High Court Reporter

The High Court has refused to halt an investigation by Ireland’s data watchdog into complaints about Google’s processing of users’ personal data during its sign-up process.

The search engine company asked the court to quash a notice to open an investigation issued by the Data Protection Commission (DPC) in October 2023.

The DPC began its investigation into six separate complaints filed on behalf of users by consumer protection agencies in Spain, France, Slovenia, Norway, Greece and the Czech Republic.

In a ruling Friday, Judge Anthony Barr said he would vacate the notice of initiation only as it relates to the Czech complaint because that person had not opened a Google account and had not process their data by the company.

He said the “first and most fundamental criterion” is that a person’s personal data has been processed by the entity against whom they wish to file a complaint.

He concluded that the commission had jurisdiction to issue the notice of initiation regarding the other five complaints.

The DPC investigation, suspended while the case is ongoing, examines whether the multinational respected transparency obligations related to the processing of personal data entered by users when registering for a Google account.

Investigators will examine whether the account creation process, including obtaining users’ consent for the processing of certain personal data, complies with the articles of the EU General Data Protection Regulation.

Each of the plaintiffs claims the process was unfair because giving consent to the use of personal data took one click, while choosing to manage your own account settings took five separate steps and 10 clicks.

They also allege unclear language used in the registration process.

Google alleged that the DPC failed to ensure that the six complaints met the required admissibility criteria. The DPC could not be satisfied that it had jurisdiction to investigate, so its investigation was unlawful, the company claimed.

The commission rejected the allegations and argued that it had broad authority to investigate a complaint.

He said there were no specific prerequisites for opening an investigation. The DPC did not believe that the Czech complaint was rejected because the account creation process was not completed.

Justice Barr stressed that Irish and European law recognize that the confidentiality of personal data deserves “special protection”.

People have “extensive rights” over the information they should receive when consent is sought for the retention and use of their personal data, he said.

Although the DPC’s power to open an investigation is “undoubtedly” broad, the judge accepted Google’s argument that certain basic criteria must be met for a complaint to be admissible.