Google v Data Protection Commission - 11 October 2024

• Judgment Date: 11 October 2024
• Issuer: High Court
• Decision Date: 11 October 2024
• Year: 2024

THE HIGH COURT

[2024] IEHC 577

[Record No. H.JR.2024/81]

BETWEEN

GOOGLE IRELAND LIMITED

APPLICANT

AND

DATA PROTECTION COMMISSION

RESPONDENT

JUDGMENT of Mr Justice Barr delivered electronically on the 11th day of

October 2024.

Introduction.

1. The applicant is a multinational company that provides an internet search

engine and other facilities to people who have an account with it.

2. The respondent is the statutory body established pursuant to the Data

Protection Act 2018 (hereinafter ‘DPA 2018’), to, inter alia, handle and if thought

appropriate, investigate complaints made by data subjects that the processing of their

personal data infringes their rights under the General Data Protection Regulation (EU)

2016/679 on the protection of natural persons with regard to the processing of

personal data and on the free movement of such data, and repealing Directive

2

95/46/EC (General Data Protection Regulation) (hereinafter ‘GDPR 2016’) and under

DPA 2018.

3. Essentially, this case concerns six complaints that were lodged by consumer

agencies in Norway, Slovenia, Greece, France, Spain and Czechia, on behalf of

people resident in those countries.

4. Each of the complainants made a range of complaints about the process known

as the account creation process, which was completed by all but one of the

complainants, when opening their account with the applicant; whereby their consent

was obtained to the processing by the applicant of their personal data.

5. In the period September 2022 to March 2023, a total of six complaints were

received by the respondent. These complaints had been forwarded by the supervisory

authorities in the countries in which the complaints had been originally lodged. These

supervisory authorities are known as concerned supervisory authorities, (hereinafter

‘CSAs’). The complaints were forwarded to the respondent as the lead supervisory

authority (hereinafter ‘LSA’), due to the fact that the applicant has its registered office

in this jurisdiction.

6. Each of the complaints were in almost identical terms. It is not necessary for

the purpose of this application, to examine the content of the complaints in any detail,

as this application deals with the admissibility of the complaints, rather than their

content.

7. It will suffice to note that each of the complainants complained that the

process leading to the creation of their account, wherein they had to indicate their

preference for various account settings, was unfair in that they alleged that it was

much easier to give consent to the applicant using their personal data, which could be

done by one click on the mouse; rather than choosing the option of managing their

3

own account settings, which required five separate steps and ten individual clicks on

the mouse.

8. It was further alleged that the language used in giving various options to a

person when opening an account was unfair in that it (a) was not transparent in

relation to what use would be made by the applicant of their personal data; (b) was

unclear in relation to what steps could subsequently be taken to alter the account

settings; (c) it engaged what are known as “dark patterns”, whereby wording was used

that influenced or prompted a person to take a particular option, by making that option

appear desirable, while at the same time, making the alternative negative option

appear undesirable, as it was described in unfavourable terms. That is but a very brief

account of the essence of the complaints lodged on behalf of the six complainants.

9. After notifying the applicant of receipt of the complaints, and having provided

the applicant with the written complaints received by the respondent and following a

considerable exchange of correspondence, in the course of which the applicant

provided substantial information in relation to its account creation process and in

relation to the use to which it puts the information that it gleans from the account

holders; the respondent decided on 23 October 2023, to commence an inquiry

pursuant to its powers under DPA 2018. It did that by issuing a notice of

commencement of inquiry (hereinafter ‘notice of commencement’) on that date.

10. By letter dated 30 November 2023, the applicant objected to the

commencement of the inquiry on the basis that the necessary criteria for admissibility

of a complaint had not been met.

11. In particular, the applicant requested that they be provided with the Google

account identifier information in respect of each account, (hereinafter ‘account

identification information’). This is essentially the Gmail address of each