The Court of Appeal has upheld the Data Protection Commission’s decision to defer consideration of part of Johnny Ryan’s data protection complaint while it completes a related inquiry into Google’s advertising practices.
In a judgment delivered on 24 June 2024, Mr Justice Binchy said the Commission could sequence its handling of the complaint where the inquiry addressed substantially the same subject matter. The appeal challenged the Commission’s decision to defer the part concerning alleged breaches of Article 5(1)(f) of the GDPR, which concerns the security of personal data processing.
Ryan, a senior fellow with the Irish Council for Civil Liberties, had complained about Google’s Authorised Buyers system for real-time advertising. He alleged that personal data could be broadcast to third parties without adequate control. The Commission’s inquiry was examining the lawfulness and transparency of Google’s processing, as well as data minimisation and retention. Its stated scope did not expressly include Article 5(1)(f).
The Commission said it would resume examining the complaint after the inquiry concluded and consider any issues that remained. Ryan argued that the security concerns were distinct and should be investigated without waiting. The High Court rejected his application for a declaration and an order requiring the Commission to proceed with that part of the investigation. Ryan appealed.
The Court of Appeal found a substantial overlap between the complaint’s concerns about the transfer and further use of data and the inquiry’s examination of lawfulness, transparency and data minimisation. It held that the Commission was entitled to sequence the elements of a complex complaint and to consider whether the inquiry’s outcome might make further examination unnecessary. The court agreed that the deferral was proportionate and within the Commission’s discretion under the GDPR.
The court dismissed the appeal’s principal ground. It also rejected the challenge to the finding that Ryan had been kept informed, and said the other grounds were not pursued in oral argument or could not justify the requested relief. The judgment did not decide whether Google breached the GDPR or whether the Commission would ultimately need to investigate any remaining Article 5(1)(f) issues. The proceedings were listed for submissions on costs and final orders on 28 June.