Google – Court Ruling (Ireland, 2024)

In 2022, Norwegian, Slovenian, Greek, French, Spanish and Czech consumer protection organisation, on behalf of data subjects, lodged complaints with DPAs relating to the account creation process with Google. These complaints were then forwarded to the Irish DPA between September 2022 and March 2023 as the lead supervisory authority due to location of the controller and in accordance with the one stop shop mechanism. The complaints alleged dark patterns were used by Google in its account creation process. On 23 October 2023, the DPC decided to commence an inquiry and issued a notice of commencement. On 30 November 2023, Google objected to the commencement of the inquiry stating that the necessary information had not been provided to the DPC and to Google itself. Google posited that neither the account identifier information of each of the data subjects nor copies of the mandates of the consumer protection organisation representing the data subjects under Article 80(1) GDPR were presented to it. Google therefore questioned the DPC's jurisdiction over the matter. On 18 January 2024, Google initiated judicial review proceedings at the Irish High Court claiming that the DPC lacked jurisdiction over the inquiry as it was not in receipt of the above information. The Irish High Court sought to determine the admissibility of the complaints and did not analyse the content of the complaints. The DPC submitted to the High Court, that it has very wide discretionary powers as to when it can launch an inquiry and that no specific preconditions must be met. In response to Google’s argument that the DPC did not have the account IDs nor the mandates of the consumer protection authorities, the DPC purported that the EU law principle of mutual trust and the duty of sincere cooperation applied. As the lead supervisory authority, the DPC had to assume that the concerned supervisory authorities had forwarded the claim on the basis that the complaints were well constituted. In fact, the