The Irish High Court has agreed to hear a lawsuit alleging that the country’s privacy watchdog’s alleged failure to thoroughly investigate a complaint against Google for a massive data breach, in a significant move.
According to Dr Johnny Ryan, a Senior Fellow of the Irish Council for Civil Liberties (ICCL), who filed the lawsuit, the Data Protection Commission’s (DPC) refusal to investigate the situation violates both the 2018 Data Protection Act and the General Data Protection Regulation (GDPR).
The ICCL said on Tuesday that it is suing the DPC for failing to protect consumers from the largest data breach ever recorded, Google’s “Real-Time Bidding” online advertising system.
ICCL said “It happens behind the scenes, and can broadcast private information about you to over a thousand other tracking companies in a split second. There is no control over what those companies do with this sensitive data,”
It added “Google operates this unlawful RTB system on millions of websites, broadcasting personal data to other tracking companies billions of times a day. This is the largest data breach ever,”
Three and a half years ago, the DPC received a complaint concerning Google’s RTB data leak.
ICCL claimed that “It was obliged to investigate and act on that complaint under the GDPR. But it did not do so. Because Google’s EU operation is based in Ireland, the DPC has the lead responsibility to see that it obeys Europe’s data protection law,”
As a result of the DPC’s failure to act on this complaint, Google’s massive data breach has continued for several years across the EU.
Dr Ryan said “The DPC was created to protect us against the illegal collection and use of intimate data about us. But it has failed to act in this landmark case, despite the passage of three and a half years and having detailed evidence of Google’s massive and ongoing data breach,”
The ICCL is Ireland’s oldest independent human rights organisation.
The complaint has yet to get a response from Google.