The High Court dismissed Johnny Ryan’s judicial review challenge to the Data Protection Commission’s decision to complete an inquiry into Google’s advertising systems before resuming its consideration of his complaint.
Mr Justice Garrett Simons held on 28 August 2023 that the Commission’s sequencing decision was proportionate and within the discretion available to it under the General Data Protection Regulation. The decision deferred one aspect of Ryan’s complaint; the court said it was not a refusal to investigate or handle the complaint.
Ryan argued that the Commission had to investigate promptly an issue he raised about whether Google’s Authorized Buyers Ad Exchange safeguards the integrity and confidentiality of personal data. He said that issue was outside the scope of the Commission’s own-volition inquiry and should be examined while that inquiry proceeded. He did not challenge the inquiry’s scope or pace.
The Commission said the inquiry substantially overlapped with the complaint and addressed the structure, lawfulness and transparency of Google’s real-time bidding operations. It argued that completing the inquiry first would avoid duplicated work and help it deal consistently with related complaints. It also said that findings about the legal basis for the processing could lead it to consider a temporary or permanent ban.
The judge said the GDPR gives supervisory authorities latitude to decide how and when to investigate, including how to sequence related inquiries. He accepted the Commission’s rationale, noting that Ryan had been kept informed, could make submissions and would have a further opportunity to respond to a preliminary draft decision. The Commission had also said it remained open to addressing the alleged security breach when it resumed the complaint.
The court rejected the Commission’s argument that the judicial review was out of time. It found that the Commission’s correspondence had repeatedly said the inquiry’s scope remained under review, and that Ryan’s grounds had crystallised after he received an issues paper on 24 December 2021. Proceedings were begun within three months of that date.
The judge made no finding on the disputed date when Ryan first lodged a complaint. He said that issue was not necessary to decide the judicial review.
The application was dismissed. The judge’s provisional view was that the Commission should recover its legal costs from Ryan and that Google Ireland Ltd should bear its own costs. The case was listed for final orders on 4 October 2023; the judgment did not state that those costs proposals had become final.