220. Specifically, as summarised above, it was apparent even from the terms of the Complaint submitted in which the Complainant expressly pointed out that the issues he raised in respect of the processing of his personal data had wider societal significance "given the recent revelations about microtargeting, and the extent of tracking on the internet today," that this was a complaint which might have ramifications beyond the personal data breach involving the Complainant.
221. In notifying the opening of the Inquiry in the terms of the formal notice served, the Commission clearly rooted the Inquiry in s. 110(1) of the 2018 Act. The Notice of Commencement of Inquiry expressly pointed out that s. 110(2) of the Act permitted it to exercise all the powers it considered appropriate under Chapters 4 (except s. 135) and 5 of Part 6 of the 2018 Act to be carried out for the purpose of the Inquiry and the Commission stated that it was reserving the right to do so. Nothing in this language could be construed as inferring a restricted process in the conduct of the investigation. Indeed, the reference to s. 110 immediately signalled that the Commission had available to it the same powers that it would have in an own-volition investigation because this is what is provided for in s. 110(1) of the 2018 Act.
222. From the Notice of Commencement of Inquiry, the purpose of the inquiry was stated to be to examine whether Facebook had discharged its obligations in connection with the subject matter of the complaint, and whether any provisions of the GDPR and/or the 2018 Act had been contravened in that context. In my view, the reference to the discharge of obligations "in connection with" "the subject matter" of the Complaint squarely brought within the parameters of the Inquiry the refusal by Facebook to provide identified information contrary to the requirements of Articles 15 and 20 of the GDPR. The repeated characterisation of the inquiry as complaint-based does not, of itself, bear the meaning which MPIL seeks to attribute to it. Properly understood, that description relates to the origin and subject matter of the Inquiry, namely that it was initiated by a complaint concerning the alleged infringement of an individual data subject's rights. It does not constitute, either expressly or by necessary implication, a representation that the Commission would limit its response, in the event of an infringement being established, to measures confined to the individual complainant.
223. It bears particular emphasis that the language used in the Notice was not limiting language which could be said to infer that the Commission was not concerned by systemic implications of any data infringements found based on systemic practices or practices of general application involved by Facebook in responding to the data request or in information provided during the Inquiry. Indeed, the Notice of Commencement of Inquiry expressly alerted MPIL to the possible outcome of the Inquiry and specifically, in the event that the Commission were to determine at the conclusion of the Inquiry that there has been a contravention of the Act and/or the GDPR, then the Commission could exercise any of its powers as provided for under the Act and the GDPR including but not limited to powers conferred on the DPC by Article 58(2) of the GDPR.
224. MPIL places particular reliance on the terms of the Draft and Final Inquiry Reports, noting that the findings proposed therein were framed exclusively by reference to the Complainant's personal data. That is so. However, those reports formed part of the investigative phase of the process. They did not purport to address, still less to determine, the question of the appropriate corrective measures to be adopted in the event of a finding of infringement. That question arises at a distinct stage of the statutory process and is governed by separate legal considerations. The absence of reference to systemic consequences in the investigative reports cannot be construed as a representation that such consequences would not be addressed at the decision-making stage.
225. Thus, while no express reference was made to s. 141 of the 2018 Act providing for administrative fines, Facebook (now MPIL) were informed in black and white, stark terms that this "may include the imposition of an administrative fine on Facebook" (in line with Articles 58(2) and 83 of the GDPR). In my view, a data controller reading the Notice of Inquiry and aware of the terms of the Request as well as the response provided to the Request and the Complaint, could be under no misapprehension as to the potential scope and ramifications of the Inquiry thus commenced, including the potential exposure to a sanction by way of administrative fine and how this would be measured.
226. The fact that the corrective measures which could flow from the Inquiry was in no way limited to the data breach affecting just one person remained clear throughout the process. There was no doubt from the outset that the Complaint raised systemic issues. The Complainant spelt this out in his complaint and the Commission expressly referenced the Complainant's position in early correspondence.
227. When the Draft Inquiry Report issued on the 25th of January, 2022, MPIL was again expressly referred to the statutory provisions governing the process. The express reference to s. 113 of the 2018 Act in the Draft Inquiry Report served (or ought to have served) as a clear reminder to Facebook/MPIL that where the Commission decision-maker adopts a decision to the effect that a data infringement has occurred or is occurring, there flows from this an obligation on the Commission under s. 113(4) of the 2018 Act to consider the exercise of corrective powers. The Commission has no discretion in this regard. It is mandated as a matter of law to consider the exercise of corrective powers, albeit that it has a discretion ultimately as to what, if any corrective powers, it considers it appropriate to exercise (provided its decision in this regard is reconcilable with its obligations under EU law).
228. It bears further emphasis that the exercise of corrective powers under s. 113(4) necessarily engages s. 115 of the 2018 Act which expressly empowers the imposition of administrative sanctions and any other corrective power specified in Article 58 of the GDPR. Even a fleeting familiarity with Article 58 identifies the range of corrective powers available to the Commission to ensure compliance with the GDPR, including the possible imposition of administrative sanctions. However, insofar as the power to impose an administrative sanction is concerned, Article 58(2)(i) requires an application of Article 83 of the GDPR when considering imposing such a sanction. This in turn mandates (through the repeated use of the word "shall" in Article 83) consideration of the number of data subjects affected.
229. In the circumstances, the proposition that MPIL was led to understand through communications during the statutory process that the Commission was only concerned with a single instance data breach in the Complainant's case and would not have regard to the broader concerns arising from the subject matter of the complaint leading to the imposition of an administrative fine referrable to these systemic concerns assessed in accordance with Article 83(2) criteria is simply untenable.
230. It was urged on me on behalf of MPIL that no findings were made in the Final Inquiry Report about Facebook's general practices, impacts on other users or systemic non‑compliance beyond the Complainant's individual data request and they relied on this as confirmation of the limited scope of the inquiry process. This approach to the Final Inquiry Report is incomplete and self-serving in circumstances where the Final Inquiry Report plainly set out information obtained during the Inquiry in relation to data on the Hive system as it affects each user or users generally.
231. Upon commencement of the decision-making phase, by letter dated the 21st of August, 2023, it was explained that the decision-maker was required not only to make findings on infringements of the GDPR but also to make a decision as to whether or not a corrective power under Article 58(2) of the GDPR or s. 115 of the 2018 Act should be exercised in respect of the controller or processor concerned, and, if so, the corrective power that is to be exercised. I am at a loss to see how MPIL contends that it could read this as consistent with their contended for representation that systemic issues were beyond the scope of the process.
232. This contention is all the more difficult to comprehend when regard is had to the letter dated the 2nd of May, 2024, from the Commission in which it repeated that where its preliminary view was that there had been an infringement, it would be necessary to consider whether or not any corrective action (including the possible imposition of an administrative fine) might be warranted. This correspondence was directed towards establishing the undertaking concerned in circumstances where Article 83 of the GDPR (interpreted in the light of Recital 150) envisages that administrative fines should be imposed on 'undertakings', rather than data controllers or processors, noting the significance of this question in identifying the relevant fining "cap", which for the purpose of Articles 83(4) and (5) falls to be calculated by reference to the turnover of the undertaking as a whole, rather than the turnover of the respondent data controller or processor. It was pointed out in this letter that MPIL is a wholly owned subsidiary of Facebook International Operations Limited which is ultimately owned and controlled by Meta Platforms Inc. and it was assumed, that Meta Platforms Inc. was similar to a sole owner as regards its power to exercise a "decisive influence over the conduct of MPIL." This was described as a "rebuttable presumption". A response was invited in this regard.
233. It is noteworthy that although the letter of the 2nd of May, 2024, elicited a detailed response from MPIL's solicitors dated the 16th of May, 2024, in which issue was taken with the Commission's approach to the concept of the undertaking concerned but in this letter it was not contended that in considering corrective action, including the imposition of administrative sanctions, there had been any enlargement of the scope of the process. While it is true that this correspondence did not alert MPIL to the scale of the proposed measures, insofar as matters of scope are concerned, it was not then disputed that a legal basis existed for the imposition of corrective measures including administrative fines. As a matter of law (and never suggested otherwise by the Commission) where administrative fines are concerned, the Commission is not at large but must approach the question in the light of the factors identified in Article 83(2) of the GDPR.
234. In this case, the Complaint and the response it elicited brought systematic compliance issues within the scope of the individual inquiry insofar as they related to infringements of Article 15(1)(a), (d) and (g). In contrast, the Commission has signalled that it accepts that systemic compliance issues relating to Article 15(1)(b), (c), (e), (f) and Article 15(2) fell outside the scope of the Inquiry and are not relied upon in the draft PDD. In all its communications throughout the process, the Commission has proceeded with clear reference to its statutory powers. It has never sought to dilute those powers and nothing it has said could be construed as diminishing those powers. The Commission is obliged when making an infringement finding to consider the question of corrective measures and administrative sanctions in accordance with Articles 58 and/or 83. Not only is the Commission not entitled to resile from this obligation as this would constitute an impermissible abdication of its functions, but I see no evidence that it ever sought to in making any representation which could have been interpreted as limiting the scope of the Commission's inquiry and decision making function on the Complaint.
235. The matters relied upon by MPIL to establish limitations on a complaint-based process which are not prescribed by the legislative scheme and would appear to cut across it, fall far short of the type of statement or representation required to give rise to a legitimate expectation considered in the caselaw. The Commission never represented, let alone clearly represented, that the process in train would not permit consideration of systemic issues arising in terms of corrective action flowing from a finding of infringement. Nor could it be said that the Commission had "committed" in its publications to only investigate systemic issues in the context of an own-volition inquiry in terms necessary to support a claim for legitimate expectation. Not only have MPIL failed to establish a representation or assurance as to the process in train upon which they relied to their detriment in concluding that the Commission would not have regard to systemic implications of any infringement findings on foot of an individual complaint and/or without conduct an own-volition inquiry but, in fact, the evidence shows that MPIL deployed significant resources (including evidence from an expert and comprehensive written submissions) to respond to the systemic implications arising in connection with the induvial complaint made. It is unclear, therefore, what detriment MPIL says arises to them by reason of the process followed.
236. The fact that the Commission squarely invoked its statutory powers at all times in the process means that it could not be said to be "unfair or inconsistent with good administration" (in the words of Lord Fraser in Attorney General of Hong Kong cited by Barniville J. in Facebook Ireland Limited the Commission & Anor.) or that is would be "unjust to permit the public authority to resile from it" (in the words of Fennelly J. in Glencar which were followed and approved in several of the subsequent cases, including Cromane, also considered in some length by Barniville J. in Facebook Ireland Limited the Commission & Anor.) to conclude that where vires is established on foot of the provisions identified, no unfairness or injustice flows from taking steps in accordance with the process provided for in the legal framework. In this regard, I am satisfied that MPIL were not entitled to expect that it would not be exposed to corrective measures of general application in the inquiry process as these are only imposed in own-volition inquiries. Such an expectation runs directly contrary to the statutory regime and it is not supported by evidence as to the practice which shows both measures of general application in own-volition and complaint-based inquiries.
237. I harbour significant doubts that the Commission could ever legitimately represent that it would restrict the exercise of its powers in a manner inconsistent with the requirements of the GDPR as given further effect to by the 2018 Act in the manner contended on behalf of MPIL. I echo the views of Barniville J. in addressing similar arguments in Facebook Ireland Limited v. the Commission & Anor. when he stated (at para. 224) that:
"a legitimate expectation of the type which FBI has sought to have recognised and enforced would, in my view, be inconsistent with the Commission's "freedom to exercise properly a statutory power" (being the phrase used by Fennelly J. in his statement of the test in Glencar)."
238. I further note Barniville J.'s finding that even if, contrary to his primary findings, a legitimate expectation had been established based on the published procedures and/or the practice followed by the Commission in other previous inquiries, it would nonetheless be open to the Commission to depart from the procedures referred to and to adopt a different procedure for its inquiry, provided that in doing so it complied with fair procedures and with the Commission's obligations under the 2018 Act and the GDPR. Even the existence of longstanding practices (which those identified on behalf of MPIL are not) does not give rise to any legitimate expectation that that practice will not change, albeit in some instances may require that a change of practice will only occur with reasonable notice being given. Those considerations do not arise in this case because it was at all times made clear to MPIL that the statutory process was being followed and there has been no deviation from this. Evidence as to practice shows that no hard and fast practice of a kind which could ground a successful claim to a legitimate expectation existed.
239. It is my view that, as with the fair procedures argument advanced, MPIL's claim based on a legitimate expectation is dependent on its interpretation of the vires of the Commission, which I have found to be wrong in law. On a proper approach to the exercise of the Commission's powers under Article 58 and 83 of the GDPR, as further given effect through the provisions of the 2018 Act, the Commission could not lawfully limit its consideration of prescribed matter when it comes to the exercise of its statutory powers. Nor did it. I am satisfied that the process pursued by the Commission is entirely in line with the applicable provisions. It was never in doubt but that were an infringement found, the Commission would proceed to consider Articles 58 and 83 of the GDPR, as it is mandated by law to do.
240. MPIL was not entitled to infer from the fact that the process was initiated on foot of an individual complaint that the consequences of any adverse findings would be limited to a remedy appropriate to the infringement of the Complainant's rights only, with no enforcement action taken regarding systemic matters. No such limitation exists within the statutory regime applying and the Commission as SA or LSA is obliged to consider corrective action having regard to the circumstances of the individual case, including any general or systemic issues arising. No representation was ever made that remedies would be limited to the individual complainant and all communications reflected the statutory framework which clearly allowed broader measures.
241. I am satisfied that the Commission did not make any representation, whether express or implied, that it would restrict the scope of its corrective powers in the manner contended for, nor did it adopt a practice capable of giving rise to such an expectation. The process followed was, at all times, consistent with the statutory framework governing the Commission's functions. The ground of challenge based on legitimate expectations must therefore fail.
CONCLUSION
242. The case made that the draft PDD is ultra vires on the basis that the GDPR and the 2018 Act distinguish between complaint-based and own-volition inquiries such that complaint-based inquiries are limited to remedies for the individual complainant, whereas systemic issues may only be addressed through own-volition inquiries, is not borne out by the legislative framework. The contention made on behalf of MPIL that the architecture and structure of the GDPR and the 2018 Act requires the Commission to address systemic issues only within the rubric of an own-volition inquiry is not legally sound.
243. The GDPR establishes a broad system of enforcement in which supervisory authorities are tasked with monitoring and ensuring compliance. Articles 57 and 58 confer wide investigative and corrective powers, including the obligation to investigate complaints "to the extent appropriate" and to take measures necessary to ensure compliance. These provisions do not differentiate between complaint-based and own-volition inquiries in terms of the extent of powers of investigation or the nature of corrective measures available.
244. While a complaint must be grounded in an alleged infringement of the complainant's personal data rights, there is nothing in Article 77 or the 2018 Act that prevents such a complaint from raising systemic issues, provided the complainant is personally affected. Nor is there any textual or purposive basis for limiting an ensuing investigation or decision to the individual circumstances of the complainant.
245. Where an infringement is found, the SA is required to consider corrective measures under Article 58(2), which include orders to bring processing operations into compliance and the imposition of administrative fines under Article 83. These powers are not confined to addressing the individual complainant's position but may extend to systemic deficiencies identified during the inquiry. Article 83 mandates consideration of factors such as the nature, gravity and duration of the infringement and the number of data subjects affected if imposing an administrative fine, confirming that sanctions are directed at ensuring general compliance rather than providing an individual remedy.
246. The 2018 Act reflects the same broad scheme as the GDPR. It confers identical corrective powers regardless of whether an inquiry is commenced on foot of a complaint or on the Commission's own initiative. The only material distinction between these processes lies in their origin: a complaint-based inquiry is defined by the subject matter of the complaint, whereas an own-volition inquiry is defined by the authority itself (or more than one authority). This procedural distinction does not affect the extent of the Commission's powers either to investigate within the parameters of a complaint or agreed terms of reference/scope of inquiry or to impose corrective measures once an infringement has been established.
247. Accordingly, a complaint-based inquiry may lawfully address systemic issues arising on the facts and may result in system-wide corrective measures including administrative fines informed by systemic considerations. This does not convert a complaint-based inquiry into an own-volition process but reflects the Commission's overarching obligation to ensure effective enforcement of the GDPR when infringements are found.
248. MPIL's contention that the Commission's powers are confined in a complaint-based inquiry to remedies for the individual complainant depends on reading into the GDPR and the 2018 Act a limitation that is not supported by their text, context, or purpose. The legal framework instead supports the conclusion that the same corrective powers apply irrespective of how an inquiry is initiated, and that those powers may properly be exercised by reference to the broader impact of the infringement identified.
249. There has been no impermissible extension of the process from an individual complaint process to an own-volition process and no breach of rights of fair procedures. The applicable legal framework, consistently referenced throughout the process, made clear that any infringement finding would require consideration of corrective measures under Article 58, including administrative fines assessed in accordance with Article 83. Those provisions plainly contemplate sanctions that are effective, proportionate and dissuasive, taking into account factors such as the scale and impact of the infringement irrespective of the source of the process.
250. MPIL was on notice from the outset that corrective measures (including administrative fine) were possible and were not confined to the individual complainant. This is borne out by the procedural record. Furthermore, the course and substance of the process of inquiry further reinforced its systemic dimension. Requests for information and MPIL's responses addressed its general approach to compliance with Article 15, particularly in respect of the Hive database. MPIL defended a uniform position applicable to all users, acknowledging that certain categories of data were not made accessible in raw form. Its submissions addressed the burden of responding to access requests at scale, demonstrating that it understood the issues to extend beyond the individual complainant. Having engaged extensively with systemic issues during the Inquiry, MPIL does not point to any unfairness in the process in terms of a different approach it might have taken if it were not mistaken as to the scope of the process.
251. The claim in reliance on legitimate expectation also fails as no assurances were ever given by the Commission that corrective measures directed to systemic issues would not be made in this case. The various materials relied upon by MPIL (guidelines, prior practice and correspondence) do not objectively support the existence of a representation that the Inquiry would be limited in scope. The correspondence and formal notices issued during the inquiry repeatedly signalled that the Commission retained the full scope of its powers, including the possibility of imposing broad corrective measures and fines at that stage of the statutory process. In addition, the statutory framework under the GDPR and the 2018 Act clearly empowers, and indeed obliges, the Commission to consider the full range of corrective measures, including those of general application and administrative fines, once an infringement is identified. Throughout the process, the Commission consistently referred to these statutory powers, and at no point sought to limit or fetter them.
252. Nor does past practice support MPIL's position as there is clear evidence that systemic corrective measures have previously been imposed in complaint-based inquiries (albeit not fines of the order now proposed). There is no rule of practice or law that systemic issues can only be addressed through own-volition investigations.
253. In view of my findings above, I will make an order dismissing the proceedings and will hear the parties in relation to any consequential matters, if required. This matter will be listed following the expiry of fourteen days from the electronic delivery of this judgment for the purpose of finalising orders.
BAILII: