Ryan v Data Protection Commission (Unapproved) [2024] IECA 152 (24 June 2024)

Ryan v Data Protection Commission (Unapproved) [2024] IECA 152 (24 June 2024)

The Data Protection Commission is entitled to defer investigation of a specific element of a complaint (here, alleged breaches of Article 5(1)(f) GDPR) pending the outcome of an own-volition inquiry, provided that the overall approach is proportionate, reasoned, and within the margin of appreciation afforded by the GDPR. The DPC's sequencing decision does not amount to a refusal to investigate and is lawful under EU and Irish law.

Citation
[2024] IECA 152
Parties
Applicant / Appellant: Johnny Ryan; Respondent: Data Protection Commission; Notice Party: Google Ireland Limited
Jurisdiction
Ireland
Judgment Date
24 June 2024
Procedural Posture
Judicial Review Appeal / Appeal From High Court to Court of Appeal
Outcome
Appeal dismissed
Legal Topics
GDPR Complaints Procedure, Supervisory Authority Discretion, Article 5(1)(f) GDPR, Article 77 GDPR, Article 57 GDPR, Article 78 GDPR, Mandamus, Judicial Review Standards
Data Protection Law Administrative Law European Union Law GDPR Complaints Procedure Supervisory Authority Discretion Article 5(1)(f) GDPR Article 77 GDPR Article 57 GDPR +3 more

Case Brief

Summary, issues, holding and outcome

More case intelligence is available

Unlock the full research layer for this judgment.

Full judgment text Downloadable case file Legal principles 3 Authorities cited 9 Party arguments 2
Sign in to unlock

Parties

Johnny Ryan

Applicant / Appellant

Data Protection Commission

Respondent

Google Ireland Limited

Notice Party

Procedural Posture

Judicial Review Appeal / Appeal From High Court to Court of Appeal

Legal Issues

  1. 1 Whether the Data Protection Commission is permitted to defer investigation of part of a complaint pending the outcome of an own-volition inquiry under s.110 of the Data Protection Act 2018
  2. 2 Whether the DPC is obliged to investigate all elements of a complaint with all due diligence and without delay under the GDPR
  3. 3 Whether the DPC's sequencing decision constitutes a refusal to investigate or a lawful exercise of discretion

Ratio Decidendi

The Data Protection Commission is entitled to defer investigation of a specific element of a complaint (here, alleged breaches of Article 5(1)(f) GDPR) pending the outcome of an own-volition inquiry, provided that the overall approach is proportionate, reasoned, and within the margin of appreciation afforded by the GDPR. The DPC's sequencing decision does not amount to a refusal to investigate and is lawful under EU and Irish law.

Court Disposition

Appeal dismissed

Orders

  • The appeal is dismissed. The High Court's decision is affirmed.