The Data Protection Commission rejects claims that it has failed to fully investigate a complaint made to it five years ago about an alleged massive data breach by the internet giant Google.
The complaint about Google's processing of personal data was made by Dr Johnny Ryan, who is a senior fellow of the Irish Council for Civil Liberties.
Dr Ryan, whose role with the ICCL includes raising concerns about data protection, says his complaint concerns the operation of a system, allegedly used by Google, called 'Real Time Bidding' or (RTB) which underlies the targeting of individual data subjects for online advertising based on their personal data.
The failure to investigate the matter, he claims, breaches the requirements of both the 2018 Data Protection Act and GDPR, he has claimed in proceedings before the High Court.
Denials
The DPC, which is the State's supervisory authority in respect of GDPR (General Data Protection Regulation), the EU's privacy and data protection requirements and in respect of data controllers whose main establishment are in Ireland, opposes Dr Ryan's application.
It denies all of Dr Ryan's claims against it, including that it has delayed in investigating issues raised in what it said were submissions from the plaintiff in 2018.
The DPP, represented by Joe Jeffers SC, says that it opened an inquiry on its own volition in 2019, which it says is ongoing.
It also argues that the proceedings have been brought outside of the legal time frame allowed to bring a judicial review, and that arguments raised in the proceedings are premature.
It further claims that its decision to open an inquiry, and the manner how that probe has been operated are matters within the sole discretion of the DPC and are not matters that are amenable to judicial review proceedings.
Dr Ryan, represented by James Doherty SC and Sean O'Sullivan Bl rejects the DPC's arguments.
The action is before Mr Justice Garrett Simons.
Reserve judgment
At the outset of the hearing the judge said that he intends to reserve his decision after submissions from the parties have concluded and will give his decision at a later date.
Google is a notice party to the proceedings; however, its lawyers told the court that it does not intend to actively participate in the hearing.
Dr Ryan, who is represented by James Doherty SC and Sean O'Sullivan Bl has raised various concerns including that the RTB systems used by Google, which he claims involves the unauthorised, as well as the potentially unlimited disclosure and processing of large volumes of personal data to other third parties.
He also raised issues about Google's alleged inability to demonstrate their compliance with the GDPR requirement that personal data be processed lawfully and fairly, and that the processing of personal data be kept to a minimum.
The DPC opened an inquiry into RTB in May 2019, under its own violation, and there had been detailed correspondence between Dr Ryan and the DPC over the matter.
However, Dr Ryan claims that his complaint has not been properly or adequately investigated by the DPC.
Seeking court declaration
As a result, he has brought judicial Review proceedings where he seeks a declaration from the court that the DPC has failed to carry out an investigation into the complaint with all due diligence within a reasonable time.
He also seeks an order directing the DPC to proceed with the investigation of he that part of the complaint not addressed in the in its inquiry, namely data security, without delay.
Opening the case Mr Doherty said that it is their case that the DPC has not complied with its GDPR obligations how it gathered, collected and distributed users' personal data.
Counsel said that Dr Ryan's complaint was made almost five years ago, and that his client should not have to wait until 2024 or 2025 for the matter to be properly progressed.
A similar complaint regarding an alleged data breach made by his client about another data controller, IAB Europe, had been considered and processed by the Belgium Data Protection Authority, counsel added.
In reply to a question from the judge Mr Doherty said that the court was not being asked to "micromanage" the DPC's handling of the complaint.
In its statement of opposition, the DPC denies that Dr Ryan has been prejudiced by the manner in which it has conducted the inquiry it opened in 2019.
It says that any issues raised have been excluded from its inquiry. It says that those issues should be addressed by an examination of the lawfulness and transparency of the relevant data processing.
The hearing continues.
