Legal challenge over alleged failure to progress data complaints
A not-for profit organisation has launched a High Court challenge over what it claims is the Data Protection Commissioner's failure to progress complaints made about the unlawful processing of personal data by social media platforms in 2018.
The action has been brought by the Vienna, Austria based NOYB- European Centre for Digital Rights against the Data Protection Commissioner which is the supervisory authority in respect of GDPR within the State.
It claims that the commissioner has breached its data protection and GDPR obligations by failing to progress or complete investigations into complaints made about 'Whatsapp' and 'Instagram.'
The matter came before Mr Justice Charles Meenan today who heard that in correspondence the commissioner has rejected NOYB's assertions that there has been a delay in investigating the complaints.
The complainants allege that the social media platform's data controllers are unlawfully processing their personal data and are in breach of the GDPR and data protection laws.
The complaints relate to how the platform's respective data controllers, under articles of GDPR, purport to rely on the consent of data subjects to process personal data.
The General Data Protection Regulation or GDPR, as it is better known is a EU regulationon data protection and privacy. The GDPR aims primarily to give individuals control over their personal data.
The complaint regarding Whatsapp was made to the German authorities. The complaint concerning Instagram, which is owned by Facebook, was made to the Belgian authorities.
Represented in court by Eoin McCullough SC NOYB says that as the companies that operate the two platforms, Whatsapp Ireland Ltd and Facebook Ireland, are registered in Ireland the commissioner must conduct the investigation.
Counsel said that the complaints were made in 2018, and were filed on the individual's behalf by NOYB. They were referred to the commissioner by the Belgian and German authorities.
Counsel said it is his client's case that the commissioner has delayed in completing the investigation, and has failed in its duties under GDPR within a reasonable period.
No reason has been given for the delay, counsel said.
The investigation of such complaints counsel said is an eight stage process. To date counsel the complaints have only gone through the first two stages.
In its action against the Data Protection Commissioner seeks various declarations including that the commissioner has failed to carry out an investigation into the complaints within a reasonable period as required under Article 57 of the GDPR and section 113 of the 2018 Data Protection Act.
NOYB also seeks declarations that the commissioner is in breach of its GDPR and Data Protection Act obligations, and that its has failed to provide information or a draft decision to the national authorities "without delay" as required under GDPR.
It further seeks an order from the court to complete its investigation within whatever time directed by the court, and if necessary that the action be referred to the Court of Justice of the European Union.
Permission to bring the action was granted, on an ex-parte basis, by Mr Justice Meenan.
The judge made the matter returnable to a date in September.
