Irish DPC to pay tens of thousands in legal costs over 47 months delay in cases against WhatsApp and Instagram

Yesterday the Irish DPC 1 has settled a case with noyb over a gross delay in two cases on Instagram and WhatsApp. 47 months after the filing of the cases on Facebook's "consent bypass", the DPC agreed to pay tens of thousands in costs for a Judicial Review over delays. While the GDPR requires a decision "without delay" the DPC takes the view that four years for producing a draft decision is reasonable. In most EU Member States the law requires a decision within 3 to 12 months.

Simple Case. On 25 May 2018, on the day the GDPR came into force noyb filed four complaints over "forced consent". One was leading to a quick € 50 million fine against Google in France, the other three cases (Facebook, Instagram and WhatsApp) were sent to the DPC as the lead authority. None of the Irish cases have seen a final decision so far. The cases itself are simple, as they only concern narrow legal questions and there is even a clear Guideline by the European Data Protection Board (EDPB) on the core matters. These guidelines themselves were passed after an attempt of the DPC to lobby its EU counterparts in the interest of Facebook. Despite the clear legal situation, the DPC has only issued a "draft decision" on WhatsApp and Instragram on 1 April 2022, 46 months after the complaints were filed. The cases are still pending and will likely not be decided before the summer 2022.

Four Years for Basic GDPR Rights is "Without Delay"? On 6 July 2020 noyb has filed a Judicial Review with the Irish High Court, claiming that the DPC has violated Article 60(3) GDPR by not providing a draft decision "without delay". The DPC took the view that (by now) roughly four years would still be "without delay". In many other EU Member States the law requires a decision within 3 to 12 months, as a recent internal table by the EDPB shows.

Irish High Court slower than DPC? But not only the DPC is taking a very long time to decide. The first hearing for discovery before the Irish High Court was set to today (28 April 2022), any hearing on the case would have been realistic in fall 2022. This would make the Judicial Review on delay itself take more than two years. Given the slow speed of the Judicial Review of the Irish High Court, the slow procedure before the DPC has now outpaced the Judicial Review, as the DPC finally submitted their draft decision for review on 1 April 2022.

Max Schrems, honorary chair of noyb: "It is grotesque that the legal procedure to deal with delays is so slow, that the DPC could just continue at a slow speed and still be faster than the Courts. We have a situation where there is really no efficient recourse against the Irish DPC delaying cases. The only learning may come from the costs of the procedure, which will have to be covered by the DPC. We expect the costs to be in the tens of thousands."

Cases Not Decided - Next Steps. The "draft decisions" on WhatsApp and Instagram will now be scrutinized by the other European Data Protection Authorities, who can file "reasoned objections". The deadline for this is coincidentally today. Because the DPC (illegally) does not share the procedural documents with noyb anymore, noyb cannot comment on the substance of these draft decisions. These procedural violations may itself be a basis for a legal challenge of any final decision. If there are objections, the cases may be escalated to the EDPB within the next months.

Max Schrems: "The procedure is not just slow, but also fundamentally unfair. The DPC basically removed us from large parts of the procedure, most of our submissions are simply ignored. In the preliminary draft decision, our submissions were largely suppressed, making it impossible for other authorities to get the full picture of the case. Large parts of our submissions just 'disappeared' at the Irish DPC."

Tip of the Iceberg. noyb has about twenty other cases before the DPC, none of them have a timely decision in sight. noyb will now focus on the delays in these other cases and may bring further cases to the attention of the High Court. Despite the DPC having one of the largest budgets of all EU Data Protection Authorities and a massive number of personnel, the DPC only produces a hand full of decisions per year, taking much longer than other authorities.

Max Schrems: "We hope the DPC learned that their excessive delays come at a cost that the Irish tax payer will not accept. The DPC got a huge budget, but it seems to get invested in obstructing procedures - not getting them done."

source: https://noyb.eu/en/irish-dpc-burns-taxpayer-money-over-delay-cases

[ppie]1) The Data Protection Commission (DPC) is the national independent authority in Ireland responsible for upholding the fundamental right of individuals in the European Union (EU) to have their personal data protected. Accordingly, the DPC is the Irish supervisory authority responsible for monitoring the application of the General Data Protection Regulation (GDPR), and we also have functions and powers related to other regulatory frameworks, including the Irish ePrivacy Regulations (2011) and the EU Directive known as the Law Enforcement Directive (LED). The statutory powers, duties and functions of the DPC are as established under the Data Protection Act 2018, which gives further effect to the GDPR, and also gives effect to the LED.[/p]