Ryan v Data Protection Commission

• Jurisdiction: Ireland
• Judge: Mr. Justice Garrett Simons
• Judgment Date: 28 August 2023
• Neutral Citation: [2023] IEHC 511
• Court: High Court
• Docket Number: 2022 No. 191 JR

Between

Johnny Ryan

Applicant

and

Data Protection Commission

Respondent

Google Ireland Ltd

Notice Party

[2023] IEHC 511

2022 No. 191 JR

THE HIGH COURT

JUDICIAL REVIEW

Judicial review – Proportionality – EU General Data Protection Regulation – Applicant challenging the manner in which the respondent handled a complaint – Whether it was proportionate for the respondent to have decided to complete an own-volition inquiry before resuming its investigation of the applicant’s complaint

Facts: The applicant, Mr Ryan, challenged the manner in which the respondent, the Data Protection Commission (the Commission), handled a complaint. The complaint had been lodged pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the General Data Protection Regulation) and the Data Protection Act 2018. The complaint related to data processing operations being carried out by the notice party, Google Ireland Ltd, for the purposes of targeted advertising facilitated through the Google Authorized Buyers Ad Exchange. The Commission had indicated that it intended to progress an own-volition inquiry to completion before resuming its consideration of the complaint. This was done in circumstances where the Commission was of the view that there was a “clear overlap” between the issues raised in the complaint and those to be considered in the own-volition inquiry. It was said that this approach would ultimately facilitate a more expeditious and effective handling of the complaint. The applicant, who was the complainant, objected to that approach. It was submitted that the principal issue of concern identified by him in his complaint was not being considered as part of the own-volition inquiry. It was further submitted that the Commission was obliged to examine fully that aspect of his complaint within a reasonable period of time with all due diligence. The applicant contended that it was not permissible for the Commission to defer consideration of that issue pending the conclusion of the own-volition inquiry. The judicial review proceedings were heard before the High Court (Simons J) over two days, commencing on 27 July 2023. Judgment was reserved until 28 August 2023.

Held by Simons J that the Commission’s decision to prioritise the own-volition inquiry was proportionate and well within the margin of appreciation allowed to it qua supervisory authority under Article 57(1)(f) of the General Data Protection Regulation. Simons J found that the Commission was engaged in a complex and time-consuming inquiry into the behavioural advertising industry. Simons J held that it was entirely proportionate for the Commission to have decided to complete the own-volition inquiry first, before resuming its investigation of the applicant’s complaint. Accordingly, Simons J dismissed the application for judicial review.

Simons J’s provisional view was that the Commission, having been “entirely successful” in opposing the judicial review proceedings, was entitled to recover its legal costs as against the applicant in accordance with the default position under s. 169 of the Legal Services Regulation Act 2015. Simons J held that the notice party should bear its own costs.

Application refused.

Appearances

James Doherty SC and Sean O'Sullivan for the applicant instructed by Ahern Rudden Quigley

Brian Kennelly SC, Joe Jeffers SC and Mark William Murphy for the respondent instructed by Philip Lee LLP

Bairbre O'Neill SC and Patrick Mair for the notice party instructed by A & L Goodbody LLP

JUDGMENT of Mr. Justice Garrett Simons delivered on 28 August 2023

INTRODUCTION

1 This judgment is delivered in respect of a challenge to the manner in which the Data Protection Commission is handling a complaint. The complaint has been lodged pursuant to the EU General Data Protection Regulation and the Data Protection Act 2018. The complaint relates to data processing operations being carried out by Google Ireland Ltd for the purposes of targeted advertising facilitated through the Google Authorized Buyers Ad Exchange.

2 The Commission has indicated that it intends to progress an own-volition inquiry to completion before resuming its consideration of the complaint. This is done in circumstances where the Commission is of the view that there is a “ clear overlap” between the issues raised in the complaint and those to be considered in the own-volition inquiry. It is said that this approach will ultimately facilitate a more expeditious and effective handling of the complaint.

3 The Applicant, who is the complainant, objects to this approach. In brief, it is submitted that the principal issue of concern identified by him in his complaint is not being considered as part of the own-volition inquiry. It is further submitted that the Commission is obliged to examine fully this aspect of his complaint within a reasonable period of time with all due diligence. The Applicant contends that it is not permissible for the Commission to defer consideration of this issue pending the conclusion of the own-volition inquiry.

4 The judicial review proceedings were heard before me over two days, commencing on 27 July 2023. Judgment was reserved until today's date.

LEGISLATIVE FRAMEWORK

5 The resolution of the dispute between the parties necessitates the consideration of two legislative instruments, as follows. First, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“ General Data Protection Regulation” or “ GDPR”). Secondly, the Data Protection Act 2018 (“ DPA 2018”). It should be explained that the GDPR, as an EU Regulation rather than an EU Directive, is directly applicable in the domestic legal order. The purpose of the DPA 2018 is thus to supplement the GDPR rather than to transpose it into the domestic legal order.

6 “ Personal data” is defined for the purposes of the GDPR as any information relating to an identified or identifiable natural person. Such a person is referred to as a “ data subject” in this context. An “ identifiable natural person” is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

7 Article 77 of the GDPR confers a right, upon every data subject, to lodge a complaint if the data subject considers that the processing of personal data relating to him or her infringes the GDPR. The complaint may be lodged with a single supervisory authority in the Member State of his or her habitual residence, place of work or place of the alleged infringement.

8 The supervisory authority's obligations in respect of a complaint are described as follows under Article 57(1)(f) of the GDPR:

“Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory:

[…]

(f) handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80, and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary;”

9 Recital 141 of the GDPR states that the investigation following a complaint should be carried out, subject to judicial review, to the extent that is appropriate in the specific case.

10 The Data Protection Commission is designated as the national supervisory authority under the Data Protection Act 2018. Section 108(2) of the DPA 2018 provides as follows:

“(2) Where the Commission is the competent supervisory authority in respect of a complaint, it shall—

• (a) handle the complaint in accordance with this Part, and

• (b) inform the complainant, within 3 months from the date on which the complaint is received by the Commission, on the progress or outcome of the complaint.”

11 Elaboration upon what is involved in handling a complaint is provided under Section 109(1) of the DPA 2018 as follows:

“(1) For the purposes of section 108(2)(a), the Commission shall examine the complaint and shall, in accordance with this section, take such action in respect of it as the Commission, having regard to the nature and circumstances of the complaint, considers appropriate.”

12 In the case of a complaint in respect of which the Commission is the lead supervisory authority, the procedure prescribed under Section 113 of the Data Protection Act 2018 must be followed. This gives effect to the procedure prescribed under Article 60 of the GDPR. This involves, inter alia, the preparation of a draft decision and its submission to the other supervisory authorities concerned for their opinion.

13 The Commission's jurisdiction to conduct an own-volition inquiry is conferred by Section 110(1) of the Data Protection Act 2018 as follows:

“(1) The Commission, whether for the purpose of section 109(5)(e), section 113(2), or of its own volition, may, in order to ascertain whether an infringement has occurred or is occurring, cause such inquiry as it thinks fit to be conducted for that purpose.”

14 As appears, an inquiry may be commenced for the purpose of the investigation of a complaint or by the Commission of its own volition. In the present proceedings, the inquiry was commenced as an own-volition inquiry. The Applicant makes no objection to the scope of the inquiry. Rather, his objection is that the Commission is...