06:52:05 PM
29 2022

Irish DPC to pay tens of thousands in legal costs over 47 months delay in cases against WhatsApp and Instagram

View 1.4K

word 909 read time 4 minutes, 32 Seconds

Yesterday the Irish DPC[1] has settled a case with noyb over a gross delay in two cases on Instagram and WhatsApp. 47 months after the filing of the cases on Facebook's "consent bypass", the DPC agreed to pay tens of thousands in costs for a Judicial Review over delays. While the GDPR requires a decision "without delay" the DPC takes the view that four years for producing a draft decision is reasonable. In most EU Member States the law requires a decision within 3 to 12 months.

Simple Case. On 25 May 2018, on the day the GDPR came into force noyb filed four complaints over "forced consent". One was leading to a quick € 50 million fine against Google in France, the other three cases (Facebook, Instagram and WhatsApp) were sent to the DPC as the lead authority. None of the Irish cases have seen a final decision so far. The cases itself are simple, as they only concern narrow legal questions and there is even a clear Guideline by the European Data Protection Board (EDPB) on the core matters. These guidelines themselves were passed after an attempt of the DPC to lobby its EU counterparts in the interest of Facebook. Despite the clear legal situation, the DPC has only issued a "draft decision" on WhatsApp and Instragram on 1 April 2022, 46 months after the complaints were filed. The cases are still pending and will likely not be decided before the summer 2022.

Four Years for Basic GDPR Rights is "Without Delay"? On 6 July 2020 noyb has filed a Judicial Review with the Irish High Court, claiming that the DPC has violated Article 60(3) GDPR by not providing a draft decision "without delay". The DPC took the view that (by now) roughly four years would still be "without delay". In many other EU Member States the law requires a decision within 3 to 12 months, as a recent internal table by the EDPB shows.

Irish High Court slower than DPC? But not only the DPC is taking a very long time to decide. The first hearing for discovery before the Irish High Court was set to today (28 April 2022), any hearing on the case would have been realistic in fall 2022. This would make the Judicial Review on delay itself take more than two years. Given the slow speed of the Judicial Review of the Irish High Court, the slow procedure before the DPC has now outpaced the Judicial Review, as the DPC finally submitted their draft decision for review on 1 April 2022.

Max Schrems, honorary chair of noyb: "It is grotesque that the legal procedure to deal with delays is so slow, that the DPC could just continue at a slow speed and still be faster than the Courts. We have a situation where there is really no efficient recourse against the Irish DPC delaying cases. The only learning may come from the costs of the procedure, which will have to be covered by the DPC. We expect the costs to be in the tens of thousands."

Cases Not Decided - Next Steps. The "draft decisions" on WhatsApp and Instagram will now be scrutinized by the other European Data Protection Authorities, who can file "reasoned objections". The deadline for this is coincidentally today. Because the DPC (illegally) does not share the procedural documents with noyb anymore, noyb cannot comment on the substance of these draft decisions. These procedural violations may itself be a basis for a legal challenge of any final decision. If there are objections, the cases may be escalated to the EDPB within the next months.

Max Schrems: "The procedure is not just slow, but also fundamentally unfair. The DPC basically removed us from large parts of the procedure, most of our submissions are simply ignored. In the preliminary draft decision, our submissions were largely suppressed, making it impossible for other authorities to get the full picture of the case. Large parts of our submissions just 'disappeared' at the Irish DPC."

Tip of the Iceberg. noyb has about twenty other cases before the DPC, none of them have a timely decision in sight. noyb will now focus on the delays in these other cases and may bring further cases to the attention of the High Court. Despite the DPC having one of the largest budgets of all EU Data Protection Authorities and a massive number of personnel, the DPC only produces a hand full of decisions per year, taking much longer than other authorities.

Max Schrems: "We hope the DPC learned that their excessive delays come at a cost that the Irish tax payer will not accept. The DPC got a huge budget, but it seems to get invested in obstructing procedures - not getting them done."


1) The Data Protection Commission (DPC) is the national independent authority in Ireland responsible for upholding the fundamental right of individuals in the European Union (EU) to have their personal data protected. Accordingly, the DPC is the Irish supervisory authority responsible for monitoring the application of the General Data Protection Regulation (GDPR), and we also have functions and powers related to other regulatory frameworks, including the Irish ePrivacy Regulations (2011) and the EU Directive known as the Law Enforcement Directive (LED). The statutory powers, duties and functions of the DPC are as established under the Data Protection Act 2018, which gives further effect to the GDPR, and also gives effect to the LED.

Source by Redazione

LSNN is an independent editor which relies on reader support. We disclose the reality of the facts, after careful observations of the contents rigorously taken from direct sources, we work in the direction of freedom of expression and for human rights , in an oppressed society that struggles more and more in differentiating. Collecting contributions allows us to continue giving reliable information that takes many hours of work. LSNN is in continuous development and offers its own platform, to give space to authors, who fully exploit its potential. Your help is also needed now more than ever!

In a world, where disinformation is the main strategy, adopted to be able to act sometimes to the detriment of human rights by increasingly reducing freedom of expression , You can make a difference by helping us to keep disclosure alive. This project was born in June 1999 and has become a real mission, which we carry out with dedication and always independently "this is a fact: we have never made use of funds or contributions of any kind, we have always self-financed every single operation and dissemination project ". Give your hard-earned cash to sites or channels that change flags every time the wind blows , LSNN is proof that you don't change flags you were born for! We have seen the birth of realities that die after a few months at most after two years. Those who continue in the nurturing reality of which there is no history, in some way contribute in taking more and more freedom of expression from people who, like You , have decided and want to live in a more ethical world, in which existing is not a right to be conquered, L or it is because you already exist and were born with these rights! The ability to distinguish and decide intelligently is a fact, which allows us to continue . An important fact is the time that «LSNN takes» and it is remarkable! Countless hours in source research and control, development, security, public relations, is the foundation of our basic and day-to-day tasks. We do not schedule releases and publications, everything happens spontaneously and at all hours of the day or night, in the instant in which the single author or whoever writes or curates the contents makes them public. LSNN has made this popular project pure love, in the direction of the right of expression and always on the side of human rights. Thanks, contribute now click here this is the wallet to contribute

Similar Articles / Irish DP...Instagram