knowledge 29 July 2024 |

Ryan v Data Protection Commission

Background

The case centred around a challenge to the Data Protection Commission's (the “DPC”) alleged failure to handle a complaint made under the General Data Protection Regulation (“GDPR”) and the Data Protection Act 2018 (the “2018 Act”) by Mr Johnny Ryan concerning data processing by Google Ireland Limited (“Google”) for targeted advertising through a real time bidding (“RTB”) system. Mr Ryan initially complained about systemic practices as opposed to making a complaint that there had been any breach specifically relating to his own personal data, however he later submitted evidence regarding the processing of his own personal data by Google. Mr Ryan’s complaint to the DPC alleged breaches by Google of Articles 5(1)(a), (c) and (f) GDPR in respect of its data processing.

Mr Ryan invited the DPC to:

(a) consider his submission as a complaint pursuant to Section 119 of the 2018 Act (the “Complaint”); and

(b) commence an inquiry pursuant to Section 110 of the 2018 Act.

Section 110 of the 2018 Act provides for the DPC to conduct an inquiry either as part of the assessment of a complaint, or of its own volition. In respect of Google’s RTB system, the DPC commenced what is termed an “own volition inquiry” (the “Inquiry”).

While the scope of the Inquiry covered in large part what Mr Ryan complained of, it did not extend to his allegation that Google’s actions were in breach of Article 5(1)(f) GDPR.

In correspondence between Mr Ryan and the DPC relating to the Complaint, the DPC outlined that there was significant overlap between the issues in the Inquiry and in the Complaint, such that the outcome of the Inquiry might inform the handling of the Complaint (or elements of the Complaint). In light of this, the DPC decided to progress the Inquiry in the first instance.

Issuing of Proceedings

Mr Ryan issued proceedings by way of judicial review seeking, inter alia, the following reliefs:

(a) a declaration that the DPC had failed to carry out an investigation into the Complaint with all due diligence and/or within a reasonable period, as required by Article 57 GDPR and the 2018 Act; and

(b) an order directing the DPC to proceed with the investigation of the part of the Complaint not addressed by the Inquiry (i.e. the alleged breach of Article 5(1)(f) GDPR) without delay and with all due diligence.

The refusal of the DPC to investigate the alleged breach of article 5(1)(f) GDPR, whether in a timely manner or at all, constituted, Mr Ryan argued, a breach of its obligations under Article 77 GDPR and the 2018 Act.

In response, the DPC maintained that, in substance, all elements of the Complaint were under consideration in the Inquiry and that it would progress and conclude the Inquiry before considering the Complaint given that the Inquiry had the potential to resolve or substantially narrow the issues raised in the Complaint.  The DPC further argued that, where it decides to conduct an own-volition inquiry, it has a discretion to determine the inquiry’s scope.

Decision of the High Court

Judge Simons in the High Court considered it incorrect to say that the DPC, as a supervisory authority, could not defer consideration of a complaint pending completion of a related investigation or inquiry. This was particularly so in this case where the data processing operations the subject of the Complaint were under active investigation in the Inquiry. Judge Simons, referencing Advocate General Pikamäe’s opinion in UF v Land Hessen (Joined Cases of C-26/22 and C-64/22 UF), pointed out that the DPC was afforded a margin of appreciation in relation to the obligation to investigate a complaint. In particular, the DPC is entitled to weigh factors such as:

(a) the seriousness or gravity of the alleged infringement;

(b) the need to marshal its resources so as to prioritise investigations appropriately; and

(c) the need to comply with fair procedures for all sides, including parties who are the subject of an investigation.

Judge Simons viewed the DPC’s decision to defer consideration of the aspect of the Complaint relating to Article 5(1)(f) pending completion of the Inquiry as a sequencing decision. He observed that the substance of the Article 5(1)(f) complaint overlapped to a significant extent with the issues under consideration in the Inquiry and that the DPC had kept Mr Ryan fully appraised of the reasons for the approach it had adopted and of the progress of the Inquiry. Judge Simons viewed the sequencing decision as proportionate and well within the margin of appreciation afforded to the DPC under the GDPR.

Judge Simons also considered the standard of review applicable in the context of a complainant having a “right to an effective remedy” where a supervisory authority does not handle their complaint and in considering whether the margin of appreciation afforded to the supervisory authority under the GDPR has been exceeded. Where there is an allegation of a breach of fair procedures in the handling and investigating of a complaint, the High Court is not required to show any deference to a statutory body’s view on the fairness of the procedure, this being capable of objective assessment by the Court. The position is more nuanced however where it is alleged that the DPC has exceeded the margin of appreciation afforded to it in deciding the extent to which it is appropriate to investigate the subject matter of a complaint. While noting that in most other legislative contexts the High Court would show deference to a decision-maker’s assessment on the merits, Judge Simons said it was arguable, having regard to the observations of Advocate General Pikamäe, that the standard of review under the GDPR was greater than simply unreasonableness or irrationality and closer to the statutory appeal test of “serious or significant error”. Ultimately, Judge Simons found that it was not necessary to formulate the standard of review with any great precision as the DPC’s procedural decision “passed muster” where either test was applied.

Appeal by Mr Ryan to the Court of Appeal

Mr Ryan appealed the High Court’s decision to the Court of Appeal (the “Court”), claiming, inter alia, that the High Court had erred in holding that the decision to defer handling of the Complaint pending the Inquiry’s completion was lawful.

Delivering judgment on behalf of the Court, Judge Binchy noted that the DPC is to be afforded a measure of discretion in the handling of complaints, referring specifically to Recital 141 and Article 57 GDPR, both of which provide for the handing and investigation of a complaint “to the extent appropriate”. With those provisions in mind, the Court referenced Advocate General Pikamäe’s opinion in UF v Land Hessen and specifically the Advocate General’s view that supervisory authorities “enjoy a margin of assessment in examining those complaints and a degree of latitude and the choice of the appropriate means to carry out its tasks”. However, once again citing the Advocate General, the Court made clear that the obligation to handle complaints is absolute.

In relation to the Article 5(1)(f) complaint, the Court determined that there was significant overlap between the issues under investigation in the Inquiry (namely, lawfulness, transparency and data minimisation), and those identified by the Appellant in the Complaint under the heading of data security (i.e. the alleged breach of Article 5(1)(f)). The Court held that this was so even where the issues were being investigated in the Inquiry by reference to a different provision of the GDPR. This, the Court considered, was a reasonable basis for deferring the handling of the Complaint pending the Inquiry’s outcome.

The Court further observed that, if the Inquiry determined that Google’s processing operations had no legal basis, then the DPC would very likely require cessation of the operations, meaning that the outcome of the Inquiry could potentially render the Complaint moot.

The Court agreed with the High Court that the DPC’s approach to ordering matters as it did was a sequencing decision. The DPC was entitled to order the sequence in which it addressed the individual elements of this complex, multi-dimensional complaint and to have regard to the fact that the Inquiry covered issues raised by the Complaint (even if there was not exact overlap). The Court emphasised that the DPC had kept Mr Ryan fully apprised of the reasoning behind this sequencing decision and the progress of the Inquiry. Further, the fact that the DPC made clear to Mr Ryan that, upon the Inquiry’s conclusion, it would investigate any elements of the Complaint that had not been considered in the Inquiry was considered by the Court to be important.

In summary, the DPC’s decision to prioritise the Inquiry and defer the handling of the Complaint was proportionate and well within the margin of appreciation allowed to a supervisory authority under the GDPR.

Comment

This decision is an interesting consideration of the extent of the obligation on the DPC to handle complaints and the margin of appreciation or discretion afforded to it in terms of how and when it handles and investigates complaints.

While specifically relevant to the DPC and the legislative framework within which it operates, this decision will also be keenly observed by regulators and regulated entities in other sectors, with learnings arising in terms of the investigation of complex, multi-faceted complaints, and the margin of appreciation that may be afforded to regulators in doing so.

Also contributed to by Diarmuid ÓhUallacháin