Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Ireland: High Court dismisses claim DPC failed to fully investigate alleged Google data breach

The High Court of Ireland issued its decision on August 28, 2023, in the case of Johnny Ryan vs. Data Protection Commission [2023] IEHC 511. This case involved a challenge to the Data Protection Commission's (DPC) handling of a complaint made under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (the Act) by Johnny Ryan, concerning Google Ireland Ltd's data processing for targeted advertising through the Google Authorized Buyers Ad Exchange.

Background to the judgment

In particular, the High Court noted that the aforementioned complaint related to data processing operations being carried out by Google Ireland Ltd for the purposes of targeted advertising facilitated through the Google Authorized Buyers Ad Exchange. The DPC had indicated that it intends to progress an own-volition inquiry to completion before resuming its consideration of the complaint. However, Johnny Ryan, the complainant, objected to this approach addressing that the principal issue of concern identified by them in their complaint is not being considered as part of the own-volition inquiry. Furthermore, Johnny Ryan submitted that the DPC is obliged to examine fully this aspect of his complaint within a reasonable period of time with all due diligence. In addition, Johnny Ryan contended that it is not permissible for the DPC to defer consideration of this issue pending the conclusion of the own-volition inquiry.

Findings of the High Court

In its finding, the High Court clarified that Johnny Ryan made no object to the scope of the inquiry, rather their objection is that the Commission is obliged to investigate fully, in parallel to the own-volition inquiry, those aspects of their complaint which do not overlap with the own-volition inquiry. The High Court further found that the position advocated by Johnny Ryan is too extreme, highlighting that it is incorrect to say that a supervisory authority cannot defer consideration of a complaint pending the completion of related investigations or inquiries. The High Court highlighted that the data processing operations the subject of the complaint are under active investigation in the own-volition inquiry, albeit not by reference to all of the legal heads asserted by Johnny Ryan.

Moreover, in deciding on the extent to which it is appropriate to investigate a complaint, the High Court noted that the supervisory authority is entitled to weigh factors such as the seriousness or gravity of the alleged infringement; the need to marshal its resources so as to prioritize investigations appropriately; and the need to comply with fair procedures for all sides, including those parties who are the subject of investigation.

Furthermore, the High Court noted that the decision to prioritize the own-volition inquiry is proportionate and well within the margin of appreciation allowed to a supervisory authority, noting that the DPC is engaged in a complex and time-consuming inquiry into the behavioral advertising industry. Therefore, the High Court found that it is entirely proportionate for the DPC to have decided to complete the own-volition inquiry first, before completing its investigation of Jonny Ryan's complaint.

Outcomes

Ultimately, the High Court ruled that the DPC's decision to prioritize the own-volition inquiry is proportionate and well within the margin of appreciation accorded to the supervisory authority under Article 57(1)(f) of the GDPR. Therefore, the application for judicial review was dismissed by the High Court.

You can read the judgment here.

Feedback