High Court - IEHC 577: Difference between revisions

Latest revision as of 09:06, 22 October 2024

High Court - IEHC 577

Court:	High Court (Ireland)
Jurisdiction:	Ireland
Relevant Law:	Article 77 GDPR Article 80 GDPR
Decided:	11.10.2024
Published:	15.10.2024
Parties:	Google Data Protection Commission of Ireland (DPC)
National Case Number/Name:	IEHC 577
European Case Law Identifier:
Appeal from:
Appeal to:
Original Language(s):	English
Original Source:	Courts website (in English)
Initial Contributor:	ao

A court held that the DPA’s failure to verify the mandate of an organisation representing a data subject under Article 80(1) GDPR, before commencing an investigation, does not justify the dismissal of the complaint procedure before the DPA.

English Summary

Facts

In 2022, Norwegian, Slovenian, Greek, French, Spanish and Czech consumer protection organisation, on behalf of data subjects, lodged complaints with DPAs relating to the account creation process with Google. These complaints were then forwarded to the Irish DPA between September 2022 and March 2023 as the lead supervisory authority due to location of the controller and in accordance with the one stop shop mechanism.

The complaints alleged dark patterns were used by Google in its account creation process. On 23 October 2023, the DPC decided to commence an inquiry and issued a notice of commencement. On 30 November 2023, Google objected to the commencement of the inquiry stating that the necessary information had not been provided to the DPC and to Google itself. Google posited that neither the account identifier information of each of the data subjects nor copies of the mandates of the consumer protection organisation representing the data subjects under Article 80(1) GDPR were presented to it. Google therefore questioned the DPC's jurisdiction over the matter.

On 18 January 2024, Google initiated judicial review proceedings at the Irish High Court claiming that the DPC lacked jurisdiction over the inquiry as it was not in receipt of the above information. The Irish High Court sought to determine the admissibility of the complaints and did not analyse the content of the complaints.

The DPC submitted to the High Court, that it has very wide discretionary powers as to when it can launch an inquiry and that no specific preconditions must be met. In response to Google’s argument that the DPC did not have the account IDs nor the mandates of the consumer protection authorities, the DPC purported that the EU law principle of mutual trust and the duty of sincere cooperation applied. As the lead supervisory authority, the DPC had to assume that the concerned supervisory authorities had forwarded the claim on the basis that the complaints were well constituted. In fact, the DPC shouldn’t just assume this but is in fact obliged to operate on that basis. Further it would be futile to strike down the inquiry as the DPC would just issue a new one.

The Czech complaint failed to provide evidence on the account creation of the data subject. The DPC argued that, the data subject not having created an account doesn’t preclude them from making a complaint as anyone can file a complaint and referred to relevant EU case law in C-757/22. This case was used for authority stating that complaints can be filed at the account creation stage even if no account is then created with the controller or rather no personal data is provided.

Holding

The court echoes the wide discretion of the DPC but accepts Google's argument that certain basic criteria must be met. The High Court sets out that when a consumer protection organisation files a complaint on behalf of a data subject the following criteria must be met:

1. Personal data of the data subject has been processed by the controller against which the complaint was made

2. The processing was in a manner which the data subject considers infringes the GDPR

3. The data subject has mandated the consumer protection organisation to act on their behalf

4. The consumer protection organisation meets the criteria under Article 80(1) GDPR

Therefore, the court concludes that it is essential for the account identifiers to be submitted before the commencement of the inquiry as it would show primarily that the data subject had created an account and which account creation process had been used. Further, the supply of this information is necessary to allow Google to prepare a response.

The Czech complaint

The Czech complaint was held to be inadmissible as the data of the Czech data subject had not been processed as no account was created. Only if Article 77 GDPR included the future tense, the Czech complaint would have been admissible. The court rejected the Meta case (C-757/22) argument as in this case the complaint was not lodged on behalf of a data subject but directly by the consumer protection organisation. The court reiterated that if no personal data is provided, the DPC cannot handle the complaint as Ireland has not implemented Article 80(2) GDPR into Irish law.

Mandate

The mandate clarifying that the consumer organisation are entitled to represent the data subject should have been present at the outset before the inquiry was started. The responding party to an inquiry has to furnish commercially sensitive data for the inquiry and the risk of release of such information could cause significant harm. Further, they must invest extensive resources into responding to the inquiry so the launch must be justified.

Mutual trust and duty of sincere cooperation

The court rejected the argument that on the basis of mutual trust and sincere cooperation the DPC should assume that the claims forwarded to it were well examined. There was no evidence showing that the consumer protection organisation had been well vetted.

However, the court summarises that the relevant facts were de facto in existence when the investigation was launched and the DPC therefore had jurisdiction to launch the investigation. Evidence submitted during the course of the proceedings clearly showed that the necessary mandates had been signed by the complainants and satisfied the requirements under Article 80(1) GDPR. The court further agrees that it would be futile to strike down the proceedings as the DPC would just issue a new investigation.

Google had been communicating with the Slovenian DPA for a period of 14 months and had never raised the issues of account IDs and mandates of the consumer protection authorities. This showed that Google had acquiesced to the process and was therefore estopped from challenging the very same process months after it had commenced. Even if the court were to disagree, the submitted affidavits proved the mandates under Article 80 GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the English original. Please refer to the English original for more details.

THE HIGH COURT

[2024] IEHC 577

[Record No. H.JR.2024/81]

BETWEEN

GOOGLE IRELAND LIMITED

APPLICANT

AND

DATA PROTECTION COMMISSION

RESPONDENT

JUDGMENT of Mr Justice Barr delivered electronically on the 11 day of

October 2024.

Introduction.

1. The applicant is a multinational company that provides an internet search

engine and other facilities to people who have an account with it.

2. The respondent is the statutory body established pursuant to the Data

Protection Act 2018 (hereinafter ‘DPA 2018’), to, inter alia, handle and if thought

appropriate, investigate complaints made by data subjects that the processing of their

personal data infringes their rights under the General Data Protection Regulation (EU)

2016/679 on the protection of natural persons with regard to the processing of

personal data and on the free movement of such data, and repealing Directive 2

95/46/EC (General Data Protection Regulation) (hereinafter ‘GDPR 2016’) and under

DPA 2018.

3. Essentially, this case concerns six complaints that were lodged by consumer

agencies in Norway, Slovenia, Greece, France, Spain and Czechia, on behalf of

people resident in those countries.

4. Each of the complainants made a range of complaints about the process known

as the account creation process, which was completed by all but one of the

complainants, when opening their account with the applicant; whereby their consent

was obtained to the processing by the applicant of their personal data.

5. In the period September 2022 to March 2023, a total of six complaints were

received by the respondent. These complaints had been forwarded by the supervisory

authorities in the countries in which the complaints had been originally lodged. These

supervisory authorities are known as concerned supervisory authorities, (hereinafter

‘CSAs’). The complaints were forwarded to the respondent as the lead supervisory

authority (hereinafter ‘LSA’), due to the fact that the applicant has its registered office

in this jurisdiction.

6. Each of the complaints were in almost identical terms. It is not necessary for

the purpose of this application, to examine the content of the complaints in any detail,

as this application deals with the admissibility of the complaints, rather than their

content.

7. It will suffice to note that each of the complainants complained that the

process leading to the creation of their account, wherein they had to indicate their

preference for various account settings, was unfair in that they alleged that it was

much easier to give consent to the applicant using their personal data, which could be

done by one click on the mouse; rather than choosing the option of managing their 3

own account settings, which required five separate steps and ten individual clicks on

the mouse.

8. It was further alleged that the language used in giving various options to a

person when opening an account was unfair in that it (a) was not transparent in

relation to what use would be made by the applicant of their personal data; (b) was

unclear in relation to what steps could subsequently be taken to alter the account

settings; (c) it engaged what are known as “dark patterns”, whereby wording was used

that influenced or prompted a person to take a particular option, by making that option

appear desirable, while at the same time, making the alternative negative option

appear undesirable, as it was described in unfavourable terms. That is but a very brief

account of the essence of the complaints lodged on behalf of the six complainants.

9. After notifying the applicant of receipt of the complaints, and having provided

the applicant with the written complaints received by the respondent and following a

considerable exchange of correspondence, in the course of which the applicant

provided substantial information in relation to its account creation process and in

relation to the use to which it puts the information that it gleans from the account

holders; the respondent decided on 23 October 2023, to commence an inquiry

pursuant to its powers under DPA 2018. It did that by issuing a notice of

commencement of inquiry (hereinafter ‘notice of commencement’) on that date.

10. By letter dated 30 November 2023, the applicant objected to the

commencement of the inquiry on the basis that the necessary criteria for admissibility

of a complaint had not been met.

11. In particular, the applicant requested that they be provided with the Google

account identifier information in respect of each account, (hereinafter ‘account

identification information’). This is essentially the Gmail address of each 4

complainant. The applicant further asked that if the complaint was being lodged by a

consumer agency pursuant to the provisions of Art. 80(1) of GDPR 2016, that they be

provided with copies of the mandates by which the data subject had authorised the

consumer agency to bring the complaint on his or her behalf.

12. The applicant also requested the evidence which demonstrated that each

consumer agency met the requirements to act as a representative body in respect of

each complaint. This essentially required evidence that the consumer agency (i) was a

not for profit organisation; (ii) had been properly constituted in accordance with the

law of the relevant Member State; (iii) had statutory objectives which are in the public

interest; and (iv) was active in the field of the protection of data subjects’ rights.

13. By letter dated 22 December 2023, the respondent replied, stating that it

disagreed with the assertion that they were obliged to provide a reasoned

determination to the applicant in relation to the admissibility of the complaints. It

denied that they were obliged to identify, or furnish, any documents which informed

the view that had been reached by the respondent that the complaints were admissible.

The letter went on to state that, as recorded in the notice of commencement, the

respondent had considered the information made available to it in respect of the

complaints, to include the content of the complaints themselves, and had satisfied

itself that it was appropriate that an inquiry be commenced in order to ascertain

whether one or more of the infringements had occurred, or was occurring. The letter

further stated that beyond that, issues relating to the validity and/or admissibility of

the complaints could and would be dealt with in the context of the decision to be

adopted by the respondent in due course. The letter further stated that prior to its

adoption, the decision would be circulated to the applicant in draft form and the 5

applicant would be afforded an opportunity to consider and respond to the contents

thereof prior to the decision being finalised and adopted.

14. In this application the applicant seeks an order setting aside the notice of

commencement on the basis that, under the DPA 2018, in order to have jurisdiction to

hold an inquiry into a complaint, the respondent was required to determine that three

criteria had been met: (a) that personal data of each of the individuals behind the

complaints had been processed by the applicant in a manner that those individuals

considered infringed GDPR 2016, insofar as it was processing by the applicant that

fell within the scope of the inquiry; (b) that each of the individuals had mandated the

consumer agency to make the complaint on their behalf; and (c) that each of the

consumer agencies met the criteria set down in Art. 80(1) of GDPR 2016.

15. It was submitted by the applicant that the respondent did not have information

or evidence before it, that would have enabled it to have been satisfied that these three

criteria had been met in respect of each complaint. It was submitted that the

respondent therefore lacked jurisdiction to commence the inquiry, given its state of

knowledge on 23 October 2023.

16. In its amended statement of grounds, the applicant states that in the light of the

information that has come to hand subsequently, the respondent is acting ultra vires,

insofar as it is proposing to inquire into complaints that fall outside the temporal

scope of the inquiry, as set out in the notice of commencement.

17. The respondent denies that the applicant is entitled to any of the reliefs sought

in the amended statement of grounds. The basis of their objection to the reliefs sought

is set out in detail later in the judgment.

Background. 6

18. Before coming to the arguments and the merits of the application, it is

unfortunately necessary to give some background to the steps that were taken by the

parties prior to the issuance of the notice of commencement. This is due to the fact

that one of the arguments raised by the respondent is that by its actions, and in

particular, by its protracted engagement with the respondent prior to the issuance of

the notice of commencement, without raising any issues in relation to the

admissibility of the complaints, the applicant thereby acquiesced in the inquiry

proceeding and is therefore estopped from raising the objections that it seeks to raise

in this application.

19. On 30 June 2022, the European Consumer Organisation (BEUC), issued a

press release wherein they alleged that Google was using deceptive design, unclear

language and misleading choices, when consumers signed up to a Google account to

encourage more extensive and invasive data processing. They claimed that contrary to

its claims, the tech company was thwarting consumers who wanted to better protect

their privacy. To that end, it was stated that ten consumer groups, under the

coordination of BEUC, were taking action to ensure that the applicant complied with

the law.

20. The press release stated that a consumer could choose to create a Google

account voluntarily, or could be obliged to create one, when they used certain Google

products and/or services. For example, they had to create an account when they

purchased a smart phone that uses Google’s android system, which BEUC claimed

almost seven in ten phones worldwide (69%) depended on, if they wanted to

download apps from the Google play store.

21. The press release went on to state that sign up was a critical point at which the

applicant made users indicate their “choices” about how their account would operate. 7

With only one step, known as “express personalisation”, the consumer would activate

all the account settings that feed the applicant’s surveillance activities. The applicant

did not provide consumers with the option to turn all settings “off” in one click. The

press release asserted that if customers wished to opt for the “manual personalisation”

option, that required five steps, with ten clicks and involved grappling with

information that was alleged to be unclear, incomplete and misleading.

22. The press release went on to state that the applicant was a colossus in the

world of surveillance capitalism, with 81% of its revenue coming from its advertising

operations, which in turn depended on the data it harvested from people to personalise

adverts for them. The press release stated that from advertising, the applicant was

forecast to earn €221bn in 2022, which was almost double the amount its closest

competitor, Facebook, was expected to make from digital advertising.

23. It is clear from the press release issued in June 2022, that the applicant must

have been expecting a fairly concerted attack on its account creation process. That

duly occurred on 29 September 2022, when the respondent wrote to the applicant

notifying it of a complaint that had been forwarded by the Slovenian supervisory

authority, in respect of a complaint lodged by a consumer agency on behalf of a

complainant resident in that country. The respondent issued a request for information

(hereinafter “RFI”) to the applicant in respect of that complaint. Thereafter, the

applicant requested an extension of time within which to respond to the queries raised

by the respondent.

24. By letter dated 04 October 2022, the respondent granted an extension of time

to 18 October 2022, in respect of all but one of its RFIs. On 06 October 2022, the

applicant provided responses to the RFIs comprising information, including screen 8

shots, regarding its account creation process. On 18 October 2022, the applicant

provided further responses.

25. On 27 October 2022, the respondent raised further RFIs. Further information

was provided by the applicant on 28 October 2022. On 05 October 2022, the applicant

requested an extension of time to furnish complete replies to the RFIs. This request

was granted on 08 November 2022. Further information was provided by the

applicant on 18 November 2022, and also on 01 December 2022.

26. On 05 December 2022, the applicant set out proposals regarding privilege,

confidentiality and commercial sensitivity attaching to documentation to be provided

in response to the RFIs. On 08 December 2022, the applicant provided further

information in response to the RFIs, identifying particular information regarding

settings and the purposes and legal basis of identified processing operations.

27. On 22 December 2022, the respondent requested the applicant to produce

documentation addressing a number of matters. That letter advised the applicant that

the respondent may “in due course…resolve to conduct a statutory inquiry into some

or all of the issues raised by the complaint”.

28. On 23 December 2022, the applicant addressed further issues of privilege

attaching to documents intended to be submitted to the respondent. It also responded

to RFIs raised by the respondent on 22 October 2022, including an appendix running

to 1,281 pages.

29. On 22 February 2023, the respondent issued notices pursuant to s.108(1) DPA

2018, to the Norwegian, French and Czech SAs. Similar notices were sent to the

Slovenian and Greek SAs on the following day.

30. On 16 March 2023, the respondent furnished copies of the full suite of

complaints to the applicant. The respondent advised the applicant that it was assessing 9

“what form of regulatory action it will take to handle these complaints”. By letter

dated 23 March 2023, the applicant raised issues regarding the respondent’s proposal

to share copies of certain documents with the CSAs. On 27 March 2023, the

respondent advised the applicant of its intention to exercise its discretion to

commence a statutory inquiry into the subject matter of the complaints.

31. By letter dated 12 May 2023, the respondent confirmed that it would not be

sharing identified documents with the CSAs at that time and that it had canvassed the

views of the CSAs regarding the appropriate scope of the inquiry, albeit it remained a

matter for the respondent as to whether to commence an inquiry and, if so, the

appropriate scope thereof.

32. On 23 May 2023, the applicant outlined certain changes to the account

creation process which it had implemented. By letter dated 01 September 2023, the

respondent sent further RFIs to the applicant regarding the changes made to the

account creation process. A response to that RFI was furnished by the applicant on 14

September 2023.

33. On 22 September 2023, the applicant furnished an appendix identifying

statistical information. A further appendix was delivered on 29 September 2023. A

further appendix identifying statistical information was furnished on 13 October 2023.

34. On 23 October 2023, the respondent notified the applicant of its intention to

commence inquiry bearing reference number “IN-23-2-4” by way of a notice of

commencement. The notice of commencement explained that it was a complaint-

based inquiry into the complaints. The notice also raised further RFIs.

35. By letter dated 25 October 2023, the applicant acknowledged receipt of the

notice of commencement and sought an extension of time to provide responses to the

RFIs. 10

36. By letter dated 30 November 2023, the applicant wrote to the respondent

requesting that it be provided with information relating to the respondent’s

jurisdiction to commence the inquiry. Specifically, the applicant sought the account

identifier information, the mandates signed by the complainants and the representative

body information in relation to the consumer agencies which had lodged the

complaints on behalf of the complainants.

37. On 04 December 2023, the applicant responded to a further RFI which had

formed part of the notice of commencement. The response ran to 319 pages, including

eight appendices. It was expressed to be made without prejudice to the applicant’s

letter of 30 November 2023.

38. By letter dated 13 December 2023, the applicant raised the issue of the

“validity and admissibility of the complaints, the material scope of the inquiry and the

confidentiality and the use of materials provide by Google to the DPC”.

39. On 19 December 2023, the respondent informed the applicant by email that it

was gathering information to enable it to respond to the applicant’s letter of 30

November 2023. The respondent stated that it was prepared to suspend the progress of

the inquiry pending this step being taken.

40. On 20 December 2023, the applicant wrote to the respondent, to propose a

standstill arrangement, which would afford the respondent additional time to gather

the information sought in the applicant’s letter of 30 November 2023, but without

prejudicing (by virtue of the passage of time) to the applicant’s right to seek judicial

review of the respondent’s decision to commence the inquiry in due course. That

proposal was rejected by the respondent on 22 December 2023. By letter dated 10

January 2024, the applicant wrote to the respondent requesting it to reconsider its

position in respect of the proposed standstill arrangement. 11

41. On 18 January 2024, the applicant issued the within proceedings. The

application seeking leave to proceed by way of judicial review was opened on 22

January 2024, but was adjourned on that date to enable it to be made on notice to the

respondent.

42. On 06 February 2024, the respondent confirmed to the court that it was not

objecting to the applicant’s application for leave to seek judicial review and that it

would agree to an effective stay on the inquiry pending the outcome of the

proceedings.

43. Following the exchange of pleadings in the case, including delivery of an

amended statement of grounds and an amended statement of opposition, the

application was heard before this Court on 25 and 26 July 2024.

Relevant Legislation.

44. The key provisions of GDPR 2016 for the purposes of this application, are

Arts. 77 and 80. Article 77 provides that without prejudice to any other administrative

or judicial remedy, every data subject shall have the right to lodge a complaint with a

supervisory authority, in particular in the Member State of his or her habitual

residence, place of work, or place of the alleged infringement, if the data subject

considers that the processing of personal data relating to him or her infringes the

regulation.

45. Article 80 provides that the data subject shall have the right to mandate a not

for profit body, organisation or association, which has been properly constituted in

accordance with the law of a Member State; has statutory objectives which are in the

public interest, and is active in the field of the protection of data subjects’ rights and 12

freedoms with regard to the protection of their personal data, to lodge the complaint

on his or her behalf.

46. It should be noted that while Art. 80(2) provides that Member States may

make provision for the lodgement of complaints by an organisation or association on

its own behalf, and independently of a data subject’s mandate; Ireland has not

incorporated this provision into its domestic law.

47. There are a number of provisions of DPA 2018 which are of relevance. The

first of these is s.107, which provides that the term “complainant” means a data

subject who lodges a complaint, or as the case may be, a not for profit body,

organisation or association that, in accordance with Article 80(1), lodges a complaint

on behalf of a data subject.

48. Section 107 defines the term “complaint” in the following way:

““complaint” means a complaint lodged pursuant to Article 77(1) or

in accordance with Article 80(1), and shall be deemed to include a

complaint so lodged by or on behalf of a data subject where—

(a) the data subject considers that the processing of personal data

relating to him or her infringes a relevant enactment, and

(b) the Commission is the competent supervisory authority in respect of

the complaint;”

49. Section 108(2) provides that where the Commission is the competent

supervisory authority in respect of a complaint, it shall (a) handle the complaint in

accordance with that part of the Act, and (b) inform the complainant of the progress or

outcome of the complaint.

50. Section 109 provides that for the purposes of s.108(2)(a) the Commission shall

examine the complaint and shall, in accordance with that section, take such action in 13

respect of it as the Commission, having regard to the nature and circumstances of the

complaint, considers appropriate. The section goes on to outline a number of steps

that can be taken by the Commission in the handling of a complaint, including the

causing of such inquiry as the Commission thinks fit to be conducted in respect of the

complaint, and the taking of such other action in respect of the complaint as the

Commission considers appropriate.

51. Section 110 is of particular relevance. It gives the Commission the power to

conduct an inquiry into a suspected infringement of a relevant enactment. It provides

as follows:

“110. (1) The Commission, whether for the purpose of section

109(5)(e), section 113(2), or of its own volition, may, in order to

ascertain whether an infringement has occurred or is occurring, cause

such inquiry as it thinks fit to be conducted for that purpose.

(2) The Commission may, for the purposes of subsection (1), where it

considers it appropriate to do so, in particular do either or both of the

following:

(a) cause any of its powers under Chapter 4 (other than section 135) to

be exercised;

(b) cause an investigation under Chapter 5 to be carried out.”

52. Finally, s.113 deals with the situation where Art. 60 applies. Where the

Commission is the LSA, the section provides that it will make a draft decision in

respect of the complaint. The section goes on to make further provisions in relation to

the content and issuing of the draft decision. 14

Summary of Receipt of Relevant Information by the Respondent in respect of

Each Complaint.

53. The dates on which information in relation to the account identifiers, the

mandates from the complainants and the representative body information, was

furnished to the respondent and the nature of that information in each case, has been

set out in extenso in the various affidavits sworn on behalf of the respondent. It is not

necessary to set out in detail each of the dates on which each piece of information in

respect of each complaint was furnished to the respondent. A brief summary of the

overall position will suffice.

54. At the date of the notice of commencement, the respondent only had account

identifier information in respect of the Spanish complaint. However, the respondent

was not aware that it had that information at that time. All the relevant account

identifier information, being the relevant Gmail addresses, came into the possession of

the respondent between December 2023 and February 2024, save for the Czech

complaint, which information was never produced.

55. At the date of the notice of commencement, the respondent had mandates from

the complainant’s authorising the consumer agencies concerned to bring the

complaints on their behalf, in respect of the Norwegian, French and Spanish

complaints. The respondent subsequently obtained mandates in respect of the

Slovenian, Greek and Czech complaints in December 2023 and February 2024.

56. At the date of the notice of commencement, the respondent had some

representative body information in respect of the Norwegian and Spanish consumer

agencies. The representative body information for the remaining consumer agencies,

being the Slovenian, Greek, French and Czech consumer agencies, was received

between December 2023 and February 2024. 15

Submissions of the Applicant.

57. The applicant submitted that in order for the respondent to have jurisdiction to

deal with a complaint submitted by a representative body on behalf of a data subject,

three conditions had to be satisfied: first, that personal data of the data subject had

been processed by the applicant in a manner that those individuals considered

infringed GDPR 2016, or DPA 2018; secondly that each individual had mandated the

consumer agency to act on their behalf; and, thirdly, that each of the consumer

agencies met the criteria for them to act as a representative body, as set down in Art.

80(1) of GDPR 2016.

58. It was submitted that it was clear that when the respondent decided to

commence the inquiry on 23 October 2023, it had failed to satisfy itself, and had no

information on which it could have satisfied itself, as to these criteria. Therefore, it

could not have been satisfied that it had jurisdiction to conduct the inquiry. The

respondent having failed to take these steps, the applicant submitted that the inquiry

was unlawful.

59. The applicant submitted that having regard to the cost and potential adverse

consequences for the applicant in having to disclose highly confidential commercial

information in the course of the inquiry, it was necessary for the respondent to make a

decision on the admissibility of the complaints at the outset. To that end, the

respondent should have ensured that the complaints received by it complied with the

requirements set down in DPA 2018, before deciding to commence an inquiry. It was

submitted that these requirements were essential to give the respondent jurisdiction to

commence an inquiry. 16

60. It was submitted that the respondent could not have been satisfied that the

complaints in this case were admissible at the time that it decided to commence the

inquiry in October 2023, because it did not have the basic information that was

necessary to establish that the complaints were admissible. The respondent was only

in possession of account identifier information in respect of the Spanish account, but

it was not aware of that at the relevant time. It did not have mandate information in

respect of the Slovenian, Czech or Greek complaints and it did not have representative

body information in respect of any of the complaints.

61. The applicant submitted that without this basic information, which was

mandated by the statutory regime established under DPA 2018, the respondent lacked

jurisdiction to begin the inquiry, which it had purported to do by the notice of

commencement dated 23 October 2023.

62. Insofar as the respondent had asserted in correspondence that the issue of

admissibility would be determined at some unspecified later stage in the course of the

inquiry, it was submitted that the respondent was wrong in that assertion, because by

so doing it was effectively giving itself jurisdiction to conduct an inquiry into the

complaint before it had ruled that the complaint was properly admissible. If the

complaint was found to be inadmissible, the respondent would not have jurisdiction to

conduct an inquiry into it. Therefore, it was submitted that the decision on

admissibility of the complaint had to be made at the outset of the process.

63. Counsel for the applicant further submitted that by deferring a definitive

decision on admissibility until the preliminary draft decision was delivered, the

applicant would be put to the expense and time consuming work of addressing the

merits of the complaints, which would involve supplying substantial amounts of

commercially confidential information, which could be disclosed to the CSAs in the 17

course of the preliminary draft decision, before it had even been established that the

complaints were admissible. It was submitted that that would place the applicant in a

position of considerable jeopardy, involving disclosure of its sensitive commercial

information. It would also put the applicant to inordinate expense in dealing with a

complaint that may ultimately be found to be inadmissible.

64. In addition, it was submitted that having regard to the very large fines that can

be imposed by the respondent in the event that certain conclusions are reached by it,

the possibility of such fines being imposed may require the applicant to make an

announcement to the markets, which would have an adverse effect on the applicant’s

share price.

65. At its simplest, the applicant’s argument was that the respondent only has

jurisdiction under the DPA 2018 to handle complaints that comply with the statutory

criteria.

66. It was submitted that the respondent had decided to embark on an inquiry into

complaints, before it had ruled definitively on their admissibility and had done so at a

time when they could not have been satisfied that the necessary criteria had been met,

because the necessary information was not in their possession at the date when they

made the decision to commence the inquiry. It was submitted that on this basis, the

notice of commencement should be struck down.

67. The applicant also challenged the level of reasoning that had been furnished

by the respondent in relation to the admissibility of the complaints. It was submitted

that in its letter of 23 December 2023, the respondent had merely stated that it was

satisfied that the complaints were admissible on the basis of the written documents

that had been submitted to it. At the same time, the respondent had maintained that the

issue of admissibility would be addressed further in the course of the inquiry. It was 18

submitted that the reasons given by the respondent on why the complaints were held

admissible, were wholly inadequate, as they did not address any of the issues that had

been raised in the applicant’s letter of 30 November 2023.

68. It was submitted that insofar as the respondent had alleged that the applicant

was estopped from challenging the notice of commencement, due to the fact that it

had engaged in a substantial way with the respondent prior to the date of the issue of

the notice of commencement; that was misconceived, because the applicant was under

a statutory duty to cooperate with the respondent whenever it wrote to the applicant in

relation to a potential complaint.

69. Secondly, the applicant did not know that the respondent did not have the

relevant information and more importantly, did not propose to obtain it until the

substantive inquiry was underway. It was submitted that without this knowledge, the

applicant could not be said to have acquiesced in the inquiry commencing in the

absence of that information.

70. It was submitted that the applicant had raised the objection to jurisdiction at

the earliest possible opportunity. It was submitted that in these circumstances there

had been no acquiescence by the applicant which would be sufficient to prevent it

raising the issue of jurisdiction at this stage.

71. Finally, in light of the information that had come to hand subsequently, it was

submitted in the additional grounds as pleaded in the amended statement of grounds,

that the respondent was purporting to hold an inquiry into complaints that were either

inadmissible, such as the Czech complaint, because that person had not opened an

account with the applicant and therefore no processing of her data had taken place; or

the complaint was out of scope, as the date of creation of the account was outside the

temporal scope identified in the notice of commencement. It was submitted that the 19

respondent was acting ultra vires in purporting to deal with these complaints in the

course of the inquiry.

Submissions on behalf of the Respondent.

72. On behalf of the respondent it was submitted that the protection of personal

data was a fundamental right of every person whose personal data was sought to be

processed by a person or entity. That was recognised in GDPR 2016 and in DPA

2018.

73. It was submitted that under DPA 2018, the respondent is given very wide

powers to hold an inquiry into a complaint whenever it deems it necessary to do so.

There are no specific preconditions that have to be complied with, before the

respondent can decide to commence an inquiry.

74. In particular, it was submitted that there was no requirement under the

statutory regime, for a preliminary hearing, or a decision on admissibility of the

complaint, prior to deciding to commence an inquiry into the complaint.

75. It was submitted that the definition of a “complaint” in s.107, made it clear

that there were two admissible criteria. First, consistent with Art. 77(1), there must be

a data subject who considers that the processing of personal data relating to him or her

infringes a relevant enactment. This required a subjective belief on the part of a data

subject that the processing of their personal data infringed a relevant enactment.

Secondly, the respondent must be the LSA in a complaint involving cross border

processing. It was submitted that both these criteria were satisfied at the time when

the respondent made its decision to commence the inquiry in October 2023.

76. It was submitted that it was important to note that the issue of admissibility

was not being determined once and for all at the commencement of the inquiry. If it 20

could be established that for any reason, a particular complaint was not admissible, it

could be struck out at any stage of the inquiry, once the fact of its inadmissibility had

been established.

77. Insofar as the applicant had complained about the absence of material in

relation to the account identifier information, the mandates and the representative

body information, not being in the possession of the respondent at the date on which it

decided to commence the inquiry; it was submitted that where the complaints had

been transferred to the respondent by the CSAs in the Member States where the

complaints had originated, the principle of EU law of mutual trust and the duty of

sincere cooperation came into play.

78. It was submitted that this principle had been described as one of fundamental

importance to European law and to the effective functioning of the EU. In essence, it

required the respondent, as the LSA, to assume that the CSAs which had forwarded

the complaints to it, had complied with their obligations under European law, and had

done so on the basis that the complaints constituted admissible complaints. It was

submitted that the respondent was not merely entitled to so presume, but was obliged

to operate on the basis that the CSAs had not transmitted complaints that were lacking

mandates, or in respect of bodies that did not comply with the requirements for a

representative body as contained in GDPR 2016.

79. It was submitted that the applicant had engaged with the respondent in relation

to the Slovenian complaint for a period of approximately fourteen months, and in

relation to the other complaints for a period of approximately seven months, prior to

the issuance of the notice of commencement; during that time they had never raised

the issues concerning account identifier information, mandates or representative body

information, which had been raised for the first time in their letter of 30 November 21

2023. It was submitted that in these circumstances, the applicant had acquiesced in the

conduct of the process and they were estopped from challenging that process many

months after it had commenced.

80. It was submitted that even if the court were to hold against the respondent in

relation to the issue of jurisdiction at the date of the notice of commencement, the

court should have regard to the information that has subsequently come to hand, as

exhibited in the affidavits filed in these proceedings, which clearly showed that the

necessary mandates had been in place at all relevant times and that the consumer

agencies satisfied the criteria to act as representative bodies pursuant to Art. 80 of

GDPR 2016.

81. It was submitted that in these circumstances, the court should either hold that

the respondent has jurisdiction to proceed with its inquiry, or in the alternative, it

should decline to strike down the notice of commencement, on the basis that it would

be futile to do so, as the respondent would simply issue a fresh notice of

commencement immediately in respect of the same complaints. It was submitted that

the more preferable course of action was to allow the notice of commencement to

continue, particularly as this would cause no prejudice to the applicant, as the inquiry

had been effectively stayed by agreement pending the outcome of these proceedings.

82. In relation to the Czech complaint, it was submitted that the fact that the data

subject in that case had not completed the account creation process, did not mean that

her complaint was inadmissible. She was still entitled to make a complaint that the

terms and conditions as set down by the applicant in the account creation process,

were misleading, lacking in transparency and unfair to consumers. In this regard the

respondent referred to the decision of the CJEU in the Meta Platforms Ireland Limited

case (C-757/22). 22

83. In relation to the assertion that certain complaints that were proposed to be

examined as part of the inquiry were out of scope, this appeared to refer to the French

complaint, where the applicant maintained that the relevant account had been opened

in 2014. However, the French complainant was adamant that her account had been

opened in 2022, which was in scope. That issue would be determined in the course of

the inquiry.

84. It was submitted that if a complaint is established as being out of scope,

because it was established that the account was opened outside the inquiry period,

then that complaint will be struck out in the course of the inquiry.

85. It was submitted that it was not required, nor was it desirable, to have an

elaborate preliminary hearing and decision on admissibility at the outset. That would

only make the procedure overly complex, which was not desirable having regard to

the rights guaranteed in the regulation and in the Act; and having regard to the need

for an effective method of protecting those rights.

86. It was submitted that for these reasons the court should refuse the reliefs

sought by the applicant and should allow the inquiry to continue.

Conclusions.

The Criteria for an Admissible Complaint.

87. Having considered the papers, and the oral and written arguments of counsel,

together with the legal authorities referred to therein, the court has reached the

following conclusions in this case: First, the privacy of personal data has been

recognised in European and Irish Law as deserving of particular protection.

88. This is provided for in GDPR 2016 and in DPA 2018. Both provide significant

protection to an individual in relation to the harvesting and use of their personal data. 23

Individuals are given extensive rights in relation to what information they must be

given when their consent is sought for the retention and use of their personal data.

There are extensive provisions in relation to the terms in which their consent may be

obtained as part of the opening of an account, and in particular, the information that

they must be given in relation to the processing and use of their personal data.

89. Individuals are also given the right in Art. 77 of GDPR 2016 to make a

complaint to the supervisory authority in their country of origin, or residence. That is

a significant right, which must not be rendered incapable of being effectively invoked

by the application of an overly restrictive admission process.

90. The power of the respondent to handle a complaint and, if necessary, to

commence an inquiry, is contained in DPA 2018. While it is undoubtedly a wide

power, I accept the submission made on behalf of the applicant that certain basic

criteria have to be met in order for a complaint to be admissible.

91. When a complaint has been lodged by a consumer agency acting on behalf of

a data subject, the following criteria must be met: that personal data of the

complainant has been processed by the person, or entity, against whom the complaint

is made, in a manner that the data subject considers infringes GDPR 2016, or DPA

2018; that the complainant has mandated the consumer agency to act on their behalf

in bringing the complaint; and that the consumer agency meets the criteria for a

representative body as set down in Art. 80(1) of GDPR 2016.

92. That is not a demanding set of criteria. The first and most fundamental

criterion is that a person’s personal data has been processed by the person or entity

against whom they wish to lodge the complaint. To establish that, they need to furnish

the account identifier information, which in this case, is effectively their Gmail

address. 24

93. By opening the Google account, they have established that they have

participated in the account creation process that applied as of the date of opening of

the account. Their personal data, in the form of the information that they provided ab

initio when opening the account, and their account usage history after opening,

constitutes the personal data that is processed by the controller of the account, in this

case, by the applicant.

94. I accept the submission made by the applicant that it is essential that account

identifier information is provided by the complainant at the outset, because it is that

information which establishes that an account was in fact opened by the data subject

with the applicant. This is basic information which the respondent should have been

given by the complainant at the outset.

95. To argue by analogy, if the Irish Medical Organisation are considering a

complaint against a doctor, which is brought by an adult, the most basic piece of

information required is that the complainant should establish that they were actually

treated by the named doctor. To that end, they would have to provide their own name,

the name of the doctor concerned and the date of alleged mistreatment, or misconduct.

96. If the patient refused to give his or her name, the IMO could not proceed to

consider the complaint, because the doctor would not know whether he or she had

treated the person, or had had any dealings with them.

97. In this case, the provision of account identifier information was essential for

two reasons: first, it would show that an account was in fact opened by the

complainant with the applicant; secondly, it would establish which account creation

process had been in place leading to creation of the account. Accordingly, I hold that

the applicant is correct in its submission that the account identifier information was 25

essential information which the respondent should have had when it decided to

commence an inquiry into each complaint.

98. I am also satisfied that the requirements of fairness in the process, demand that

when the respondent decided that it was appropriate to hold an inquiry into a

particular complaint, the applicant should be given the account identifier information

in respect of each complaint. Otherwise, it could not adequately prepare its response

to each complaint.

99. At its most basic, if a person is going to make a complaint against a person or

entity, basic fairness requires that the person or entity against whom the complaint is

made, be given basic information about the complaint, which would include

information showing that an account was actually opened by the person with the data

controller.

The Czech Complaint.

100. Before coming to the other necessary criteria for an admissible complaint, I

will deal with the issue of the Czech complaint. I accept the argument made on behalf

of the applicant that this complaint is inadmissible because the Czech person did not

open any account with the respondent; therefore, the respondent did not process any

of her personal data.

101. The wording of both Art. 77 GDPR 2016 and s.107 DPA 2018, make it clear

that a data subject can make a complaint if they consider that the processing of their

personal data “infringes this regulation” (GDPR 2016), or “infringes a relevant

enactment” (DPA 2018). In both cases the verb is in the present tense. If it were

intended to give a right to a data subject to make a complaint in circumstances where 26

they had not in fact opened an account, the verb would have to be in the future

conditional tense.

102. I am satisfied that the wording of these provisions make it clear that when

lodging the complaint, the complainant must hold the subjective view that the

processing of their personal data by the person or entity, infringes the relevant

provisions of EU law or Irish law. That clearly requires that their personal data is

being processed by the person or entity complained against. For that to happen in this

case, the complainant would have to have opened an account with the applicant.

103. In relation to the Czech complaint, it appears that the person did not like the

terms on which the Google account was offered to her, so she did not continue with

the account creation process. She did not open any Google account. Her personal data

was never processed by the applicant. In these circumstances, I hold that she does not

have an admissible complaint against the applicant, as none of her personal data was

ever processed by the applicant.

104. The respondent relied on the decision of the CJEU in Meta Platforms Ireland

Limited (case C-757/22) as authority for the proposition that a complaint can be made

where inadequate information in relation to the processing of personal data is given by

the data controller at the account creation stage, even though the complainant does not

create an account, or provide their personal data.

105. In particular, the respondent relied on the following paragraphs from the

judgment, as authority for the proposition that a complaint can be lodged, even where

personal data is not actually provided by the data subject:

“61 In so far as processing of personal data carried out in breach of

the data subject's right to information under Articles 12 and 13 of the

GDPR infringes the requirements laid down in Article 5 of that 27

regulation, the infringement of that right to information must be

regarded as an infringement of the data subject's rights 'as a result of

the processing', within the meaning of Article 80(2) of that regulation.

62 It follows that the right of the subject of a personal data processing

operation, under the first sentence of Article 12(1) and Article 13(1)(c)

and (e) of the GDPR, to obtain from the controller, in a concise,

transparent, intelligible and easily accessible form, using clear and

plain language, information relating to the purpose of such processing

and to the recipients of such data, constitutes a right whose

infringement allows recourse to the representative action mechanism

provided for in Article 80(2) of that regulation.

63 That interpretation is confirmed, first, by the objective of the

GDPR, recalled in paragraph 48 above, of ensuring effective

protection of the fundamental rights and freedoms of natural persons

and, in particular, a high level of protection of the right of every

person to privacy with respect to the processing of personal data

concerning him or her.”

106. On a close reading of that judgment, I am not satisfied that it actually supports

the argument made by the respondent in the present proceedings. In the Meta case the

proceedings were instituted in Germany by a consumer agency under the domestic

law of Germany, prior to the entry into force of Art. 80(2) of GDPR 2016. However,

Germany had enacted the provisions of Art. 80(2) into its domestic law. Accordingly,

it was effectively a complaint lodged directly by a consumer agency. It was not a

complaint submitted on behalf of any particular data subject. 28

107. In countries where it is possible for consumer agencies to lodge complaints

directly, it is implicit that they must be able to bring complaints without opening an

account, because as a consumer agency, they will never have personal data within the

meaning of the regulation.

108. Thus, by giving a consumer agency the right to lodge complaints directly

pursuant to Art. 80(2), the relevant Member State, and indeed the regulation, is

implicitly authorising them to bring complaints when they think that an infringement

of GDPR 2016 has, or may occur, even though they do not have personal data of their

own. These are the relevant facts underlying the decision in the Meta case.

109. In the case of a person who makes a complaint under Art. 77, as enacted in

Irish law in s.107, it is necessary that the person must have formed the subjective

opinion that the processing of their personal data “infringes a relevant enactment”. I

hold that for a complaint to be lodged with the respondent by or on behalf of a person,

the requirement that they believe that processing of their personal data by the person

or entity infringes their rights under the regulation and the Act, requires that they must

have opened an account, or otherwise had their personal data processed by the person

or entity, against whom the complaint is made.

110. As the Czech complainant did not open an account with the applicant, and in

the absence of any evidence that her personal data was processed by it, I hold that the

Czech complaint is inadmissible.

The Remaining Criteria for an Admissible Complaint.

111. Returning to the remaining criteria that must be met for a complaint to be

deemed admissible, I accept the submission on behalf of the applicant that where a

complaint is lodged by a consumer agency on behalf of a person, there must be some 29

evidence that the consumer agency has been authorised by the data subject to bring

the complaint on their behalf. This is a fundamental principle of the law of agency: A

can only act on behalf of B, where he has been authorised by B to do so.

112. Art. 80(2) of the regulation was not implemented into Irish law. Therefore, a

consumer agency does not have the right to lodge a complaint on its own behalf. A

consumer agency has power to lodge a complaint with the respondent, when it is

acting on behalf of a data subject within the meaning of the Act.

113. To establish that, all that is required, is that a mandate be signed by the data

subject that they authorise the consumer agency to lodge a complaint on their behalf.

That is not an onerous requirement. The mandate does not have to be sworn before a

solicitor, or be notarised in any particular way. It is simply a written confirmation that

the consumer agency has authority to act on behalf of the complainant. It ought to

have been in place at the outset, and certainly before the respondent made the decision

to commence an inquiry.

114. The third essential condition for admissibility of a complaint, arises where the

complaint is lodged by a consumer agency. In such circumstances in order for the

complaint to be admissible, the organisation must comply with the requirements of

Art. 80(1). This requires that the consumer agency must be a not-for-profit body,

organisation or association, which has been properly constituted in accordance with

the law of a Member State; has statutory objectives which are in the public interest;

and is active in the field of the protection of data subjects’ rights and freedoms with

regard to the protection of their personal data.

115. The respondent accepts that all these criteria must be met, but states that it is

not necessary that they be established at the outset. I am satisfied that they are wrong

in that regard. 30

116. The requirements for an admissible complaint are not onerous. In the

circumstances of the present case, the complainants have to establish that they opened

an account with the applicant; that is established by providing their Gmail addresses,

and that they hold the subjective opinion that the processing of their personal data by

the controller infringes relevant enactments, that is proven by lodging the complaint

itself. They have to establish that they have authorised the consumer agencies to bring

the complaints on their behalf; which is done by providing a mandate authorising the

consumer agency to do so. Finally, there must be some evidence that the consumer

agency meets the requirements of being a representative body, as set out in Art. 80(1).

All of that is very easily done. It should have been done before deciding to hold an

inquiry into the complaints.

117. The reason why this should be done at the outset and not during the inquiry, as

proposed by the respondent, is that the very existence of the inquiry can have

significant adverse effects on the person, or entity, against whom the complaint is

made.

118. In Facebook Ireland Limited v Data Protection Commission [2021] IEHC

336, Barniville J (as he then was) noted that the commencement of an inquiry by the

respondent into suspected infringement of the GDPR, has legal consequences. He set

out some of these consequences at para. 130:

“First, as noted above, the commencement of an inquiry by the DPC

into suspected infringement of the GDPR does have legal

consequences. Once an inquiry is commenced, the DPC may cause any

of its powers under Chapter 4 (other than s. 135) to be exercised

and/or an investigation under Chapter 5 to be carried out (s. 110(2)).

Chapter 4 (ss. 129 to 136) of the 2018 Act provides for a range of 31

powers to be exercised by the DPC, including the appointment of

authorised officers, who are given a range of powers, including entry,

search and seizure powers, the entitlement to apply for search

warrants and to serve an information notice requiring certain

information from a controller or processor. Chapter 4 creates various

criminal offences to support the DPC and its authorised officers in

respect of the powers contained in that chapter. There are other

compulsory powers contained in Chapter 5. The DPC may cause those

powers to be exercised for the purposes of an inquiry which it has

caused to be conducted under s. 110(1) of the 2018 Act. The decision

by the DPC to commence an inquiry and the commencement of that

inquiry does, therefore, have legal consequences in that those

compulsory powers to which I have just referred may be exercised by

the DPC for the purposes of such inquiry.”

119. In addition, when responding to the merits of the complaint, the entity

concerned may have to furnish extensive information that is commercially sensitive.

If the ruling on admissibility of the complaint, is not made until the preliminary draft

decision, by that time, some or all of the commercially sensitive information may be

contained in the PDD itself, which is furnished to the CSAs under the Art. 60 process.

I am satisfied that there is a legitimate concern on the part of the applicant, that

release of that information in the context of the PDD, could cause it significant harm.

120. I also accept the submission on behalf of the applicant, that the possibility of

the imposition of substantial fines, which can arise at the conclusion of an inquiry,

may require the applicant to make a statement to the stock market, with adverse

effects on their share price. 32

121. I also accept their argument, that they will have to commit very considerable

resources in terms of manpower and legal resources, to meet the merits of the

complaints. They should not have to do that, unless and until the complaints are

deemed admissible by the respondent.

122. Accordingly, I hold that the applicant is correct in its essential submission that

the criteria for an admissible complaint should have been established to the

satisfaction of the respondent, before it decided to commence the inquiry into the

merits of the complaints in this case.

The Acquiescence Issue.

123. I turn now to deal with the arguments raised by the respondent as to why the

reliefs sought by the applicant should not be granted in the circumstances of the case

generally, and in particular, in light of the facts that have unfolded since the

commencement of the proceedings.

124. The respondent submitted that it was well established in Irish law, that where a

person participated in a statutory or other process, knowing of the defect or want of

jurisdiction, they could not subsequently challenge the process, or the jurisdiction of

the body to act in the way that they had consented to: see The State (Byrne) v Frawley

[1978] IR 326; Brennan v Governor of Portlaoise Prison [2008] 3 IR 364; Q(M) v

Judge of the Northern Circuit [2003] IEHC 88.

125. The respondent submitted that having been informed of the Slovenian

complaint some fourteen months in advance of the notice of commencement, and

having been informed of the remainder of the complaints in March 2023, some seven

months prior to the notice of commencement; and having engaged extensively with

the respondent during those periods, without raising any objection in relation to the 33

admissibility of the complaints; the applicant had acquiesced in the handling of the

complaints by the respondent to such an extent that it was estopped from raising the

admissibility issues that it had sought to raise in its letter of 30 November 2023 and in

the present proceedings. In particular, it was submitted that the applicant was

estopped from challenging the jurisdiction of the respondent to deal with the

complaints, when it had engaged actively with that process for such a prolonged

period of time.

126. The court accepts the broad submission made on behalf of the respondent that

where a person, with full knowledge of all relevant facts, participates in a statutory

process, they cannot subsequently, when they receive an adverse decision at the end

of that process, seek to challenge the jurisdiction of the decisionmaker.

127. In R (Kildare County Council) v Commissioner of Valuation [1901] 2 IR 215,

the Valuation Commissioner, when carrying out a valuation of a railway line in

County Kerry, purported to carry out a valuation of all parts of the main line,

including that part of the line running through County Kildare, notwithstanding that

no reference had been made to him in respect of a revaluation in that county. When

the valuation for County Kildare was reduced by the Commissioner, Kildare County

Council brought the matter back in before the Commissioner, who refused to alter his

valuation. Thereafter, they appealed to the County Court. Their notice of appeal did

not state want of jurisdiction as a ground of appeal. The County Court judge affirmed

the valuation.

128. The County Council then issued a writ of certiorari to quash the revised

valuation lists. In the Court of Appeal, Holmes LJ agreed with Palles CB in the lower

court, that the right to question an adjudication could be lost by the conduct of the

applicant. He stated that he could not conceive of a stronger case of estoppel by 34

conduct than in the case before him. The County Council had taken an appeal from

the valuation, with a view to having the valuation increased. By so doing, they had not

challenged the jurisdiction to make the valuation, but had in fact acted upon it, by

bringing the appeal with a view to getting an increased valuation. The court held that

the County Council’s acquiescence in the process and their conduct in bringing an

appeal on the merits, was sufficient to estop them from subsequently challenging the

jurisdiction of the Valuation Commissioner.

129. More recently, in Podariu v Veterinary Council of Ireland [2018] 3 IR 124,

the Court of Appeal revisited the law in relation to the circumstances in which

acquiescence and estoppel by conduct, can be said to confer jurisdiction on a statutory

tribunal. In that case, the Veterinary Council had purported to deal with an additional

complaint, which had not been referred to it by the Preliminary Investigation

Committee. Delivering the judgment of the court, Hogan J described the principle of

estoppel by conduct in the following way at para. 38:

“The law in relation to estoppel by conduct is illustrated by a trilogy of

leading Supreme Court decisions from the 1970s: In re Green Dale

Building Co. [1977] I.R. 256, Corrigan v. Irish Land Commission

[1977] I.R. 317 and The State (Byrne) v. Frawley [1978] I.R. 326. It is

quite clear from these cases that an entirely new jurisdiction cannot be

created by estoppel. Thus, for example, a decision of the Medical

Council purporting to sanction a veterinary surgeon would be wholly

void and ineffective, even if the veterinarian in question had somehow

submitted to the jurisdiction of that council. It is likewise clear that the

District Court cannot exceed its own geographical limitations by

purporting to deal with offences which had not been the subject of a 35

complaint made within the appropriate District Court district.

In O'Malley v. District Judge Kelly [2015] IECA 67, (Unreported,

Court of Appeal, 27 March 2015) this court accordingly held that the

District Court had no jurisdiction in such cases and quashed the

ensuing convictions, the acquiescence of the applicant in the entire

procedure notwithstanding.”

130. However, the court went on to note that the statutory provisions which

provided for the referral of complaints to the Fitness to Practice Committee, by the

Preliminary Investigation Committee, was primarily designed as a protection for the

veterinary surgeon. The court held that there had been sufficient acquiescence on the

part of the applicant to the addition of complaint number 17 at the hearing before the

FTPC. He was deemed to have waived the protection of the statutory provisions

which existed for his benefit. He was thus precluded from challenging the validity of

the FTPC decision to permit such an amendment to the notice of inquiry. The

applicant was held to be estopped by his conduct from challenging or impugning the

validity of the FTPC decision to permit the additional complaint to be added to the

original complaints. He was deemed by his acquiescence to have waived the statutory

provisions which existed for his benefit.

131. In light of these principles, I do not regard the argument advanced by the

respondent as being well founded for the following reasons: first, for acquiescence to

give rise to an estoppel by conduct, it must take place where the person who is said to

have acquiesced in the process, has full knowledge of all relevant facts, and with such

knowledge, has made a decision to participate in the process.

132. In this case, the applicant did not know that the respondent did not have much

of the requisite information when it decided to commence the inquiry. The applicant, 36

not unreasonably, assumed that the respondent had obtained the relevant information

so as to establish the admissibility of the complaints, when it decided to commence

the inquiry. The absence of any request for such information prior to being told that

an inquiry would be commenced, does not constitute knowledge or acquiescence in

the inquiry proceeding in the absence of that essential information.

133. Secondly, I accept the submission made on behalf of the applicant, that the

applicant was obliged by the DPA 2018, to cooperate with the respondent. Thus, the

significant engagement which the applicant had with the respondent since receipt of

the Slovenian complaint in September 2022, does not constitute a waiver by the

applicant of compliance with the necessary criteria for admissibility of a complaint.

134. I hold that by its engagement with the respondent in the period prior to the

decision to commence the inquiry on 23 October 2023, the applicant did not acquiesce

in the complaints being the subject of an inquiry, without the necessary criteria for

admissibility being met.

Principle of Mutual Trust and Duty of Sincere Cooperation.

135. The respondent’s submission under this heading has been summarised earlier

in the judgment. The court does not accept the proposition that the mere receipt by the

respondent of complaints from the CSAs in six countries, obliged it under the

principle of mutual trust and duty of sincere cooperation, to reach the conclusion that

the necessary criteria had been examined and had been found to have been in

existence by the CSAs concerned.

136. There is no evidence, save perhaps in relation to the Greek complaint, that the

CSAs concerned had examined the admissibility of the complaints. In other words,

there is nothing to suggest that the CSAs, with the exception of the Greek SA, had 37

sought mandates from the data subject to the complaint being lodged on their behalf

by a consumer agency. Nor was there any evidence that they had satisfied themselves

that the consumer agencies concerned had complied with the requirements for

representative bodies as set down in Art. 80(1) of GDPR 2016.

137. In other words, in the absence of anything to suggest that any vetting or

screening of the complaints for admissibility, had been carried out by the CSAs, the

respondent could not rely on the principle of mutual trust and the duty of sincere

cooperation, to make the assumption that such screening or assessment had been

carried out, or that the forwarding of such complaints constituted evidence that the

requisite criteria had been complied with.

138. The principle of mutual trust and the duty of sincere cooperation, only

provides that one state agency must assume that a state agency in another state has

complied with its obligations under EU law. In this case, the obligation on the CSA

was not to handle, or consider, the complaint; it was merely to pass it on to the

respondent as LSA for such investigation and determination as it considered

appropriate. Thus the respondent could not assume under this principle, that the CSAs

had found the complaints admissible. Accordingly, I reject this submission.

The Argument based on Rowland v An Post.

139. The respondent submitted that the present application should be refused on the

basis of the decision of the Supreme Court in Rowland v An Post [2017] 1 IR 355. In

that decision, the Supreme Court had held that for disciplinary inquiries within the

employment context, ordinarily, a court should not interfere with an ongoing process

unless the court was satisfied that it was clear that the process had gone wrong; that

there was nothing that could be done to rectify it; and that it followed that it was more 38

or less inevitable that any adverse conclusion reached at the end of the process, would

be bound to be unsustainable in law: see decision of Clarke J (as he then was) at paras

11 – 14.

140. It was submitted that in the present case, it could not be said that the process

had gone irremediably wrong. Any concerns that the applicant had in relation to the

admissibility of the complaints against it, could be addressed in the context of the

inquiry which had only just begun by virtue of the notice of commencement dated 23

October 2023. It was submitted that in these circumstances, the court should follow

the decision in the Rowland case and should decline to intervene in the inquiry at this

stage.

141. The court accepts that the statement of principle set down by the Supreme

Court in the Rowland case has been applied in many subsequent cases. The court also

accepts that in Murphy v Commissioner of An Garda Siochana [2023] IECA 92, the

Court of Appeal held that the principles enunciated in the Rowland case, are

applicable to judicial review proceedings.

142. In reaching its conclusion as to whether it is appropriate for this court to

intervene in the inquiry process which has been commenced by the respondent, the

court is of the view that it must have regard to the fact that in many of the previous

cases, such as in the Rowland case itself; and in the following cases: Becker v The

Board of Management of St Dominic’s School [2006] IEHC 130; Student A.B. (A

Minor) v Board of Management of a School [2019] IEHC 255; Ivers v Commissioner

of An Garda Siochana [2022] IECA 206, the processes that were sought to be

injuncted, concerned disputes between an individual and his employer, or between

individual students and their schools. 39

143. In the present case, the court is dealing with an inquiry of an altogether

different nature. The inquiry which the respondent proposes to hold into the

complaints lodged on behalf of the six complainants, constitutes an inquiry into a

systemic process utilised by the applicant at the account creation stage. Thus, it is

much wider than an inquiry of a disciplinary or other nature, between an individual

and another entity, be it an employer, or a school.

144. The court accepts the evidence given by Mr McHale in his affidavit sworn on

16 January 2024, as to the level of time and manpower that has been expended by the

applicant in dealing with the requests for further information that have issued from the

respondent to date. The court also accepts his evidence that if the inquiry is to

proceed, the applicant will have to incur very significant further expense and

deployment of manpower to deal with the subject matter of the complaints: see paras

81 – 85. In addition, as already noted, the court accepts that in order to deal with the

complaints the subject matter of the inquiry, the applicant may be required to divulge

a significant amount of confidential information. The court also accepts that the very

holding of an inquiry, with the possibility of the imposition of very significant fines at

the conclusion thereof, may require the applicant to make an announcement to the

markets, with a consequential adverse effect on its share price.

145. In these circumstances, the court is satisfied that notwithstanding the

principles set down in the Rowland case, the present case falls into the category of

cases where it is appropriate for the court to intervene in the process at this stage,

given that the holding of the inquiry itself will have significant adverse effects for the

applicant. Accordingly, the court rejects the submission made on behalf of the

respondent, that having regard to the principles set down in the Rowland case, the

court should decline to intervene in the inquiry at this stage. 40

Subsequent Evidence Establishing Jurisdiction.

146. Since the issuance of the notice of commencement, and also subsequent to the

institution of these proceedings, a substantial amount of evidence has been provided

to the respondent which establishes that mandates had been signed by each of the

complainants authorising the relevant consumer agencies to lodge complaints on their

behalf.

147. A substantial volume of documentary evidence has also been provided which

establishes that each of the consumer agencies meet the criteria for the representative

bodies, as laid down in Art. 80(1) of GDPR 2016.

148. It is not necessary to set out the precise dates on which each piece of evidence

came into the possession of the respondent. Broadly speaking, the relevant material

was received by the respondent in the period December 2023 to February 2024.

149. The respondent submits that it is permissible for the court to have regard to

this further evidence, when examining the question of fact, as to whether the

respondent had jurisdiction to make the decision to commence the inquiry, that it

made on 23 October 2023.

150. In support of the proposition that the court can have regard to fresh evidence

when examining the issue of jurisdiction, the respondent relied on the decision in R v

Secretary of State for the Environment [Ex P. Powis] [1981] 1 WLR 584, where

Dunne LJ, delivering the judgment of the English Court of Appeal, stated as follows

at p.595:

“What are the principles on which fresh evidence should be admitted

on judicial review? They are … (2) where the jurisdiction of the

Minister or inferior tribunal depends on a question of fact or where the 41

question is whether essential procedural requirements were observed,

the court may receive and consider additional evidence to determine

the jurisdictional fact or procedural error: see De Smith’s Judicial
th
Review of Administrative Action, 4 Ed, [1980] at pp. 140, 141 and

cases there cited…”

151. In Sweetman v An Bord Pleanála [2021] IEHC 16, the applicant was permitted

to make the case that the Board did not have jurisdiction to grant planning permission

to the entity which had applied for planning permission, being An Bradán Beo

Teoranta, because it had not been furnished with consents from all relevant

landowners, enabling that party to make the planning application, as required by Reg.

22(2) of the planning regulations. As it was a jurisdictional issue, the applicant was

allowed to call fresh evidence on it and was allowed to make the argument that the

Board lacked jurisdiction, even though that argument had not been raised by it at the

appeal hearing: see paras. 25 and 26.

152. In Reid v An Bord Pleanála [2021] IEHC 230 Humphreys J endorsed the

decision that had been given in the Sweetman case. He looked at the circumstances in

which fresh evidence can be admitted in judicial review proceedings. He held that the

court can admit fresh evidence when the issue goes to jurisdiction: see paras. 30-32.

153. I accept the submission made on behalf of the respondent that in looking at the

question of whether the respondent had jurisdiction to make the decision that it did on

23 October 2023, the court can have regard to the evidence that has come to hand in

the course of these proceedings.

154. That evidence clearly shows that the necessary mandates had been signed by

the complainants prior to the time when the decision to commence the inquiry had

been taken by the respondent. The evidence further establishes that at all material 42

times, the consumer agencies satisfied the criteria for representative bodies, which are

capable of lodging complaints on behalf of a complainant, as required by Art. 80(1) of

GDPR 2016.

155. I hold that as the necessary facts giving rise to jurisdiction on the part of the

respondent, were de facto in existence at the time when the decision to commence the

inquiry was made by it, the respondent had jurisdiction to make that decision.

156. While I have held that the respondent ought to have obtained evidence of the

existence of these facts, prior to making its decision; the existence of the required

criteria at the date of the making of the decision to commence the inquiry, which facts

have been established by evidence that has subsequently come to hand; which

evidence shows that such facts were in existence at the time when jurisdiction was

assumed by the respondent; that is sufficient to establish that the respondent de facto

had jurisdiction to issue the notice of commencement. It is also sufficient to resist the

applicant’s application to have the notice of commencement set aside.

157. Even if I am wrong in that conclusion, I accept the submission made on behalf

of the respondent that as the granting of relief by way of judicial review is a

discretionary remedy, the court should not grant the reliefs sought by the applicant in

this case, due to the fact that the necessary criteria showing that these complaints are

admissible, being now to hand; it would be futile to make an order striking down the

notice of commencement, as the respondent would simply issue a fresh one

immediately. As the conduct of the inquiry has been stayed voluntarily while these

proceedings have been pending before the court, there is no prejudice to the applicant

in allowing the original notice of commencement to continue. 43

Further Grounds Raised in the Amended Statement of Grounds.

158. There are two further matters on which it is necessary to reach a

determination. First, insofar as the applicant has sought in its amended statement of

grounds to have a declaration that the respondent has acted ultra vires by including

within the inquiry, complaints that fall outside the temporal scope of the notice of

commencement; this primarily relates to the French complaint. The applicant

maintains that this account was opened in 2014, meaning that it falls outside the

temporal scope of the inquiry. The account holder is adamant that she opened the

account in 2022, meaning that it comes within the temporal scope of the inquiry.

159. The respondent is entitled to resolve that conflict in the course of the inquiry.

Accordingly, I am not satisfied that the French complaint should be struck from the

notice of commencement.

Submission that the Complaints are an Abuse of Process.

160. The second matter is in the following terms: the applicant has argued that

subsequent evidence and investigations by them, have revealed that certain of the

complainants are employees within the consumer agencies, which have submitted the

complaints on behalf of the complainants.

161. The applicant relies on the decision of the Belgium DPA in its decision of 24

January 2024, in case bearing reference number 22/2024, relating to an alleged non-

compliant cookie banner. In that case, the Belgium DPA found that the complainant

was in fact an intern, who had been working in the consumer agency, which had

brought the complaint on her behalf. Furthermore, it transpired that she had been

directed as part of her duties while working with the consumer agency, to visit the

website and examine the cookie banner in respect of which the complaint was lodged. 44

162. The Belgium DPA held that in these circumstances, there was no spontaneous

nature to the visit to the website that had been conducted by the complainant in her

position as an intern with the consumer agency. It was held that the necessary genuine

consent on her part to the bringing of a complaint on her behalf by the consumer

agency, was missing. The Belgium DPA held that the consumer agency was acting,

not as an agent on the basis of Art. 80(1) of the GDPR, but as a complainant on the

basis of Article 80(2). As the Belgium Government had deliberately chosen not to

implement Art. 80(2), the complaint was deemed inadmissible: see paras. 51-55 and

59-60.

163. The applicant further argues that when one looks at the account history in

relation to a number of the accounts in this case, it is apparent that the accounts once

opened, where hardly used at all; suggesting that they were opened solely, or

primarily, for the purpose of making the complaints the subject matter of these

proceedings.

164. In essence, it is submitted that because a number of the complainants appear to

be employees of the consumer agencies, which have lodged the complaints and

having regard to the account history, the complaints are in effect an abuse of process,

as a means of enabling the consumer agencies to make the complaints on their own

behalf, notwithstanding that Art. 80(2) has not been implemented in Irish law.

165. These arguments have only been made subsequent to the notice of

commencement, because the relevant information was only provided to the applicant

in the affidavits filed on behalf of the respondent in the course of these proceedings.

166. No application has yet been made to the respondent to deem the complaints

inadmissible, as being an abuse of process, on these grounds. This is because the

inquiry was voluntarily stayed pending the outcome of these proceedings. 45

Accordingly, there is, as yet, no decision of the respondent on any such application, so

the issue does not fall for consideration in these judicial review proceedings.

167. If the applicant wishes to make that application to the respondent, it can do so.

It will be for the respondent to decide what procedure it will adopt to determine that

application, if and when it is made. The respondent may decide to deal with it as a

preliminary matter, or it may decide to deal with it as part of the inquiry that it has

commenced.

168. If the applicant makes such an application to the respondent, and if it is

aggrieved with the decision of the respondent on how it proposes to deal with that

application, they can take whatever steps they regard as necessary at that stage.

Proposed Order.

169. For the reasons set out herein, the court would propose to make the followings

orders:

(a) The court will set aside the notice of commencement dated 23 October

2023, insofar as it relates to the Czech complaint;

(b) save as indicated at (a) above, refuse the reliefs sought by the applicant in

its notice of motion and in its amended statement of grounds.

170. As this judgment is being delivered electronically, the parties will have two

weeks within which to furnish brief written submissions of not more than 1,000

words, on the terms of the final order and on costs and on any other matters that may

arise.

171. The matter will be listed for mention at 10.30 hours on 5 November 2024 for

the purpose of making final orders.

@@ Line 71: / Line 71: @@
 === Facts ===
-In 2022, Norwegian, Slovenian, Greek, French, Spanish and Czech consumer protection agencies, on behalf of data subjects, lodged complaints with DPAs relating to the account creation process with Google. These complaints were then forwarded to the Irish DPA between September 2022 and March 2023 as the lead supervisory authority due to location of the controller and in accordance with the one stop shop mechanism.
+In 2022, Norwegian, Slovenian, Greek, French, Spanish and Czech consumer protection organisation, on behalf of data subjects, lodged complaints with DPAs relating to the account creation process with Google. These complaints were then forwarded to the Irish DPA between September 2022 and March 2023 as the lead supervisory authority due to location of the controller and in accordance with the one stop shop mechanism.
-The complaints alleged dark patterns were used by Google in its account creation process. On 23 October 2023, the DPC decided to commence an inquiry and issued a notice of commencement. On 30 November 2023, Google objected to the commencement of the inquiry stating that the necessary information had not been provided to the DPC and to Google itself. Google posited that neither the account identifier information of each of the data subjects nor copies of the mandates of the consumer protection agencies representing the data subjects under [[Article 80 GDPR|Article 80(1) GDPR]] were presented to it. Google therefore questioned the DPC's jurisdiction over the matter.
+The complaints alleged dark patterns were used by Google in its account creation process. On 23 October 2023, the DPC decided to commence an inquiry and issued a notice of commencement. On 30 November 2023, Google objected to the commencement of the inquiry stating that the necessary information had not been provided to the DPC and to Google itself. Google posited that neither the account identifier information of each of the data subjects nor copies of the mandates of the consumer protection organisation representing the data subjects under [[Article 80 GDPR|Article 80(1) GDPR]] were presented to it. Google therefore questioned the DPC's jurisdiction over the matter.
@@ Line 84: / Line 84: @@
 === Holding ===
-The court echoes the wide discretion of the DPC but accepts Google's argument that certain basic criteria must be met. The High Court sets out that when a consumer protection agency files a complaint on behalf of a data subject the following criteria must be met:
+The court echoes the wide discretion of the DPC but accepts Google's argument that certain basic criteria must be met. The High Court sets out that when a consumer protection organisation files a complaint on behalf of a data subject the following criteria must be met:
 . Personal data of the data subject has been processed by the controller against which the complaint was made
@@ Line 90: / Line 90: @@
 . The processing was in a manner which the data subject considers infringes the GDPR
-. The data subject has mandated the consumer protection agency to act on their behalf
+. The data subject has mandated the consumer protection organisation to act on their behalf
-. The consumer protection agency meets the criteria under [[Article 80 GDPR#1|Article 80(1) GDPR]]
+. The consumer protection organisation meets the criteria under [[Article 80 GDPR#1|Article 80(1) GDPR]]
 Therefore, the court concludes that it is essential for the account identifiers to be submitted before the commencement of the inquiry as it would show primarily that the data subject had created an account and which account creation process had been used. Further, the supply of this information is necessary to allow Google to prepare a response.
@@ Line 98: / Line 98: @@
 * The Czech complaint
-The Czech complaint was held to be inadmissible as the data of the Czech data subject had not been processed as no account was created. Only if [[Article 77 GDPR]] included the future tense, the Czech complaint would have been admissible. The court rejected the Meta case ([[CJEU - C‑757/22 - Meta Platforms Ireland (Representative action)|C-757/22]]) argument as in this case the complaint was not lodged on behalf of a data subject but directly by the consumer protection agency. The court reiterated that if no personal data is provided, the DPC cannot handle the complaint as Ireland has not implemented Article 80(2) GDPR into Irish law.
+The Czech complaint was held to be inadmissible as the data of the Czech data subject had not been processed as no account was created. Only if [[Article 77 GDPR]] included the future tense, the Czech complaint would have been admissible. The court rejected the Meta case ([[CJEU - C‑757/22 - Meta Platforms Ireland (Representative action)|C-757/22]]) argument as in this case the complaint was not lodged on behalf of a data subject but directly by the consumer protection organisation. The court reiterated that if no personal data is provided, the DPC cannot handle the complaint as Ireland has not implemented Article 80(2) GDPR into Irish law.
 * Mandate
-The mandate clarifying that the consumer agencies are entitled to represent the data subject should have been present at the outset before the inquiry was started. The responding party to an inquiry has to furnish commercially sensitive data for the inquiry and the risk of release of such information could cause significant harm. Further, they must invest extensive resources into responding to the inquiry so the launch must be justified.
+The mandate clarifying that the consumer organisation are entitled to represent the data subject should have been present at the outset before the inquiry was started. The responding party to an inquiry has to furnish commercially sensitive data for the inquiry and the risk of release of such information could cause significant harm. Further, they must invest extensive resources into responding to the inquiry so the launch must be justified.
 * Mutual trust and duty of sincere cooperation
-The court rejected the argument that on the basis of mutual trust and sincere cooperation the DPC should assume that the claims forwarded to it were well examined. There was no evidence showing that the consumer protection agencies had been well vetted.
+The court rejected the argument that on the basis of mutual trust and sincere cooperation the DPC should assume that the claims forwarded to it were well examined. There was no evidence showing that the consumer protection organisation had been well vetted.
 However, the court summarises that the relevant facts were de facto in existence when the investigation was launched and the DPC therefore had jurisdiction to launch the investigation. Evidence submitted during the course of the proceedings clearly showed that the necessary mandates had been signed by the complainants and satisfied the requirements under [[Article 80 GDPR|Article 80(1) GDPR]]. The court further agrees that it would be futile to strike down the proceedings as the DPC would just issue a new investigation.