Ryan v Data Protection Commission (Approved) [2023] IEHC 511 (28 August 2023)

Ryan v Data Protection Commission (Approved) [2023] IEHC 511 (28 August 2023)

The Data Protection Commission’s decision to defer investigation of certain aspects of the applicant’s complaint pending completion of an own-volition inquiry is proportionate and within the margin of appreciation allowed under Article 57(1)(f) GDPR. The Commission’s approach is lawful, efficient, and does not amount to a refusal to handle the complaint. The application for judicial review is dismissed.

Citation
[2023] IEHC 511
Parties
Applicant: Johnny Ryan; Respondent: Data Protection Commission; Notice Party: Google Ireland Ltd
Jurisdiction
Ireland
Judgment Date
28 August 2023
Procedural Posture
Judicial Review / Final Judgment on Application for Judicial Review
Outcome
Application for judicial review dismissed
Legal Topics
GDPR Complaint Handling, Supervisory Authority Discretion, Judicial Review of Regulatory Decisions, Procedural Fairness, Statutory Remedies
Data Protection Law Administrative Law European Union Law GDPR Complaint Handling Supervisory Authority Discretion Judicial Review of Regulatory Decisions Procedural Fairness Statutory Remedies

Case Brief

Summary, issues, holding and outcome

More case intelligence is available

Unlock the full research layer for this judgment.

Full judgment text Downloadable case file Legal principles 3 Authorities cited 11 Party arguments 2
Sign in to unlock

Parties

Johnny Ryan

Applicant

Data Protection Commission

Respondent

Google Ireland Ltd

Notice Party

Procedural Posture

Judicial Review / Final Judgment on Application for Judicial Review

Legal Issues

  1. 1 Whether the Data Protection Commission is obliged to investigate all aspects of a complaint in parallel with an own-volition inquiry
  2. 2 Whether deferring investigation of certain complaint issues pending completion of an own-volition inquiry is lawful under the GDPR and Data Protection Act 2018
  3. 3 Whether the Commission exceeded its margin of appreciation in sequencing investigations

Ratio Decidendi

The Data Protection Commission’s decision to defer investigation of certain aspects of the applicant’s complaint pending completion of an own-volition inquiry is proportionate and within the margin of appreciation allowed under Article 57(1)(f) GDPR. The Commission’s approach is lawful, efficient, and does not amount to a refusal to handle the complaint. The application for judicial review is dismissed.

Court Disposition

Application for judicial review dismissed

Orders

  • Application for judicial review dismissed
  • Provisional order for costs: Commission entitled to recover legal costs from applicant; notice party to bear own costs