20 December 2022
After a year-long inquiry, the EU Ombudsman recommends that the European Commission should monitor the progress of every single Big Tech case that the Irish Data Protection Commission is responsible for.
The EU Ombudsman, Dr Emily O’Reilly, has issued a decision on the Irish Council for Civil Liberties’ (ICCL) complaint against the European Commission for its failure to adequately monitor Ireland’s application of the GDPR. The Irish Data Protection Commission (DPC) is the lead GDPR supervisory authority for Google, Meta, Apple, and Microsoft, for all of the European Union.
Following correspondence between ICCL and the European Commission, ICCL complained to the EU Ombudsman that the European Commission was failing to diligently monitor Ireland's application of the GDPR. The EU Ombudsman wrote to European Commission President Ursula von der Leyen to request a "detailed and comprehensive account" of its monitoring of Ireland's application of the GDPR. After several rounds of submissions from the European Commission and from ICCL, the EU Ombudsman has now delivered a decision.
The Ombudsman’s assessment begins at paragraph 22 of the Decision.
The Ombudsman expressed “serious doubts” about the adequacy of the sources of information initially cited by the Commission, including the DPC’s annual reports (paragraph 27, including footnote 18).
The Ombudsman agrees that ICCL’s recommendations about data the European Commission should gather are indeed “basic” and “what one would expect” (paragraph 25).
However, the Ombudsman notes positively that the European Commission has requested bi-monthly overviews of the DPC’s large scale inquiries. Having now examined a sample of these reports, the Ombudsman says they are an “encouraging example of a specific targeted monitoring measure” (paragraph 27).
The European Commission’s reply to ICCL’s freedom of information request shows that there was no regular reporting before ICCL’s complaint and the launch of the Ombudsman’s inquiry.
The EU Ombudsman also recommends that the European Commission should request regular status reports from the DPC about each individual Big Tech case, including how long it takes for the case to advance through each stage.
“We hope this will lead to improvement in the European Commission’s monitoring of Ireland’s application of the GDPR”, said Liam Herrick, Executive Director of ICCL.
Documents
Decision on whether the European Commission collects sufficient information to monitor Ireland’s implementation of the EU's General Data Protection Regulation (GDPR) (Case 97/2022/PB), 19 December 2022 (PDF).
Emily O'Reilly's initial letter to Ursula von der Leyen, 10 February 2022 (PDF).