Court backs Data Protection Commission over Google inquiry
In a recent development, the High Court dismissed the claim that the Data Protection Commission (DPC) failed to fully investigate a complaint made five years ago about an alleged data breach by Google. The complaint was raised by Dr Johnny Ryan, a senior fellow of the Irish Council for Civil Liberties (ICCL) and focused on Google’s Real Time Bidding system, which is used for online advertising based on personal data. Dr Ryan believed there was a lack of investigation into the matter, which he argued, breaches the 2018 Data Protection Act and GDPR.
The DPC, which is the State’s supervisory authority in respect of GDPR and data controllers whose main establishments are in Ireland, had opened its inquiry into the breach. However, Dr Ryan was concerned that issues he outlined were not being considered in the DPC’s own investigation. Despite this, the DPC opposed Dr Ryan’s application, denying all claims against it and defending its decision to conduct its own inquiry before resuming the investigation into Dr Ryan’s complaint.
The Commission argued that its approach would lead to faster and more effective handling of the complaint. It also reasoned that the proceedings were outside of the legal time frame for a judicial review and deemed any arguments premature. The DPC asserted that its decision to open an inquiry was within its discretion and not subject to judicial review proceedings.
Mr Justice Simons supported the DPC’s decision as “proportionate” and “within the margin of appreciation allowed to it” under GDPR. He also mentioned that given the complexity of an inquiry into the advertising industry, it was sensible for the DPC to complete its own inquiry first before investigating Dr Ryan’s complaint. In light of this ruling, other similar cases could be affected in terms of how they’re investigated by the DPC.
Source: Court backs Data Protection Commission over Google inquiry – The Irish Times
