Ryan v Data Protection Commission

• Jurisdiction: Ireland
• Judge: Mr. Justice Binchy
• Judgment Date: 24 June 2024
• Neutral Citation: [2024] IECA 152
• Court: Court of Appeal (Ireland)
• Docket Number: Court Of Appeal Record Number: 2023/282

Between/

Johnny Ryan

Applicant/Appellant

and

Data Protection Commission

Respondent

and

(By Order) Google Ireland Limited

Notice Party

[2024] IECA 152

Noonan J.

Ní Raifeartaigh J.

Binchy J.

Court Of Appeal Record Number: 2023/282

High Court Record Number: 2022/191JR

THE COURT OF APPEAL — UNAPPROVED

Due diligence – Declaratory relief – Order of mandamus – Appellant seeking a declaration that the respondent failed to carry out an investigation into a complaint with all due diligence – Whether the respondent could defer the investigation of one element of the complaint

Facts: The appellant, Mr Ryan, appealed to the Court of Appeal from a decision of the High Court whereby Simons J refused the appellant’s application for a declaration that the respondent, the Data Protection Commission, had failed to carry out an investigation into a complaint lodged by the appellant pursuant to the provisions of article 77 of Regulation (EU) 2016/679 (General Data Protection Regulation) (GDPR) with all due diligence, and further refused the application of the appellant for an order of mandamus directing the respondent to proceed with the investigation of that part of the complaint which the appellant claimed the respondent had refused to handle. The issue that fell for determination was whether it was permissible for the respondent to defer the investigation of one element of a complaint in circumstances where all other elements of the same complaint were the subject of an inquiry – called for by the same complainant – being conducted by the respondent pursuant to s. 110 of the Data Protection Act 2018, the outcome of which (it was said) may render it unnecessary to determine that element of the complaint, the consideration of which the respondent had deferred. There was disagreement between the parties as to the scope of the inquiry upon which the respondent had embarked.

Held by Binchy J that he could find no error in the conclusion of the High Court judge that the decision of the appellant to prioritise the inquiry and defer the handling of the complaint was proportionate, and well within the margin of appreciation allowed to a supervisory authority. Binchy J held that this conclusion disposed of the appellant’s first, and main ground of appeal. As to the appellant’s second ground of appeal, Binchy J noted that it was not pursued at the hearing of the appeal. Binchy J noted that while the third and fourth grounds of appeal were addressed briefly in written submissions, they were not pursued in oral submissions to the Court. Binchy J noted that the fourth ground of appeal was that the High Court erred in finding that the appellant was kept fully informed by the respondent; in his written submissions the appellant contended that this finding flies in the face of the correspondence, which it was submitted shows a lack of specificity and detail in communications from the respondent, and a failure to inform the appellant until December 2021 that the respondent had not been investigating article 5(1)(f) GDPR breaches since at least April 2021, and perhaps earlier. Binchy J held that this ground was not made out, referring to the correspondence exchanged between the parties between 29th May and 7th August 2020. Binchy J held that even if the ground of appeal was made out, it could not result in the granting of the declaratory and injunctive reliefs sought in the proceedings. Binchy J noted that the fifth ground of appeal was not pursued at all.

Binchy J held that the appeal would be dismissed.

Appeal dismissed.

NO REDACTION NEEDED

JUDGMENT ofMr. Justice Binchydelivered on the 24 ^th day of June 2024

1 . This is an appeal from a decision of the High Court whereby Simons J. refused the application of the appellant for a declaration that the respondent has failed to carry out an investigation into a complaint lodged by the appellant pursuant to the provisions of article 77 of Regulation (EU) 2016/679 (General Data Protection Regulation) (“the GDPR”) with all due diligence, and further refused the application of the appellant for an order of mandamus directing the respondent to proceed with the investigation of that part of the complaint which the appellant claims the respondent has refused to handle. While I set out in detail below the circumstances in which the dispute between the parties has arisen, the issue that falls for determination is whether it is permissible for the respondent to defer the investigation of one element of a complaint in circumstances where all other elements of the same complaint are the subject of an inquiry – called for by the same complainant – being conducted by the respondent pursuant to s. 110 of the Data Protection Act, 2018 (the “2018 Act”), the outcome of which (it is said) may render it unnecessary to determine that element of the complaint, the consideration of which the respondent has deferred. In posing the question thus, it is necessary to observe immediately that there is disagreement between the parties as to the scope of the inquiry upon which the respondent has embarked, and this disagreement is explained and considered in detail later in this judgment.

2 . The appellant in these proceedings is a senior fellow with the Irish Council for Civil Liberties. The respondent is the supervisory authority in the State established for the purposes of the GDPR, in accordance with article 51 thereof.

3 . Before proceeding to consider the background to the proceedings, it is useful to identify now the relevant legislative provisions as well as some relevant authorities in which those provisions have been considered, and upon which reliance has been placed by the parties.

Relevant Provisions of the GDPR

4 . Recital 141 of the GDPR provides:-

“Every data subject [defined as an identified or identifiable natural person] should have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, and the right to an effective judicial remedy in accordance with Article 47 of the Charter if the data subject considers that his or her rights under this Regulation are infringed or where the supervisory authority does not act on a complaint, partially or wholly rejects or dismisses a complaint or does not act where such action is necessary to protect the rights of the data subject. The investigation following a complaint should be carried out, subject to judicial review, to the extent that is appropriate in the specific case. The supervisory authority should inform the data subject of the progress and the outcome of the complaint within a reasonable period. ….”

5 .Article 77 of the GDPR provides that every “data subject” shall have the right to lodge a complaint with a supervisory authority in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes the GDPR. The respondent is the supervisory authority in this jurisdiction for the purpose of the GDPR.

6 . Article 78 provides data subjects with the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them. This includes the right to a remedy where a supervisory authority does not handle a complaint, or does not inform the data subject within three months on the progress or outcome of the complaint lodged pursuant to article 77.

7 . Article 57(1)(f) requires the supervisory authority to handle complaints lodged by a data subject and to “ investigate, to the extent appropriate [my emphasis], the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period…”.

8 . Article 5 of the GDPR is entitled “ Principles relating to processing of personal data”. Three provisions of article 5 are relevant for present purposes, those being articles 5(1)(a), (c) and (f). Those provisions provide that personal data shall be:

(a) processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”);

(c) adequate relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”);

(f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (“integrity and confidentiality”)

9 . Article 6 of the GDPR, entitled “ Lawfulness of processing” sets out the circumstances in which the processing of data is deemed lawful by the GDPR. Article 32 of the GDPR, entitled “ Security of processing” addresses the obligation of data controllers and data processers to ensure a level of security of data appropriate to the risks involved as referred to therein.

Relevant Authorities of the CJEU

10 . It has been held (and stated repeatedly) by the Court of Justice of the European Union (the “CJEU”) that supervisory authorities have an obligation to handle complaints with all due diligence. In Case C-311/18, Schrems II, EU:C:2020:559, at para. 112, the CJEU held:-

“Although the supervisory authority must determine which action is appropriate and necessary and take into consideration all the circumstances of the transfer of personal data in question in that determination, the supervisory authority is nevertheless required to execute its responsibility for ensuring that the GDPR is fully enforced with all due diligence.”

11 . At the time that these proceedings came on for hearing before the High Court, there was pending before the CJEU the Joined Cases of C-26/22 and C-64/22 UF and AB v. Land Hessen and Schufa Holding AG, EU:C:2023:222. The High Court judge had available to...