Irish privacy watchdog sued for not probing 'massive Google data breach'

In a significant move, the Irish High Court has agreed to hear a lawsuit against the country's privacy watchdog's alleged failure to fully investigate a complaint against Google for a massive data breach.

The failure to investigate the matter by the Data Protection Commission (DPC) is in breach of the requirements of both the 2018 Data Protection Act and the General Data Protection Regulation (GDPR), according to Dr Johnny Ryan, a senior fellow of the Irish Council for Civil Liberties (ICCL) who filed the lawsuit.

In a statement on Tuesday, the ICCL said it is suing the DPC for its failure to protect people against the biggest data breach ever recorded: Google's "Real-Time Bidding" online advertising system.

Google's "Real-Time Bidding" (RTB) system selects what ads you will see when a website or app loads.

"It happens behind the scenes, and can broadcast private information about you to over a thousand other tracking companies in a split second. There is no control over what those companies do with this sensitive data," the ICCL said.

"Google operates this unlawful RTB system on millions of websites, broadcasting personal data to other tracking companies billions of times a day. This is the largest data breach ever," it added.

The DPC received a complaint about Google's RTB data breach three and a half years ago.

"It was obliged to investigate and act on that complaint under the GDPR. But it did not do so. Because Google's EU operation is based in Ireland, the DPC has the lead responsibility to see that it obeys Europe's data protection law," claimed the ICCL.

The DPC's failure to act on this complaint has therefore allowed Google's massive data breach to continue across the entire EU for many years.

"The DPC was created to protect us against the illegal collection and use of intimate data about us. But it has failed to act in this landmark case, despite the passage of three and a half years and having detailed evidence of Google's massive and ongoing data breach," said Dr Ryan.

The ICCL is Ireland's oldest independent human rights campaigning organisation.

Google was yet to comment on the lawsuit.