The High Court has proposed setting aside the Data Protection Commission’s inquiry notice only insofar as it concerns a Czech complainant who did not open a Google account. It refused Google Ireland Limited’s other requests to quash the notice, finding that evidence later provided to the Commission established the required jurisdictional facts for the remaining complaints.
The case concerns six complaints, brought by consumer agencies on behalf of people in Norway, Slovenia, Greece, France, Spain and Czechia. They alleged that Google’s account creation process made it easier to consent to data use than to manage settings, and used unclear or leading language. Those allegations were not determined in this judicial review, which concerned whether the complaints could be examined and whether the Commission could begin an inquiry.
Justice Barr held that a complaint brought by an agency on behalf of a data subject required evidence that the person’s data had been processed, that they had authorised the agency to act, and that the agency met the representative-body requirements in Article 80(1) of the GDPR. The court said the account identifier should have been provided and the criteria established before the inquiry began on 23 October 2023. It rejected the Commission’s argument that it could rely on mutual trust and cooperation to assume that the other countries’ supervisory authorities had screened the complaints.
The Czech complainant had not completed account creation. The judge found that, without evidence her personal data had been processed, she did not have an admissible complaint under the relevant provisions. The court rejected the Commission’s reliance on a CJEU decision concerning representative actions, noting that Ireland had not implemented the GDPR provision allowing organisations to complain on their own behalf.
For the other complaints, evidence submitted during the proceedings showed that the mandates had been signed before the inquiry decision and that the agencies met the representative-body criteria. The court held that those facts established the Commission’s jurisdiction, despite its failure to obtain the evidence before issuing the notice. It therefore refused to set aside the notice as it applied to those complaints.
The court also declined to remove the French complaint on timing grounds. Google said the account was opened in 2014; the account holder said it was opened in 2022. The judge left that conflict for the Commission to resolve in the inquiry. An argument that some complaints were an abuse of process, including because complainants were said to work for the agencies, was not decided: no application had yet been made to the Commission on that basis.
The judgment proposed setting aside the notice for the Czech complaint and refusing the remaining relief. The parties were invited to make written submissions on the final order and costs, with the matter listed for mention on 5 November 2024. The judgment does not record the final order.