High Court rejects procedural challenge against DPC’s inquiry into EU-US data transfers

The High Court, in a 197-page judgment, has dismissed a legal challenge against a decision by the Data Protection Commission (DPC) to commence an “own volition” inquiry into the applicant’s data transfers to its parent company in the US, and to issue a preliminary draft decision (PDD) proposing to suspend such transfers.

The applicant brought judicial review proceedings against the DPC, alleging that the inquiry and PDD were unlawful on a number of procedural grounds. In particular, the applicant claimed that the DPC had breached its legitimate expectation that the DPC would follow the statutory inquiry procedure set out in its Annual Report for 2018, on its website, and that it had adopted in other inquiries. The applicant also claimed the DPC had breached its right to fair procedures by failing to conduct an investigation/inquiry before reaching a decision. The High Court rejected all of the applicant’s grounds of challenge, finding that the DPC’s decision to commence an inquiry and issue the PDD, along with the associated procedural steps, were lawful.

The proceedings concerned the procedural rights and obligations of the parties in the context of the DPC’s inquiry following Schrems II, rather than the merits of the DPC’s preliminary views in the PDD.

Background

The PDD

Following the Schrems II decision (see our previous update), the DPC informed the applicant that it considered it appropriate to commence a new own volition inquiry under section 110 of the Data Protection Act (DPA 2018), and Article 60 of the GDPR. The inquiry would examine whether the applicant’s transfers of personal data relating to EU/EEA users are lawful, and whether any corrective power should be exercised by the DPC. The DPC issued a PDD, which stated that, it was the DPC’s preliminary view, that the applicant is infringing Article 46(1) of the GDPR, and proposed suspending its data transfers to the US.

The DPC’s reasoning for the proposed suspension was that the SCCs (which are used by the applicant to transfer data to the US) cannot compensate for the inadequate protection provided by US law, and the applicant did not appear to have implemented supplementary measures. The DPC proposed a suspension rather than a “ban” on the data transfers, on the basis that the applicant might later be able to adopt measures to address the deficiencies identified in the PDD. It gave the applicant 21 days to make submissions on the PDD.

Judicial Review Proceedings

The applicant issued judicial review proceedings against the DPC, seeking to quash the DPC’s decision to commence an “own volition” inquiry, issue the PDD, and adopt the procedures it had adopted. It argued that the DPC’s decision and procedures were unlawful on several grounds including:

  • Alleged failure to conduct an investigation/inquiry before issuing the PDD;
  • Alleged departure from published statutory inquiry procedures / breach of legitimate expectation;
  • Alleged breach of fair procedures: 21-day period for submissions on the PDD
  • Alleged breach of fair procedures: premature judgment;
  • Alleged breach of fair procedures: involvement of Ms. Dixon at investigation and decision-making stage;
  • Alleged failure to await publication of EDPB Guidance on the “supplementary measures”;
  • Alleged breach of right to equality and non-discrimination (Inquiry into the applicant’s data transfers only);
  • Inadequate reasons for issuing the PDD.

High Court Decision

The High Court held that of the DPC to commence the inquiry and issue the PDD, as well as the procedures it adopted for the purpose of its inquiry, were amenable to judicial review. Judge Barniville stated that in order to challenge the DPC’s “decision-making process”, the applicant had to be entitled to challenge the PDD itself, as the PDD not only commenced the inquiry but also set out the process which would ultimately lead to the “draft decision” being submitted by the DPC to the Article 60 procedure.

However, the court rejected each of the grounds of challenge advanced by the applicant. We have summarised the court’s conclusions below, in respect of each of the grounds of challenge.

1. Alleged failure by DPC to conduct an investigation/inquiry before reaching a decision

The applicant contended that the DPC acted in breach of its powers under section 110 of the DPA 2018, the GDPR, and the CJEU’s judgment in Schrems II, by failing to conduct an investigation or inquiry prior to issuing the PDD. It was alleged that the steps taken by the DPC prior to issuing the PDD were insufficient and that the PDD was factually incorrect. For example, the DPC stated in the PDD that the applicant had never sought to invoke any of the derogations in Article 26(1) of the Directive (the predecessor to Article 49 of the GDPR). However, the applicant submitted that the DPC knew that it was relying on such derogations. It referred to its submissions to the DPC dated 22 January 2016 (post-Schrems I), in which it had identified three legal bases for its data transfers to the US, including: (i) the SCCs; (ii) the data subject consent derogation under Article 26(1)(a) of the Data Protection Directive (predecessor to the Article 49(1)(a) of the GDPR), and (iii) the contractual necessity derogation under Article 26(1)(b) of the Data Protection Directive (predecessor to Article 49(1)(b) of the GDPR).

The court did not accept that the DPC acted in breach of the DPA 2018, GDPR, or the Schrems II decision, in terms of the investigation or inquiry to be conducted prior to issuing the PDD. Judge Barniville concluded that the DPC has a wide discretion in terms of the nature and extent of its statutory inquiries. Section 110 of the DPA 2018 expressly entitles the DPC to “cause such inquiry as it thinks fit to be conducted”. Furthermore, section 12(8) of the DPA 2018 makes it clear that, the DPC is entitled to “regulate its own procedures”. The court was satisfied that the DPC was in possession of “a vast amount of information” in light of the events since Mr Schrems’ original complaint in 2013, and that the DPC had carried out some further investigation before deciding to commence the new inquiry.

The court rejected the applicant’s contention that the PDD amounts to a “decision” on infringement and corrective power under section 111 of the DPA 2018, or the “draft decision” for submission to the Article 60 procedure. Judge Barniville stated that it was open and remains open to the applicant to make full submissions on the facts and law in relation to all the matters raised in the PDD and on any other matters it feels are relevant.

2. Alleged departure by DPC from published procedures/breach of legitimate expectation

The applicant contended that it had a legitimate expectation that the DPC would follow the statutory inquiry procedure set out in its Annual Report for May-December 2018; on the DPC’s website; and that it had adopted in other inquiries.

The court found that it was clear from the express terms of the 2018 Annual Report that the inquiry process set out therein was not binding on the DPC. The Report expressly stated that the 12-step process for statutory inquiries described therein was “illustrative only”; “not determinative of the precise steps which will be followed in each inquiry”; and “subject to change”.  The court therefore rejected the applicant’s submission that it had a “legitimate expectation” that the DPC would follow the statutory inquiry procedure set out in its 2018 Annual Report and on its website.

The court also rejected the applicant’s contention there was a course of conduct or regular practice by the DPC of adopting such procedures in statutory inquiries prior to the present inquiry. In Judge Barniville’s view, it was doubtful that the relatively limited number of previous statutory inquiries was sufficient to constitute the sort of established procedure or regular practice which could give rise to a legitimate expectation that that practice would be followed in all cases. The Deputy DPC, Colm Walsh, stated that, as of December 2020, the DPC had commenced 27 cross-border inquiries, and 21 of those inquiries had been progressed using a procedure “broadly reflective of the illustrative process” set out in the 2018 Annual Report. However, he noted that the DPC had begun “a process of revising its procedures generally”, and “that review was ongoing“, and in recent inquiries, the DPC had departed from the illustrative procedure in the 2018 Annual Report.

The court concluded that even if it was satisfied that the applicant had established a legitimate expectation, based on published procedures and/or the practice followed by the DPC in other inquiries, it would be open to the DPC to depart from those procedures, provided that in doing so it complied with fair procedures. Ultimately, Judge Barniville said that the question was whether to depart from the published procedures or practice would be unfair or unjust to those affected. The court did not believe that it would be unfair or unjust for the DPC to depart from the published procedures for the purposes of the present inquiry.

3. Alleged breach of fair procedures: 21-day period to make submissions on the PDD 

The applicant contended that the DPC had failed to comply with its obligation to provide fair procedures, by affording it an inadequate time-period (namely 21 days) to make submissions in response to the PDD.

The court agreed with the DPC that the precise content and extent of the fair procedures, including the right to be heard, depends on the particular circumstances and context of the process at issue. In considering an allegation of a breach of fair procedures in the course of a statutory process, the court held it is necessary to look at the entirety of the procedure and to consider the process as a whole. The court concluded that, in the particular circumstances of the present inquiry, that the 21-day period for submissions was adequate and did not amount to a breach fair procedures under Irish law, EU law or the GDPR.

4. Alleged breach of fair procedures: Premature judgment

The applicant asserted that this was a clear case of objective bias and premature judgment by the DPC. It was alleged that the DPC’s process started with a “decision”, before the applicant was even aware that the process had commenced.

The court stated that the cases on pre-judgment or premature judgment all stress the importance of the language used by the decision-maker and the stage of the process at which the premature judgment is said to arise. In Judge Barniville’s view, it was clear that the PDD was not a final decision or “draft decision” for the purposes of the Article 60 process, as the views expressed by the DPC in the PDD were invariably qualified by the word "preliminary".  He concluded that, reading the PDD in its entirety, it was sufficiently clear that it was open to the applicant to make submissions to the effect that the DPC was wrong in relation to the views it expressed in the PDD. Judge Barniville therefore rejected this ground of challenge.

5. Alleged breach of fair procedures: Involvement of Data Protection Commissioner at investigation and decision-making stage

The applicant contended that the involvement of Ms. Dixon, at all stages of the inquiry process, in particular in both the investigative and decision-making stages was in breach of its right to fair procedures.

The court rejected this contention. Judge Barniville stated that there is no general principle that the same person cannot be involved at different stages of an inquiry process. However, he acknowledged that “there are undoubtedly some cases in which it is inappropriate and would be a breach of fair procedures for one person to be involved at all stages of a particular inquiry or adjudicative process”.  It will very much be fact dependent. In this case, he concluded that it was entirely reasonable, given the history of the issues concerning EU-US data transfers, that Ms. Dixon would be involved in the investigative and decision-making stages of the inquiry.

6. Failure to await EDPB Guidance and/or take timing of EDPB Guidance into account

The applicant contended that the DPC acted unlawfully in commencing the present inquiry in circumstances before the EDPB had published its guidance on measures that data exporters could implement to supplement the SCCs. In the alternative, the applicant argued that in commencing the inquiry, the DPC had failed to take into account a relevant consideration, namely the anticipated EDPB guidance on supplementary measures.

The court concluded that the DPC was not obliged to await publication of EDPB guidance before commencing its inquiry. In addition, the court rejected the applicant’s contention that the DPC had failed to take into account, as a relevant consideration, in its decision to commence with the inquiry, the fact that the EDPB would be issuing guidance on supplementary measures following the Schrems II judgment. However, Judge Barniville noted that the position might have been different if publication of the EDPB’s guidance was “imminent” when the DPC issued the PDD.

The court noted that Article 52(1) of the GDPR provides that “each supervisory authority shall act with complete independence in performing its tasks and exercising its powers in accordance with [the GDPR]”.  Furthermore, Article 52(2) of the GDPR requires supervisory authorities to “remain free from external influence, whether direct or indirect” and “[to] neither seek nor take instructions from anybody”. In the court’s view, an obligation to await EDPB guidance before proceeding to exercise powers under the GDPR (or under the DPA 2018) would be inconsistent with the independence of the DPC under the GDPR, and with the non-binding nature of the guidance which the EDPB is empowered to issue under Article 70(1)(e) of the GDPR. It would also be inconsistent with the obligations imposed on the DPC to act within a reasonable time-frame, and with due diligence.

7. Alleged Discrimination / Breach of right to equality (Inquiry into the applicant’s data transfers only)

The applicant pleaded that it was a breach of its rights to equality and non-discrimination for the DPC to commence an inquiry into its data transfers, but not into other entities’ transfers.

The court did not accept that the DPC was in breach of the applicant’s rights to equality and non-discrimination. In its view, the DPC was entitled to commence and proceed with the inquiry in respect of the applicant’s data transfers without having to carry out inquiries into other entities involved in similar transfers. Jude Barniville stated that a regulator, like the DPC, must be able to prioritize its enforcement actions unless the law provides otherwise, which in this case, it does not. In addition, the DPC did not have any legal obligation to explain why it had not commenced an own-volition inquiry against other entities who were using the SCCs for EU-US data transfers. Judge Barniville acknowledged that the DPC does have an obligation to explain why it has decided to proceed against a particular entity, but it was obvious from the content of the PDD and surrounding circumstances why the DPC had chosen to proceed with an inquiry into the applicant’s data transfers.

8. Adequacy of DPC’s reasons

This ground of challenge overlapped with other grounds. The applicant sought a declaration that the DPC did not provide sufficient reasons for its commencement of the own volition inquiry, the PDD, and the inquiry process. The court was not satisfied that there was any deficiency in terms of the reasoning given by the DPC for its decision to commence the inquiry, and take the various procedural steps and decisions it took.

Duty of Candour

While it was not a pleaded issue in the case, the applicant contended in written and oral submissions at the hearing that the DPC was in breach of its duty of candour by refusing to answer questions raised by the applicant’s legal counsel in a letter dated 29 October 2020.

Judge Barniville rejected this contention, but voiced “misgivings” about the DPC’s failure to respond more fully to the information sought by the applicant’s legal counsel. The court stated that the DPC ought to have “erred on the side of caution” and provided the information requested.

Abuse of Process/ Improper Purpose

The DPC originally pleaded that the proceedings were an abuse of process, claiming that the applicant had brought the proceedings “for the purpose of preventing any decision being taken regarding its EU-US data transfers until such time as the European Commission and the US” had negotiated a replacement for the EU-US Privacy Shield.

The applicant disputed this allegation, asserting that it brought the proceedings to secure “the vindication of its rights to fair and proper procedures and ensuring that it is not subjected to an unlawful inquiry”.  The court was not obliged to deal with this allegation, as it was withdrawn by the DPC at the hearing. However, the court noted that there was no basis for this allegation, that it was a serious allegation, and that the DPC should not have made it.

Next Steps

The DPC will now resume its inquiry into the applicant’s data transfers to the US. The DPC has given the applicant six weeks to make submissions in response to the PDD. The DPC will then finalise and circulate its draft decision to the other Concerned Supervisory Authorities (CSAs) under the Article 60 GDPR procedure (i.e. the-one-stop-shop mechanism) for their opinion. If the CSAs agree with the DPC’s draft decision, the applicant could be forced to suspend its data transfers about EU/EEA users to its parent company in the US.  In parallel with its statutory inquiry, the DPC will advance its handling of Mr Schrems’ original complaint under sections 109 and 113 of the DPA 2018.

For more information, contact Davinia Brennan, Associate or any member of the Commercial & Technology team.

Date published: 16 June 2021