Google Ireland Ltd v Data Protection Commission (Approved)

Factual and Procedural Background

This case concerns six complaints lodged by consumer agencies in six different countries on behalf of residents of those countries, relating to the account creation process of a multinational internet services company (the Applicant). The complaints allege unfair practices in obtaining consent for processing personal data, including the use of "dark patterns" and lack of transparency. The national data protection authority (the Respondent), acting as lead supervisory authority due to the Applicant’s registered office location, received these complaints between September 2022 and March 2023.

After exchanges and requests for information between the parties, the Respondent issued a notice of commencement of inquiry on 23 October 2023. The Applicant objected to the inquiry’s commencement, arguing that the Respondent lacked jurisdiction because it had not established the admissibility of the complaints, specifically lacking essential information such as account identifiers, mandates authorizing the consumer agencies to act, and evidence that the consumer agencies met statutory criteria.

The Applicant sought judicial review to set aside the notice of commencement, contending that the Respondent should have determined admissibility before commencing the inquiry. The Respondent denied the claims, asserting broad powers to commence inquiries without preliminary admissibility decisions and relying on principles of mutual trust between supervisory authorities of different states. The matter was heard on 25 and 26 July 2024.

Legal Issues Presented

1. Whether the Respondent had jurisdiction to commence an inquiry without first determining the admissibility of complaints under the Data Protection Act 2018 and GDPR 2016.
2. Whether the absence of essential information (account identifiers, mandates, and representative body evidence) at the time of the inquiry’s commencement invalidated the Respondent’s jurisdiction.
3. Whether the Applicant acquiesced or was estopped from challenging the inquiry due to prior engagement with the Respondent.
4. Whether certain complaints, specifically the Czech complaint, were inadmissible due to the complainant not having opened an account and thus no personal data processing occurred.
5. Whether the Respondent’s reliance on the principle of mutual trust and duty of sincere cooperation between supervisory authorities justified commencing the inquiry without verifying admissibility.
6. Whether fresh evidence obtained after the notice of commencement can be considered to establish jurisdiction retrospectively.
7. Whether the inquiry includes complaints outside the temporal scope of the notice of commencement and if this constitutes ultra vires conduct.
8. Whether certain complaints might constitute an abuse of process due to complainants being employees of consumer agencies and the absence of genuine consent.

Arguments of the Parties

Applicant's Arguments

• The Respondent lacked jurisdiction to commence the inquiry because it had not established the admissibility of complaints by verifying that personal data was processed, that mandates authorizing consumer agencies were in place, and that consumer agencies met statutory criteria under Art. 80(1) GDPR.
• The Respondent did not possess or was unaware of essential information (account identifiers, mandates, representative body evidence) at the time it commenced the inquiry.
• The inquiry’s commencement without a prior admissibility decision was unlawful and caused potential prejudice, including the risk of disclosure of confidential commercial information and significant expense.
• The Applicant did not acquiesce or waive objections to jurisdiction despite extensive engagement, as it was unaware that the Respondent lacked the necessary information.
• The Czech complaint was inadmissible because the complainant did not open an account, so no personal data was processed.
• The Respondent’s reasoning on admissibility was inadequate and deferred to a later stage, which was improper.
• The Respondent was acting ultra vires by including complaints outside the temporal scope of the inquiry.
• Some complaints may be abusive process as complainants appear to be employees of the consumer agencies and accounts were minimally used, suggesting complaints were made on agencies’ own behalf, which is not permitted under Irish law.

Respondent's Arguments

• Protection of personal data is a fundamental right, and the Respondent has broad statutory powers under the Data Protection Act 2018 to commence inquiries without preliminary admissibility hearings.
• Only two criteria for a complaint’s admissibility are required at inquiry commencement: the complainant must subjectively consider their data processing infringes the law, and the Respondent must be the lead supervisory authority.
• The principle of mutual trust and duty of sincere cooperation obliges the Respondent to presume that other supervisory authorities forwarded admissible complaints.
• The Applicant acquiesced and is estopped from challenging jurisdiction due to prolonged engagement without raising objections to admissibility.
• Subsequent evidence shows that mandates and representative body criteria were satisfied at all relevant times, establishing de facto jurisdiction.
• The Czech complaint is admissible because a complaint can be made even if no account was opened, relying on the CJEU Meta Platforms Ireland Limited decision, as it concerns misleading information at the account creation stage.
• Complaints outside the temporal scope of the inquiry can be dealt with during the inquiry and struck out if found out of scope.
• It is neither required nor desirable to have an elaborate preliminary admissibility hearing, which would complicate proceedings and delay protection of rights.
• If jurisdiction was lacking at the outset, striking down the notice would be futile as a fresh notice would be issued immediately.
• Issues of abuse of process raised by the Applicant have not been decided by the Respondent and are not ripe for judicial review at this stage.

Table of Precedents Cited

Court's Reasoning and Analysis

The court began by affirming the fundamental right to personal data protection under GDPR 2016 and DPA 2018, recognizing the significant protections and rights afforded to individuals, including the right to complain to supervisory authorities.

The court accepted that certain basic criteria must be satisfied for a complaint to be admissible when lodged by a consumer agency on behalf of a data subject: (1) the data subject’s personal data must have been processed by the entity complained against, demonstrated by account identifier information; (2) the data subject must have mandated the consumer agency to act on their behalf; and (3) the consumer agency must meet statutory criteria as a representative body under Art. 80(1) GDPR.

The court held that the Respondent should have obtained and been satisfied with this information before commencing the inquiry, as these criteria establish jurisdiction. The provision of account identifier information was deemed essential for fairness and to enable the Applicant to prepare an adequate response.

Regarding the Czech complaint, the court found it inadmissible because the complainant did not open an account and thus no personal data was processed by the Applicant. The court distinguished the Respondent’s reliance on the Meta Platforms case, noting that the circumstances differ, particularly as Ireland has not implemented Art. 80(2) GDPR allowing complaints by consumer agencies on their own behalf.

The court rejected the Respondent’s argument that the principle of mutual trust and duty of sincere cooperation required it to assume the complaints were admissible. There was no evidence that the concerned supervisory authorities had vetted the complaints for admissibility before forwarding them.

On estoppel and acquiescence, the court acknowledged the principle that participation with full knowledge can preclude later jurisdictional challenges. However, it found the Applicant did not have knowledge that the Respondent lacked essential information when commencing the inquiry, and the Applicant was under a statutory duty to cooperate, which did not amount to acquiescence.

The court also considered the Respondent’s reliance on the Rowland v An Post principle of non-intervention in ongoing processes. It distinguished the present case due to the significant adverse effects on the Applicant, including potential disclosure of confidential information, substantial expense, and market consequences, justifying judicial intervention at this stage.

The court accepted that fresh evidence obtained after the notice of commencement could be considered on judicial review of jurisdictional facts. The evidence demonstrated that mandates and representative body criteria existed at the relevant time, establishing de facto jurisdiction for the Respondent to commence the inquiry.

Accordingly, while the Respondent ought to have obtained this evidence before commencing the inquiry, the existence of the necessary facts at the time sufficed to confer jurisdiction retrospectively.

The court held that complaints outside the temporal scope of the inquiry, such as the disputed French complaint, would be dealt with during the inquiry and were not grounds to strike out the entire inquiry.

Finally, the court noted that allegations of abuse of process regarding complainants’ employment status and account usage had not been determined by the Respondent and were not ripe for judicial review.

Holding and Implications

The court made the following orders:

• The notice of commencement dated 23 October 2023 is set aside insofar as it relates to the Czech complaint, which was held inadmissible.
• In all other respects, the reliefs sought by the Applicant are refused, and the inquiry may proceed.

The court emphasized that the Respondent had jurisdiction to commence the inquiry as the necessary criteria for admissibility were met in fact at the time of commencement, even if the Respondent did not have all evidence in hand at that moment. No new precedent was established beyond clarifying the necessity of establishing jurisdictional facts for admissibility and the limited circumstances permitting judicial intervention before inquiry conclusion.

The decision allows the inquiry to continue, subject to the exclusion of the Czech complaint, and leaves open the possibility for the Applicant to raise further challenges or objections during the inquiry process, including on abuse of process grounds.