High Court challenge brought against DPC over processing of personal data

A High Court challenge has been brought against the Data Protection Commission's alleged failure to fully investigate a complaint made about Google and IAB Europe's procession of personal data.

The action has been brought by Dr Johnny Ryan, a senior fellow of the Irish Council for Civil Liberties (ICCL), regarding what he claims is the DPC’s delay in investigating his 2018 complaint regarding the two companies.

The DPC, in correspondence with Dr Ryan’s lawyers, has denied that it has delayed in handling the complaint.

Dr Ryan, who in his capacity with the ICCL raises issues of concern about data protection rights, has sued the DPC over its alleged failure to progress and substantially complete the investigation into his complaint.

Subjects

His complaint concerns the operation of a system, alleged used by Google and IAB, called “Real Time Bidding” (RTB) which underlies the targeting of individual data subjects for online advertising based on their personal data.

The failure to investigate the matter, he claims, is in breach of the requirements of both the 2018 Data Protection Act and the General Data Protection Regulation (GDPR) which is the EU’s privacy and data protection requirement.

In his complaint Dr Ryan raised concerns including that the RTB systems used by the two firms involve unauthorised and potentially unlimited disclosure and processing of personal data.

His complaint contains several instances where he claims that Google and IAB have breached GDPR.

The DPC is the state’s supervisory authority in respect of GDPR.

He also raised issues about the company’s alleged inability to demonstrate their compliance with the GDPR requirement that personal data be processed lawfully and fairly, or that the processing of personal data be kept to a minimum.

Investigation

The High Court heard that the DPC opened an inquiry into RTB in May 2019, under its own violation, and there had been detailed correspondence between Dr Ryan and the DPC over the matter.

However, Dr Ryan claims that his complaint has not been properly or adequately investigated by the commission and has brought High Court judicial review proceedings against the DPC.

In his action Dr Ryan, represented by James Doherty SC and Sean O’Sullivan, seeks a declaration that the respondent has failed to carry out an investigation into the complaint with all due diligence within a reasonable time.

He also seeks an order directing the DPC to proceed with the investigation of that part of the complaint not addressed in the in the inquiry, without delay.

He further seeks that the matter be referred to the Court of Justice of the European Union.

The action came before Mr Justice Charles Meenan on Monday.

The judge, on an ex-parte basis, granted Dr Ryan permission to bring his challenge.

The matter was adjourned to a date in May.