Veri Koruma Komisyonunun Önceliklendirme Kararının Yargısal Denetimi

APPROVED                                                             [2023] IEHC 511

 

 

 

THE HIGH COURT

JUDICIAL REVIEW

 

 

2022 No. 191 JR

 

BETWEEN

 

JOHNNY RYAN

 

 

APPLICANT

 

 

AND

 

 

DATA PROTECTION COMMISSION

 

 

RESPONDENT

 

 

 

GOOGLE IRELAND LTD

 

NOTICE PARTY

 

 

 

 

JUDGMENT of Mr. Justice Garrett Simons delivered on 28 August 2023

 

 

Introduction

1.             This judgment is delivered in respect of a challenge to the manner in which the Data Protection Commission is handling a complaint.  The complaint has been lodged pursuant to the EU General Data Protection Regulation and the Data Protection Act 2018.  The complaint relates to data processing operations being carried out by Google Ireland Ltd for the purposes of targeted advertising facilitated through the Google Authorized Buyers Ad Exchange.

2.             The Commission has indicated that it intends to progress an own-volition inquiry to completion before resuming its consideration of the complaint.  This is done in circumstances where the Commission is of the view that there is a “clear overlap” between the issues raised in the complaint and those to be considered in the own-volition inquiry.  It is said that this approach will ultimately facilitate a more expeditious and effective handling of the complaint.

3.             The Applicant, who is the complainant, objects to this approach.  In brief, it is submitted that the principal issue of concern identified by him in his complaint is not being considered as part of the own-volition inquiry.  It is further submitted that the Commission is obliged to examine fully this aspect of his complaint within a reasonable period of time with all due diligence.  The Applicant contends that it is not permissible for the Commission to defer consideration of this issue pending the conclusion of the own-volition inquiry.

4.             The judicial review proceedings were heard before me over two days, commencing on 27 July 2023.  Judgment was reserved until today’s date.

 

 

Legislative framework

5.             The resolution of the dispute between the parties necessitates the consideration of two legislative instruments, as follows.  First, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“General Data Protection Regulation” or “GDPR”).  Secondly, the Data Protection Act 2018 (“DPA 2018”).  It should be explained that the GDPR, as an EU Regulation rather than an EU Directive, is directly applicable in the domestic legal order.  The purpose of the DPA 2018 is thus to supplement the GDPR rather than to transpose it into the domestic legal order.

6.             “Personal data” is defined for the purposes of the GDPR as any information relating to an identified or identifiable natural person.  Such a person is referred to as a “data subject” in this context.  An “identifiable natural person” is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

7.             Article 77 of the GDPR confers a right, upon every data subject, to lodge a complaint if the data subject considers that the processing of personal data relating to him or her infringes the GDPR.  The complaint may be lodged with a single supervisory authority in the Member State of his or her habitual residence, place of work or place of the alleged infringement.

8.             The supervisory authority’s obligations in respect of a complaint are described as follows under Article 57(1)(f) of the GDPR:

“Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory:

 

[…]

 

(f)         handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80, and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary;”

 

9.             Recital 141 of the GDPR states that the investigation following a complaint should be carried out, subject to judicial review, to the extent that is appropriate in the specific case. 

10.         The Data Protection Commission is designated as the national supervisory authority under the Data Protection Act 2018.  Section 108(2) of the DPA 2018 provides as follows:

“(2)        Where the Commission is the competent supervisory authority in respect of a complaint, it shall—

 

(a)        handle the complaint in accordance with this Part, and

 

(b)        inform the complainant, within 3 months from the date on which the complaint is received by the Commission, on the progress or outcome of the complaint.”

 

11.         Elaboration upon what is involved in handling a complaint is provided under Section 109(1) of the DPA 2018 as follows:

“(1)        For the purposes of section 108(2)(a), the Commission shall examine the complaint and shall, in accordance with this section, take such action in respect of it as the Commission, having regard to the nature and circumstances of the complaint, considers appropriate.”

 

12.         In the case of a complaint in respect of which the Commission is the lead supervisory authority, the procedure prescribed under Section 113 of the Data Protection Act 2018 must be followed.  This gives effect to the procedure prescribed under Article 60 of the GDPR.  This involves, inter alia, the preparation of a draft decision and its submission to the other supervisory authorities concerned for their opinion. 

13.         The Commission’s jurisdiction to conduct an own-volition inquiry is conferred by Section 110(1) of the Data Protection Act 2018 as follows:

“(1)        The Commission, whether for the purpose of section 109(5)(e), section 113(2), or of its own volition, may, in order to ascertain whether an infringement has occurred or is occurring, cause such inquiry as it thinks fit to be conducted for that purpose.”

 

14.         As appears, an inquiry may be commenced for the purpose of the investigation of a complaint or by the Commission of its own volition.  In the present proceedings, the inquiry was commenced as an own-volition inquiry.  The Applicant makes no objection to the scope of the inquiry.  Rather, his objection is that the Commission is obliged to investigate fully, in parallel to the own-volition inquiry, those aspects of his complaint which do not overlap with the own-volition inquiry. 

15.         Article 78 of the GDPR provides that a data subject has the right to an effective judicial remedy against a supervisory authority:

“1.          Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.

 

2.          Without prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to an effective judicial remedy where the supervisory authority which is competent pursuant to Articles 55 and 56 does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged pursuant to Article 77.

 

3.          Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established.

 

4.          Where proceedings are brought against a decision of a supervisory authority which was preceded by an opinion or a decision of the Board in the consistency mechanism, the supervisory authority shall forward that opinion or decision to the court.”

 

16.         As appears, the right to an effective judicial remedy is not confined to circumstances where the supervisory authority has made a “legally binding decision” but also extends to circumstances where the supervisory authority does not “handle” a complaint.  Some guidance as to the extent of the availability of the remedy is to be found in Recital 141 of the GDPR: the right to an effective judicial remedy applies, inter alia, where “the supervisory authority does not act on a complaint, partially or wholly rejects or dismisses a complaint”.

17.         As a matter of domestic law, the procedural route to be followed in order to avail of the “effective judicial remedy” differs depending on the nature of the act or decision under challenge.  If the challenge is to a “legally binding decision” of the Commission on a complaint, then there is a statutory right of appeal provided for under sub-sections 150(5) and (6) of the Data Protection Act 2018.  The Circuit Court and the High Court enjoy concurrent jurisdiction to hear and determine such an appeal.  The court hearing an appeal has jurisdiction to (a) annul the decision concerned; (b) substitute its own determination for the decision; or (c) dismiss the appeal. 

18.         If, conversely, the act being challenged is the (alleged) failure of the Commission to handle a complaint, then there is a right to apply to court for an order directing the Commission to comply with its obligation to handle the complaint in accordance with Part 6 of the Data Protection Act 2018.  This right to apply to court is provided for under sub-sections 150(7) and (8) of the Act.  Again, the Circuit Court and the High Court enjoy concurrent jurisdiction to hear and determine such an application.

19.         For reasons which have not been explained, the Applicant has brought these proceedings by way of an application for judicial review pursuant to the High Court’s inherent jurisdiction, rather than by way of an application pursuant to sub-section 150(7) and (8) of the Data Protection Act 2018.  It is correct to say that the High Court, as part of its inherent judicial review jurisdiction, enjoys a supervisory jurisdiction over statutory bodies such as the Commission.  However, this inherent jurisdiction should not normally be invoked in circumstances where there is a specific statutory remedy available in respect of the act or decision complained of. 

20.         In circumstances where the Commission has not raised any objection in this regard, I propose to overlook any irregularity in the form of the present proceedings.  This is because, even if the statutory procedure under sub-sections 150(7) and (8) of the Data Protection Act 2018 had been invoked, it would still have been open to the Applicant to bring the matter before the High Court at first instance rather than before the Circuit Court: the two courts enjoy concurrent jurisdiction.  Thus the procedural irregularity has not resulted in the matter coming before the “wrong” court.  The choice of venue may, however, be relevant to the allocation of legal costs by reference to Section 17 of the Courts Act 1981.

21.         An example of an act or decision which is properly subject to the High Court’s inherent jurisdiction is provided by Facebook Ireland Ltd v. Data Protection Commission [2021] IEHC 336.  There, the Commission had commenced an own-volition inquiry and had issued what was described as a “preliminary draft decision”.  Whereas there is a statutory right of appeal against a legally binding decision reached by the Commission, pursuant to Section 111, at the conclusion of an own-volition inquiry, this right of appeal does not extend to earlier procedural decisions.  The High Court (Barniville J.) held that both of the impugned acts of the Commission were amenable to judicial review.  Whereas neither act constituted a “legally binding decision” such as to trigger a statutory appeal, the High Court was nevertheless satisfied that the acts did have legal consequences in that the Commission’s compulsory powers of investigation became exercisable.  The acts were, therefore, amenable to the High Court’s supervisory jurisdiction by way of judicial review.

 

 

Case law from the CJEU

22.         The Court of Justice of the European Union (“CJEU”) has held that the national supervisory authority must handle a complaint with all due diligence: Case C‑311/18, Schrems II, EU:C:2020:559 (at paragraphs 100 to 112):

“Article 78(1) and (2) of the GDPR recognises the right of each person to an effective judicial remedy, in particular, where the supervisory authority fails to deal with his or her complaint.  Recital 141 of that regulation also refers to that ‘right to an effective judicial remedy in accordance with Article 47 of the Charter’ in circumstances where that supervisory authority ‘does not act where such action is necessary to protect the rights of the data subject’.

 

In order to handle complaints lodged, Article 58(1) of the GDPR confers extensive investigative powers on each supervisory authority.  If a supervisory authority takes the view, following an investigation, that a data subject whose personal data have been transferred to a third country is not afforded an adequate level of protection in that country, it is required, under EU law, to take appropriate action in order to remedy any findings of inadequacy, irrespective of the reason for, or nature of, that inadequacy.  To that effect, Article 58(2) of that regulation lists the various corrective powers which the supervisory authority may adopt.

 

Although the supervisory authority must determine which action is appropriate and necessary and take into consideration all the circumstances of the transfer of personal data in question in that determination, the supervisory authority is nevertheless required to execute its responsibility for ensuring that the GDPR is fully enforced with all due diligence.”

 

23.         The extent of the national supervisory authority’s obligations has been considered, most recently, in the Advocate General’s opinion in Joined Cases C‑26/22 and C-64/22, UF v. Land Hessen, EU:C:2023:222.  (Counsel handed in an informal translation of the opinion at the hearing before me, but the official English language version has since become available). 

24.         This opinion is dated 16 March 2023 and was delivered in the context of a reference for a preliminary ruling pursuant to Article 267 TFEU.  The reference was made by Verwaltungsgericht Wiesbaden (Germany).  Relevantly, the referring court sought guidance from the CJEU as to the standard of judicial review to be applied in the case of a “legally binding decision” of a supervisory authority.  The referring court posited two potential standards as follows:

(a)               Judicial review would be limited to the question of whether the supervisory authority has handled the complaint, investigated the subject matter of the complaint to the extent appropriate and informed the complainant of the outcome of the investigation.

(b)              Judicial review would be a full substantive review by the court, whereby, in individual cases the supervisory authority may also be obliged by the court to take a specific measure within the meaning of Article 58 of the GDPR.

25.         Advocate General Pikamäe concluded that a remedy can be “effective” within the meaning of Article 47 of the Charter of Fundamental Rights of the European Union and Article 78(1) of the GDPR only if the national court having jurisdiction has the power and is under an obligation to submit the supervisory authority’s decision on the merits to a full judicial review in order to determine whether the supervisory authority has correctly applied the GDPR.

26.         In the course of his opinion, the Advocate General made a number of observations in respect of the provisions of Article 57(1)(f) of the GDPR.  The Advocate General stated that the national supervisory authority has a binding obligation to handle complaints lodged by data subjects with all due diligence that is appropriate in the specific case.  Nevertheless, the supervisory authority enjoys a margin of assessment in examining those complaints and a degree of latitude in the choice of the appropriate means to carry out its tasks.  See paragraphs 38 to 41 of the opinion as follows:

“The Court has ruled that under that provision ‘each supervisory authority is required on its territory to handle complaints which, in accordance with Article 77(1) of [the GDPR], any data subject is entitled to lodge where that data subject considers that the processing of his or her personal data infringes the regulation, and is required to examine the nature of that complaint as necessary’.  It should be pointed out in this connection that the Court has underlined the supervisory authority’s obligation to ‘handle such a complaint with all due diligence’ in order to ensure compliance with the provisions of the GDPR.  It should also be noted that recital 141 of the GDPR states that ‘the investigation following a complaint should be carried out … to the extent that is appropriate in the specific case’ (italicized by me).

 

All these factors suggest that the supervisory authority has a binding obligation to handle complaints lodged by data subjects with all due diligence that is appropriate in the specific case.  In so far as any infringement of the GDPR is, in principle, capable of constituting an infringement of fundamental rights, it would seem to be incompatible with the system established by that regulation to allow the supervisory authority discretion as to whether or not to handle complaints.  Such an approach would undermine the crucial role conferred on it by the GDPR, which is to ensure compliance with the rules on the protection of personal data, and would therefore run counter to the objectives pursued by the EU legislature.  Ultimately, it should be borne in mind that complaints are an important source of information for the supervisory authority, enabling it to identify infringements.

 

This interpretation is all the more convincing because Article 57(1)(f) of the GDPR imposes on the supervisory authority a number of requirements in connection with the handling of such a complaint, namely the obligation to investigate, to the extent appropriate, the subject matter of the complaint and to inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary. Additionally, there is the obligation under Article 77(2) of the GDPR to inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78 of the GDPR.  All these requirements, coming under the concept of ‘good administration’ which found expression in Article 41 of the Charter specifically with regard to the activities of the institutions and bodies of the European Union, are intended to strengthen the complaints procedure in order to make it a genuine administrative remedy.

 

Although the supervisory authority, as guarantor of compliance with the provisions of the GDPR, is required to handle complaints lodged with it, several factors militate in favour of an interpretation to the effect that it enjoys a margin of assessment in examining those complaints and a degree of latitude in the choice of the appropriate means to carry out its tasks.  Advocate General Saugmandsgaard Øe has noted that Article 58(1) of the GDPR ‘confers on the supervisory authorities … significant investigative powers’ and that they have, under Article 58(2) of that regulation, ‘a wide range of means … of carrying out the task entrusted to [them]’, referring in this connection to the various powers to adopt corrective measures listed in that provision.  It was then stated that, although the competent supervisory authority ‘is required to carry out in full the supervisory task entrusted to it’, ‘the choice of the most effective means is a matter for [its] discretion … having regard to all the circumstances … at issue’.  I can only concur with this interpretation.”

 

*Footnotes omitted

 

27.         Counsel on behalf of the Applicant has suggested that it might be appropriate for this court to defer delivering its judgment in these judicial review proceedings until such time as the CJEU has delivered its ruling in UF v. Land Hessen.  As of yet, no date has been scheduled for that ruling.

28.         I have decided that it is preferable that I deliver my judgment promptly.  First, it is undesirable that there should be unnecessary delay in determining proceedings which themselves criticise the Commission for delay.  It is preferable that the judicial review proceedings be resolved now, and that the Commission be allowed to concentrate its energies on completing the own-volition inquiry and the complaint thereafter.  Secondly, the ruling of the CJEU is unlikely to address, in as much detail as the Advocate General has done, the nature of a national supervisory authority’s obligation to handle and investigate complaints.  This is because the questions which have been referred to the CJEU are directed to the standard of review applicable to a “legally binding decision” on a complaint, i.e. the decision at the conclusion of the complaint process.  The CJEU is likely to confine its consideration to this specific issue, rather than engage in a wider ranging discussion of the type provided by the Advocate General.  Put shortly, it is unlikely that the ruling of the CJEU in UF v. Land Hessen will be directly relevant to the issues before me.

 

 

The Applicant’s argument

29.         The Applicant submits that there is an obligation, as a matter of EU law, on the Commission qua supervisory authority to proceed with the handling of a complaint with all due diligence.  This obligation is said to entail a duty to investigate fully any complaint that the individual’s data protection rights have been infringed.  It is said that the Commission is under a duty to take action on a complaint and is not entitled to defer investigation.  On this argument, not only is the Commission precluded from deferring consideration of a complaint pending the completion of an inquiry, the Commission would not even be allowed to determine individual issues within a complaint on a modularised or sequenced basis. 

30.         The Applicant further submits that the Commission’s procedural decision to defer consideration of the complaint pending the completion of the own-volition inquiry is unlawful.  This procedural decision is said to have had the consequence that one of the core issues raised by the Applicant in his complaint, namely that his personal data is being processed in a manner that does not ensure appropriate security of the data in breach of Article 5(1)(f) of the GDPR, is not currently being investigated.  This issue is summarised as follows in the notification of the complaint sent to Google Ireland Ltd on 29 April 2020:

“The Grounds of Complaint allege non-compliance with Article 5(1)(f) GDPR on the basis that the Authorized Buyer Guidelines do not provide adequate “integrity and confidentiality” over personal data, and, in particular, do not (i) require notification to data subjects of the dissemination of their data or of any intention or decision to broadcast their data to every recipient; (ii) afford individuals an opportunity to make representations to vendors / recipients of data in respect of how their personal data may be used; (iii) grant a formal right to data subjects to object to the use of their data by those individual third parties; or (iv) provide for any, or any sufficient, control to prevent unlawful and / or unauthorised further usage.”

 

31.         This issue is not being specifically investigated as part of the own-volition inquiry.  As I understand the Applicant’s position, he accepts that it would have been lawful for the Commission to hive off all issues raised in a complaint to an inquiry and to defer the investigation of the complaint pending the completion of such an exhaustive inquiry.  His objection only arises in circumstances where the “integrity and confidentiality” issue is not being considered as part of the own-volition inquiry.  The Commission is said to be under an obligation to investigate this aspect of his complaint now, i.e. in parallel with the own-volition inquiry.  In particular, it is said, rhetorically, that if the Commission is deferring dealing with the issue raised by the complaint under Article 5(1)(f) to a future point of time, it cannot, by definition, be “handling” the complaint with all due diligence.

32.         It should be explained that the Applicant does not challenge the Commission’s decision as to the scope of the own-volition inquiry.  Nor does the Applicant challenge the pace of the progression of the own-volition inquiry.  Rather, the challenge is directed exclusively to the procedural decision to defer consideration of the Applicant’s complaint pending the completion of the own-volition inquiry.

 

 

Discussion and decision

33.         The absolutist position advocated for by the Applicant is too extreme.  It is incorrect to say that a supervisory authority cannot defer consideration of a complaint pending the completion of related investigations or inquiries.  This is especially so where, as in the present case, the data processing operations the subject of the complaint are under active investigation in the own-volition inquiry, albeit not by reference to all of the legal heads asserted by the Applicant.

34.         It is apparent from the language of the GDPR that a margin of appreciation is afforded to a supervisory authority.  In particular, the obligation to investigate a complaint is couched in qualified terms, i.e. to investigate, to the extent appropriate, the subject matter of the complaint.  As observed by Advocate General Pikamäe in the passages from UF v. Land Hessen cited earlier, the supervisory authority enjoys a margin of assessment in examining complaints and a degree of latitude in the choice of the appropriate means to carry out its tasks.  This must include discretion as to the sequencing of investigations and inquiries.  The extent of the investigation which is appropriate in the case of a particular complaint will often depend on the outcome of related inquiries and investigations which are already ongoing as of the date the complaint is lodged. 

35.         In deciding on the extent to which it is appropriate to investigate a complaint, the supervisory authority is entitled to weigh factors such as, inter alia, the seriousness or gravity of the alleged infringement; the need to marshal its resources so as to prioritise investigations appropriately; and the need to comply with fair procedures for all sides, including those parties who are the subject of investigation.  On this last point, the High Court (Barniville J.) summarised the position as follows in Facebook Ireland Ltd v. Data Protection Commission [2021] IEHC 336 (at paragraph 263):

“It is clear from the GDPR and from the judgment of the CJEU in Schrems II that it is necessary for the supervisory authority to balance and attempt to reconcile the right to be heard and to fair procedures on the part of those who are the subject of an investigation or inquiry conducted by a supervisory authority against the obligations on the supervisory authority to act within a reasonable time and with due diligence in determining whether the GDPR has been infringed and in determining what, if any, corrective powers should be exercised.  That can be a difficult balance for the supervisory authority and, in this case, the DPC, to achieve, but both rights and obligations must be properly taken into account by the supervisory authority in terms of the procedures which it applies.  One does not necessarily trump the other and individual assessment will be required to be made by the supervisory authority in each case.”

 

36.         A complainant has the right to an “effective judicial remedy” where the supervisory authority does not “handle” their complaint.  Thus, the procedural decision of the Commission to defer consideration of the Applicant’s complaint pending the completion of its own-volition inquiry is amenable to review by a court.  The appropriate remedy is to make an application, pursuant to sub‑sections 150(7) and (8) of the Data Protection Act 2018, for an order directing the Commission to comply with its obligation to handle the complaint in accordance with Part 6 of the Act.  Here, the application has been brought, instead, by way of judicial review pursuant to the High Court’s inherent jurisdiction.  Nevertheless, the standard of review to be applied by the court is the same.  The court must determine whether the Commission has exceeded the margin of appreciation afforded to it under the GDPR.

37.         If and insofar as it is alleged that the Commission has acted in breach of fair procedures in handling and investigating a complaint, the High Court is not required to show any deference to the Commission’s view on whether the procedure is fair or not.  Rather, this is capable of objective assessment by the High Court.  See, by analogy, Facebook Ireland Ltd v. Data Protection Commission [2021] IEHC 336 (at paragraph 268): the court’s assessment as to the fairness of the procedures adopted as part of a statutory process does not depend on a rationality assessment.

38.         The position is more nuanced where it is alleged that the Commission has exceeded the margin of appreciation afforded to it in deciding the extent to which it is appropriate to investigate the subject matter of the complaint.  This may require some consideration by the High Court of the specifics of the complaint.  In most other legislative contexts, the High Court would show deference to a decision-maker’s assessment on the merits.  However, it is at least arguable, having regard to the observations of Advocate General Pikamäe, that the standard of review under the GDPR is more searching than that of unreasonableness or irrationality as per O’Keeffe v. An Bord Pleanála [1993] 1 I.R. 39.  The standard of review may approximate more closely to that applicable in the case of a statutory appeal, i.e. the threshold is that of a serious or significant error.  See Nowak v. Data Protection Commission [2016] IESC 18, [2016] 2 I.R. 585 (at paragraphs 28 to 30).  It is not necessary, for the purpose of the resolution of the present proceedings, to formulate the standard of review with any greater precision.  This is because whether one applies the test of serious or significant error, or the higher test of proportionality, the procedural decision made by the Commission in the present case passes muster. 

39.         Here, the Commission has taken a decision to defer consideration of one aspect of the Applicant’s complaint pending the completion of its own-volition inquiry.  This does not amount to a refusal to investigate the complaint, still less a refusal to handle the complaint.  Rather, it is a sequencing decision.  The substance of the complaint overlaps, to a significant extent, with the issues being investigated in the own-volition inquiry.  The Commission has kept the Applicant fully apprised of the reasons for its sequencing decision and of the progress of the own-volition inquiry.  The Commission has engaged in extensive correspondence with the Applicant on these matters. 

40.         The decision to prioritise the own-volition inquiry is proportionate and well within the margin of appreciation allowed to a supervisory authority.  The Commission is engaged on a complex and time-consuming inquiry into the behavioural advertising industry.  It is entirely proportionate for the Commission to have decided to complete the own-volition inquiry first, before completing its investigation of the Applicant’s complaint. 

41.         The broad scope of the own-volition inquiry is apparent from the notification sent to Google Ireland Ltd on 22 May 2019.  The scope of the inquiry is summarised as follows:

“The Inquiry commenced by this Notice will examine and assess:

 

a.          whether Google has a lawful basis for processing personal data, including special category data, for the Purposes via the Google Authorized Buyers mechanism, and specifically for the sourcing, sharing and combining of the personal data collected by Google with other companies/partners;

 

b.          How Google fulfils its transparency obligations particularly with regard to Articles 5(1), 12, 13 and 14 of the GDPR; and,

 

c.          The legal basis/bases upon which Google relies when retaining personal data processed in the context of the Google Authorized Buyers Ad Exchange, and how Google complies with Article 5(1)(c) of the GDPR in the context of its retention of personal data processed through the Google Authorized Buyers Ad Exchange.”

 

42.         The Commission has explained, in open correspondence with the Applicant, that the own-volition inquiry is directed to whether or not the processing operations engaged in by Google in the context of the real-time bidding systems have a legal basis by reference to Article 5(1)(a) and Article 6 of the GDPR, and whether or not Google has discharged its obligations by reference to its transparency obligations.

43.         The Commission has also made the point that it is reasonable to anticipate that if, at the conclusion of its own-volition inquiry, the Commission were to find that the processing operations that are central to the real-time bidding systems do not have a legal basis, then those processing operations would have to cease.  The Commission rejects the Applicant’s contention that the reaching of findings adverse to Google in relation to the issue of the foundational lawfulness of its processing operations will not resolve the security issues raised by the Applicant in his complaint.  The Commission explains that an adverse finding would necessarily require the Commission to consider the imposition of a temporary or permanent ban on Google’s processing operations.

44.         The Commission makes the point that the security considerations raised by the complaint are not those typically arising under Article 5(1)(f) and Article 32 of the GDPR.  The complaint is concerned with the way in which the real-time bidding systems are structured, i.e. whereby personal data may, by design, pass beyond the control of the controller, rather than concerned with accidental loss, destruction or damage.  The own-volition inquiry is already addressing the structural framework through an examination of the lawfulness and transparency of Google’s processing operations, i.e. the extent of data subjects’ knowledge of the processing, their control over that processing and the exercise of their rights.

45.         The Commission’s approach has also been informed by the fact that it has received a number of complaints from other data subjects which are based on the same report as that relied upon by the Applicant and therefore raise the same systemic issues.  The Commission is of the view that its approach of dealing with the number of systemic issues as part of the own-volition inquiry in the first instance is the most efficient and consistent way of dealing with such issues and subsequent, individual complaints which relate to same.

46.         The Commission’s aim in progressing the own-volition inquiry first is to deal with the inquiry, the complaint, and other complaints arising, in the most efficient manner possible.  In this regard, the Commission wishes to avoid, to the extent possible, duplicative investigative steps.

47.         The Commission has thus articulated a clear rationale for its procedural decision to prioritise the own-volition inquiry over the complaint.  The Applicant has been kept informed as to the progress of the own-volition inquiry and has been involved as an interested person and afforded an opportunity to make submissions.  The own-volition inquiry has reached the point of a preliminary draft decision, in relation to which the Applicant and Google will have an opportunity to make submissions.  This will be followed by the preparation of a draft decision which other supervisory authorities will have an opportunity to engage with.  A decision will then be made and adopted.  Moreover, the Commission has consistently explained to the Applicant that it remains open to addressing the alleged breach of Article 5(1)(f) in the context of its consideration of his complaint.  This overall approach is appropriate and proportionate. 

 

 

Rex (Delo) v. Information Commissioner

48.         For completeness, it should be recorded that both parties helpfully referred me to the judgment of the High Court of England and Wales in Rex (Delo) v. Information Commissioner [2022] EWHC 3046 (Admin), [2023] 1 WLR 1327.  That judgment is under appeal: by coincidence, the appeal was heard the week prior to the hearing before me. 

49.         For the reasons which follow, I have not relied upon the High Court judgment in Delo in reaching my decision.  The judgment is concerned with a different question, namely whether the (UK) Information Commissioner is obliged to investigate and reach a final conclusion on each and every complaint made to him.  Here, the dispute centres, instead, on the timing of the investigation: the Commission has not refused to determine the complaint.  Moreover, the legislative regime now applicable in the United Kingdom is, as a result of Brexit, very different from that obtaining in this jurisdiction.  The Advocate General’s opinion in Joined Cases C‑26/22 and C-64/22, UF v. Land Hessen, EU:C:2023:222 does not appear to have been brought to the High Court’s attention.

 

 

Time-limit point

50.         It should be recorded that the Commission has pleaded that the application for judicial review is out of time.  More specifically, it is submitted that the Applicant has been on notice, since at least 29 May 2020, that the Commission had made a decision to defer consideration of the complaint pending the completion of the own-volition inquiry.  It is said that if and insofar as the Applicant wished to challenge this sequencing decision, he should have instituted proceedings within three months of that date.  The Commission relies on the provisions of Order 84, rule 21 of the Rules of the Superior Courts.  The proceedings were not instituted until 9 March 2022.

51.         With respect, the inter partes correspondence is equivocal on this point.  The letter of 29 May 2020 itself contains a footnote to the effect that the scope of the own-volition inquiry is subject to ongoing review and/or refinement in light of the submissions received and on foot of the analysis and consideration of same by the Commission.

52.         This theme reoccurs throughout the subsequent correspondence.  It is stated in the letter of 7 September 2020, for example, that the Commission continues to have an “open mind” in relation to the central matters which fall for consideration in the own-volition inquiry.  It is further stated that the Commission has discretion, under Section 110(1) of the Data Protection Act 2018, to scope the inquiry as it sees fit and that the Commission was continuing to keep the scope of the inquiry under review.  It was also stated that the Applicant would be provided by the Commission with an issues paper, setting out in more detail the scope of the own-volition inquiry and the issues being examined as part of same.  It was only by letter dated 12 January 2022 that the Commission stated that it had come to a “final view” that the central issues requiring determination, in the own-volition inquiry, are those relating to transparency, legal basis, data minimization and storage limitation, to the exclusion of data security. 

53.         Having regard to the repeated refrain that the scope of the own-volition inquiry was under continuous review, the Applicant is not to be criticised for having held off instituting legal proceedings.  The Applicant’s grounds of challenge did not crystallise until such time as he had received the issues paper on 24 December 2021.  The judicial review proceedings were instituted within three months of that date.  Accordingly, the Commission’s plea that the proceedings are out of time is not well founded.

54.         For completeness, it should be reiterated that the Applicant’s challenge to the handling and investigation of his complaint should properly have been brought by way of a statutory application pursuant to sub-sections 150(7) and (8) of the Data Protection Act 2018.  (See paragraphs ‎17 to ‎20 above).  Such an application is not subject to the three month time-limit prescribed under Order 84, rule 21.

 

 

Date upon which complaint first lodged

55.         There is a dispute between the parties as to the date upon which it can be said that a complaint was first lodged by the Applicant.  This dispute centres on whether the initial submission—to use a neutral term—made by the Applicant on 12 September 2018 should be regarded as a complaint.  As appears from the content of this submission, the principal request being made by the Applicant at that time had been that the Commission should commence an inquiry pursuant to Section 110 of the Data Protection Act 2018.

56.         The Applicant subsequently provided specific information in respect of the processing of his personal data in September 2019.  Thereafter, the Commission indicated that it now regarded the Applicant as having lodged a complaint. 

57.         Although this issue of the timing of the complaint has generated a considerable amount of correspondence between the parties, it does not appear to be necessary for this court to reach a finding—one way or the other—on the issue for the purpose of resolving these judicial review proceedings.  As put by counsel for the Applicant, this issue is a red herring.  I also note that the Commission, in its written legal submissions, makes an objection to the issue being raised. 

58.         Accordingly, I make no finding on this issue.  If, for whatever reason, either party considers that it is necessary for this issue to be determined, they should indicate that to me when the proceedings are next listed.

 

 

Conclusion and proposed form of order

59.         For the reasons explained, the Data Protection Commission’s decision to prioritise the own-volition inquiry is proportionate and well within the margin of appreciation allowed to it qua supervisory authority under Article 57(1)(f) of the GDPR.  The Commission is engaged on a complex and time-consuming inquiry into the behavioural advertising industry.  It is entirely proportionate for the Commission to have decided to complete the own-volition inquiry first, before resuming its investigation of the Applicant’s complaint.  Accordingly, the application for judicial review is dismissed.

60.         As to legal costs, my provisional view is that the Commission, having been “entirely successful” in opposing the judicial review proceedings, is entitled to recover its legal costs as against the Applicant in accordance with the default position under Section 169 of the Legal Services Regulation Act 2015.  The notice party should bear its own costs.  If any party wishes to contend for a different form of costs order than that proposed, they will have an opportunity to do so when the proceedings are next listed.

61.         These proceedings will be listed on Wednesday, 4 October 2023 at 10.30 o’clock for final orders.

 

 

Appearances

James Doherty SC and Sean O’Sullivan for the applicant instructed by Ahern Rudden Quigley

Brian Kennelly SC, Joe Jeffers SC and Mark William Murphy for the respondent instructed by Philip Lee LLP

Bairbre O’Neill SC and Patrick Mair for the notice party instructed by A & L Goodbody LLP