Ireland: Dismissed lawsuit claiming DPC failed to investigate Google data processing for targeted advertising compliance with GDPR (Johnny Ryan v DPC)

On 28 August 2023, the High Court of Ireland issued its ruling in the case of Johnny Ryan v Data Protection Commission (DPC). This case revolved around a challenge to the DPC's handling of a complaint lodged under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 by Johnny Ryan. His complaint pertained to the data processing practices of Google Ireland for targeted advertising through the Google Authorized Buyers Ad Exchange. Previously, the Irish Council for Civil Liberties (ICCL) had lodged a High Court appeal against Ireland's Data Protection Commission (DPC), alleging that the DPC had inadequately investigated a complaint related to a GDPR violation concerning Google's real-time bidding (RTB) system for online advertising. The complainant had initially submitted the complaint to the DPC in September 2018, specifically addressing Google's and IAB Europe's RTB processes. The DPC initiated an investigation into this matter in May 2019. The High Court ruled that the DPC's decision to prioritise its own-volition inquiry was proportionate and well within the discretion granted to the supervisory authority under Article 57(1)(f) of the GDPR. Consequently, the High Court dismissed the application for judicial review.