The Data Protection Commission (DPC) rejects claims it has failed to fully investigate a complaint made to it five years ago about an alleged massive data breach by the internet giant Google, the High Court was told.
The complaint about Google’s processing of personal data was made by Dr Johnny Ryan, who is a senior fellow of the Irish Council for Civil Liberties.
Dr Ryan says his complaint concerns the operation of a system, allegedly used by Google, called Real Time Bidding (RTB) which underlies the targeting of individual data subjects for online advertising based on their personal data.
The failure to investigate the matter breaches the requirements of both the 2018 Data Protection Act and the General Data Protection Regulation (GDPR), he claims.
The DPC, which is the State’s data watchdog, opposes Dr Ryan’s application.
It denies all of his claims, including that it has delayed investigating issues raised in what it said were submissions from the plaintiff in 2018.
The DPC, represented by Joe Jeffers SC, says it opened an inquiry on its own volition in 2019, which it says is ongoing.
It also argues the proceedings have been brought outside of the legal time frame allowed to bring a judicial review and that arguments raised in the proceedings are premature.
It further claims its decisions on the scope of an inquiry are within the sole discretion of the DPC and are not amenable to judicial review proceedings.
Dr Ryan, represented by James Doherty SC and Sean O’Sullivan BL, rejects the DPC’s arguments.
The action is before Mr Justice Garrett Simons.
Google is a notice party to the proceedings, but its lawyers told the court it does not intend to actively participate in the hearing.
Dr Ryan’s concerns include that the RTB systems used by Google allegedly involve unauthorised and potentially unlimited disclosure and processing of large volumes of personal data to other third parties.
His action seeks a declaration from the court that the DPC has failed to carry out an investigation into his complaint with all due diligence within a reasonable time.
He also seeks an order directing the DPC to proceed with the investigation without delay.
Opening the case, Mr Doherty said Dr Ryan’s complaint was made almost five years ago and should not have to wait until 2024 or 2025 for the matter to be properly progressed.
A similar complaint regarding an alleged data breach was made by his client about another data controller, IAB Europe, which had been considered and processed by the Belgium Data Protection Authority, counsel added.
In reply to a question from the judge, Mr Doherty said the court was not being asked to “micromanage” the DPC’s handling of the complaint.
In its statement of opposition, the DPC denies Dr Ryan has been prejudiced by the manner in which it has conducted the inquiry.
The hearing continues.
