look at whether the account creation process, including garnering users’ consent for processing certain personal data, is compliant with articles of the EU’s General Data Proctetion Regulation.
Each of the complainants claim the process was unfair as giving consent to the use of the personal data took one click, while opting to manage one’s own account settings took five separate steps and 10 clicks.
They also allege unclear language used in the sign-up process.
Google alleged the DPC had failed to satisfy itself that the six complaints met the required criteria for admissibility. The DPC could not be satisfied it had jurisdiction to investigate, so its inquiry was unlawful, the company claimed.
The commission rejected the claims and argued it has a very broad power to inquire into a complaint.
It said there are no specific preconditions to commencing an inquiry. The DPC did not believe the Czech complaint was barred by having not completed the account creation process.
Mr Justice Barr noted Irish and European law recognise that personal data privacy deserves “particular protection”.
People have “extensive rights” about the information they must receive when their consent is sought for retention and use of their personal data, he said.
While the DPC’s power to commence an inquiry is “undoubtedly” wide, the judge accepted Google’s submission that certain basic criteria must be met for a complaint to be admissible.
