Google. Photo: Bloomberg
The Court of Appeal (CoA) has dismissed a claim that the Data Protection Commission failed to fully investigate a complaint made to it several years ago about an alleged massive data breach by the internet giant Google.
The complaint about Google’s processing of personal data was made by Dr Johnny Ryan, a senior fellow of the Irish Council for Civil Liberties.
He filed his complaint in 2018 regarding a system, allegedly used by Google, called ‘Real Time Bidding’ or (RTB) which underlies the targeting of individual data subjects for online advertising based on their personal data.
Last year Mr Justice Garrett Simons in the High Court dismissed the action on the grounds that the DPC was entitled to conduct its own inquiry into the alleged data breach, which the commission has opted to do, before resuming its investigation into Dr Ryan’s complaint.
That ruling was appealed to the CoA which on Monday upheld the lower court’s findings.
The DPC, represented by Joe Jeffers SC had opposed the appeal.
Giving the CoA’s decision Mr Justice Donald Binchy said that the central ground of the appeal was the High Court erred in determining the DPC’s decision to defer consideration of Dr Ryan’s complaints of breaches GDPR pending completion of the own volition inquiry was lawful.
In particular, it was argued by Dr Ryan that the High Court failed to apply properly the provisions of the GDPR and the relevant judgments of the Courts of Justice of the European Union on issues of data control, the CoA said.
Mr Justice Binchy said that he could “find no error in the conclusion of the High Court judge that the decision to prioritise the Inquiry and defer the handling of the Complaint is proportionate, and well within the margin of appreciation allowed to a supervisory authority.”
All other grounds of the appeal were either deemed to have been not made out or were not pursed, the CoA added.
The complaint was by Dr Ryan, whose role with the ICCL includes raising concerns about data protection.
The DPC, which is the state’s supervisory authority in respect of GDPR (General Data Protection Regulation) opposed Dr Ryan’s action.
Google Ireland was a notice party to the proceedings.