Google has been added to a High Court action where it is alleged the Data Protection Commission (DPC) has failed to fully investigate a complaint about how the internet giant and IAB Europe process personal data.
The case has been brought by Dr Johnny Ryan, a senior fellow of the Irish Council for Civil Liberties (ICCL), regarding what he claims is the DPC's delay in investigating his 2018 complaint regarding the way the two companies process personal data.
The DPC denies that it has delayed processing the complaint.
Last March, Mr Justice Charles Meenan granted Dr Ryan permission to bring his judicial review proceedings against the DPC, where he seeks a declaration that the respondent has failed to carry out an investigation into the complaint with all due diligence within a reasonable time.
He also seeks an order directing the DPC to proceed with the investigation of that part of the complaint not addressed in the inquiry, without delay, and wants the case referred to the Court of Justice of the European Union.
When the matter was mentioned before the High Court on Tuesday, Rossa Fanning SC for Google's Irish arm, Google Ireland Ltd, said his client wanted to be joined as a notice party to the action. This was because Google had an "obvious interest" in the outcome of the proceedings.
The judge, after being told that neither Dr Ryan nor the DPC had any objections to Google's bid to be joined, made the company a notice party to the proceedings.
The judge was also told on Tuesday that issues have arisen between the DPC and Dr Ryan's legal representatives over the respondent's concerns that commercially sensitive material may be put before the court.
While there was some disagreement over this issue, the court heard the parties were discussing ways to try and resolve the matter.
The judge said the DPC should file a statement of opposition outlining its objection to Dr Ryan's action in the coming weeks. The court said any commercially sensitive material in that document and any supporting material could be redacted.
The judge adjourned the case to a date in late June and gave the respective parties' liberty to apply to the court should the need arise.
Dr Ryan, who in his capacity with the ICCL raises issues of concern about data protection rights, has sued the DPC over its alleged failure to progress and substantially complete the investigation into his complaint.
His complaint concerns the operation of a system, alleged used by Googles and IAB, called 'Real Time Bidding' or (RTB) which underlies the targeting of individual data subjects for online advertising based on their personal data.
The failure to investigate the matter, he claims, is in breach of the requirements of both the 2018 Data Protection Act and the GDPR (General Data Protection Regulation), which is the EU's privacy and data protection requirements.
Personal data
In his complaint, Dr Ryan raised various concerns including that the RTB systems used by the two firms involves the unauthorised, and potentially unlimited disclosure and processing of personal data.
His complaint contains several instances where he claims Google and IAB have breached GDPR.
The DPC is the State's supervisory authority in respect of GDPR and in respect of data controllers whose main establishment is in Ireland.
He also raised issues about the company's alleged inability to demonstrate their compliance with the GDPR requirement that personal data be processed lawfully and fairly, or that the processing of personal data be kept to a minimum.
The DPC opened an inquiry into RTB in May 2019, and there had been detailed correspondence between Dr Ryan and the DPC over the matter.
However, Dr Ryan claims his complaint has not been properly or adequately investigated by the commission and has brought High Court judicial review proceedings against the DPC.
