Ireland’s data watchdog, the Data Protection Commission (DPC), will continue its investigation into Google as ordered by the High Court, despite resistance from the tech giant. The DPC’s investigation is focused on complaints about the process by which Google manages personal data of its users during the registration phase.
In October 2023, Google called on the High Court to prevent an investigation initiated by the DPC, prospective to accusations raised by consumer agencies in six different countries – Spain, France, Slovenia, Norway, Greece, and the Czech Republic. The DPC began examining these claims, but the case was momentarily put on hold.
Justice Anthony Barr delivered a judgement on a Friday stating that the investigation pertaining to the Czech user would be stopped, given that the person in question had never set up a Google account, therefore there had been no data processing by Google in relation to them. Justice Barr emphasised the essential need for data to have been processed by the company for a complaint to stand.
However, the rights to pursue an investigation concerning the remaining five complaints was confirmed by Justice Barr. The investigation in process seeks to ascertain whether Google complied with the mandatory transparency related to processing users’ data during their sign-up activity.
Critics argue that the method of consenting to the use of personal data is unbalanced and unjust, since it takes a single click to approve while personal account configuration requires ten clicks across five stages. Additionally, there are complaints about ambiguity in the language employed during the sign-up process.
Google countered by suggesting the DPC had not sufficiently proven that the six complaints fulfilled perquisite conditions to be considered legal. They contended that the investigation being conducted by DPC was illicit as it lacked the necessary jurisdiction.
The claims were dismissed by the commission who argued they had ample authority to explore a complaint with no explicit prerequisites to beginning an investigation. In regards to the Czech complaint, they didn’t consider the absence of a completed account creation process as a hindrance.
Justice Barr, referencing Irish and European legislation, highlighted the exceptional protective measures entitled for private data. He stated that individuals have extensive rights pertaining to the information they are provided when their approval is sought in relation to the storage and utilisation of their private information.
Undeniably, the judge agreed with Google’s assertion where the DPC’s authority to initiate an investigation is broad; however, there are some fundamental requirements that a complaint must satisfy for acceptance.