Google has been added to a High Court action where it is alleged the Data Protection Commission (DPC) has failed to fully investigate a complaint about how the internet giant and digital marketing association IAB Europe process personal data.
The case has been brought by Dr Johnny Ryan, a senior fellow of the Irish Council for Civil Liberties (ICCL), regarding what he claims is the DPC's delay in investigating his 2018 complaint regarding the way the two companies process personal data.
The DPC denies that it has delayed processing the complaint.
Last March, Mr Justice Charles Meenan granted Dr Ryan permission to bring his judicial review proceedings against the DPC, where he seeks a declaration that the respondent has failed to carry out an investigation into the complaint with all due diligence within a reasonable time.
He also seeks an order directing the DPC to proceed with the investigation or that part of the complaint not addressed in the inquiry, without delay and wants the case referred to the Court of Justice of the European Union (ECJ).
When the matter was mentioned before the High Court on Tuesday, Rossa Fanning SC for Google's Irish arm, Google Ireland Ltd, said his client wanted to be joined as a notice party to the action.
This was because Google had an “obvious interest” in the outcome of the proceedings.
The judge, after being told that neither Dr Ryan nor the DPC had any objections to Google’s bid to be joined, made the company a notice party to the proceedings.
Commercially sensitive
The judge was also told on Tuesday that issues have arisen between the DPC and Dr Ryan’s legal representatives over the respondent’s concerns that commercially sensitive material may be put before the court.
While there was some disagreement over this issue, the court heard that the parties were discussing ways to try to resolve the matter.
The judge said that the DPC should file a statement of opposition outlining its objection to Dr Ryan’s action in the coming weeks. The court said that any commercially sensitive material in that document and any supporting material could be redacted.
The judge adjourned the case to a date in late June and gave the respective parties liberty to apply to the court should the need arise.
Dr Ryan, who in his capacity with the ICCL raises issues of concern about data protection rights, has sued the DPC over its alleged failure to progress and substantially complete the investigation into his complaint.
His complaint concerns the operation of a system, allegedly used by Google and IAB, called real-time bidding, which underlies the targeting of individual data subjects for online advertising based on their personal data.
The failure to investigate the matter, he claims, is in breach of the requirements of both the 2018 Data Protection Act and the General Data Protection Regulation (GDPR).
Disclosure
In his complaint Dr Ryan raised various concerns including that the bidding systems used by the two firms involves the unauthorised, and potentially unlimited, disclosure and processing of personal data.
His complaint contains several instances where he claims that Google and IAB have breached GDPR. The DPC is the State’s supervisory authority in respect of GDPR and in respect of data controllers whose main establishment is in Ireland.
He also raised issues about the companies’ alleged inability to demonstrate their compliance with the GDPR requirement that personal data be processed lawfully and fairly, or that the processing of personal data be kept to a minimum.
The DPC opened an inquiry into real-time bidding in May 2019, under its own volition, and there had been detailed correspondence between Dr Ryan and the DPC over the matter. However, Dr Ryan claims that his complaint has not been properly or adequately investigated by the commission and has brought High Court judicial review proceedings against the DPC.
