Courts

Court dismisses claim data watchdog failed to investigate alleged breach by Google

Complaint concerning processing of personal data was made by Irish Council for Civil Liberties senior fellow

The Court of Appeal has dismissed a claim that the Data Protection Commission failed to fully investigate a complaint made several years ago about an alleged massive data breach by internet giant Google.
The Court of Appeal has dismissed a claim that the Data Protection Commission failed to fully investigate a complaint made several years ago about an alleged massive data breach by internet giant Google.
Aodhan O'Faolain
Mon Jun 24 2024 - 17:40

The Court of Appeal has dismissed a claim that the Data Protection Commission (DPC) failed to fully investigate a complaint made to it several years ago about an alleged massive data breach by the internet giant Google.

The complaint about Google’s processing of personal data was made by Dr Johnny Ryan, who is a senior fellow of the Irish Council for Civil Liberties (ICCL).

He filed his complaint in 2018 regarding a system, allegedly used by Google, called Real Time Bidding (RTB) which underlies the targeting of individual data subjects for online advertising based on their personal data.

Last year, Mr Justice Garrett Simons in the High Court dismissed the action on the grounds that the DPC was entitled to conduct its own inquiry into the alleged data breach, which the commission has opted to do, before resuming its investigation into Dr Ryan’s complaint.

READ MORE

[ Data watchdog should be notified of Google’s bid to challenge probe, judge says ]

That ruling was appealed to the Court of Appeal, which on Monday upheld the lower court’s findings.

The DPC, represented by Joe Jeffers SC, opposed the appeal.

Giving the court’s decision, Mr Justice Donald Binchy said the central appeal ground was that the High Court erred in determining it was lawful for the DPC to defer consideration of Dr Ryan’s complaints of General Data Protection Regulation breaches pending completion of its own-volition inquiry.

It was argued by Dr Ryan that the High Court failed to properly apply the GDPR and the relevant judgments of the Court of Justice of the European Union on issues of data control, the appeal court said.

Mr Justice Binchy said he could “find no error” in the High Court’s conclusion that the decision to prioritise the inquiry and defer the handling of the complaint was proportionate and well within the margin of appreciation allowed to a supervisory authority.

[ Data Protection Commission defends record after article labelling Republic a ‘corporate crime haven’ ]

All other grounds of the appeal were either deemed to have been not made out or were not pursued, he added.

In September 2018, Dr Ryan filed a complaint to the DPC about RTB systems he claims are used by Google and involve the unauthorised, as well as the potentially unlimited, disclosure and processing of large volumes of personal data to other third parties.

He also raised issues about Google’s alleged inability to demonstrate its compliance with the GDPR requirement that personal data be processed lawfully and fairly.

[ TikTok video revealing access to medical records spurs inquiry into HSE data breaches ]

While the DPC opened its own inquiry into the alleged breach in 2019, Dr Ryan was concerned the issues identified by him were not being considered as part of this probe.

He brought proceedings seeking a declaration from the court that the DPC has failed to carry out an investigation into the complaint with all due diligence within a reasonable time.

Google Ireland was a notice party to the proceedings.