High Court of Ireland Decisions

THE HIGH COURT

[2024] IEHC 577

[Record No. H.JR.2024/81]

BETWEEN

GOOGLE IRELAND LIMITED

APPLICANT

AND

 

DATA PROTECTION COMMISSION

RESPONDENT

 

JUDGMENT of Mr Justice Barr delivered electronically on the 11^th day of October 2024.

Introduction.

1.                  The applicant is a multinational company that provides an internet search engine and other facilities to people who have an account with it.

2.                  The respondent is the statutory body established pursuant to the Data Protection Act 2018 (hereinafter 'DPA 2018'), to, inter alia, handle and if thought appropriate, investigate complaints made by data subjects that the processing of their personal data infringes their rights under the General Data Protection Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter 'GDPR 2016') and under DPA 2018.

3.                  Essentially, this case concerns six complaints that were lodged by consumer agencies in Norway, Slovenia, Greece, France, Spain and Czechia, on behalf of people resident in those countries.

4.                  Each of the complainants made a range of complaints about the process known as the account creation process, which was completed by all but one of the complainants, when opening their account with the applicant; whereby their consent was obtained to the processing by the applicant of their personal data.

5.                  In the period September 2022 to March 2023, a total of six complaints were received by the respondent. These complaints had been forwarded by the supervisory authorities in the countries in which the complaints had been originally lodged. These supervisory authorities are known as concerned supervisory authorities, (hereinafter 'CSAs'). The complaints were forwarded to the respondent as the lead supervisory authority (hereinafter 'LSA'), due to the fact that the applicant has its registered office in this jurisdiction.

6.                  Each of the complaints were in almost identical terms. It is not necessary for the purpose of this application, to examine the content of the complaints in any detail, as this application deals with the admissibility of the complaints, rather than their content.

7.                  It will suffice to note that each of the complainants complained that the process leading to the creation of their account, wherein they had to indicate their preference for various account settings, was unfair in that they alleged that it was much easier to give consent to the applicant using their personal data, which could be done by one click on the mouse; rather than choosing the option of managing their own account settings, which required five separate steps and ten individual clicks on the mouse.

8.                  It was further alleged that the language used in giving various options to a person when opening an account was unfair in that it (a) was not transparent in relation to what use would be made by the applicant of their personal data; (b) was unclear in relation to what steps could subsequently be taken to alter the account settings; (c) it engaged what are known as "dark patterns", whereby wording was used that influenced or prompted a person to take a particular option, by making that option appear desirable, while at the same time, making the alternative negative option appear undesirable, as it was described in unfavourable terms. That is but a very brief account of the essence of the complaints lodged on behalf of the six complainants.

9.                  After notifying the applicant of receipt of the complaints, and having provided the applicant with the written complaints received by the respondent and following a considerable exchange of correspondence, in the course of which the applicant provided substantial information in relation to its account creation process and in relation to the use to which it puts the information that it gleans from the account holders; the respondent decided on 23 October 2023, to commence an inquiry pursuant to its powers under DPA 2018. It did that by issuing a notice of commencement of inquiry (hereinafter 'notice of commencement') on that date.

10.              By letter dated 30 November 2023, the applicant objected to the commencement of the inquiry on the basis that the necessary criteria for admissibility of a complaint had not been met.

11.              In particular, the applicant requested that they be provided with the Google account identifier information in respect of each account, (hereinafter 'account identification information'). This is essentially the Gmail address of each complainant. The applicant further asked that if the complaint was being lodged by a consumer agency pursuant to the provisions of Art. 80(1) of GDPR 2016, that they be provided with copies of the mandates by which the data subject had authorised the consumer agency to bring the complaint on his or her behalf.

12.              The applicant also requested the evidence which demonstrated that each consumer agency met the requirements to act as a representative body in respect of each complaint. This essentially required evidence that the consumer agency (i) was a not for profit organisation; (ii) had been properly constituted in accordance with the law of the relevant Member State; (iii) had statutory objectives which are in the public interest; and (iv) was active in the field of the protection of data subjects' rights.

13.              By letter dated 22 December 2023, the respondent replied, stating that it disagreed with the assertion that they were obliged to provide a reasoned determination to the applicant in relation to the admissibility of the complaints. It denied that they were obliged to identify, or furnish, any documents which informed the view that had been reached by the respondent that the complaints were admissible. The letter went on to state that, as recorded in the notice of commencement, the respondent had considered the information made available to it in respect of the complaints, to include the content of the complaints themselves, and had satisfied itself that it was appropriate that an inquiry be commenced in order to ascertain whether one or more of the infringements had occurred, or was occurring. The letter further stated that beyond that, issues relating to the validity and/or admissibility of the complaints could and would be dealt with in the context of the decision to be adopted by the respondent in due course. The letter further stated that prior to its adoption, the decision would be circulated to the applicant in draft form and the applicant would be afforded an opportunity to consider and respond to the contents thereof prior to the decision being finalised and adopted.

14.              In this application the applicant seeks an order setting aside the notice of commencement on the basis that, under the DPA 2018, in order to have jurisdiction to hold an inquiry into a complaint, the respondent was required to determine that three criteria had been met: (a) that personal data of each of the individuals behind the complaints had been processed by the applicant in a manner that those individuals considered infringed GDPR 2016, insofar as it was processing by the applicant that fell within the scope of the inquiry; (b) that each of the individuals had mandated the consumer agency to make the complaint on their behalf; and (c) that each of the consumer agencies met the criteria set down in Art. 80(1) of GDPR 2016.

15.              It was submitted by the applicant that the respondent did not have information or evidence before it, that would have enabled it to have been satisfied that these three criteria had been met in respect of each complaint. It was submitted that the respondent therefore lacked jurisdiction to commence the inquiry, given its state of knowledge on 23 October 2023.

16.              In its amended statement of grounds, the applicant states that in the light of the information that has come to hand subsequently, the respondent is acting ultra vires, insofar as it is proposing to inquire into complaints that fall outside the temporal scope of the inquiry, as set out in the notice of commencement.

17.              The respondent denies that the applicant is entitled to any of the reliefs sought in the amended statement of grounds. The basis of their objection to the reliefs sought is set out in detail later in the judgment.

 

Background.

18.              Before coming to the arguments and the merits of the application, it is unfortunately necessary to give some background to the steps that were taken by the parties prior to the issuance of the notice of commencement. This is due to the fact that one of the arguments raised by the respondent is that by its actions, and in particular, by its protracted engagement with the respondent prior to the issuance of the notice of commencement, without raising any issues in relation to the admissibility of the complaints, the applicant thereby acquiesced in the inquiry proceeding and is therefore estopped from raising the objections that it seeks to raise in this application.

19.              On 30 June 2022, the European Consumer Organisation (BEUC), issued a press release wherein they alleged that Google was using deceptive design, unclear language and misleading choices, when consumers signed up to a Google account to encourage more extensive and invasive data processing. They claimed that contrary to its claims, the tech company was thwarting consumers who wanted to better protect their privacy. To that end, it was stated that ten consumer groups, under the coordination of BEUC, were taking action to ensure that the applicant complied with the law.

20.              The press release stated that a consumer could choose to create a Google account voluntarily, or could be obliged to create one, when they used certain Google products and/or services. For example, they had to create an account when they purchased a smart phone that uses Google's android system, which BEUC claimed almost seven in ten phones worldwide (69%) depended on, if they wanted to download apps from the Google play store.

21.              The press release went on to state that sign up was a critical point at which the applicant made users indicate their "choices" about how their account would operate. With only one step, known as "express personalisation", the consumer would activate all the account settings that feed the applicant's surveillance activities. The applicant did not provide consumers with the option to turn all settings "off" in one click. The press release asserted that if customers wished to opt for the "manual personalisation" option, that required five steps, with ten clicks and involved grappling with information that was alleged to be unclear, incomplete and misleading.

22.              The press release went on to state that the applicant was a colossus in the world of surveillance capitalism, with 81% of its revenue coming from its advertising operations, which in turn depended on the data it harvested from people to personalise adverts for them. The press release stated that from advertising, the applicant was forecast to earn €221bn in 2022, which was almost double the amount its closest competitor, Facebook, was expected to make from digital advertising.

23.              It is clear from the press release issued in June 2022, that the applicant must have been expecting a fairly concerted attack on its account creation process. That duly occurred on 29 September 2022, when the respondent wrote to the applicant notifying it of a complaint that had been forwarded by the Slovenian supervisory authority, in respect of a complaint lodged by a consumer agency on behalf of a complainant resident in that country. The respondent issued a request for information (hereinafter "RFI") to the applicant in respect of that complaint. Thereafter, the applicant requested an extension of time within which to respond to the queries raised by the respondent.

24.              By letter dated 04 October 2022, the respondent granted an extension of time to 18 October 2022, in respect of all but one of its RFIs. On 06 October 2022, the applicant provided responses to the RFIs comprising information, including screen shots, regarding its account creation process. On 18 October 2022, the applicant provided further responses.

25.              On 27 October 2022, the respondent raised further RFIs. Further information was provided by the applicant on 28 October 2022. On 05 October 2022, the applicant requested an extension of time to furnish complete replies to the RFIs. This request was granted on 08 November 2022. Further information was provided by the applicant on 18 November 2022, and also on 01 December 2022.

26.              On 05 December 2022, the applicant set out proposals regarding privilege, confidentiality and commercial sensitivity attaching to documentation to be provided in response to the RFIs. On 08 December 2022, the applicant provided further information in response to the RFIs, identifying particular information regarding settings and the purposes and legal basis of identified processing operations.

27.              On 22 December 2022, the respondent requested the applicant to produce documentation addressing a number of matters. That letter advised the applicant that the respondent may "in due course...resolve to conduct a statutory inquiry into some or all of the issues raised by the complaint".

28.              On 23 December 2022, the applicant addressed further issues of privilege attaching to documents intended to be submitted to the respondent. It also responded to RFIs raised by the respondent on 22 October 2022, including an appendix running to 1,281 pages.

29.              On 22 February 2023, the respondent issued notices pursuant to s.108(1) DPA 2018, to the Norwegian, French and Czech SAs. Similar notices were sent to the Slovenian and Greek SAs on the following day.

30.              On 16 March 2023, the respondent furnished copies of the full suite of complaints to the applicant. The respondent advised the applicant that it was assessing "what form of regulatory action it will take to handle these complaints". By letter dated 23 March 2023, the applicant raised issues regarding the respondent's proposal to share copies of certain documents with the CSAs. On 27 March 2023, the respondent advised the applicant of its intention to exercise its discretion to commence a statutory inquiry into the subject matter of the complaints.

31.              By letter dated 12 May 2023, the respondent confirmed that it would not be sharing identified documents with the CSAs at that time and that it had canvassed the views of the CSAs regarding the appropriate scope of the inquiry, albeit it remained a matter for the respondent as to whether to commence an inquiry and, if so, the appropriate scope thereof.

32.              On 23 May 2023, the applicant outlined certain changes to the account creation process which it had implemented. By letter dated 01 September 2023, the respondent sent further RFIs to the applicant regarding the changes made to the account creation process. A response to that RFI was furnished by the applicant on 14 September 2023.

33.              On 22 September 2023, the applicant furnished an appendix identifying statistical information. A further appendix was delivered on 29 September 2023. A further appendix identifying statistical information was furnished on 13 October 2023.

34.              On 23 October 2023, the respondent notified the applicant of its intention to commence inquiry bearing reference number "IN-23-2-4" by way of a notice of commencement. The notice of commencement explained that it was a complaint-based inquiry into the complaints. The notice also raised further RFIs.

35.              By letter dated 25 October 2023, the applicant acknowledged receipt of the notice of commencement and sought an extension of time to provide responses to the RFIs.

36.              By letter dated 30 November 2023, the applicant wrote to the respondent requesting that it be provided with information relating to the respondent's jurisdiction to commence the inquiry. Specifically, the applicant sought the account identifier information, the mandates signed by the complainants and the representative body information in relation to the consumer agencies which had lodged the complaints on behalf of the complainants.

37.              On 04 December 2023, the applicant responded to a further RFI which had formed part of the notice of commencement. The response ran to 319 pages, including eight appendices. It was expressed to be made without prejudice to the applicant's letter of 30 November 2023.

38.              By letter dated 13 December 2023, the applicant raised the issue of the "validity and admissibility of the complaints, the material scope of the inquiry and the confidentiality and the use of materials provide by Google to the DPC".

39.              On 19 December 2023, the respondent informed the applicant by email that it was gathering information to enable it to respond to the applicant's letter of 30 November 2023. The respondent stated that it was prepared to suspend the progress of the inquiry pending this step being taken.

40.              On 20 December 2023, the applicant wrote to the respondent, to propose a standstill arrangement, which would afford the respondent additional time to gather the information sought in the applicant's letter of 30 November 2023, but without prejudicing (by virtue of the passage of time) to the applicant's right to seek judicial review of the respondent's decision to commence the inquiry in due course. That proposal was rejected by the respondent on 22 December 2023. By letter dated 10 January 2024, the applicant wrote to the respondent requesting it to reconsider its position in respect of the proposed standstill arrangement.

41.              On 18 January 2024, the applicant issued the within proceedings. The application seeking leave to proceed by way of judicial review was opened on 22 January 2024, but was adjourned on that date to enable it to be made on notice to the respondent.

42.              On 06 February 2024, the respondent confirmed to the court that it was not objecting to the applicant's application for leave to seek judicial review and that it would agree to an effective stay on the inquiry pending the outcome of the proceedings.

43.              Following the exchange of pleadings in the case, including delivery of an amended statement of grounds and an amended statement of opposition, the application was heard before this Court on 25 and 26 July 2024.

 

Relevant Legislation.

44.              The key provisions of GDPR 2016 for the purposes of this application, are Arts. 77 and 80. Article 77 provides that without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work, or place of the alleged infringement, if the data subject considers that the processing of personal data relating to him or her infringes the regulation.

45.              Article 80 provides that the data subject shall have the right to mandate a not for profit body, organisation or association, which has been properly constituted in accordance with the law of a Member State; has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects' rights and freedoms with regard to the protection of their personal data, to lodge the complaint on his or her behalf.

46.              It should be noted that while Art. 80(2) provides that Member States may make provision for the lodgement of complaints by an organisation or association on its own behalf, and independently of a data subject's mandate; Ireland has not incorporated this provision into its domestic law.

47.              There are a number of provisions of DPA 2018 which are of relevance. The first of these is s.107, which provides that the term "complainant" means a data subject who lodges a complaint, or as the case may be, a not for profit body, organisation or association that, in accordance with Article 80(1), lodges a complaint on behalf of a data subject.

48.              Section 107 defines the term "complaint" in the following way:

""complaint" means a complaint lodged pursuant to Article 77(1) or in accordance with Article 80(1), and shall be deemed to include a complaint so lodged by or on behalf of a data subject where—

(a) the data subject considers that the processing of personal data relating to him or her infringes a relevant enactment, and

(b) the Commission is the competent supervisory authority in respect of the complaint;"

49.              Section 108(2) provides that where the Commission is the competent supervisory authority in respect of a complaint, it shall (a) handle the complaint in accordance with that part of the Act, and (b) inform the complainant of the progress or outcome of the complaint.

50.              Section 109 provides that for the purposes of s.108(2)(a) the Commission shall examine the complaint and shall, in accordance with that section, take such action in respect of it as the Commission, having regard to the nature and circumstances of the complaint, considers appropriate. The section goes on to outline a number of steps that can be taken by the Commission in the handling of a complaint, including the causing of such inquiry as the Commission thinks fit to be conducted in respect of the complaint, and the taking of such other action in respect of the complaint as the Commission considers appropriate.

51.              Section 110 is of particular relevance. It gives the Commission the power to conduct an inquiry into a suspected infringement of a relevant enactment. It provides as follows:

"110. (1) The Commission, whether for the purpose of section 109(5)(e), section 113(2), or of its own volition, may, in order to ascertain whether an infringement has occurred or is occurring, cause such inquiry as it thinks fit to be conducted for that purpose.

(2) The Commission may, for the purposes of subsection (1), where it considers it appropriate to do so, in particular do either or both of the following:

(a) cause any of its powers under Chapter 4 (other than section 135) to be exercised;

(b) cause an investigation under Chapter 5 to be carried out."

52.              Finally, s.113 deals with the situation where Art. 60 applies. Where the Commission is the LSA, the section provides that it will make a draft decision in respect of the complaint. The section goes on to make further provisions in relation to the content and issuing of the draft decision.

 

Summary of Receipt of Relevant Information by the Respondent in respect of Each Complaint.

53.              The dates on which information in relation to the account identifiers, the mandates from the complainants and the representative body information, was furnished to the respondent and the nature of that information in each case, has been set out in extenso in the various affidavits sworn on behalf of the respondent. It is not necessary to set out in detail each of the dates on which each piece of information in respect of each complaint was furnished to the respondent. A brief summary of the overall position will suffice.

54.              At the date of the notice of commencement, the respondent only had account identifier information in respect of the Spanish complaint. However, the respondent was not aware that it had that information at that time. All the relevant account identifier information, being the relevant Gmail addresses, came into the possession of the respondent between December 2023 and February 2024, save for the Czech complaint, which information was never produced.

55.              At the date of the notice of commencement, the respondent had mandates from the complainant's authorising the consumer agencies concerned to bring the complaints on their behalf, in respect of the Norwegian, French and Spanish complaints. The respondent subsequently obtained mandates in respect of the Slovenian, Greek and Czech complaints in December 2023 and February 2024.

56.              At the date of the notice of commencement, the respondent had some representative body information in respect of the Norwegian and Spanish consumer agencies. The representative body information for the remaining consumer agencies, being the Slovenian, Greek, French and Czech consumer agencies, was received between December 2023 and February 2024.

 

Submissions of the Applicant.

57.              The applicant submitted that in order for the respondent to have jurisdiction to deal with a complaint submitted by a representative body on behalf of a data subject, three conditions had to be satisfied: first, that personal data of the data subject had been processed by the applicant in a manner that those individuals considered infringed GDPR 2016, or DPA 2018; secondly that each individual had mandated the consumer agency to act on their behalf; and, thirdly, that each of the consumer agencies met the criteria for them to act as a representative body, as set down in Art. 80(1) of GDPR 2016.

58.              It was submitted that it was clear that when the respondent decided to commence the inquiry on 23 October 2023, it had failed to satisfy itself, and had no information on which it could have satisfied itself, as to these criteria. Therefore, it could not have been satisfied that it had jurisdiction to conduct the inquiry. The respondent having failed to take these steps, the applicant submitted that the inquiry was unlawful.

59.              The applicant submitted that having regard to the cost and potential adverse consequences for the applicant in having to disclose highly confidential commercial information in the course of the inquiry, it was necessary for the respondent to make a decision on the admissibility of the complaints at the outset. To that end, the respondent should have ensured that the complaints received by it complied with the requirements set down in DPA 2018, before deciding to commence an inquiry. It was submitted that these requirements were essential to give the respondent jurisdiction to commence an inquiry.

60.              It was submitted that the respondent could not have been satisfied that the complaints in this case were admissible at the time that it decided to commence the inquiry in October 2023, because it did not have the basic information that was necessary to establish that the complaints were admissible. The respondent was only in possession of account identifier information in respect of the Spanish account, but it was not aware of that at the relevant time. It did not have mandate information in respect of the Slovenian, Czech or Greek complaints and it did not have representative body information in respect of any of the complaints.

61.              The applicant submitted that without this basic information, which was mandated by the statutory regime established under DPA 2018, the respondent lacked jurisdiction to begin the inquiry, which it had purported to do by the notice of commencement dated 23 October 2023.

62.              Insofar as the respondent had asserted in correspondence that the issue of admissibility would be determined at some unspecified later stage in the course of the inquiry, it was submitted that the respondent was wrong in that assertion, because by so doing it was effectively giving itself jurisdiction to conduct an inquiry into the complaint before it had ruled that the complaint was properly admissible. If the complaint was found to be inadmissible, the respondent would not have jurisdiction to conduct an inquiry into it. Therefore, it was submitted that the decision on admissibility of the complaint had to be made at the outset of the process.

63.              Counsel for the applicant further submitted that by deferring a definitive decision on admissibility until the preliminary draft decision was delivered, the applicant would be put to the expense and time consuming work of addressing the merits of the complaints, which would involve supplying substantial amounts of commercially confidential information, which could be disclosed to the CSAs in the course of the preliminary draft decision, before it had even been established that the complaints were admissible. It was submitted that that would place the applicant in a position of considerable jeopardy, involving disclosure of its sensitive commercial information. It would also put the applicant to inordinate expense in dealing with a complaint that may ultimately be found to be inadmissible.

64.              In addition, it was submitted that having regard to the very large fines that can be imposed by the respondent in the event that certain conclusions are reached by it, the possibility of such fines being imposed may require the applicant to make an announcement to the markets, which would have an adverse effect on the applicant's share price.

65.              At its simplest, the applicant's argument was that the respondent only has jurisdiction under the DPA 2018 to handle complaints that comply with the statutory criteria.  

66.              It was submitted that the respondent had decided to embark on an inquiry into complaints, before it had ruled definitively on their admissibility and had done so at a time when they could not have been satisfied that the necessary criteria had been met, because the necessary information was not in their possession at the date when they made the decision to commence the inquiry. It was submitted that on this basis, the notice of commencement should be struck down.

67.              The applicant also challenged the level of reasoning that had been furnished by the respondent in relation to the admissibility of the complaints. It was submitted that in its letter of 23 December 2023, the respondent had merely stated that it was satisfied that the complaints were admissible on the basis of the written documents that had been submitted to it. At the same time, the respondent had maintained that the issue of admissibility would be addressed further in the course of the inquiry. It was submitted that the reasons given by the respondent on why the complaints were held admissible, were wholly inadequate, as they did not address any of the issues that had been raised in the applicant's letter of 30 November 2023.

68.              It was submitted that insofar as the respondent had alleged that the applicant was estopped from challenging the notice of commencement, due to the fact that it had engaged in a substantial way with the respondent prior to the date of the issue of the notice of commencement; that was misconceived, because the applicant was under a statutory duty to cooperate with the respondent whenever it wrote to the applicant in relation to a potential complaint.

69.              Secondly, the applicant did not know that the respondent did not have the relevant information and more importantly, did not propose to obtain it until the substantive inquiry was underway. It was submitted that without this knowledge, the applicant could not be said to have acquiesced in the inquiry commencing in the absence of that information.

70.              It was submitted that the applicant had raised the objection to jurisdiction at the earliest possible opportunity. It was submitted that in these circumstances there had been no acquiescence by the applicant which would be sufficient to prevent it raising the issue of jurisdiction at this stage.

71.              Finally, in light of the information that had come to hand subsequently, it was submitted in the additional grounds as pleaded in the amended statement of grounds, that the respondent was purporting to hold an inquiry into complaints that were either inadmissible, such as the Czech complaint, because that person had not opened an account with the applicant and therefore no processing of her data had taken place; or the complaint was out of scope, as the date of creation of the account was outside the temporal scope identified in the notice of commencement. It was submitted that the respondent was acting ultra vires in purporting to deal with these complaints in the course of the inquiry.

 

Submissions on behalf of the Respondent.

72.              On behalf of the respondent it was submitted that the protection of personal data was a fundamental right of every person whose personal data was sought to be processed by a person or entity. That was recognised in GDPR 2016 and in DPA 2018.

73.              It was submitted that under DPA 2018, the respondent is given very wide powers to hold an inquiry into a complaint whenever it deems it necessary to do so. There are no specific preconditions that have to be complied with, before the respondent can decide to commence an inquiry.

74.              In particular, it was submitted that there was no requirement under the statutory regime, for a preliminary hearing, or a decision on admissibility of the complaint, prior to deciding to commence an inquiry into the complaint.

75.              It was submitted that the definition of a "complaint" in s.107, made it clear that there were two admissible criteria. First, consistent with Art. 77(1), there must be a data subject who considers that the processing of personal data relating to him or her infringes a relevant enactment. This required a subjective belief on the part of a data subject that the processing of their personal data infringed a relevant enactment. Secondly, the respondent must be the LSA in a complaint involving cross border processing. It was submitted that both these criteria were satisfied at the time when the respondent made its decision to commence the inquiry in October 2023.

76.              It was submitted that it was important to note that the issue of admissibility was not being determined once and for all at the commencement of the inquiry. If it could be established that for any reason, a particular complaint was not admissible, it could be struck out at any stage of the inquiry, once the fact of its inadmissibility had been established.

77.              Insofar as the applicant had complained about the absence of material in relation to the account identifier information, the mandates and the representative body information, not being in the possession of the respondent at the date on which it decided to commence the inquiry; it was submitted that where the complaints had been transferred to the respondent by the CSAs in the Member States where the complaints had originated, the principle of EU law of mutual trust and the duty of sincere cooperation came into play.

78.              It was submitted that this principle had been described as one of fundamental importance to European law and to the effective functioning of the EU. In essence, it required the respondent, as the LSA, to assume that the CSAs which had forwarded the complaints to it, had complied with their obligations under European law, and had done so on the basis that the complaints constituted admissible complaints. It was submitted that the respondent was not merely entitled to so presume, but was obliged to operate on the basis that the CSAs had not transmitted complaints that were lacking mandates, or in respect of bodies that did not comply with the requirements for a representative body as contained in GDPR 2016.

79.              It was submitted that the applicant had engaged with the respondent in relation to the Slovenian complaint for a period of approximately fourteen months, and in relation to the other complaints for a period of approximately seven months, prior to the issuance of the notice of commencement; during that time they had never raised the issues concerning account identifier information, mandates or representative body information, which had been raised for the first time in their letter of 30 November 2023. It was submitted that in these circumstances, the applicant had acquiesced in the conduct of the process and they were estopped from challenging that process many months after it had commenced.

80.              It was submitted that even if the court were to hold against the respondent in relation to the issue of jurisdiction at the date of the notice of commencement, the court should have regard to the information that has subsequently come to hand, as exhibited in the affidavits filed in these proceedings, which clearly showed that the necessary mandates had been in place at all relevant times and that the consumer agencies satisfied the criteria to act as representative bodies pursuant to Art. 80 of GDPR 2016.

81.              It was submitted that in these circumstances, the court should either hold that the respondent has jurisdiction to proceed with its inquiry, or in the alternative, it should decline to strike down the notice of commencement, on the basis that it would be futile to do so, as the respondent would simply issue a fresh notice of commencement immediately in respect of the same complaints. It was submitted that the more preferable course of action was to allow the notice of commencement to continue, particularly as this would cause no prejudice to the applicant, as the inquiry had been effectively stayed by agreement pending the outcome of these proceedings.

82.              In relation to the Czech complaint, it was submitted that the fact that the data subject in that case had not completed the account creation process, did not mean that her complaint was inadmissible. She was still entitled to make a complaint that the terms and conditions as set down by the applicant in the account creation process, were misleading, lacking in transparency and unfair to consumers. In this regard the respondent referred to the decision of the CJEU in the Meta Platforms Ireland Limited case (C-757/22).

83.              In relation to the assertion that certain complaints that were proposed to be examined as part of the inquiry were out of scope, this appeared to refer to the French complaint, where the applicant maintained that the relevant account had been opened in 2014. However, the French complainant was adamant that her account had been opened in 2022, which was in scope. That issue would be determined in the course of the inquiry.

84.              It was submitted that if a complaint is established as being out of scope, because it was established that the account was opened outside the inquiry period, then that complaint will be struck out in the course of the inquiry.

85.              It was submitted that it was not required, nor was it desirable, to have an elaborate preliminary hearing and decision on admissibility at the outset. That would only make the procedure overly complex, which was not desirable having regard to the rights guaranteed in the regulation and in the Act; and having regard to the need for an effective method of protecting those rights.

86.              It was submitted that for these reasons the court should refuse the reliefs sought by the applicant and should allow the inquiry to continue.

 

Conclusions.

The Criteria for an Admissible Complaint.

87.              Having considered the papers, and the oral and written arguments of counsel, together with the legal authorities referred to therein, the court has reached the following conclusions in this case: First, the privacy of personal data has been recognised in European and Irish Law as deserving of particular protection.

88.              This is provided for in GDPR 2016 and in DPA 2018. Both provide significant protection to an individual in relation to the harvesting and use of their personal data. Individuals are given extensive rights in relation to what information they must be given when their consent is sought for the retention and use of their personal data. There are extensive provisions in relation to the terms in which their consent may be obtained as part of the opening of an account, and in particular, the information that they must be given in relation to the processing and use of their personal data.

89.              Individuals are also given the right in Art. 77 of GDPR 2016 to make a complaint to the supervisory authority in their country of origin, or residence. That is a significant right, which must not be rendered incapable of being effectively invoked by the application of an overly restrictive admission process.

90.              The power of the respondent to handle a complaint and, if necessary, to commence an inquiry, is contained in DPA 2018. While it is undoubtedly a wide power, I accept the submission made on behalf of the applicant that certain basic criteria have to be met in order for a complaint to be admissible.

91.              When a complaint has been lodged by a consumer agency acting on behalf of a data subject, the following criteria must be met: that personal data of the complainant has been processed by the person, or entity, against whom the complaint is made, in a manner that the data subject considers infringes GDPR 2016, or DPA 2018; that the complainant has mandated the consumer agency to act on their behalf in bringing the complaint; and that the consumer agency meets the criteria for a representative body as set down in Art. 80(1) of GDPR 2016.

92.              That is not a demanding set of criteria. The first and most fundamental criterion is that a person's personal data has been processed by the person or entity against whom they wish to lodge the complaint. To establish that, they need to furnish the account identifier information, which in this case, is effectively their Gmail address.

93.              By opening the Google account, they have established that they have participated in the account creation process that applied as of the date of opening of the account. Their personal data, in the form of the information that they provided ab initio when opening the account, and their account usage history after opening, constitutes the personal data that is processed by the controller of the account, in this case, by the applicant.

94.              I accept the submission made by the applicant that it is essential that account identifier information is provided by the complainant at the outset, because it is that information which establishes that an account was in fact opened by the data subject with the applicant. This is basic information which the respondent should have been given by the complainant at the outset.

95.              To argue by analogy, if the Irish Medical Organisation are considering a complaint against a doctor, which is brought by an adult, the most basic piece of information required is that the complainant should establish that they were actually treated by the named doctor. To that end, they would have to provide their own name, the name of the doctor concerned and the date of alleged mistreatment, or misconduct.

96.              If the patient refused to give his or her name, the IMO could not proceed to consider the complaint, because the doctor would not know whether he or she had treated the person, or had had any dealings with them.

97.              In this case, the provision of account identifier information was essential for two reasons: first, it would show that an account was in fact opened by the complainant with the applicant; secondly, it would establish which account creation process had been in place leading to creation of the account. Accordingly, I hold that the applicant is correct in its submission that the account identifier information was essential information which the respondent should have had when it decided to commence an inquiry into each complaint.

98.              I am also satisfied that the requirements of fairness in the process, demand that when the respondent decided that it was appropriate to hold an inquiry into a particular complaint, the applicant should be given the account identifier information in respect of each complaint. Otherwise, it could not adequately prepare its response to each complaint.

99.              At its most basic, if a person is going to make a complaint against a person or entity, basic fairness requires that the person or entity against whom the complaint is made, be given basic information about the complaint, which would include information showing that an account was actually opened by the person with the data controller.

 

The Czech Complaint.

100.          Before coming to the other necessary criteria for an admissible complaint, I will deal with the issue of the Czech complaint. I accept the argument made on behalf of the applicant that this complaint is inadmissible because the Czech person did not open any account with the respondent; therefore, the respondent did not process any of her personal data.

101.          The wording of both Art. 77 GDPR 2016 and s.107 DPA 2018, make it clear that a data subject can make a complaint if they consider that the processing of their personal data "infringes this regulation" (GDPR 2016), or "infringes a relevant enactment" (DPA 2018). In both cases the verb is in the present tense. If it were intended to give a right to a data subject to make a complaint in circumstances where they had not in fact opened an account, the verb would have to be in the future conditional tense.

102.          I am satisfied that the wording of these provisions make it clear that when lodging the complaint, the complainant must hold the subjective view that the processing of their personal data by the person or entity, infringes the relevant provisions of EU law or Irish law. That clearly requires that their personal data is being processed by the person or entity complained against. For that to happen in this case, the complainant would have to have opened an account with the applicant.

103.          In relation to the Czech complaint, it appears that the person did not like the terms on which the Google account was offered to her, so she did not continue with the account creation process. She did not open any Google account. Her personal data was never processed by the applicant. In these circumstances, I hold that she does not have an admissible complaint against the applicant, as none of her personal data was ever processed by the applicant.

104.          The respondent relied on the decision of the CJEU in Meta Platforms Ireland Limited (case C-757/22) as authority for the proposition that a complaint can be made where inadequate information in relation to the processing of personal data is given by the data controller at the account creation stage, even though the complainant does not create an account, or provide their personal data.

105.          In particular, the respondent relied on the following paragraphs from the judgment, as authority for the proposition that a complaint can be lodged, even where personal data is not actually provided by the data subject:

"61 In so far as processing of personal data carried out in breach of the data subject's right to information under Articles 12 and 13 of the GDPR infringes the requirements laid down in Article 5 of that regulation, the infringement of that right to information must be regarded as an infringement of the data subject's rights 'as a result of the processing', within the meaning of Article 80(2) of that regulation.

62 It follows that the right of the subject of a personal data processing operation, under the first sentence of Article 12(1) and Article 13(1)(c) and (e) of the GDPR, to obtain from the controller, in a concise, transparent, intelligible and easily accessible form, using clear and plain language, information relating to the purpose of such processing and to the recipients of such data, constitutes a right whose infringement allows recourse to the representative action mechanism provided for in Article 80(2) of that regulation.

63 That interpretation is confirmed, first, by the objective of the GDPR, recalled in paragraph 48 above, of ensuring effective protection of the fundamental rights and freedoms of natural persons and, in particular, a high level of protection of the right of every person to privacy with respect to the processing of personal data concerning him or her."

106.          On a close reading of that judgment, I am not satisfied that it actually supports the argument made by the respondent in the present proceedings. In the Meta case the proceedings were instituted in Germany by a consumer agency under the domestic law of Germany, prior to the entry into force of Art. 80(2) of GDPR 2016. However, Germany had enacted the provisions of Art. 80(2) into its domestic law. Accordingly, it was effectively a complaint lodged directly by a consumer agency. It was not a complaint submitted on behalf of any particular data subject.

107.          In countries where it is possible for consumer agencies to lodge complaints directly, it is implicit that they must be able to bring complaints without opening an account, because as a consumer agency, they will never have personal data within the meaning of the regulation.

108.          Thus, by giving a consumer agency the right to lodge complaints directly pursuant to Art. 80(2), the relevant Member State, and indeed the regulation, is implicitly authorising them to bring complaints when they think that an infringement of GDPR 2016 has, or may occur, even though they do not have personal data of their own. These are the relevant facts underlying the decision in the Meta case.

109.          In the case of a person who makes a complaint under Art. 77, as enacted in Irish law in s.107, it is necessary that the person must have formed the subjective opinion that the processing of their personal data "infringes a relevant enactment". I hold that for a complaint to be lodged with the respondent by or on behalf of a person, the requirement that they believe that processing of their personal data by the person or entity infringes their rights under the regulation and the Act, requires that they must have opened an account, or otherwise had their personal data processed by the person or entity, against whom the complaint is made.

110.          As the Czech complainant did not open an account with the applicant, and in the absence of any evidence that her personal data was processed by it, I hold that the Czech complaint is inadmissible.

 

The Remaining Criteria for an Admissible Complaint.

111.          Returning to the remaining criteria that must be met for a complaint to be deemed admissible, I accept the submission on behalf of the applicant that where a complaint is lodged by a consumer agency on behalf of a person, there must be some evidence that the consumer agency has been authorised by the data subject to bring the complaint on their behalf. This is a fundamental principle of the law of agency: A can only act on behalf of B, where he has been authorised by B to do so.

112.          Art. 80(2) of the regulation was not implemented into Irish law. Therefore, a consumer agency does not have the right to lodge a complaint on its own behalf. A consumer agency has power to lodge a complaint with the respondent, when it is acting on behalf of a data subject within the meaning of the Act.

113.          To establish that, all that is required, is that a mandate be signed by the data subject that they authorise the consumer agency to lodge a complaint on their behalf. That is not an onerous requirement. The mandate does not have to be sworn before a solicitor, or be notarised in any particular way. It is simply a written confirmation that the consumer agency has authority to act on behalf of the complainant. It ought to have been in place at the outset, and certainly before the respondent made the decision to commence an inquiry.

114.          The third essential condition for admissibility of a complaint, arises where the complaint is lodged by a consumer agency. In such circumstances in order for the complaint to be admissible, the organisation must comply with the requirements of Art. 80(1). This requires that the consumer agency must be a not-for-profit body, organisation or association, which has been properly constituted in accordance with the law of a Member State; has statutory objectives which are in the public interest; and is active in the field of the protection of data subjects' rights and freedoms with regard to the protection of their personal data.

115.          The respondent accepts that all these criteria must be met, but states that it is not necessary that they be established at the outset. I am satisfied that they are wrong in that regard.

116.          The requirements for an admissible complaint are not onerous. In the circumstances of the present case, the complainants have to establish that they opened an account with the applicant; that is established by providing their Gmail addresses, and that they hold the subjective opinion that the processing of their personal data by the controller infringes relevant enactments, that is proven by lodging the complaint itself. They have to establish that they have authorised the consumer agencies to bring the complaints on their behalf; which is done by providing a mandate authorising the consumer agency to do so. Finally, there must be some evidence that the consumer agency meets the requirements of being a representative body, as set out in Art. 80(1). All of that is very easily done. It should have been done before deciding to hold an inquiry into the complaints.

117.          The reason why this should be done at the outset and not during the inquiry, as proposed by the respondent, is that the very existence of the inquiry can have significant adverse effects on the person, or entity, against whom the complaint is made.

118.          In Facebook Ireland Limited v Data Protection Commission [2021] IEHC 336, Barniville J (as he then was) noted that the commencement of an inquiry by the respondent into suspected infringement of the GDPR, has legal consequences. He set out some of these consequences at para. 130:

"First, as noted above, the commencement of an inquiry by the DPC into suspected infringement of the GDPR does have legal consequences. Once an inquiry is commenced, the DPC may cause any of its powers under Chapter 4 (other than s. 135) to be exercised and/or an investigation under Chapter 5 to be carried out (s. 110(2)). Chapter 4 (ss. 129 to 136) of the 2018 Act provides for a range of powers to be exercised by the DPC, including the appointment of authorised officers, who are given a range of powers, including entry, search and seizure powers, the entitlement to apply for search warrants and to serve an information notice requiring certain information from a controller or processor. Chapter 4 creates various criminal offences to support the DPC and its authorised officers in respect of the powers contained in that chapter. There are other compulsory powers contained in Chapter 5. The DPC may cause those powers to be exercised for the purposes of an inquiry which it has caused to be conducted under s. 110(1) of the 2018 Act. The decision by the DPC to commence an inquiry and the commencement of that inquiry does, therefore, have legal consequences in that those compulsory powers to which I have just referred may be exercised by the DPC for the purposes of such inquiry."

119.          In addition, when responding to the merits of the complaint, the entity concerned may have to furnish extensive information that is commercially sensitive. If the ruling on admissibility of the complaint, is not made until the preliminary draft decision, by that time, some or all of the commercially sensitive information may be contained in the PDD itself, which is furnished to the CSAs under the Art. 60 process. I am satisfied that there is a legitimate concern on the part of the applicant, that release of that information in the context of the PDD, could cause it significant harm.

120.          I also accept the submission on behalf of the applicant, that the possibility of the imposition of substantial fines, which can arise at the conclusion of an inquiry, may require the applicant to make a statement to the stock market, with adverse effects on their share price.

121.          I also accept their argument, that they will have to commit very considerable resources in terms of manpower and legal resources, to meet the merits of the complaints. They should not have to do that, unless and until the complaints are deemed admissible by the respondent.

122.          Accordingly, I hold that the applicant is correct in its essential submission that the criteria for an admissible complaint should have been established to the satisfaction of the respondent, before it decided to commence the inquiry into the merits of the complaints in this case.

 

The Acquiescence Issue.

123.          I turn now to deal with the arguments raised by the respondent as to why the reliefs sought by the applicant should not be granted in the circumstances of the case generally, and in particular, in light of the facts that have unfolded since the commencement of the proceedings.

124.          The respondent submitted that it was well established in Irish law, that where a person participated in a statutory or other process, knowing of the defect or want of jurisdiction, they could not subsequently challenge the process, or the jurisdiction of the body to act in the way that they had consented to: see The State (Byrne) v Frawley [1978] IR 326; Brennan v Governor of Portlaoise Prison [2008] 3 IR 364; Q(M) v Judge of the Northern Circuit [2003] IEHC 88.

125.          The respondent submitted that having been informed of the Slovenian complaint some fourteen months in advance of the notice of commencement, and having been informed of the remainder of the complaints in March 2023, some seven months prior to the notice of commencement; and having engaged extensively with the respondent during those periods, without raising any objection in relation to the admissibility of the complaints; the applicant had acquiesced in the handling of the complaints by the respondent to such an extent that it was estopped from raising the admissibility issues that it had sought to raise in its letter of 30 November 2023 and in the present proceedings. In particular, it was submitted that the applicant was estopped from challenging the jurisdiction of the respondent to deal with the complaints, when it had engaged actively with that process for such a prolonged period of time.

126.          The court accepts the broad submission made on behalf of the respondent that where a person, with full knowledge of all relevant facts, participates in a statutory process, they cannot subsequently, when they receive an adverse decision at the end of that process, seek to challenge the jurisdiction of the decisionmaker.

127.          In R (Kildare County Council) v Commissioner of Valuation [1901] 2 IR 215, the Valuation Commissioner, when carrying out a valuation of a railway line in County Kerry, purported to carry out a valuation of all parts of the main line, including that part of the line running through County Kildare, notwithstanding that no reference had been made to him in respect of a revaluation in that county. When the valuation for County Kildare was reduced by the Commissioner, Kildare County Council brought the matter back in before the Commissioner, who refused to alter his valuation. Thereafter, they appealed to the County Court. Their notice of appeal did not state want of jurisdiction as a ground of appeal. The County Court judge affirmed the valuation.

128.          The County Council then issued a writ of certiorari to quash the revised valuation lists. In the Court of Appeal, Holmes LJ agreed with Palles CB in the lower court, that the right to question an adjudication could be lost by the conduct of the applicant. He stated that he could not conceive of a stronger case of estoppel by conduct than in the case before him. The County Council had taken an appeal from the valuation, with a view to having the valuation increased. By so doing, they had not challenged the jurisdiction to make the valuation, but had in fact acted upon it, by bringing the appeal with a view to getting an increased valuation. The court held that the County Council's acquiescence in the process and their conduct in bringing an appeal on the merits, was sufficient to estop them from subsequently challenging the jurisdiction of the Valuation Commissioner.

129.          More recently, in Podariu v Veterinary Council of Ireland [2018] 3 IR 124, the Court of Appeal revisited the law in relation to the circumstances in which acquiescence and estoppel by conduct, can be said to confer jurisdiction on a statutory tribunal. In that case, the Veterinary Council had purported to deal with an additional complaint, which had not been referred to it by the Preliminary Investigation Committee. Delivering the judgment of the court, Hogan J described the principle of estoppel by conduct in the following way at para. 38:

"The law in relation to estoppel by conduct is illustrated by a trilogy of leading Supreme Court decisions from the 1970s: In re Green Dale Building Co. [1977] I.R. 256, Corrigan v. Irish Land Commission [1977] I.R. 317 and The State (Byrne) v. Frawley [1978] I.R. 326. It is quite clear from these cases that an entirely new jurisdiction cannot be created by estoppel. Thus, for example, a decision of the Medical Council purporting to sanction a veterinary surgeon would be wholly void and ineffective, even if the veterinarian in question had somehow submitted to the jurisdiction of that council. It is likewise clear that the District Court cannot exceed its own geographical limitations by purporting to deal with offences which had not been the subject of a complaint made within the appropriate District Court district. In O'Malley v. District Judge Kelly [2015] IECA 67, (Unreported, Court of Appeal, 27 March 2015) this court accordingly held that the District Court had no jurisdiction in such cases and quashed the ensuing convictions, the acquiescence of the applicant in the entire procedure notwithstanding."

130.          However, the court went on to note that the statutory provisions which provided for the referral of complaints to the Fitness to Practice Committee, by the Preliminary Investigation Committee, was primarily designed as a protection for the veterinary surgeon. The court held that there had been sufficient acquiescence on the part of the applicant to the addition of complaint number 17 at the hearing before the FTPC. He was deemed to have waived the protection of the statutory provisions which existed for his benefit. He was thus precluded from challenging the validity of the FTPC decision to permit such an amendment to the notice of inquiry. The applicant was held to be estopped by his conduct from challenging or impugning the validity of the FTPC decision to permit the additional complaint to be added to the original complaints. He was deemed by his acquiescence to have waived the statutory provisions which existed for his benefit.

131.          In light of these principles, I do not regard the argument advanced by the respondent as being well founded for the following reasons: first, for acquiescence to give rise to an estoppel by conduct, it must take place where the person who is said to have acquiesced in the process, has full knowledge of all relevant facts, and with such knowledge, has made a decision to participate in the process.

132.          In this case, the applicant did not know that the respondent did not have much of the requisite information when it decided to commence the inquiry. The applicant, not unreasonably, assumed that the respondent had obtained the relevant information so as to establish the admissibility of the complaints, when it decided to commence the inquiry. The absence of any request for such information prior to being told that an inquiry would be commenced, does not constitute knowledge or acquiescence in the inquiry proceeding in the absence of that essential information.

133.          Secondly, I accept the submission made on behalf of the applicant, that the applicant was obliged by the DPA 2018, to cooperate with the respondent. Thus, the significant engagement which the applicant had with the respondent since receipt of the Slovenian complaint in September 2022, does not constitute a waiver by the applicant of compliance with the necessary criteria for admissibility of a complaint.

134.          I hold that by its engagement with the respondent in the period prior to the decision to commence the inquiry on 23 October 2023, the applicant did not acquiesce in the complaints being the subject of an inquiry, without the necessary criteria for admissibility being met.

 

Principle of Mutual Trust and Duty of Sincere Cooperation.

135.          The respondent's submission under this heading has been summarised earlier in the judgment. The court does not accept the proposition that the mere receipt by the respondent of complaints from the CSAs in six countries, obliged it under the principle of mutual trust and duty of sincere cooperation, to reach the conclusion that the necessary criteria had been examined and had been found to have been in existence by the CSAs concerned.

136.          There is no evidence, save perhaps in relation to the Greek complaint, that the CSAs concerned had examined the admissibility of the complaints. In other words, there is nothing to suggest that the CSAs, with the exception of the Greek SA, had sought mandates from the data subject to the complaint being lodged on their behalf by a consumer agency. Nor was there any evidence that they had satisfied themselves that the consumer agencies concerned had complied with the requirements for representative bodies as set down in Art. 80(1) of GDPR 2016.

137.          In other words, in the absence of anything to suggest that any vetting or screening of the complaints for admissibility, had been carried out by the CSAs, the respondent could not rely on the principle of mutual trust and the duty of sincere cooperation, to make the assumption that such screening or assessment had been carried out, or that the forwarding of such complaints constituted evidence that the requisite criteria had been complied with.

138.          The principle of mutual trust and the duty of sincere cooperation, only provides that one state agency must assume that a state agency in another state has complied with its obligations under EU law. In this case, the obligation on the CSA was not to handle, or consider, the complaint; it was merely to pass it on to the respondent as LSA for such investigation and determination as it considered appropriate. Thus the respondent could not assume under this principle, that the CSAs had found the complaints admissible. Accordingly, I reject this submission.

 

The Argument based on Rowland v An Post.

139.          The respondent submitted that the present application should be refused on the basis of the decision of the Supreme Court in Rowland v An Post [2017] 1 IR 355. In that decision, the Supreme Court had held that for disciplinary inquiries within the employment context, ordinarily, a court should not interfere with an ongoing process unless the court was satisfied that it was clear that the process had gone wrong; that there was nothing that could be done to rectify it; and that it followed that it was more or less inevitable that any adverse conclusion reached at the end of the process, would be bound to be unsustainable in law: see decision of Clarke J (as he then was) at paras 11 - 14.

140.          It was submitted that in the present case, it could not be said that the process had gone irremediably wrong. Any concerns that the applicant had in relation to the admissibility of the complaints against it, could be addressed in the context of the inquiry which had only just begun by virtue of the notice of commencement dated 23 October 2023. It was submitted that in these circumstances, the court should follow the decision in the Rowland case and should decline to intervene in the inquiry at this stage.

141.          The court accepts that the statement of principle set down by the Supreme Court in the Rowland case has been applied in many subsequent cases. The court also accepts that in Murphy v Commissioner of An Garda Siochana [2023] IECA 92, the Court of Appeal held that the principles enunciated in the Rowland case, are applicable to judicial review proceedings.

142.          In reaching its conclusion as to whether it is appropriate for this court to intervene in the inquiry process which has been commenced by the respondent, the court is of the view that it must have regard to the fact that in many of the previous cases, such as in the Rowland case itself; and in the following cases: Becker v The Board of Management of St Dominic's School [2006] IEHC 130; Student A.B. (A Minor) v Board of Management of a School [2019] IEHC 255; Ivers v Commissioner of An Garda Siochana [2022] IECA 206, the processes that were sought to be injuncted, concerned disputes between an individual and his employer, or between individual students and their schools.

143.          In the present case, the court is dealing with an inquiry of an altogether different nature. The inquiry which the respondent proposes to hold into the complaints lodged on behalf of the six complainants, constitutes an inquiry into a systemic process utilised by the applicant at the account creation stage. Thus, it is much wider than an inquiry of a disciplinary or other nature, between an individual and another entity, be it an employer, or a school.

144.          The court accepts the evidence given by Mr McHale in his affidavit sworn on 16 January 2024, as to the level of time and manpower that has been expended by the applicant in dealing with the requests for further information that have issued from the respondent to date. The court also accepts his evidence that if the inquiry is to proceed, the applicant will have to incur very significant further expense and deployment of manpower to deal with the subject matter of the complaints: see paras 81 - 85. In addition, as already noted, the court accepts that in order to deal with the complaints the subject matter of the inquiry, the applicant may be required to divulge a significant amount of confidential information. The court also accepts that the very holding of an inquiry, with the possibility of the imposition of very significant fines at the conclusion thereof, may require the applicant to make an announcement to the markets, with a consequential adverse effect on its share price.

145.          In these circumstances, the court is satisfied that notwithstanding the principles set down in the Rowland case, the present case falls into the category of cases where it is appropriate for the court to intervene in the process at this stage, given that the holding of the inquiry itself will have significant adverse effects for the applicant. Accordingly, the court rejects the submission made on behalf of the respondent, that having regard to the principles set down in the Rowland case, the court should decline to intervene in the inquiry at this stage.

 

Subsequent Evidence Establishing Jurisdiction.

146.          Since the issuance of the notice of commencement, and also subsequent to the institution of these proceedings, a substantial amount of evidence has been provided to the respondent which establishes that mandates had been signed by each of the complainants authorising the relevant consumer agencies to lodge complaints on their behalf.

147.          A substantial volume of documentary evidence has also been provided which establishes that each of the consumer agencies meet the criteria for the representative bodies, as laid down in Art. 80(1) of GDPR 2016.

148.          It is not necessary to set out the precise dates on which each piece of evidence came into the possession of the respondent. Broadly speaking, the relevant material was received by the respondent in the period December 2023 to February 2024.

149.          The respondent submits that it is permissible for the court to have regard to this further evidence, when examining the question of fact, as to whether the respondent had jurisdiction to make the decision to commence the inquiry, that it made on 23 October 2023.

150.          In support of the proposition that the court can have regard to fresh evidence when examining the issue of jurisdiction, the respondent relied on the decision in R v Secretary of State for the Environment [Ex P. Powis] [1981] 1 WLR 584, where Dunne LJ, delivering the judgment of the English Court of Appeal, stated as follows at p.595:

"What are the principles on which fresh evidence should be admitted on judicial review? They are ... (2) where the jurisdiction of the Minister or inferior tribunal depends on a question of fact or where the question is whether essential procedural requirements were observed, the court may receive and consider additional evidence to determine the jurisdictional fact or procedural error: see De Smith's Judicial Review of Administrative Action, 4^th Ed, [1980] at pp. 140, 141 and cases there cited..."

151.          In Sweetman v An Bord Pleanála [2021] IEHC 16, the applicant was permitted to make the case that the Board did not have jurisdiction to grant planning permission to the entity which had applied for planning permission, being An Bradán Beo Teoranta, because it had not been furnished with consents from all relevant landowners, enabling that party to make the planning application, as required by Reg. 22(2) of the planning regulations. As it was a jurisdictional issue, the applicant was allowed to call fresh evidence on it and was allowed to make the argument that the Board lacked jurisdiction, even though that argument had not been raised by it at the appeal hearing: see paras. 25 and 26.

152.          In Reid v An Bord Pleanála [2021] IEHC 230 Humphreys J endorsed the decision that had been given in the Sweetman case. He looked at the circumstances in which fresh evidence can be admitted in judicial review proceedings. He held that the court can admit fresh evidence when the issue goes to jurisdiction: see paras. 30-32.

153.          I accept the submission made on behalf of the respondent that in looking at the question of whether the respondent had jurisdiction to make the decision that it did on 23 October 2023, the court can have regard to the evidence that has come to hand in the course of these proceedings.

154.          That evidence clearly shows that the necessary mandates had been signed by the complainants prior to the time when the decision to commence the inquiry had been taken by the respondent. The evidence further establishes that at all material times, the consumer agencies satisfied the criteria for representative bodies, which are capable of lodging complaints on behalf of a complainant, as required by Art. 80(1) of GDPR 2016.

155.          I hold that as the necessary facts giving rise to jurisdiction on the part of the respondent, were de facto in existence at the time when the decision to commence the inquiry was made by it, the respondent had jurisdiction to make that decision.

156.          While I have held that the respondent ought to have obtained evidence of the existence of these facts, prior to making its decision; the existence of the required criteria at the date of the making of the decision to commence the inquiry, which facts have been established by evidence that has subsequently come to hand; which evidence shows that such facts were in existence at the time when jurisdiction was assumed by the respondent; that is sufficient to establish that the respondent de facto had jurisdiction to issue the notice of commencement. It is also sufficient to resist the applicant's application to have the notice of commencement set aside.

157.          Even if I am wrong in that conclusion, I accept the submission made on behalf of the respondent that as the granting of relief by way of judicial review is a discretionary remedy, the court should not grant the reliefs sought by the applicant in this case, due to the fact that the necessary criteria showing that these complaints are admissible, being now to hand; it would be futile to make an order striking down the notice of commencement, as the respondent would simply issue a fresh one immediately. As the conduct of the inquiry has been stayed voluntarily while these proceedings have been pending before the court, there is no prejudice to the applicant in allowing the original notice of commencement to continue.

 

Further Grounds Raised in the Amended Statement of Grounds.

158.          There are two further matters on which it is necessary to reach a determination. First, insofar as the applicant has sought in its amended statement of grounds to have a declaration that the respondent has acted ultra vires by including within the inquiry, complaints that fall outside the temporal scope of the notice of commencement; this primarily relates to the French complaint. The applicant maintains that this account was opened in 2014, meaning that it falls outside the temporal scope of the inquiry. The account holder is adamant that she opened the account in 2022, meaning that it comes within the temporal scope of the inquiry.

159.          The respondent is entitled to resolve that conflict in the course of the inquiry. Accordingly, I am not satisfied that the French complaint should be struck from the notice of commencement.

 

Submission that the Complaints are an Abuse of Process.

160.          The second matter is in the following terms: the applicant has argued that subsequent evidence and investigations by them, have revealed that certain of the complainants are employees within the consumer agencies, which have submitted the complaints on behalf of the complainants.

161.          The applicant relies on the decision of the Belgium DPA in its decision of 24 January 2024, in case bearing reference number 22/2024, relating to an alleged non-compliant cookie banner. In that case, the Belgium DPA found that the complainant was in fact an intern, who had been working in the consumer agency, which had brought the complaint on her behalf. Furthermore, it transpired that she had been directed as part of her duties while working with the consumer agency, to visit the website and examine the cookie banner in respect of which the complaint was lodged.

162.          The Belgium DPA held that in these circumstances, there was no spontaneous nature to the visit to the website that had been conducted by the complainant in her position as an intern with the consumer agency. It was held that the necessary genuine consent on her part to the bringing of a complaint on her behalf by the consumer agency, was missing. The Belgium DPA held that the consumer agency was acting, not as an agent on the basis of Art. 80(1) of the GDPR, but as a complainant on the basis of Article 80(2). As the Belgium Government had deliberately chosen not to implement Art. 80(2), the complaint was deemed inadmissible: see paras. 51-55 and 59-60.

163.          The applicant further argues that when one looks at the account history in relation to a number of the accounts in this case, it is apparent that the accounts once opened, where hardly used at all; suggesting that they were opened solely, or primarily, for the purpose of making the complaints the subject matter of these proceedings.

164.          In essence, it is submitted that because a number of the complainants appear to be employees of the consumer agencies, which have lodged the complaints and having regard to the account history, the complaints are in effect an abuse of process, as a means of enabling the consumer agencies to make the complaints on their own behalf, notwithstanding that Art. 80(2) has not been implemented in Irish law.

165.          These arguments have only been made subsequent to the notice of commencement, because the relevant information was only provided to the applicant in the affidavits filed on behalf of the respondent in the course of these proceedings.

166.          No application has yet been made to the respondent to deem the complaints inadmissible, as being an abuse of process, on these grounds. This is because the inquiry was voluntarily stayed pending the outcome of these proceedings. Accordingly, there is, as yet, no decision of the respondent on any such application, so the issue does not fall for consideration in these judicial review proceedings.

167.          If the applicant wishes to make that application to the respondent, it can do so. It will be for the respondent to decide what procedure it will adopt to determine that application, if and when it is made. The respondent may decide to deal with it as a preliminary matter, or it may decide to deal with it as part of the inquiry that it has commenced.

168.          If the applicant makes such an application to the respondent, and if it is aggrieved with the decision of the respondent on how it proposes to deal with that application, they can take whatever steps they regard as necessary at that stage.

 

Proposed Order.

169.          For the reasons set out herein, the court would propose to make the followings orders:

(a)    The court will set aside the notice of commencement dated 23 October 2023, insofar as it relates to the Czech complaint;

(b)   save as indicated at (a) above, refuse the reliefs sought by the applicant in its notice of motion and in its amended statement of grounds.

170.          As this judgment is being delivered electronically, the parties will have two weeks within which to furnish brief written submissions of not more than 1,000 words, on the terms of the final order and on costs and on any other matters that may arise.

171.          The matter will be listed for mention at 10.30 hours on 5^th November 2024 for the purpose of making final orders.