A senior fellow at the Irish Council for Civil Liberties (ICCL) is set to take the Data Protection Commissioner (DPR) to court next week, in a case alleging that the data watchdog failed to fully investigate a complaint about how internet giant Google and digital marketing association Interactive Advertising Bureau (IAB) process personal data.
The case set to be heard in the High Court over two days starting on Thursday July 27th has been brought by Dr Johnny Ryan, regarding what he claims is the DPC’s delay in investigating his 2018 complaint to the commissioner about the “real-time bidding” (RTB) online advertising system used by Google and IAB.
Mr Ryan and the ICCL are also seeking to compel the DPC to investigate the RTB system, which the human rights campaigning organisation has called the “biggest data breach ever recorded”.
The RTB system determines the personalised ads which appear for internet users. Tracking firms representing advertisers receive information from Google about individuals browsing the web or using apps, and bid in auctions for advertising slots to show them personalised ads.
The ICCL have said that this auction process is a “vast and unending data breach”, as Google sends information about what people are doing online to over a thousand tracking companies, with “no control over what any of these companies then do with the information”.
In 2019 the DPC launched an inquiry into Google’s RTB system, citing submissions previously made by Dr Ryan. However, the ICCL has said this inquiry excludes Dr Ryan’s primary concern regarding a lack of security for personal data.
Speaking on Friday, Dr Ryan said that the DPC’s “half-decade refusal to investigate Google’s massive data breach is inexplicable”.
“We are asking the Irish High Court to order the DPC to finally do its job. Having worked in the RTB industry, I know how dangerous these data are when put in the wrong hands. Everyone in Europe is at risk when the DPC fails to protect our data rights,” he said.
The DPC denies that it has delayed processing Mr Ryan’s complaint.
A spokesman for the DPC said that it would be “inappropriate to comment on matters that are before the courts”, but that the DPC “will be strongly defending its position in this case”.
This story was updated on July 22 to correct the name of Interactive Advertising Bureau in the first paragraph.
