A European digital rights advocacy group wants the High Court to direct Ireland’s data-protection watchdog to fully investigate its complaints about social media giant Meta’s handling of users’ data.
The NOYB European Centre for Digital Rights complained that Meta’s platforms WhatsApp, Instagram and Facebook each purported to rely on users’ consent to process personal data, including sensitive personal data, under article 6(1)(b) of the General Data Protection Regulation (GDPR).
The NOYB centre says it complained in May 2018 to national data supervisory authorities in Austria, Belgium and Germany over data processing at Facebook, Instagram and WhatsApp. It argued that article 6(1)(b) of the GDPR cannot be a valid legal basis in this case and certain processing actions could not be legitimised.
The complaints, says the NOYB group, were then transmitted to Ireland’s Data Protection Commission (DPC) as the lead supervisory authority for data holders established in this State, which includes Meta.
The DPC delivered draft decisions finding each of the Meta platforms could rely on the GDPR article.
The NOYB group says several concerned supervisory authorities in other European Union countries referred the matter to the European Data Protection Board, which instructed the DPC to alter its draft decisions.
The DPC then reversed its earlier findings and held that Facebook and Instagram were not allowed to rely on article 6(1)(b) to process the complainant’s personal data for the purpose of behavioural advertising. WhatsApp, it said, could not rely on this article to process the data for improvement and security under its terms of service.
The NOYB group claims that, notwithstanding the DPC’s delivery of decisions on the complaints, it has “wholly failed” to consider the effects of the reversal of its position and its obligation to investigate discrete processing actions complained of. It alleges the DPC did not address, either in whole or in part, nine discrete issues raised about Facebook, 10 issues concerning Instagram and seven issues raised about WhatsApp.
The NOYB centre is now asking the High Court to declare that the DPC has failed to carry out its investigation within a reasonable time frame, as required by the GDPR and/or the Data Protection Act of 2018. These include further complaints relating to other advertising.
It also wants the court to direct the DPC to complete its investigation of the complaints with “all due diligence”.
On Monday, the NOYB group’s lawyers said the DPC is obliged to investigate the complaints “to the extent appropriate”. The DPC maintains that this phrase relates to its assessment of what is appropriate, while the NOYB centre believes this is an objective test, the court heard.
While only the NOYB group was represented in court and aware of the application, Mr Justice Charles Meenan granted permission for the judicial review action to be brought.
The judge said he was satisfied there were “arguable” legal grounds in the case, which was adjourned.
