Apple has been given permission to challenge a decision by the Data Protection Commissioner (DPC) to inquire into a data processing complaint by a French digital rights group, after the tech giant argued the validity of the submission should have been evaluated first.
At the High Court today, Apple Distribution International Limited successfully applied through barrister Imogen McGrath SC for leave to have the decision judicially reviewed.
The company is seeking the quashing of a decision made last September by the DPC, which Apple claims involves the refusal to determine the validity or admissibility of a sample complainant before proceeding to a preliminary draft decision for submission to other authorities.
Apple is seeking declarations from the High Court that the DPC acted unlawfully, outside of its powers, and unreasonably in refusing to determine the validity of the complaint. Apple claims that the DPC had also breached the company's right to fair procedure and had acted contrary to the requirements of natural and constitutional justice.
Ms McGrath also successfully applied to Ms Justice Mary Rose Gearty in an 'ex parte' motion, where only one side is represented, to have a stay granted on further steps being taken in the inquiry, which arises from a complaint launched by French digital rights and freedoms advocacy group La Quadrature du Net (LQdN).
Apple claims the DPC "does not have jurisdiction to produce a draft decision... unless that complaint is determined to be valid or admissible".
The company says that LQdN "lodged a complaint purportedly on behalf of 6,880 people" with the Commission Nationale de l'Informatique et de Libertés (CNIL), alleging that Apple is processing personal data in a way that infringes the Data Protection Act (GDPR). The CNIL is the body responsible for monitoring the application of data protection in France.
Apple denies the allegation.
Apple says that the complaint was lodged on May 28, 2018, "three days" after the GDPR commenced its application across Europe. LQdN says that it was mandated, prior to the GDPR coming into effect, to lodge the complaint when certain persons ticked an online form or petition to mandate the making of complaints against a number of companies, including Apple.
On March 3, 2021, an individual nominated by LQdN as a "sample subject" was required to confirm whether or not they were a registered user of an iOS device at the time of the complaint and an email address was provided. However, on March 18, 2021, Apple said it had no record of any account on its books matching the email address provided.
In September 2021, Apple submitted that it was concerned that the investigation "may have proceeded on a fundamentally flawed basis" because it could not be confirmed that the sample subject was a relevant, or valid, data subject.
In February 2022, the DPC's office wrote to Apple saying the file had been passed on to the commissioner and that the first sample subject had now been substituted with an alternative individual.
Apple says the DPC should not have proceeded to any decision-making stage without first making a decision on the validity of the grounds and that this was of "fundamental importance" to the conduct of the inquiry.
The company also submits that last September the DPC failed to articulate reasons for "the refusal of the request for a standalone decision on validity" before continuing with the inquiry into the complaint that will lead to a draft decision.
Ms Justice Gearty granted leave to appeal to Ms McGrath and put a stay on the inquiry before adjourning the matter to January, with the matter of the costs of the hearing reserved.
