High Court - IEHC 577
From GDPRhub
| High Court - IEHC 577 | |
|---|---|
 | |
| Court: | High Court (Ireland) |
| Jurisdiction: | Ireland |
| Relevant Law: | Article 77 GDPR Article 80 GDPR |
| Decided: | 11.10.2024 |
| Published: | 15.10.2024 |
| Parties: | Google Data Protection Commission of Ireland (DPC) |
| National Case Number/Name: | IEHC 577 |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | English |
| Original Source: | Courts website (in English) |
| Initial Contributor: | ao |
A court confirmed the discretionary powers of a DPA in launching an investigation while setting out prerequisite information which must be disclosed at the outset.
English Summary
Facts
In 2022, Norwegian, Slovenian, Greek, French, Spanish and Czech consumer protection authorities, on behalf of data subjects, lodged complaints with DPAs relating to the account creation process with Google. These complaints were then forwarded to the Irish DPA between September 2022 and March 2023 from the concerned supervisory authorities with which they were originally lodged.
The complaints alleged dark patterns were used by Google in its account creation process. On 23 October 2023, the DPC decided to commence an inquiry and issued a notice of commencement. On 30 November 2023, Google objected to the commencement of the inquiry stating that the necessary information had not been provided to the DPC and to Google itself. Google posited that the account identifier information of each of the data subjects nor copies of the mandates of the consumer protection agencies representing the data subjects under Article 80(1) GDPR.
On 18 January 2024, Google initiated proceedings at the Irish High Court claiming that the DPC lacked jurisdiction over the inquiry as it was not in receipt of the above information. The Irish High Court sought to determine the admissibility of the complaints and did not analyse the content of the complaints.
The DPC submitted to the High Court, that it has very wide discretionary powers as to when it can launch an inquiry and that no specific preconditions must be met. In response to Google’s argument that the DPC did not have the account IDs nor the mandates of the consumer protection authorities, the DPC purported that the EU law principle of mutual trust and the duty of sincere cooperation applied. As the lead supervisory authority, the DPC had to assume that the concerned supervisory authorities had forwarded the claim on the basis that the complaints were well constituted. In fact, the DPC shouldn’t just assume this but is in fact obliged to operate on that basis. Further it would be futile to strike down the inquiry as the DPC would just issue a new one.
The Czech complaint failed to provide evidence on the account creation of the data subject. The DPC argued that, the data subject not having created an account doesn’t preclude them from making a complaint as anyone can file a complaint and referred to relevant EU case law in C-757/22. This case was used for authority stating that complaints can be filed at the account creation stage even if no account is then created with the controller or rather no personal data is provided.
Holding
The court echoes the wide discretion of the DPC but accepts Google's argument that certain basic criteria must be met. The High Court sets out that when a consumer protection agency files a complaint on behalf of a data subject the following criteria must be met:
1. Personal data of the data subject has been processed by the controller against which the complaint was made
2. The processing was in a manner which the data subject considers infringes the GDPR
3. The data subject has mandated the consumer protection agency to act on their behalf
4. The consumer protection agency meets the criteria under Article 80(1) GDPR
Therefore, the court concludes that it is essential for the account identifiers to be submitted before the commencement of the inquiry as it would show primarily that the data subject had created an account and which account creation process had been used. Further, the supply of this information is necessary to allow Google to prepare a response.
- The Czech complaint
The Czech complaint was held to be inadmissible as the data of the Czech data subject had not been processed as no account was created. Only if Article 77 GDPR included the future tense, the Czech complaint would have been admissible. The court rejected the Meta case (C-757/22) argument as in this case the complaint was not lodged on behalf of a data subject but directly by the consumer protection agency. The court reiterated that if no personal data is provided, the DPC cannot handle the complaint as Ireland has not implemented Article 80(2) GDPR into Irish law.
- Mandate
The mandate clarifying that the consumer agencies are entitled to represent the data subject should have been present at the outset before the inquiry was started. The responding party to an inquiry has to furnish commercially sensitive data for the inquiry and the risk of release of such information could cause significant harm. Further, they must invest extensive resources into responding to the inquiry so the launch must be justified.
- Mutual trust and duty of sincere cooperation
The court rejected the argument that on the basis of mutual trust and sincere cooperation the DPC should assume that the claims forwarded to it were well examined. There was no evidence showing that the consumer protection agencies had been well vetted.
However, the court summarises that the relevant facts were de facto in existence when the investigation was launched and the DPC therefore had jurisdiction to launch the investigation. Evidence submitted during the course of the proceedings clearly showed that the necessary mandates had been signed by the complainants and satisfied the requirements under Article 80(1) GDPR. The court further agrees that it would be futile to strike down the proceedings as the DPC would just issue a new investigation.
Google had been communicating with the Slovenian DPA for a period of 14 months and had never raised the issues of account IDs and mandates of the consumer protection authorities. This showed that Google had acquiesced to the process and was therefore estopped from challenging the very same process months after it had commenced. Even if the court were to disagree, the submitted affidavits proved the mandates under Article 80 GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
THE HIGH COURT
[2024] IEHC 577
[Record No. H.JR.2024/81]
BETWEEN
GOOGLE IRELAND LIMITED
APPLICANT
AND
DATA PROTECTION COMMISSION
RESPONDENT
JUDGMENT of Mr Justice Barr delivered electronically on the 11 day of
October 2024.
Introduction.
1. The applicant is a multinational company that provides an internet search
engine and other facilities to people who have an account with it.
2. The respondent is the statutory body established pursuant to the Data
Protection Act 2018 (hereinafter ‘DPA 2018’), to, inter alia, handle and if thought
appropriate, investigate complaints made by data subjects that the processing of their
personal data infringes their rights under the General Data Protection Regulation (EU)
2016/679 on the protection of natural persons with regard to the processing of
personal data and on the free movement of such data, and repealing Directive 2
95/46/EC (General Data Protection Regulation) (hereinafter ‘GDPR 2016’) and under
DPA 2018.
3. Essentially, this case concerns six complaints that were lodged by consumer
agencies in Norway, Slovenia, Greece, France, Spain and Czechia, on behalf of
people resident in those countries.
4. Each of the complainants made a range of complaints about the process known
as the account creation process, which was completed by all but one of the
complainants, when opening their account with the applicant; whereby their consent
was obtained to the processing by the applicant of their personal data.
5. In the period September 2022 to March 2023, a total of six complaints were
received by the respondent. These complaints had been forwarded by the supervisory
authorities in the countries in which the complaints had been originally lodged. These
supervisory authorities are known as concerned supervisory authorities, (hereinafter
‘CSAs’). The complaints were forwarded to the respondent as the lead supervisory
authority (hereinafter ‘LSA’), due to the fact that the applicant has its registered office
in this jurisdiction.
6. Each of the complaints were in almost identical terms. It is not necessary for
the purpose of this application, to examine the content of the complaints in any detail,
as this application deals with the admissibility of the complaints, rather than their
content.
7. It will suffice to note that each of the complainants complained that the
process leading to the creation of their account, wherein they had to indicate their
preference for various account settings, was unfair in that they alleged that it was
much easier to give consent to the applicant using their personal data, which could be
done by one click on the mouse; rather than choosing the option of managing their 3
own account settings, which required five separate steps and ten individual clicks on
the mouse.
8. It was further alleged that the language used in giving various options to a
person when opening an account was unfair in that it (a) was not transparent in
relation to what use would be made by the applicant of their personal data; (b) was
unclear in relation to what steps could subsequently be taken to alter the account
settings; (c) it engaged what are known as “dark patterns”, whereby wording was used
that influenced or prompted a person to take a particular option, by making that option
appear desirable, while at the same time, making the alternative negative option
appear undesirable, as it was described in unfavourable terms. That is but a very brief
account of the essence of the complaints lodged on behalf of the six complainants.
9. After notifying the applicant of receipt of the complaints, and having provided
the applicant with the written complaints received by the respondent and following a
considerable exchange of correspondence, in the course of which the applicant
provided substantial information in relation to its account creation process and in
relation to the use to which it puts the information that it gleans from the account
holders; the respondent decided on 23 October 2023, to commence an inquiry
pursuant to its powers under DPA 2018. It did that by issuing a notice of
commencement of inquiry (hereinafter ‘notice of commencement’) on that date.
10. By letter dated 30 November 2023, the applicant objected to the
commencement of the inquiry on the basis that the necessary criteria for admissibility
of a complaint had not been met.
11. In particular, the applicant requested that they be provided with the Google
account identifier information in respect of each account, (hereinafter ‘account
identification information’). This is essentially the Gmail address of each 4
complainant. The applicant further asked that if the complaint was being lodged by a
consumer agency pursuant to the provisions of Art. 80(1) of GDPR 2016, that they be
provided with copies of the mandates by which the data subject had authorised the
consumer agency to bring the complaint on his or her behalf.
12. The applicant also requested the evidence which demonstrated that each
consumer agency met the requirements to act as a representative body in respect of
each complaint. This essentially required evidence that the consumer agency (i) was a
not for profit organisation; (ii) had been properly constituted in accordance with the
law of the relevant Member State; (iii) had statutory objectives which are in the public
interest; and (iv) was active in the field of the protection of data subjects’ rights.
13. By letter dated 22 December 2023, the respondent replied, stating that it
disagreed with the assertion that they were obliged to provide a reasoned
determination to the applicant in relation to the admissibility of the complaints. It
denied that they were obliged to identify, or furnish, any documents which informed
the view that had been reached by the respondent that the complaints were admissible.
The letter went on to state that, as recorded in the notice of commencement, the
respondent had considered the information made available to it in respect of the
complaints, to include the content of the complaints themselves, and had satisfied
itself that it was appropriate that an inquiry be commenced in order to ascertain
whether one or more of the infringements had occurred, or was occurring. The letter
further stated that beyond that, issues relating to the validity and/or admissibility of
the complaints could and would be dealt with in the context of the decision to be
adopted by the respondent in due course. The letter further stated that prior to its
adoption, the decision would be circulated to the applicant in draft form and the 5
applicant would be afforded an opportunity to consider and respond to the contents
thereof prior to the decision being finalised and adopted.
14. In this application the applicant seeks an order setting aside the notice of
commencement on the basis that, under the DPA 2018, in order to have jurisdiction to
hold an inquiry into a complaint, the respondent was required to determine that three
criteria had been met: (a) that personal data of each of the individuals behind the
complaints had been processed by the applicant in a manner that those individuals
considered infringed GDPR 2016, insofar as it was processing by the applicant that
fell within the scope of the inquiry; (b) that each of the individuals had mandated the
consumer agency to make the complaint on their behalf; and (c) that each of the
consumer agencies met the criteria set down in Art. 80(1) of GDPR 2016.
15. It was submitted by the applicant that the respondent did not have information
or evidence before it, that would have enabled it to have been satisfied that these three
criteria had been met in respect of each complaint. It was submitted that the
respondent therefore lacked jurisdiction to commence the inquiry, given its state of
knowledge on 23 October 2023.
16. In its amended statement of grounds, the applicant states that in the light of the
information that has come to hand subsequently, the respondent is acting ultra vires,
insofar as it is proposing to inquire into complaints that fall outside the temporal
scope of the inquiry, as set out in the notice of commencement.
17. The respondent denies that the applicant is entitled to any of the reliefs sought
in the amended statement of grounds. The basis of their objection to the reliefs sought
is set out in detail later in the judgment.
Background. 6
18. Before coming to the arguments and the merits of the application, it is
unfortunately necessary to give some background to the steps that were taken by the
parties prior to the issuance of the notice of commencement. This is due to the fact
that one of the arguments raised by the respondent is that by its actions, and in
particular, by its protracted engagement with the respondent prior to the issuance of
the notice of commencement, without raising any issues in relation to the
admissibility of the complaints, the applicant thereby acquiesced in the inquiry
proceeding and is therefore estopped from raising the objections that it seeks to raise
in this application.
19. On 30 June 2022, the European Consumer Organisation (BEUC), issued a
press release wherein they alleged that Google was using deceptive design, unclear
language and misleading choices, when consumers signed up to a Google account to
encourage more extensive and invasive data processing. They claimed that contrary to
its claims, the tech company was thwarting consumers who wanted to better protect
their privacy. To that end, it was stated that ten consumer groups, under the
coordination of BEUC, were taking action to ensure that the applicant complied with
the law.
20. The press release stated that a consumer could choose to create a Google
account voluntarily, or could be obliged to create one, when they used certain Google
products and/or services. For example, they had to create an account when they
purchased a smart phone that uses Google’s android system, which BEUC claimed
almost seven in ten phones worldwide (69%) depended on, if they wanted to
download apps from the Google play store.
21. The press release went on to state that sign up was a critical point at which the
applicant made users indicate their “choices” about how their account would operate. 7
With only one step, known as “express personalisation”, the consumer would activate
all the account settings that feed the applicant’s surveillance activities. The applicant
did not provide consumers with the option to turn all settings “off” in one click. The
press release asserted that if customers wished to opt for the “manual personalisation”
option, that required five steps, with ten clicks and involved grappling with
information that was alleged to be unclear, incomplete and misleading.
22. The press release went on to state that the applicant was a colossus in the
world of surveillance capitalism, with 81% of its revenue coming from its advertising
operations, which in turn depended on the data it harvested from people to personalise
adverts for them. The press release stated that from advertising, the applicant was
forecast to earn €221bn in 2022, which was almost double the amount its closest
competitor, Facebook, was expected to make from digital advertising.
23. It is clear from the press release issued in June 2022, that the applicant must
have been expecting a fairly concerted attack on its account creation process. That
duly occurred on 29 September 2022, when the respondent wrote to the applicant
notifying it of a complaint that had been forwarded by the Slovenian supervisory
authority, in respect of a complaint lodged by a consumer agency on behalf of a
complainant resident in that country. The respondent issued a request for information
(hereinafter “RFI”) to the applicant in respect of that complaint. Thereafter, the
applicant requested an extension of time within which to respond to the queries raised
by the respondent.
24. By letter dated 04 October 2022, the respondent granted an extension of time
to 18 October 2022, in respect of all but one of its RFIs. On 06 October 2022, the
applicant provided responses to the RFIs comprising information, including screen 8
shots, regarding its account creation process. On 18 October 2022, the applicant
provided further responses.
25. On 27 October 2022, the respondent raised further RFIs. Further information
was provided by the applicant on 28 October 2022. On 05 October 2022, the applicant
requested an extension of time to furnish complete replies to the RFIs. This request
was granted on 08 November 2022. Further information was provided by the
applicant on 18 November 2022, and also on 01 December 2022.
26. On 05 December 2022, the applicant set out proposals regarding privilege,
confidentiality and commercial sensitivity attaching to documentation to be provided
in response to the RFIs. On 08 December 2022, the applicant provided further
information in response to the RFIs, identifying particular information regarding
settings and the purposes and legal basis of identified processing operations.
27. On 22 December 2022, the respondent requested the applicant to produce
documentation addressing a number of matters. That letter advised the applicant that
the respondent may “in due course…resolve to conduct a statutory inquiry into some
or all of the issues raised by the complaint”.
28. On 23 December 2022, the applicant addressed further issues of privilege
attaching to documents intended to be submitted to the respondent. It also responded
to RFIs raised by the respondent on 22 October 2022, including an appendix running
to 1,281 pages.
29. On 22 February 2023, the respondent issued notices pursuant to s.108(1) DPA
2018, to the Norwegian, French and Czech SAs. Similar notices were sent to the
Slovenian and Greek SAs on the following day.
30. On 16 March 2023, the respondent furnished copies of the full suite of
complaints to the applicant. The respondent advised the applicant that it was assessing 9
“what form of regulatory action it will take to handle these complaints”. By letter
dated 23 March 2023, the applicant raised issues regarding the respondent’s proposal
to share copies of certain documents with the CSAs. On 27 March 2023, the
respondent advised the applicant of its intention to exercise its discretion to
commence a statutory inquiry into the subject matter of the complaints.
31. By letter dated 12 May 2023, the respondent confirmed that it would not be
sharing identified documents with the CSAs at that time and that it had canvassed the
views of the CSAs regarding the appropriate scope of the inquiry, albeit it remained a
matter for the respondent as to whether to commence an inquiry and, if so, the
appropriate scope thereof.
32. On 23 May 2023, the applicant outlined certain changes to the account
creation process which it had implemented. By letter dated 01 September 2023, the
respondent sent further RFIs to the applicant regarding the changes made to the
account creation process. A response to that RFI was furnished by the applicant on 14
September 2023.
33. On 22 September 2023, the applicant furnished an appendix identifying
statistical information. A further appendix was delivered on 29 September 2023. A
further appendix identifying statistical information was furnished on 13 October 2023.
34. On 23 October 2023, the respondent notified the applicant of its intention to
commence inquiry bearing reference number “IN-23-2-4” by way of a notice of
commencement. The notice of commencement explained that it was a complaint-
based inquiry into the complaints. The notice also raised further RFIs.
35. By letter dated 25 October 2023, the applicant acknowledged receipt of the
notice of commencement and sought an extension of time to provide responses to the
RFIs. 10
36. By letter dated 30 November 2023, the applicant wrote to the respondent
requesting that it be provided with information relating to the respondent’s
jurisdiction to commence the inquiry. Specifically, the applicant sought the account
identifier information, the mandates signed by the complainants and the representative
body information in relation to the consumer agencies which had lodged the
complaints on behalf of the complainants.
37. On 04 December 2023, the applicant responded to a further RFI which had
formed part of the notice of commencement. The response ran to 319 pages, including
eight appendices. It was expressed to be made without prejudice to the applicant’s
letter of 30 November 2023.
38. By letter dated 13 December 2023, the applicant raised the issue of the
“validity and admissibility of the complaints, the material scope of the inquiry and the
confidentiality and the use of materials provide by Google to the DPC”.
39. On 19 December 2023, the respondent informed the applicant by email that it
was gathering information to enable it to respond to the applicant’s letter of 30
November 2023. The respondent stated that it was prepared to suspend the progress of
the inquiry pending this step being taken.
40. On 20 December 2023, the applicant wrote to the respondent, to propose a
standstill arrangement, which would afford the respondent additional time to gather
the information sought in the applicant’s letter of 30 November 2023, but without
prejudicing (by virtue of the passage of time) to the applicant’s right to seek judicial
review of the respondent’s decision to commence the inquiry in due course. That
proposal was rejected by the respondent on 22 December 2023. By letter dated 10
January 2024, the applicant wrote to the respondent requesting it to reconsider its
position in respect of the proposed standstill arrangement. 11
41. On 18 January 2024, the applicant issued the within proceedings. The
application seeking leave to proceed by way of judicial review was opened on 22
January 2024, but was adjourned on that date to enable it to be made on notice to the
respondent.
42. On 06 February 2024, the respondent confirmed to the court that it was not
objecting to the applicant’s application for leave to seek judicial review and that it
would agree to an effective stay on the inquiry pending the outcome of the
proceedings.
43. Following the exchange of pleadings in the case, including delivery of an
amended statement of grounds and an amended statement of opposition, the
application was heard before this Court on 25 and 26 July 2024.
Relevant Legislation.
44. The key provisions of GDPR 2016 for the purposes of this application, are
Arts. 77 and 80. Article 77 provides that without prejudice to any other administrative
or judicial remedy, every data subject shall have the right to lodge a complaint with a
supervisory authority, in particular in the Member State of his or her habitual
residence, place of work, or place of the alleged infringement, if the data subject
considers that the processing of personal data relating to him or her infringes the
regulation.
45. Article 80 provides that the data subject shall have the right to mandate a not
for profit body, organisation or association, which has been properly constituted in
accordance with the law of a Member State; has statutory objectives which are in the
public interest, and is active in the field of the protection of data subjects’ rights and 12
freedoms with regard to the protection of their personal data, to lodge the complaint
on his or her behalf.
46. It should be noted that while Art. 80(2) provides that Member States may
make provision for the lodgement of complaints by an organisation or association on
its own behalf, and independently of a data subject’s mandate; Ireland has not
incorporated this provision into its domestic law.
47. There are a number of provisions of DPA 2018 which are of relevance. The
first of these is s.107, which provides that the term “complainant” means a data
subject who lodges a complaint, or as the case may be, a not for profit body,
organisation or association that, in accordance with Article 80(1), lodges a complaint
on behalf of a data subject.
48. Section 107 defines the term “complaint” in the following way:
““complaint” means a complaint lodged pursuant to Article 77(1) or
in accordance with Article 80(1), and shall be deemed to include a
complaint so lodged by or on behalf of a data subject where—
(a) the data subject considers that the processing of personal data
relating to him or her infringes a relevant enactment, and
(b) the Commission is the competent supervisory authority in respect of
the complaint;”
49. Section 108(2) provides that where the Commission is the competent
supervisory authority in respect of a complaint, it shall (a) handle the complaint in
accordance with that part of the Act, and (b) inform the complainant of the progress or
outcome of the complaint.
50. Section 109 provides that for the purposes of s.108(2)(a) the Commission shall
examine the complaint and shall, in accordance with that section, take such action in 13
respect of it as the Commission, having regard to the nature and circumstances of the
complaint, considers appropriate. The section goes on to outline a number of steps
that can be taken by the Commission in the handling of a complaint, including the
causing of such inquiry as the Commission thinks fit to be conducted in respect of the
complaint, and the taking of such other action in respect of the complaint as the
Commission considers appropriate.
51. Section 110 is of particular relevance. It gives the Commission the power to
conduct an inquiry into a suspected infringement of a relevant enactment. It provides
as follows:
“110. (1) The Commission, whether for the purpose of section
109(5)(e), section 113(2), or of its own volition, may, in order to
ascertain whether an infringement has occurred or is occurring, cause
such inquiry as it thinks fit to be conducted for that purpose.
(2) The Commission may, for the purposes of subsection (1), where it
considers it appropriate to do so, in particular do either or both of the
following:
(a) cause any of its powers under Chapter 4 (other than section 135) to
be exercised;
(b) cause an investigation under Chapter 5 to be carried out.”
52. Finally, s.113 deals with the situation where Art. 60 applies. Where the
Commission is the LSA, the section provides that it will make a draft decision in
respect of the complaint. The section goes on to make further provisions in relation to
the content and issuing of the draft decision. 14
Summary of Receipt of Relevant Information by the Respondent in respect of
Each Complaint.
53. The dates on which information in relation to the account identifiers, the
mandates from the complainants and the representative body information, was
furnished to the respondent and the nature of that information in each case, has been
set out in extenso in the various affidavits sworn on behalf of the respondent. It is not
necessary to set out in detail each of the dates on which each piece of information in
respect of each complaint was furnished to the respondent. A brief summary of the
overall position will suffice.
54. At the date of the notice of commencement, the respondent only had account
identifier information in respect of the Spanish complaint. However, the respondent
was not aware that it had that information at that time. All the relevant account
identifier information, being the relevant Gmail addresses, came into the possession of
the respondent between December 2023 and February 2024, save for the Czech
complaint, which information was never produced.
55. At the date of the notice of commencement, the respondent had mandates from
the complainant’s authorising the consumer agencies concerned to bring the
complaints on their behalf, in respect of the Norwegian, French and Spanish
complaints. The respondent subsequently obtained mandates in respect of the
Slovenian, Greek and Czech complaints in December 2023 and February 2024.
56. At the date of the notice of commencement, the respondent had some
representative body information in respect of the Norwegian and Spanish consumer
agencies. The representative body information for the remaining consumer agencies,
being the Slovenian, Greek, French and Czech consumer agencies, was received
between December 2023 and February 2024. 15
Submissions of the Applicant.
57. The applicant submitted that in order for the respondent to have jurisdiction to
deal with a complaint submitted by a representative body on behalf of a data subject,
three conditions had to be satisfied: first, that personal data of the data subject had
been processed by the applicant in a manner that those individuals considered
infringed GDPR 2016, or DPA 2018; secondly that each individual had mandated the
consumer agency to act on their behalf; and, thirdly, that each of the consumer
agencies met the criteria for them to act as a representative body, as set down in Art.
80(1) of GDPR 2016.
58. It was submitted that it was clear that when the respondent decided to
commence the inquiry on 23 October 2023, it had failed to satisfy itself, and had no
information on which it could have satisfied itself, as to these criteria. Therefore, it
could not have been satisfied that it had jurisdiction to conduct the inquiry. The
respondent having failed to take these steps, the applicant submitted that the inquiry
was unlawful.
59. The applicant submitted that having regard to the cost and potential adverse
consequences for the applicant in having to disclose highly confidential commercial
information in the course of the inquiry, it was necessary for the respondent to make a
decision on the admissibility of the complaints at the outset. To that end, the
respondent should have ensured that the complaints received by it complied with the
requirements set down in DPA 2018, before deciding to commence an inquiry. It was
submitted that these requirements were essential to give the respondent jurisdiction to
commence an inquiry. 16
60. It was submitted that the respondent could not have been satisfied that the
complaints in this case were admissible at the time that it decided to commence the
inquiry in October 2023, because it did not have the basic information that was
necessary to establish that the complaints were admissible. The respondent was only
in possession of account identifier information in respect of the Spanish account, but
it was not aware of that at the relevant time. It did not have mandate information in
respect of the Slovenian, Czech or Greek complaints and it did not have representative
body information in respect of any of the complaints.
61. The applicant submitted that without this basic information, which was
mandated by the statutory regime established under DPA 2018, the respondent lacked
jurisdiction to begin the inquiry, which it had purported to do by the notice of
commencement dated 23 October 2023.
62. Insofar as the respondent had asserted in correspondence that the issue of
admissibility would be determined at some unspecified later stage in the course of the
inquiry, it was submitted that the respondent was wrong in that assertion, because by
so doing it was effectively giving itself jurisdiction to conduct an inquiry into the
complaint before it had ruled that the complaint was properly admissible. If the
complaint was found to be inadmissible, the respondent would not have jurisdiction to
conduct an inquiry into it. Therefore, it was submitted that the decision on
admissibility of the complaint had to be made at the outset of the process.
63. Counsel for the applicant further submitted that by deferring a definitive
decision on admissibility until the preliminary draft decision was delivered, the
applicant would be put to the expense and time consuming work of addressing the
merits of the complaints, which would involve supplying substantial amounts of
commercially confidential information, which could be disclosed to the CSAs in the 17
course of the preliminary draft decision, before it had even been established that the
complaints were admissible. It was submitted that that would place the applicant in a
position of considerable jeopardy, involving disclosure of its sensitive commercial
information. It would also put the applicant to inordinate expense in dealing with a
complaint that may ultimately be found to be inadmissible.
64. In addition, it was submitted that having regard to the very large fines that can
be imposed by the respondent in the event that certain conclusions are reached by it,
the possibility of such fines being imposed may require the applicant to make an
announcement to the markets, which would have an adverse effect on the applicant’s
share price.
65. At its simplest, the applicant’s argument was that the respondent only has
jurisdiction under the DPA 2018 to handle complaints that comply with the statutory
criteria.
66. It was submitted that the respondent had decided to embark on an inquiry into
complaints, before it had ruled definitively on their admissibility and had done so at a
time when they could not have been satisfied that the necessary criteria had been met,
because the necessary information was not in their possession at the date when they
made the decision to commence the inquiry. It was submitted that on this basis, the
notice of commencement should be struck down.
67. The applicant also challenged the level of reasoning that had been furnished
by the respondent in relation to the admissibility of the complaints. It was submitted
that in its letter of 23 December 2023, the respondent had merely stated that it was
satisfied that the complaints were admissible on the basis of the written documents
that had been submitted to it. At the same time, the respondent had maintained that the
issue of admissibility would be addressed further in the course of the inquiry. It was 18
submitted that the reasons given by the respondent on why the complaints were held
admissible, were wholly inadequate, as they did not address any of the issues that had
been raised in the applicant’s letter of 30 November 2023.
68. It was submitted that insofar as the respondent had alleged that the applicant
was estopped from challenging the notice of commencement, due to the fact that it
had engaged in a substantial way with the respondent prior to the date of the issue of
the notice of commencement; that was misconceived, because the applicant was under
a statutory duty to cooperate with the respondent whenever it wrote to the applicant in
relation to a potential complaint.
69. Secondly, the applicant did not know that the respondent did not have the
relevant information and more importantly, did not propose to obtain it until the
substantive inquiry was underway. It was submitted that without this knowledge, the
applicant could not be said to have acquiesced in the inquiry commencing in the
absence of that information.
70. It was submitted that the applicant had raised the objection to jurisdiction at
the earliest possible opportunity. It was submitted that in these circumstances there
had been no acquiescence by the applicant which would be sufficient to prevent it
raising the issue of jurisdiction at this stage.
71. Finally, in light of the information that had come to hand subsequently, it was
submitted in the additional grounds as pleaded in the amended statement of grounds,
that the respondent was purporting to hold an inquiry into complaints that were either
inadmissible, such as the Czech complaint, because that person had not opened an
account with the applicant and therefore no processing of her data had taken place; or
the complaint was out of scope, as the date of creation of the account was outside the
temporal scope identified in the notice of commencement. It was submitted that the 19
respondent was acting ultra vires in purporting to deal with these complaints in the
course of the inquiry.
Submissions on behalf of the Respondent.
72. On behalf of the respondent it was submitted that the protection of personal
data was a fundamental right of every person whose personal data was sought to be
processed by a person or entity. That was recognised in GDPR 2016 and in DPA
2018.
73. It was submitted that under DPA 2018, the respondent is given very wide
powers to hold an inquiry into a complaint whenever it deems it necessary to do so.
There are no specific preconditions that have to be complied with, before the
respondent can decide to commence an inquiry.
74. In particular, it was submitted that there was no requirement under the
statutory regime, for a preliminary hearing, or a decision on admissibility of the
complaint, prior to deciding to commence an inquiry into the complaint.
75. It was submitted that the definition of a “complaint” in s.107, made it clear
that there were two admissible criteria. First, consistent with Art. 77(1), there must be
a data subject who considers that the processing of personal data relating to him or her
infringes a relevant enactment. This required a subjective belief on the part of a data
subject that the processing of their personal data infringed a relevant enactment.
Secondly, the respondent must be the LSA in a complaint involving cross border
processing. It was submitted that both these criteria were satisfied at the time when
the respondent made its decision to commence the inquiry in October 2023.
76. It was submitted that it was important to note that the issue of admissibility
was not being determined once and for all at the commencement of the inquiry. If it 20
could be established that for any reason, a particular complaint was not admissible, it
could be struck out at any stage of the inquiry, once the fact of its inadmissibility had
been established.
77. Insofar as the applicant had complained about the absence of material in
relation to the account identifier information, the mandates and the representative
body information, not being in the possession of the respondent at the date on which it
decided to commence the inquiry; it was submitted that where the complaints had
been transferred to the respondent by the CSAs in the Member States where the
complaints had originated, the principle of EU law of mutual trust and the duty of
sincere cooperation came into play.
78. It was submitted that this principle had been described as one of fundamental
importance to European law and to the effective functioning of the EU. In essence, it
required the respondent, as the LSA, to assume that the CSAs which had forwarded
the complaints to it, had complied with their obligations under European law, and had
done so on the basis that the complaints constituted admissible complaints. It was
submitted that the respondent was not merely entitled to so presume, but was obliged
to operate on the basis that the CSAs had not transmitted complaints that were lacking
mandates, or in respect of bodies that did not comply with the requirements for a
representative body as contained in GDPR 2016.
79. It was submitted that the applicant had engaged with the respondent in relation
to the Slovenian complaint for a period of approximately fourteen months, and in
relation to the other complaints for a period of approximately seven months, prior to
the issuance of the notice of commencement; during that time they had never raised
the issues concerning account identifier information, mandates or representative body
information, which had been raised for the first time in their letter of 30 November 21
2023. It was submitted that in these circumstances, the applicant had acquiesced in the
conduct of the process and they were estopped from challenging that process many
months after it had commenced.
80. It was submitted that even if the court were to hold against the respondent in
relation to the issue of jurisdiction at the date of the notice of commencement, the
court should have regard to the information that has subsequently come to hand, as
exhibited in the affidavits filed in these proceedings, which clearly showed that the
necessary mandates had been in place at all relevant times and that the consumer
agencies satisfied the criteria to act as representative bodies pursuant to Art. 80 of
GDPR 2016.
81. It was submitted that in these circumstances, the court should either hold that
the respondent has jurisdiction to proceed with its inquiry, or in the alternative, it
should decline to strike down the notice of commencement, on the basis that it would
be futile to do so, as the respondent would simply issue a fresh notice of
commencement immediately in respect of the same complaints. It was submitted that
the more preferable course of action was to allow the notice of commencement to
continue, particularly as this would cause no prejudice to the applicant, as the inquiry
had been effectively stayed by agreement pending the outcome of these proceedings.
82. In relation to the Czech complaint, it was submitted that the fact that the data
subject in that case had not completed the account creation process, did not mean that
her complaint was inadmissible. She was still entitled to make a complaint that the
terms and conditions as set down by the applicant in the account creation process,
were misleading, lacking in transparency and unfair to consumers. In this regard the
respondent referred to the decision of the CJEU in the Meta Platforms Ireland Limited
case (C-757/22). 22
83. In relation to the assertion that certain complaints that were proposed to be
examined as part of the inquiry were out of scope, this appeared to refer to the French
complaint, where the applicant maintained that the relevant account had been opened
in 2014. However, the French complainant was adamant that her account had been
opened in 2022, which was in scope. That issue would be determined in the course of
the inquiry.
84. It was submitted that if a complaint is established as being out of scope,
because it was established that the account was opened outside the inquiry period,
then that complaint will be struck out in the course of the inquiry.
85. It was submitted that it was not required, nor was it desirable, to have an
elaborate preliminary hearing and decision on admissibility at the outset. That would
only make the procedure overly complex, which was not desirable having regard to
the rights guaranteed in the regulation and in the Act; and having regard to the need
for an effective method of protecting those rights.
86. It was submitted that for these reasons the court should refuse the reliefs
sought by the applicant and should allow the inquiry to continue.
Conclusions.
The Criteria for an Admissible Complaint.
87. Having considered the papers, and the oral and written arguments of counsel,
together with the legal authorities referred to therein, the court has reached the
following conclusions in this case: First, the privacy of personal data has been
recognised in European and Irish Law as deserving of particular protection.
88. This is provided for in GDPR 2016 and in DPA 2018. Both provide significant
protection to an individual in relation to the harvesting and use of their personal data. 23
Individuals are given extensive rights in relation to what information they must be
given when their consent is sought for the retention and use of their personal data.
There are extensive provisions in relation to the terms in which their consent may be
obtained as part of the opening of an account, and in particular, the information that
they must be given in relation to the processing and use of their personal data.
89. Individuals are also given the right in Art. 77 of GDPR 2016 to make a
complaint to the supervisory authority in their country of origin, or residence. That is
a significant right, which must not be rendered incapable of being effectively invoked
by the application of an overly restrictive admission process.
90. The power of the respondent to handle a complaint and, if necessary, to
commence an inquiry, is contained in DPA 2018. While it is undoubtedly a wide
power, I accept the submission made on behalf of the applicant that certain basic
criteria have to be met in order for a complaint to be admissible.
91. When a complaint has been lodged by a consumer agency acting on behalf of
a data subject, the following criteria must be met: that personal data of the
complainant has been processed by the person, or entity, against whom the complaint
is made, in a manner that the data subject considers infringes GDPR 2016, or DPA
2018; that the complainant has mandated the consumer agency to act on their behalf
in bringing the complaint; and that the consumer agency meets the criteria for a
representative body as set down in Art. 80(1) of GDPR 2016.
92. That is not a demanding set of criteria. The first and most fundamental
criterion is that a person’s personal data has been processed by the person or entity
against whom they wish to lodge the complaint. To establish that, they need to furnish
the account identifier information, which in this case, is effectively their Gmail
address. 24
93. By opening the Google account, they have established that they have
participated in the account creation process that applied as of the date of opening of
the account. Their personal data, in the form of the information that they provided ab
initio when opening the account, and their account usage history after opening,
constitutes the personal data that is processed by the controller of the account, in this
case, by the applicant.
94. I accept the submission made by the applicant that it is essential that account
identifier information is provided by the complainant at the outset, because it is that
information which establishes that an account was in fact opened by the data subject
with the applicant. This is basic information which the respondent should have been
given by the complainant at the outset.
95. To argue by analogy, if the Irish Medical Organisation are considering a
complaint against a doctor, which is brought by an adult, the most basic piece of
information required is that the complainant should establish that they were actually
treated by the named doctor. To that end, they would have to provide their own name,
the name of the doctor concerned and the date of alleged mistreatment, or misconduct.
96. If the patient refused to give his or her name, the IMO could not proceed to
consider the complaint, because the doctor would not know whether he or she had
treated the person, or had had any dealings with them.
97. In this case, the provision of account identifier information was essential for
two reasons: first, it would show that an account was in fact opened by the
complainant with the applicant; secondly, it would establish which account creation
process had been in place leading to creation of the account. Accordingly, I hold that
the applicant is correct in its submission that the account identifier information was 25
essential information which the respondent should have had when it decided to
commence an inquiry into each complaint.
98. I am also satisfied that the requirements of fairness in the process, demand that
when the respondent decided that it was appropriate to hold an inquiry into a
particular complaint, the applicant should be given the account identifier information
in respect of each complaint. Otherwise, it could not adequately prepare its response
to each complaint.
99. At its most basic, if a person is going to make a complaint against a person or
entity, basic fairness requires that the person or entity against whom the complaint is
made, be given basic information about the complaint, which would include
information showing that an account was actually opened by the person with the data
controller.
The Czech Complaint.
100. Before coming to the other necessary criteria for an admissible complaint, I
will deal with the issue of the Czech complaint. I accept the argument made on behalf
of the applicant that this complaint is inadmissible because the Czech person did not
open any account with the respondent; therefore, the respondent did not process any
of her personal data.
101. The wording of both Art. 77 GDPR 2016 and s.107 DPA 2018, make it clear
that a data subject can make a complaint if they consider that the processing of their
personal data “infringes this regulation” (GDPR 2016), or “infringes a relevant
enactment” (DPA 2018). In both cases the verb is in the present tense. If it were
intended to give a right to a data subject to make a complaint in circumstances where 26
they had not in fact opened an account, the verb would have to be in the future
conditional tense.
102. I am satisfied that the wording of these provisions make it clear that when
lodging the complaint, the complainant must hold the subjective view that the
processing of their personal data by the person or entity, infringes the relevant
provisions of EU law or Irish law. That clearly requires that their personal data is
being processed by the person or entity complained against. For that to happen in this
case, the complainant would have to have opened an account with the applicant.
103. In relation to the Czech complaint, it appears that the person did not like the
terms on which the Google account was offered to her, so she did not continue with
the account creation process. She did not open any Google account. Her personal data
was never processed by the applicant. In these circumstances, I hold that she does not
have an admissible complaint against the applicant, as none of her personal data was
ever processed by the applicant.
104. The respondent relied on the decision of the CJEU in Meta Platforms Ireland
Limited (case C-757/22) as authority for the proposition that a complaint can be made
where inadequate information in relation to the processing of personal data is given by
the data controller at the account creation stage, even though the complainant does not
create an account, or provide their personal data.
105. In particular, the respondent relied on the following paragraphs from the
judgment, as authority for the proposition that a complaint can be lodged, even where
personal data is not actually provided by the data subject:
“61 In so far as processing of personal data carried out in breach of
the data subject's right to information under Articles 12 and 13 of the
GDPR infringes the requirements laid down in Article 5 of that 27
regulation, the infringement of that right to information must be
regarded as an infringement of the data subject's rights 'as a result of
the processing', within the meaning of Article 80(2) of that regulation.
62 It follows that the right of the subject of a personal data processing
operation, under the first sentence of Article 12(1) and Article 13(1)(c)
and (e) of the GDPR, to obtain from the controller, in a concise,
transparent, intelligible and easily accessible form, using clear and
plain language, information relating to the purpose of such processing
and to the recipients of such data, constitutes a right whose
infringement allows recourse to the representative action mechanism
provided for in Article 80(2) of that regulation.
63 That interpretation is confirmed, first, by the objective of the
GDPR, recalled in paragraph 48 above, of ensuring effective
protection of the fundamental rights and freedoms of natural persons
and, in particular, a high level of protection of the right of every
person to privacy with respect to the processing of personal data
concerning him or her.”
106. On a close reading of that judgment, I am not satisfied that it actually supports
the argument made by the respondent in the present proceedings. In the Meta case the
proceedings were instituted in Germany by a consumer agency under the domestic
law of Germany, prior to the entry into force of Art. 80(2) of GDPR 2016. However,
Germany had enacted the provisions of Art. 80(2) into its domestic law. Accordingly,
it was effectively a complaint lodged directly by a consumer agency. It was not a
complaint submitted on behalf of any particular data subject. 28
107. In countries where it is possible for consumer agencies to lodge complaints
directly, it is implicit that they must be able to bring complaints without opening an
account, because as a consumer agency, they will never have personal data within the
meaning of the regulation.
108. Thus, by giving a consumer agency the right to lodge complaints directly
pursuant to Art. 80(2), the relevant Member State, and indeed the regulation, is
implicitly authorising them to bring complaints when they think that an infringement
of GDPR 2016 has, or may occur, even though they do not have personal data of their
own. These are the relevant facts underlying the decision in the Meta case.
109. In the case of a person who makes a complaint under Art. 77, as enacted in
Irish law in s.107, it is necessary that the person must have formed the subjective
opinion that the processing of their personal data “infringes a relevant enactment”. I
hold that for a complaint to be lodged with the respondent by or on behalf of a person,
the requirement that they believe that processing of their personal data by the person
or entity infringes their rights under the regulation and the Act, requires that they must
have opened an account, or otherwise had their personal data processed by the person
or entity, against whom the complaint is made.
110. As the Czech complainant did not open an account with the applicant, and in
the absence of any evidence that her personal data was processed by it, I hold that the
Czech complaint is inadmissible.
The Remaining Criteria for an Admissible Complaint.
111. Returning to the remaining criteria that must be met for a complaint to be
deemed admissible, I accept the submission on behalf of the applicant that where a
complaint is lodged by a consumer agency on behalf of a person, there must be some 29
evidence that the consumer agency has been authorised by the data subject to bring
the complaint on their behalf. This is a fundamental principle of the law of agency: A
can only act on behalf of B, where he has been authorised by B to do so.
112. Art. 80(2) of the regulation was not implemented into Irish law. Therefore, a
consumer agency does not have the right to lodge a complaint on its own behalf. A
consumer agency has power to lodge a complaint with the respondent, when it is
acting on behalf of a data subject within the meaning of the Act.
113. To establish that, all that is required, is that a mandate be signed by the data
subject that they authorise the consumer agency to lodge a complaint on their behalf.
That is not an onerous requirement. The mandate does not have to be sworn before a
solicitor, or be notarised in any particular way. It is simply a written confirmation that
the consumer agency has authority to act on behalf of the complainant. It ought to
have been in place at the outset, and certainly before the respondent made the decision
to commence an inquiry.
114. The third essential condition for admissibility of a complaint, arises where the
complaint is lodged by a consumer agency. In such circumstances in order for the
complaint to be admissible, the organisation must comply with the requirements of
Art. 80(1). This requires that the consumer agency must be a not-for-profit body,
organisation or association, which has been properly constituted in accordance with
the law of a Member State; has statutory objectives which are in the public interest;
and is active in the field of the protection of data subjects’ rights and freedoms with
regard to the protection of their personal data.
115. The respondent accepts that all these criteria must be met, but states that it is
not necessary that they be established at the outset. I am satisfied that they are wrong
in that regard. 30
116. The requirements for an admissible complaint are not onerous. In the
circumstances of the present case, the complainants have to establish that they opened
an account with the applicant; that is established by providing their Gmail addresses,
and that they hold the subjective opinion that the processing of their personal data by
the controller infringes relevant enactments, that is proven by lodging the complaint
itself. They have to establish that they have authorised the consumer agencies to bring
the complaints on their behalf; which is done by providing a mandate authorising the
consumer agency to do so. Finally, there must be some evidence that the consumer
agency meets the requirements of being a representative body, as set out in Art. 80(1).
All of that is very easily done. It should have been done before deciding to hold an
inquiry into the complaints.
117. The reason why this should be done at the outset and not during the inquiry, as
proposed by the respondent, is that the very existence of the inquiry can have
significant adverse effects on the person, or entity, against whom the complaint is
made.
118. In Facebook Ireland Limited v Data Protection Commission [2021] IEHC
336, Barniville J (as he then was) noted that the commencement of an inquiry by the
respondent into suspected infringement of the GDPR, has legal consequences. He set
out some of these consequences at para. 130:
“First, as noted above, the commencement of an inquiry by the DPC
into suspected infringement of the GDPR does have legal
consequences. Once an inquiry is commenced, the DPC may cause any
of its powers under Chapter 4 (other than s. 135) to be exercised
and/or an investigation under Chapter 5 to be carried out (s. 110(2)).
Chapter 4 (ss. 129 to 136) of the 2018 Act provides for a range of 31
powers to be exercised by the DPC, including the appointment of
authorised officers, who are given a range of powers, including entry,
search and seizure powers, the entitlement to apply for search
warrants and to serve an information notice requiring certain
information from a controller or processor. Chapter 4 creates various
criminal offences to support the DPC and its authorised officers in
respect of the powers contained in that chapter. There are other
compulsory powers contained in Chapter 5. The DPC may cause those
powers to be exercised for the purposes of an inquiry which it has
caused to be conducted under s. 110(1) of the 2018 Act. The decision
by the DPC to commence an inquiry and the commencement of that
inquiry does, therefore, have legal consequences in that those
compulsory powers to which I have just referred may be exercised by
the DPC for the purposes of such inquiry.”
119. In addition, when responding to the merits of the complaint, the entity
concerned may have to furnish extensive information that is commercially sensitive.
If the ruling on admissibility of the complaint, is not made until the preliminary draft
decision, by that time, some or all of the commercially sensitive information may be
contained in the PDD itself, which is furnished to the CSAs under the Art. 60 process.
I am satisfied that there is a legitimate concern on the part of the applicant, that
release of that information in the context of the PDD, could cause it significant harm.
120. I also accept the submission on behalf of the applicant, that the possibility of
the imposition of substantial fines, which can arise at the conclusion of an inquiry,
may require the applicant to make a statement to the stock market, with adverse
effects on their share price. 32
121. I also accept their argument, that they will have to commit very considerable
resources in terms of manpower and legal resources, to meet the merits of the
complaints. They should not have to do that, unless and until the complaints are
deemed admissible by the respondent.
122. Accordingly, I hold that the applicant is correct in its essential submission that
the criteria for an admissible complaint should have been established to the
satisfaction of the respondent, before it decided to commence the inquiry into the
merits of the complaints in this case.
The Acquiescence Issue.
123. I turn now to deal with the arguments raised by the respondent as to why the
reliefs sought by the applicant should not be granted in the circumstances of the case
generally, and in particular, in light of the facts that have unfolded since the
commencement of the proceedings.
124. The respondent submitted that it was well established in Irish law, that where a
person participated in a statutory or other process, knowing of the defect or want of
jurisdiction, they could not subsequently challenge the process, or the jurisdiction of
the body to act in the way that they had consented to: see The State (Byrne) v Frawley
[1978] IR 326; Brennan v Governor of Portlaoise Prison [2008] 3 IR 364; Q(M) v
Judge of the Northern Circuit [2003] IEHC 88.
125. The respondent submitted that having been informed of the Slovenian
complaint some fourteen months in advance of the notice of commencement, and
having been informed of the remainder of the complaints in March 2023, some seven
months prior to the notice of commencement; and having engaged extensively with
the respondent during those periods, without raising any objection in relation to the 33
admissibility of the complaints; the applicant had acquiesced in the handling of the
complaints by the respondent to such an extent that it was estopped from raising the
admissibility issues that it had sought to raise in its letter of 30 November 2023 and in
the present proceedings. In particular, it was submitted that the applicant was
estopped from challenging the jurisdiction of the respondent to deal with the
complaints, when it had engaged actively with that process for such a prolonged
period of time.
126. The court accepts the broad submission made on behalf of the respondent that
where a person, with full knowledge of all relevant facts, participates in a statutory
process, they cannot subsequently, when they receive an adverse decision at the end
of that process, seek to challenge the jurisdiction of the decisionmaker.
127. In R (Kildare County Council) v Commissioner of Valuation [1901] 2 IR 215,
the Valuation Commissioner, when carrying out a valuation of a railway line in
County Kerry, purported to carry out a valuation of all parts of the main line,
including that part of the line running through County Kildare, notwithstanding that
no reference had been made to him in respect of a revaluation in that county. When
the valuation for County Kildare was reduced by the Commissioner, Kildare County
Council brought the matter back in before the Commissioner, who refused to alter his
valuation. Thereafter, they appealed to the County Court. Their notice of appeal did
not state want of jurisdiction as a ground of appeal. The County Court judge affirmed
the valuation.
128. The County Council then issued a writ of certiorari to quash the revised
valuation lists. In the Court of Appeal, Holmes LJ agreed with Palles CB in the lower
court, that the right to question an adjudication could be lost by the conduct of the
applicant. He stated that he could not conceive of a stronger case of estoppel by 34
conduct than in the case before him. The County Council had taken an appeal from
the valuation, with a view to having the valuation increased. By so doing, they had not
challenged the jurisdiction to make the valuation, but had in fact acted upon it, by
bringing the appeal with a view to getting an increased valuation. The court held that
the County Council’s acquiescence in the process and their conduct in bringing an
appeal on the merits, was sufficient to estop them from subsequently challenging the
jurisdiction of the Valuation Commissioner.
129. More recently, in Podariu v Veterinary Council of Ireland [2018] 3 IR 124,
the Court of Appeal revisited the law in relation to the circumstances in which
acquiescence and estoppel by conduct, can be said to confer jurisdiction on a statutory
tribunal. In that case, the Veterinary Council had purported to deal with an additional
complaint, which had not been referred to it by the Preliminary Investigation
Committee. Delivering the judgment of the court, Hogan J described the principle of
estoppel by conduct in the following way at para. 38:
“The law in relation to estoppel by conduct is illustrated by a trilogy of
leading Supreme Court decisions from the 1970s: In re Green Dale
Building Co. [1977] I.R. 256, Corrigan v. Irish Land Commission
[1977] I.R. 317 and The State (Byrne) v. Frawley [1978] I.R. 326. It is
quite clear from these cases that an entirely new jurisdiction cannot be
created by estoppel. Thus, for example, a decision of the Medical
Council purporting to sanction a veterinary surgeon would be wholly
void and ineffective, even if the veterinarian in question had somehow
submitted to the jurisdiction of that council. It is likewise clear that the
District Court cannot exceed its own geographical limitations by
purporting to deal with offences which had not been the subject of a 35
complaint made within the appropriate District Court district.
In O'Malley v. District Judge Kelly [2015] IECA 67, (Unreported,
Court of Appeal, 27 March 2015) this court accordingly held that the
District Court had no jurisdiction in such cases and quashed the
ensuing convictions, the acquiescence of the applicant in the entire
procedure notwithstanding.”
130. However, the court went on to note that the statutory provisions which
provided for the referral of complaints to the Fitness to Practice Committee, by the
Preliminary Investigation Committee, was primarily designed as a protection for the
veterinary surgeon. The court held that there had been sufficient acquiescence on the
part of the applicant to the addition of complaint number 17 at the hearing before the
FTPC. He was deemed to have waived the protection of the statutory provisions
which existed for his benefit. He was thus precluded from challenging the validity of
the FTPC decision to permit such an amendment to the notice of inquiry. The
applicant was held to be estopped by his conduct from challenging or impugning the
validity of the FTPC decision to permit the additional complaint to be added to the
original complaints. He was deemed by his acquiescence to have waived the statutory
provisions which existed for his benefit.
131. In light of these principles, I do not regard the argument advanced by the
respondent as being well founded for the following reasons: first, for acquiescence to
give rise to an estoppel by conduct, it must take place where the person who is said to
have acquiesced in the process, has full knowledge of all relevant facts, and with such
knowledge, has made a decision to participate in the process.
132. In this case, the applicant did not know that the respondent did not have much
of the requisite information when it decided to commence the inquiry. The applicant, 36
not unreasonably, assumed that the respondent had obtained the relevant information
so as to establish the admissibility of the complaints, when it decided to commence
the inquiry. The absence of any request for such information prior to being told that
an inquiry would be commenced, does not constitute knowledge or acquiescence in
the inquiry proceeding in the absence of that essential information.
133. Secondly, I accept the submission made on behalf of the applicant, that the
applicant was obliged by the DPA 2018, to cooperate with the respondent. Thus, the
significant engagement which the applicant had with the respondent since receipt of
the Slovenian complaint in September 2022, does not constitute a waiver by the
applicant of compliance with the necessary criteria for admissibility of a complaint.
134. I hold that by its engagement with the respondent in the period prior to the
decision to commence the inquiry on 23 October 2023, the applicant did not acquiesce
in the complaints being the subject of an inquiry, without the necessary criteria for
admissibility being met.
Principle of Mutual Trust and Duty of Sincere Cooperation.
135. The respondent’s submission under this heading has been summarised earlier
in the judgment. The court does not accept the proposition that the mere receipt by the
respondent of complaints from the CSAs in six countries, obliged it under the
principle of mutual trust and duty of sincere cooperation, to reach the conclusion that
the necessary criteria had been examined and had been found to have been in
existence by the CSAs concerned.
136. There is no evidence, save perhaps in relation to the Greek complaint, that the
CSAs concerned had examined the admissibility of the complaints. In other words,
there is nothing to suggest that the CSAs, with the exception of the Greek SA, had 37
sought mandates from the data subject to the complaint being lodged on their behalf
by a consumer agency. Nor was there any evidence that they had satisfied themselves
that the consumer agencies concerned had complied with the requirements for
representative bodies as set down in Art. 80(1) of GDPR 2016.
137. In other words, in the absence of anything to suggest that any vetting or
screening of the complaints for admissibility, had been carried out by the CSAs, the
respondent could not rely on the principle of mutual trust and the duty of sincere
cooperation, to make the assumption that such screening or assessment had been
carried out, or that the forwarding of such complaints constituted evidence that the
requisite criteria had been complied with.
138. The principle of mutual trust and the duty of sincere cooperation, only
provides that one state agency must assume that a state agency in another state has
complied with its obligations under EU law. In this case, the obligation on the CSA
was not to handle, or consider, the complaint; it was merely to pass it on to the
respondent as LSA for such investigation and determination as it considered
appropriate. Thus the respondent could not assume under this principle, that the CSAs
had found the complaints admissible. Accordingly, I reject this submission.
The Argument based on Rowland v An Post.
139. The respondent submitted that the present application should be refused on the
basis of the decision of the Supreme Court in Rowland v An Post [2017] 1 IR 355. In
that decision, the Supreme Court had held that for disciplinary inquiries within the
employment context, ordinarily, a court should not interfere with an ongoing process
unless the court was satisfied that it was clear that the process had gone wrong; that
there was nothing that could be done to rectify it; and that it followed that it was more 38
or less inevitable that any adverse conclusion reached at the end of the process, would
be bound to be unsustainable in law: see decision of Clarke J (as he then was) at paras
11 – 14.
140. It was submitted that in the present case, it could not be said that the process
had gone irremediably wrong. Any concerns that the applicant had in relation to the
admissibility of the complaints against it, could be addressed in the context of the
inquiry which had only just begun by virtue of the notice of commencement dated 23
October 2023. It was submitted that in these circumstances, the court should follow
the decision in the Rowland case and should decline to intervene in the inquiry at this
stage.
141. The court accepts that the statement of principle set down by the Supreme
Court in the Rowland case has been applied in many subsequent cases. The court also
accepts that in Murphy v Commissioner of An Garda Siochana [2023] IECA 92, the
Court of Appeal held that the principles enunciated in the Rowland case, are
applicable to judicial review proceedings.
142. In reaching its conclusion as to whether it is appropriate for this court to
intervene in the inquiry process which has been commenced by the respondent, the
court is of the view that it must have regard to the fact that in many of the previous
cases, such as in the Rowland case itself; and in the following cases: Becker v The
Board of Management of St Dominic’s School [2006] IEHC 130; Student A.B. (A
Minor) v Board of Management of a School [2019] IEHC 255; Ivers v Commissioner
of An Garda Siochana [2022] IECA 206, the processes that were sought to be
injuncted, concerned disputes between an individual and his employer, or between
individual students and their schools. 39
143. In the present case, the court is dealing with an inquiry of an altogether
different nature. The inquiry which the respondent proposes to hold into the
complaints lodged on behalf of the six complainants, constitutes an inquiry into a
systemic process utilised by the applicant at the account creation stage. Thus, it is
much wider than an inquiry of a disciplinary or other nature, between an individual
and another entity, be it an employer, or a school.
144. The court accepts the evidence given by Mr McHale in his affidavit sworn on
16 January 2024, as to the level of time and manpower that has been expended by the
applicant in dealing with the requests for further information that have issued from the
respondent to date. The court also accepts his evidence that if the inquiry is to
proceed, the applicant will have to incur very significant further expense and
deployment of manpower to deal with the subject matter of the complaints: see paras
81 – 85. In addition, as already noted, the court accepts that in order to deal with the
complaints the subject matter of the inquiry, the applicant may be required to divulge
a significant amount of confidential information. The court also accepts that the very
holding of an inquiry, with the possibility of the imposition of very significant fines at
the conclusion thereof, may require the applicant to make an announcement to the
markets, with a consequential adverse effect on its share price.
145. In these circumstances, the court is satisfied that notwithstanding the
principles set down in the Rowland case, the present case falls into the category of
cases where it is appropriate for the court to intervene in the process at this stage,
given that the holding of the inquiry itself will have significant adverse effects for the
applicant. Accordingly, the court rejects the submission made on behalf of the
respondent, that having regard to the principles set down in the Rowland case, the
court should decline to intervene in the inquiry at this stage. 40
Subsequent Evidence Establishing Jurisdiction.
146. Since the issuance of the notice of commencement, and also subsequent to the
institution of these proceedings, a substantial amount of evidence has been provided
to the respondent which establishes that mandates had been signed by each of the
complainants authorising the relevant consumer agencies to lodge complaints on their
behalf.
147. A substantial volume of documentary evidence has also been provided which
establishes that each of the consumer agencies meet the criteria for the representative
bodies, as laid down in Art. 80(1) of GDPR 2016.
148. It is not necessary to set out the precise dates on which each piece of evidence
came into the possession of the respondent. Broadly speaking, the relevant material
was received by the respondent in the period December 2023 to February 2024.
149. The respondent submits that it is permissible for the court to have regard to
this further evidence, when examining the question of fact, as to whether the
respondent had jurisdiction to make the decision to commence the inquiry, that it
made on 23 October 2023.
150. In support of the proposition that the court can have regard to fresh evidence
when examining the issue of jurisdiction, the respondent relied on the decision in R v
Secretary of State for the Environment [Ex P. Powis] [1981] 1 WLR 584, where
Dunne LJ, delivering the judgment of the English Court of Appeal, stated as follows
at p.595:
“What are the principles on which fresh evidence should be admitted
on judicial review? They are … (2) where the jurisdiction of the
Minister or inferior tribunal depends on a question of fact or where the 41
question is whether essential procedural requirements were observed,
the court may receive and consider additional evidence to determine
the jurisdictional fact or procedural error: see De Smith’s Judicial
th
Review of Administrative Action, 4 Ed, [1980] at pp. 140, 141 and
cases there cited…”
151. In Sweetman v An Bord Pleanála [2021] IEHC 16, the applicant was permitted
to make the case that the Board did not have jurisdiction to grant planning permission
to the entity which had applied for planning permission, being An Bradán Beo
Teoranta, because it had not been furnished with consents from all relevant
landowners, enabling that party to make the planning application, as required by Reg.
22(2) of the planning regulations. As it was a jurisdictional issue, the applicant was
allowed to call fresh evidence on it and was allowed to make the argument that the
Board lacked jurisdiction, even though that argument had not been raised by it at the
appeal hearing: see paras. 25 and 26.
152. In Reid v An Bord Pleanála [2021] IEHC 230 Humphreys J endorsed the
decision that had been given in the Sweetman case. He looked at the circumstances in
which fresh evidence can be admitted in judicial review proceedings. He held that the
court can admit fresh evidence when the issue goes to jurisdiction: see paras. 30-32.
153. I accept the submission made on behalf of the respondent that in looking at the
question of whether the respondent had jurisdiction to make the decision that it did on
23 October 2023, the court can have regard to the evidence that has come to hand in
the course of these proceedings.
154. That evidence clearly shows that the necessary mandates had been signed by
the complainants prior to the time when the decision to commence the inquiry had
been taken by the respondent. The evidence further establishes that at all material 42
times, the consumer agencies satisfied the criteria for representative bodies, which are
capable of lodging complaints on behalf of a complainant, as required by Art. 80(1) of
GDPR 2016.
155. I hold that as the necessary facts giving rise to jurisdiction on the part of the
respondent, were de facto in existence at the time when the decision to commence the
inquiry was made by it, the respondent had jurisdiction to make that decision.
156. While I have held that the respondent ought to have obtained evidence of the
existence of these facts, prior to making its decision; the existence of the required
criteria at the date of the making of the decision to commence the inquiry, which facts
have been established by evidence that has subsequently come to hand; which
evidence shows that such facts were in existence at the time when jurisdiction was
assumed by the respondent; that is sufficient to establish that the respondent de facto
had jurisdiction to issue the notice of commencement. It is also sufficient to resist the
applicant’s application to have the notice of commencement set aside.
157. Even if I am wrong in that conclusion, I accept the submission made on behalf
of the respondent that as the granting of relief by way of judicial review is a
discretionary remedy, the court should not grant the reliefs sought by the applicant in
this case, due to the fact that the necessary criteria showing that these complaints are
admissible, being now to hand; it would be futile to make an order striking down the
notice of commencement, as the respondent would simply issue a fresh one
immediately. As the conduct of the inquiry has been stayed voluntarily while these
proceedings have been pending before the court, there is no prejudice to the applicant
in allowing the original notice of commencement to continue. 43
Further Grounds Raised in the Amended Statement of Grounds.
158. There are two further matters on which it is necessary to reach a
determination. First, insofar as the applicant has sought in its amended statement of
grounds to have a declaration that the respondent has acted ultra vires by including
within the inquiry, complaints that fall outside the temporal scope of the notice of
commencement; this primarily relates to the French complaint. The applicant
maintains that this account was opened in 2014, meaning that it falls outside the
temporal scope of the inquiry. The account holder is adamant that she opened the
account in 2022, meaning that it comes within the temporal scope of the inquiry.
159. The respondent is entitled to resolve that conflict in the course of the inquiry.
Accordingly, I am not satisfied that the French complaint should be struck from the
notice of commencement.
Submission that the Complaints are an Abuse of Process.
160. The second matter is in the following terms: the applicant has argued that
subsequent evidence and investigations by them, have revealed that certain of the
complainants are employees within the consumer agencies, which have submitted the
complaints on behalf of the complainants.
161. The applicant relies on the decision of the Belgium DPA in its decision of 24
January 2024, in case bearing reference number 22/2024, relating to an alleged non-
compliant cookie banner. In that case, the Belgium DPA found that the complainant
was in fact an intern, who had been working in the consumer agency, which had
brought the complaint on her behalf. Furthermore, it transpired that she had been
directed as part of her duties while working with the consumer agency, to visit the
website and examine the cookie banner in respect of which the complaint was lodged. 44
162. The Belgium DPA held that in these circumstances, there was no spontaneous
nature to the visit to the website that had been conducted by the complainant in her
position as an intern with the consumer agency. It was held that the necessary genuine
consent on her part to the bringing of a complaint on her behalf by the consumer
agency, was missing. The Belgium DPA held that the consumer agency was acting,
not as an agent on the basis of Art. 80(1) of the GDPR, but as a complainant on the
basis of Article 80(2). As the Belgium Government had deliberately chosen not to
implement Art. 80(2), the complaint was deemed inadmissible: see paras. 51-55 and
59-60.
163. The applicant further argues that when one looks at the account history in
relation to a number of the accounts in this case, it is apparent that the accounts once
opened, where hardly used at all; suggesting that they were opened solely, or
primarily, for the purpose of making the complaints the subject matter of these
proceedings.
164. In essence, it is submitted that because a number of the complainants appear to
be employees of the consumer agencies, which have lodged the complaints and
having regard to the account history, the complaints are in effect an abuse of process,
as a means of enabling the consumer agencies to make the complaints on their own
behalf, notwithstanding that Art. 80(2) has not been implemented in Irish law.
165. These arguments have only been made subsequent to the notice of
commencement, because the relevant information was only provided to the applicant
in the affidavits filed on behalf of the respondent in the course of these proceedings.
166. No application has yet been made to the respondent to deem the complaints
inadmissible, as being an abuse of process, on these grounds. This is because the
inquiry was voluntarily stayed pending the outcome of these proceedings. 45
Accordingly, there is, as yet, no decision of the respondent on any such application, so
the issue does not fall for consideration in these judicial review proceedings.
167. If the applicant wishes to make that application to the respondent, it can do so.
It will be for the respondent to decide what procedure it will adopt to determine that
application, if and when it is made. The respondent may decide to deal with it as a
preliminary matter, or it may decide to deal with it as part of the inquiry that it has
commenced.
168. If the applicant makes such an application to the respondent, and if it is
aggrieved with the decision of the respondent on how it proposes to deal with that
application, they can take whatever steps they regard as necessary at that stage.
Proposed Order.
169. For the reasons set out herein, the court would propose to make the followings
orders:
(a) The court will set aside the notice of commencement dated 23 October
2023, insofar as it relates to the Czech complaint;
(b) save as indicated at (a) above, refuse the reliefs sought by the applicant in
its notice of motion and in its amended statement of grounds.
170. As this judgment is being delivered electronically, the parties will have two
weeks within which to furnish brief written submissions of not more than 1,000
words, on the terms of the final order and on costs and on any other matters that may
arise.
171. The matter will be listed for mention at 10.30 hours on 5 November 2024 for
the purpose of making final orders.
