Filed By: GIBSON & ASSOCIATES SOLICITORS 38 ARRAN QUAY

DUBLIN 7
Record No: 2011/02390

AN CHUIRT CHUARDA (fHE CIRCUIT COURT) DUBLIN CIRCUIT COUNTY OF THE CITY OF DUBLIN
BEFORE
tli

JUDGE

LINNANE

THE 4 DAY OF May 2011

IN THE MATTER OF SECTION 26 OF THE DATA PROTECTION ACTS 1988 TO

2003 BETWEEN

-ANDThe Office of the Data Protection Commissioner

APPLICANT

RESPONDENT
The Respondent having been duly served with the Notice of Motion on behalf of the Applicant dated the 10th day of March 2011 herein appealing the decision of the

Respondent dated the 15th February 2011 WHEREUPON and on reading the documents f'LIed and on hearing Counsel for the Applicant and Counsel for the Respondent THE COURT DOTH ORDER that the Applicant's Appeal be and the same is hereby
dismissed.

THE COURT DOTH ORDER that the Respondent do recover costs of the Application
from the Applicant, such costs to be taxed in default of agreement. THE COURT DOTH FURTHER ORDER that execution for costs hereon be stayed for a period of ten days. In the event of an Appeal to the High Court:, such stay to continue pending determination of the appeal should same be lodged, the stay being granted on the basis that the appeal is prosecuted without delay.

BY THE COURT

Order settled by RENA QUINN

Draft Order settled on 04/0512011

Court Attendance
Client: Date:

at

Data Protection Commissioner (DAT001/0044) Wednesday 4 May 2011 (Civil Motions List began @ 10.00 am and hearing commenced

12.05pm)
Case: ~ v - Data Protection Commissioner (Circuit Court Record No. 2011/02390) Trial of preliminary issue on Jurisdiction of the Court to hear Statutory Appeal pursuant to Section 26 of the Data Protection Acts 1988 and 2003 Circuit Court No. 22 before Judge Jacqueline Linnane (Civil Motions List) (Office of the Data (Gibson & Associates,

Matter:

Court:

Attendees: Protection Commissioner), Solicitors for the Appellant) Counsel:

Paul Anthony McDermott BL for the Data Protection Commissioner and Andrew Fergus BL for the Appellant

Decision of the Court Judge Linnane gave judgment in the following terms: "It was agreed betweeJ1the parties that the preliminary issue be decided first as to whether the Court had jurisdiction to entertain this appeal. It is quite ciear, in my vieJP,from Section 10(1 )(b)(ii) and Section 26(1)(d) of the Act that it is onlY aJ a result of an investigation of a complaint and where the CommisJioner makes the decision thereto that an appeal lies under Section 26 to the Circuit Court. If there is no investigation because the Commis.rioner is 0/ the opinion that the mmplaint is friJ)o!ous or IJexatious, which the Commissioner iJ entitled to do under Section 10(1)(b)(i), there is no rigbt 0/ appeal to this Court aJ"no decision has been made jo!!02!Jingan itwestigatiotl. That is 11JI ruling. "

Having heard further submissions from the parties, Judge Linnane then made an order for costs in favour of the Commissioner, costs to be taxed in default of agreement. (In the event of an appeal; theJudge directed a stay on executing the costs order).

D."'.'l'OOl-0044-865527 -1

THE PARTIES~ SUBMISSIONS First Calling

Wben the case was frrst called in the Civil Motions List, Judge Linnane commented that it should have been put into the Civil Hearings List and she wasn't sure why it had been put into her Motions list. Judge Linnance said that she had not seen any papers connected with this appeal yet. Counsel for the Data Protection Commissioner ("DPC") informed the Court that submissions had already been exchanged and lodged with the Circuit Court offrce for this case. Judge Linnane said that she would not deal with it in the current Motions List but she would see if she could take it in the Hearings List later on when she knew what had been sent over from the President's list. Both parties indicated to the Court that the matter would take around 20 minutes to hear but Judge Linnane commented that it sounded like it would take longer than that.

Hearing (aJ Submissions/or the Respondent

Counsel for the DPC agreed that it was appropriate that he should put his arguments to the Court first as the issue currendy before the Court had been raised by the respondent. Counsel for the DPC explained to the Court that there was a preliminary issue relating to the jurisdiction of the Court to hear this appeal and in circumstances where the Court had ah'eady made a similar decision on jurisdiction (in the Nowak case) it seemed prudent to have the preliminary issue determined separate to any full hearing of the matter. Counsel noted that if the DPC was successful on this point it would end the appeal and if not the appeal could then be dealt with on its merits. Counsel for the DPC then took the Court through Section 10 of the Data Protection Acts 1988 and 2003 (the "DP A") regarding the powers of the DPC to investigate and the procedure to be followed under Section 10(1)(b) of the DPA when a complaint is received. Counsel for the DPC explained the background to this matter i.e. that the appellant was a security guard at the National GallelY of Ireland, that he had made various complaints concerning his employers and that he appeared to be in dispute with them. Counsel noted the Court would see from the DP A that there is a mandatory obligation on the DPC to investigate a complaint unless the matter is considered to be frivolous or vexatious. Counsel submitted that in this regard the word "unless" in Section 10(1)(b) (i) of the DPA was important because it showed the DPC had discretion to look into something to see if it merited the tUne and resources of its offrce to spent on it. On the issue of "frivolous and vexatious", Counsel noted that the Court ",,':ill be familiar with that phrase and that lawyers in particular know that there are certain connotations

D AT001-0044-86

5527-1

flowing from it i.e. that a case has no chance of success. The phrase does not impune the bone fides of the person concerned and while the phrase might sound insulting, all it means is that the person has not raised any point worth investigating. Counsel for the DPC then referred to the word "and" in Section 10(1)(b)(i) as to what happens if the complaint is investigated. If the complaint is not investigated that is the end of the matter. However if there is an investigation then there could be an amicable resolution but if that is not possible the DPC then makes a decision, which the aggrieved party can then appeal to the Court. Counsel then took the Court through Section 26 of the DP A and in particular the provision relating to appeals (Section 26(1)(d. Counsel noted that there was no independent def111itionof the word "decision". In order to see what the word means, you need to look at Section 10 i.e. the decision referred to in Section 26 is that made in the context of the DPC having investigated a complaint and then made a formal decision. Counsel for the DPC submitted that the DP A do not allow for an appeal where the complaint never gets out of the starting blocks. Counsel went on to address whether this meant that a person has no redress in circumstances where it was not open to hun to take an appeal under the DPA. Counsel noted that in such a situation the remedy of judicial review was available as the DPC is a public body. Consequently an aggrieved party is not left without a remedy - he just does not have a statutory right of appeal in such circumstances. Counsel then referred the Court to its previous decision last year in the case of Nowak v. Data Protection Commissioner (Circuit Court Record No. 2010/008035) and to the case note in the Court Booklet before the Court. Counsel explained the background to this case i.e. the appellant had failed his accountancy exams and wanted to see his exam scripts. The appellant argued that his exam scripts constituted personal information however the DPC had said that his complaint was frivolous and vexatious. Counsel then specifically referred the Court to its judgment in this case (recorded at paragraph 4 of the note). Counsel acknowledged that in the Nowak case, matters had been slightly different in that the Court had heard the entire appeal at the same time as determining the jurisdiction issue. On the facts, the Court had also agreed with the DPC's decision [that the exam scripts in question did not constitute personal data] (which it had gone on to look at after the issue of jurisdiction). Counsel asked the Court to follow its earlier ruling. He confirmed (from his mvn knowledge and research) that he was not aware of any developments (in the High Court) relating to the law in this area since this Court's previous judgment. Counsel also noted that, equally, Counsel for tlle appellant had not identified any further such developments in this area.

(b) Submissions for the Appellant

Andrew Fergus BL, Counsel for the appellant, then addressed the court. Counsel submitted that the DPC was substituting the word "decision" for outcome of investigation" however there was notlling in the DPA justifying the use of such a

Dt\ TOOI-0044-865527- J

synonym. The DPC had taken the decision to deem the appellant's complaint frivolous and vexatious but, Counsel submitted, you could not divide out various sub strata of decisions. He noted that Counsel for the respondent had urged a particular interpretation of Section 10(1)(b)(i) and (ii). Counsel for the appellant was of the view that the phrase "unless he is of the opinion" in Section 10(1)(b)(i) only applies to the decision to investigate the complaint further (or not) and it does not apply to the acts in Section 10(1)(b)(ii). Counsel further submitted that the word "and" is still in operation in relation to the second part of Section lO(l)(b) of the legislation i.e. that the DPC must still notify an individual of the outcome of the decision. Counsel for the appellant highlighted that under sub-section (1)(b) of Section 10, the DPC must do three things:
L Attempt to amicably resolve the complaint; 2. Notify the outcome of the complaint to the complainant; and 3. Notify the complainant of the right of appeaL

Counsel then referred the Court to the European Directive 95/46/EEC and in particular Article 28(4) of that Directive which requires that a person lodging a claim be informed of the outcome of that claim. He pointed out that in this article there was no reference to whether or not a complaint has been investigated etc. However, because the DP A must be consistent "vith the Directive, the DPA must be read as envisaging the complainant being informed of the outcome of the complaint and of their right to appeal. Counsel for the appellant noted that the DPC has argued that under Section 10(1)(b)(i) of the DP A, if a complaint was deemed frivolous or vexatious then that was the end of the matter and effectively the DPC was saying that Section 10(1)(b)(ii) subsequently does not apply i.e. that there is no onus on the DPC's office to reply to a complainant. However such an interpretation is not consistent with the Directive because according to the Directive the complainant must be informed of the outcome of his complaint. Counsel argued that from the wording of Section 10(1)(b) of the DPA it is clear that the "unless" clause in Section 10(1)(b) (i) applies only to a decision to undertake an investigation but the "and" step still applies regardless. Counsel made the final point that Order 60 of the Rules of tlle Circuit Courts refers to statutory appeals made under the DP A. The interpretation attributed to this nue by the author of the annotated consolidated Circuit Court Rules reflects a plain reading of the legislation. Counsel referred to his written legal submission on this point. Additionally, Counsel submitted that none of the Data Protection texts books say that there should be a division between different types of decisions for the pUl}Joses of an appeal under tlle DPA. Counsel also informed the Court that he had reviewed the Dail debates and had come across nothing in the debates relating to the 1988 and the 2003 Acts which indicated that the Oireachtas wanted sub-strata of decisions to apply to appeals. Instead the most likely interpretation was that any decision of the DPC is capable of appeal and that is consistent with Article 28 of the Directive and the requirement of a com:plai.rtailtto be notified of the outcome of the complaint. According to Counsel, there was no indication

D ;\TOn 1-0044-8(, 5527-1

on the face of the DPA that there should be different types of decision. Therefore even a decision by the DPC to dismiss a complaint \vas, in effect, a decision. At this point Judge Linnane stated that the decision being decision as a result of an investigation, was it not? Counsel decision of the DPC in relation tel a complaint. As a matter the complaint as frivolous and vexatious in and of itself must referred in the DPA was a replied that it was simply a of logic, a decision to reject be a decision of the DPC.

(c) Replies by Counsel/or the Respondent

On the issue of the Directive, Counsel accepted that the Ditective says that a complainant must be informed of the outcome of the complaint, but he submitted that this requirement merely reflects the existing principles of Irish public law. Counsel noted that Ireland had implemented the Directive by way of the DP A and that Member States have discretion as to how to implement a Directive. There was no claim put before the Court in this case that Section lOaf the DPA had not been properly implemented in Ireland. Counsel continued by stating that Counsel for the appellant was concerned with what is the plain meaning of the DPA. Counsel for the DPC stated that a decision was something which only happens after an investigation, othenvise it would make no sense because Section 10(1)(b)(ii) begins by saying there must be an attempt at an amicable resolution. Counsel stated that the purpose of Section 10 was to save the limited time and resources of the DPC and equally to save the funited time and resources of the Circuit Court. He argued that it made no sense if the DPC could weed out complaints but the Court then had to hear appeals on such complaints which were weeded out. In relation to the point made on the annotated consolidated Circuit Court Rules, Counsel submitted that the author had only read the relevant section of the DPA and taken a view on them. She obviously did not have the benefit of the Nowak decision when doing so whereas he did. A further point was made that if appeals of this nature were allowed under the DPA, it would in fact, be hard to appeal against a non-event. There would be nothing for the Court to get its teeth into because the DPC had not in such circumstances investigated the complaint in question and reached a formal decision on it. Finally, Counsel for the DPC noted, for the purposes of laying everything before the Court, that the Nowak decision had since been appealed to the High Court in that a notice of appeal had been served however, d1.eappellant in that case had done nothing further to progress his appeal at this point.

(d) Replies by Counselfor the Appellant

Counsel for the appellant stated that there was nothing suggesting that it was the intention of the Oireachtas to limit the appeal system under the DPA and nor that by introducing the anucable resolution provision into Section 10 by way of the 2003 Act that this would JiJ.nitthe appeal system allowed for under the original 1988 Act.

DXl'OOl-0044-865527-1

In relation to the assertion that the Oireachtas had implemented the Directive correctly, Counsel noted that Article 28(4) required that a person must be informed of the outcome of an appeal so Section lOaf the DP A had to be consistent with article. There was nothing in the DPA to suggest that different types of decision were available to the DPC. Counsel again submitted that the plain meaning of the DP A arrives at the same conclusion as the author of the annotated consolidated Circuit Court Rules. Counsel also noted, [in relation to the point that judicial review was the approptiate legal remedy in such a case] that to seek to judicially review a decision completely blind would be an unfair onus on the applicant. Finally, in relation to the Nowak case, Counsel for the appellant said t..~athe had received a note of this judgment but the ratio decidendi was not set out in it. He therefore urged the Court to reach a different decision to that in the Nowak case.

Judgment
Judge Linnane then gave her judgment in the following terms: '1t was agreed between the parties that the prefiminary issue be decidedfirJt juriJdiction to enterlain thiJ appeaL
aJ to

whether the Court had

It iJ quite clear, in my view, from Section 10(1)(b )(ii) and Section 26(1 )(d) oj the Act that it is onlY as a reJult oj an investigation oj a complaint and )JJherethe Commissioner makes the decision thereto that an appeal !eJ under Section 26 to the Circuit Court. If there is no imJeJ-tigatiolt because the Commissioner is oj the opinion that the complaint is frivolous or vexatiouJ, which the CommiJJioner is entitled to do under Section 10(I)(b)(i), there iJ no right oj appeal to this Court aJ no decision has been made fol/owing an inveJtigation. That is my rttling. " Counsel for the DPC then applied for the costs of the DPC on the basis thit costs follow the event. He also pointed out to the Court that the Nowak decision had already been brought to the attention of the appellant in this case and they would have seen in that note that the Court had awarded costs against Mr. Nowak. Counsel submitted that there was no reason why someone who comes afterwards should be in a better position than Mr. Nowak was in that case. Counsel for the appellant asked that costs be stayed. Judge Linnane stated that costs must follow the event and made the following orders:
III

III

Costs of the ruling on the preliminary decision were awarded to the DPC to be taxed in default of agreement; There was to be a stay on executing the costs order in the event of an appeal; and Any appeal should be brought without delay.

D ATOOl ~1I044-865527-

AN CHUIRT CHUARDA THE CIRCUIT COURT

Record No 2012/02787

DUBLIN CIRCUIT

COUNTY OF THE CITY OF DUBLIN

IN THE MATTER OF THE DATA PROTECTION ACTS 1988AND 2003 IN THE MATTER OF AN APPEAL PURSUANT TO SECTION 26 OF THE DATA PROTECTION ACTS 1988AND 2003

Between:-

Appellant -and-

DATA PROTECTION

COMMISSIONER
Respondent

NOTE OF THE HEARING AND JUDGMENT DELIVERED BY HIS HONOUR JUDGE MATTHEW DEERY, THE PRESIDENT OF THE CIRCUIT COURT, ON THE 9TH DAY OF MAY 2012

Client: Date: Case:

Data Protection Commissioner _

_v 1988 and 2003

~PC)_

Wednesday 91hy 2012 (Heating c01Umencedat 1022 am) Data Protection Commissioner (Circuit Court Record No. 2012/02787)

Matter:

Heating of a Prelitninary Issue in relation to Jurisdiction in the context of a Statutory Appeal pursuant to Section 26 of the Data Protection Acts

Court: Attendees: Counsel:

Circuit Court 28 before the President of the Circuit Court

Paul Anthony McDermott BL for the Data Protection Commissioner ("the Respondent")

DATOOI-0051-1126825<1

Submission By Counsel For The Respondent Introduction

1. Counsel for the Respondent, Paul Anthony McDermott BL, began his submission by setting out the central issue for consideration by the Circuit Court ("CC") as being whether or not the CC had jurisdiction to hear an appeal pursuant to the Data Protection Acts 1988 and 2003 ("the Acts") against the Respondent's refusal to investigate a complaint made by the Appellant that \vas deemed "frivolous and vexatious". Counsel stated that Section 10 of the consolidated version of the Acts set out the procedure to be followed by the DPC on receiving a complaint. He stated that as part of that procedure, if a complaint is taken on and investigated, an attempt is made to mediate and reach an amicable resolution in relation to the matter. Failing this, a formal decision is made by the DPC. That decision is subject to a right of appeal to the CC in favour of any aggrieved complainant. The decision of the CC is, itself, subject to a further right of appeal on a point of law to the High Court ("HC"). However, Counsel went on to point out that if the DPC is of the opinion that a complaint made is "frivolous or vexatious", it is simply not taken on or investigated at all. He stated that the phrase "frivolous or vexatious" was not intended to be insulting - it simply conveyed a particular legal meaning that a case was not worth taking on as no possible breach of the Acts could be identified. He pointed out that it was this rejection of a complaint as "frivolous or vexatious" that concerned the Court in the instant case and that the question for consideration by the Court was whether the opinion of the DPC that a case was not worth taking on was capable of being appealed under the Acts. The President intervened and questioned whether such an opinion could be subject to Judicial Review. Counsel responded by confirming that as the DPC is a public body, judicial review remained available.

2.

3.

4.

5.

Courisel then proceeded to give a brief outline of the facts of the case. He outlined that the Appellant in this case appeared to be involved in a dispute \vith Trinity College Dublin ("TCD") concerning disciplinary proceedings taken against him by TeD. As patt of that dispute a medical examination appeared to have been performed on the Appellant, who appeared unhappy with the manner in which that examination had been obtained and the way in which the medical information obtained had been passed on by the Junior Dean of TCD to other members of TeD staff. Counsel stated that the Appellant was alleging that these actions amounted to breaches of his constitutional fights and his right to natural justice and, further, amounted to criminal actions in breach of the Public Order Acts. Counsel argued that the DPC had no role in investigating these matters and could not have any involvement in that dispute. If the Appellant wished to challenge the procedures followed by TCD as having been unfair or unlawful, this was a separate dispute bet\veen the Appellant and TCD - it had nothing to do with the Respondent.

D!\T001-0051-1126825-2

6.

Counsel continued by pointing out that what was involved here was simply an internal dispute within TCD. The information disclosed was only disclosed via internal communications between staff within TCD, which is a single data controller for the purposes of the Acts. He stated that this was different to a situation where information is passed to the world at large and, as such, did not give rise to a breach of the Acts. Counsel concluded his outline of the facts by reiterating that the dispute involved here did not involve issues of data protection.

7.

Reliefs Sought 8. Counsel outlined that the Appellant here was seeking two reliefs, namely: (i) (ii) To appeal the refusal of the DPC to investigate his complaint; and The removal of the DPC from office for failure to carry out his duties. Counsel stated that it was not open to the Court to the Appellant to seek the second reliefsought.

Affidavit 9. Counsel proceeded to examine the Affidavit grounding the Appellant's Notice of Motion in some detail. He stated that the Affidavit outlined the Appellant's dispute with the Junior Dean in some detail, accusing the Junior Dean of attempted blackmail and deliberate leaking of sensitive personal data in order to deliberately damage the good name of the Appellant and his standing within TCD. The Affidavit further alleged that TCD had breached the criminal law. Finally, the Affidavit took issue with the fact that the DPC had not investigated the Appellant's complaint and stated that the DPC had a duty to do so. Counsel went on to examine the letters and emails exhibited to both the Affidavit and the original complaint before the DPC. He stated that it was clear from these docrunents that the dissemination of information involved here was internal, between staff members of TCD, in relation to the difficulties that have arisen with the Appellant. He stated that these communications also made reference to a disciplinary hearing within TCD in relation to the Appellant. Counsel pointed out that if the Appellant feels that the information was unfairly obtained or inappropriately disclosed, then the appropriate forllin to raise these grievances is at the hearing itself He concluded by stating that these materials confirmed the DPC's decision that there was no breach of the Acts involved here as the Appellant's complaint concerned internal communications between a single data controller in relation to an internal disciplinary procedure, and that these were not matters of data protection law. Commissioner

10.

Nowak v. Data Protection 11.

Counsel drew the Court's attention to a letter sent by the DPC to the Appellant on receipt of his Notice of Motion attempting to appeal the DPC refusal to

D:\T001-0051-1126825-Z

investigate his complaint. He stated that this letter informed the Appellant that a refusal by the DPC to investigate a complaint on the grounds that it is frivolous or vexatious is not capable of appeal pursuant to the Acts in light of a recent HC decision of Birmingham J in the case of Nowak v. Data Protection Commissioner. 12. Counsel set out the finding in the Nowak Case that the jurisdiction to hear an appeal is only against a decision that has been arrived at has been an investigation. He stated that this issue was fully argued HC, with legal teams on both sides and involving consideration of Directive. of the CC after there before the the parent

13.

Counsel stated that while the Appellant may disagree with the decision of the HC in the Nowak Case, the rules of precedent dictate that neither the CC nor the HC could assist him by overturning the decision made in the Nowak Case. The President intervened and stated that the situation appeared akin to that pertaining under the Rent Restrictions Acts, in that there must be a determination before a right of appeal can arise. Counsel agreed with this assessment.

14.

Electronic Privacy Regulations 15. Counsel pointed out that the Appellant's complaint was also grounded on the provisions of the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.l. No. 336 of 2011). Therefore; for completeness, he stated that these Regulations contain identical appeal provisions to those outlined in the Data Protection Acts. Moreover, he pointed out that these Regulations are aimed at mobile phone companies and those involved in the telecommunications industry.

Submission By The Appellant 16. The Appellant handed a copy of written submissions into the court. I The Court invited him to read from these submissions. The essence of these submissions was to the effect that the High Court judgment in the Nowak Case was a miscarriage of justice, denying individuals their right of appeal under the Acts and further amounted to an appalling waste of public funds. He stated that he was seeking that the CC determine his appeal, as his complaint concerned serious breaches of the Data Protection Acts and the criminal law.

17.

JUDGMENT

DELIVERED BY HIS HONOUR JUDGE MATTHEW DEERY, THE PRESIDENT OF THE CIRCUIT COURT

A copy of these submissions is now included in the office file in relation to these proceedIngs.

DATOOI-0051-1126825-2

18.

The President commenced his decision by stating that the procedure envisaged under the Data Protection Acts 1988 and 2003 was that it is only where complaints are made, duly investigated, and a decision reached on foot of that investigation, that an appeal to the CC arises. The President went on to state that in some cases, complaints were not investigated as they were deemed frivolous or vexatious. He stated that this was provided for under the Acts, which set out that the DPC was not required to investigate complaints where he was the view that no breach of the Acts was involved. He went on to point out that it was clear that that was what was involved in t.lJ.e instant case, as the complaint related to internal communications between staff in TCD, yet the Appellant had proceeded to bring an appeal to the CC. Next, the President referred to the Nowak Case, and stated that the HC in this case had affirmed the view taken by the CC that it was not open to a complainant to appeal a refusal by the DPC to investigate a complaint, having formed the opinion that the complaint is one that is frivolous or vexatious. The President stated that the Appellant had other potential avenues open to him to review the finding of the DPC that his complaint was one without merit, but that the avenue of appeal sought in this case fell within the confines ofthe HC decision in Nowak. Accordingly, the appeal was dismissed. In circumstances where the Appellant indicated that he would not be accepting the Court's ruling but would be appealing to the High Court, Counsel for the Commissioner sought an order for costs. (Note: the Appellant asserted that the Nowak judgment is to be appealed to the Supreme Court). An Order for Costs was awarded made in favour of the Commissioner on the basis of the standard lUle that costs follow the event.

19.

20.

21.

22. 23.

DATOOl-0051-1126825-2

AN CHUIRT CHUARDA THE CIRCUIT COURT

Record No 2011/00239

MIDLAND CIRCUIT

COUNTY OF LONGFORD

IN THE MATTER OF THE DATA PROTECTION ACTS 1988AND 2003 IN THE MATTER OF AN APPEAL PURSUANT TO SECTION 26 OF THE DATA PROTECTION ACTS 1988AND 2003

Between:-

Appellant

-and-

DATA PROTECTION
(substituted by Order of]udge

COMMISSIONER
Hunt made on 31"'January 2012 Respondent

Note of the Judgment delivered by His Honour Judge Tony Hunt on the 2nd day of May 2012

1.

Judge Hunt commenced his judgment by stating that although Counsel for the Appellant had attempted to suggest othenvise, he was satisfied that the decision made by the Data Protection Commissioner in this case was purely in relation to the Appellant's complaint concerning the disclosure of his personal data by Dermot Kehoe Supply and DIY Limited (I<':ehoe).

2.

Judge Hunt summarised the facts of the matter in the following terms; The Appellant's complaint to the Data Protection Commissioner arose out of an accident that the Appellant had been involved in August 2007 on Kehoe's premises that was captured on CCTV;
III

The Appellant's employer requested and obtained a copy of the CCTV capturing the incident from Kehoe, which was then passed on to their

DAT001-0047-1124155,1

insurer (Tudge Hunt commented that it appeared that the lnsurer were part of the Quinn group.) 3. Judge Hunt then gave judgment in the following terms:
11II

In his view, the complaint raised in relation to the disclosure by Kehoe and suggesting that the Appellant's consent ought to have been obtained and that the he ought to have been provided with a copy of his personal data at this stage had some merit as a matter of fairness; Ho\vever, as a matter of law, the decision of the Data Protection Commissioner was correct, so far as it related to the actions of Kehoe; He stated that Kehoe ,vas entitled to maintain CCTV on his premises under the provisions of sections 2 and 2D of the Data Protection Acts. He weht on to state that Kehoe was entitled to disclose personal data captured on such CCTV once it fell ,vithin one of the legitimising conditions set out under section 2A of the Acts. He pointed out that one of these permitted disclosure of personal data to a third party who had a legitimate interest in receiving that data. He stated that the disclosure of the CCTV footage in question in this case to the Appellant's employer was clearly necessary in order to enable them to defend any subsequent personal injury claim brought by the Appellant. Judge Hunt commented that, as a by product of that disclosure, CCTV footage of the incident was preserved, which might otherwise have been lost. Therefore, he stated that this disclosure did not prejudice, but actually served the legitimate interests of the Appellant; Judge Hunt went on to comment that the facts of the case highlighted an apparent gap in the legislation, as the CCTV ought to have been disclosed to both parties as a matter of fairness. However, he stated that there was no statutory basis for the complaints made by counsel on behalf of the Appellant and that, accordingly, there was a clear statutory basis for the decision of the Commissioner;

III

Judge Hunt then observed that the decision of Birmingham J in Nowak v. Data Protection Commissioner had set an extremely high standard for setting aside a decision of the Commissioner. He commented that while he would disagree with some of tlle findings of the Commissioner in this case, (namely, that Kehoe may have thought that the Appellant had consented to tlle disclosure of the eCTV to his employer), this was not sufficient to set aside tlle decision of the Commissioner in this case, as any error fell far short of tlle magnitude required by the Nowak decision. He then reiterated that there were legitimate reasons for the disclosure in any event; The appeal was therefore dismissed.

4.

Prior to any application for costs being made, Judge Hunt went on to comment on the conduct of the Quinn Group in tlus case and how they dealt with the Appellant, wluch he stated had been "far from satisfactory." He stated tllat it was
- 2-

beyond belief that they could have asserted a claim of privilege over the CCTV footage in question and refused to provide the Appellant with a copy. He observed that it reflected poorly on the advisors of the Quinn Group and that he hoped the situation had changed since there had been a change of management. He concluded by stating that as a result of dus poor handling of the Appellant, he \vould not be awarding any costs against the Appellant in this case. 5. It was pointed out to Judge Hunt that the appeal in this case related to the Data Protection Conun1ssioner and was not in any way related to the actions of the Quinn Group. It was further pointed out that it was the actions of the Conun1ssioner wruch actually secured a copy of the CCTV footage for the Appellant from the Quinn Group. However, the Judge responded that Data Protection Commissioner was simply performing a statutory function in tlUs regard and that there was no suggestion that the Appellant was anything but entitled to bring the complaint he made. He concluded that if a sinUlar case arose again, however, he would be minded to award costs against an Appellant in light of trus decision.

D.t\:TOOI-0047-1124155-1

3-

Note of}udgment
Client: Date: Data Protection CommissionerTuesday 16 November 2010 (Hearing commenced at 11.15 am and judgment was given at 3.10 pm) Case: v - Data Protection Commissioner ourt Record No. 2010/008035) Trial of Statutory Appeal pursuant to Section 26 of the Data Protection Acts 1988 and 2003/ Hearing of Respondent's Notice of Motion to dismiss appeal Circuit Court NO.22 before Judge Linnane

Matter:

Court: Attendees: Counsel:

(DPC);

(PLS)

Paul Anthony McDermott BL for the Data Protection Commissioner; Promsias O'Maolchalain BL (insuucted by Peter Connolly Solicitors) for

1.

Judge Linnane commenced her judgment by stating that the first question which the Court had to consider was whether it had jurisdiction to entertain the appeal.

2.

She then quoted Section 10(1)(b)(i) and Section 26(1)(d) of the Data Protection Acts 1988 and 2003.

3.

Judge Linnane summarised the facts of the matter the following terms:

and the reliefs sought

in

The Appellant made a complaint to the Data Protection Commissioner on 1 July 2010 and 14 July 2010 regarding his accountancy exam; In a letter of reply by the Data Protection Commissioner of 21 July and again on 11 August 2010, the Data Protection Commissioner made it clear that he was not imrestigating the complaints and cited Section 10(1)(b) (i) of the Data Protection Act;
III

The Data Protection Conunissioner indicated that the complaint was frivolous and vexatious and having examined tile materials submitted was of the view that tile exam scripts of the Appellant were not personal data

D /\T001-0037 -792293-1

-I -

within the meaning of the Acts and was not obliged to investigate circumstances where no breach of the Acts could be identified;

111

The Data Protection Commissioner's view is that no decision was made which could be the subject matter of an appeal to this Court under Section 26 of the Acts and that only a decision follO\ving an investigation which had been conducted can be appealed; On behalf of the Appellant it had been argued that the Data Protection Commissioner's finding that the complaint was vexatious or frivolous, was a decision giving a right of appeal. The notice of appeal seeks a declaration, amongst others, that the complaints were neither frivolous nor vexatious and that exam scripts are personal data. On this basis the Appellant was clainUng that he is entitled to a copy of his exam scripts; and
III

There was also a cross appeal by the Data Protection Commissioner which argued that the Court has no jurisdiction to entertain an appeal but in the alternative that if the Court does entertain such an appeal, it should be dismissed.

4.

Judge Linnane then gave judgment

Ii

in the following terms:

In her view the reference to an appeal in Section 10(1}(b)(ii) envisages an appeal to this Court under Section 26 where the Data Protection Commissioner has conducted an investigation following a complaint and has made a decision. This does not apply where the Data Protection Commissioner has not carried out an investigation because of a:complaint being frivolous or vexatious; It was open to the Appellant to bring judicial review proceedings; Even if the Court is wrong on the jurisdiction point and the Court does have jurisdiction to hear the appeal, in her view the Data Protection Commissioner's finding that the complaint was frivolous and vexatious and unsustainable was reasonable and was not erroneous and should not be set aside; The Appellant's exam scripts are not personal data "vitlUn the meaning of Section 1 of the Data Protection Acts. Therefore there was no breach of the Acts and the Appellant was not entitled to copies of his exam scripts; and

!II

The appeal was therefore dismissed.

5.

Paul Anthony McDermott BL then made an application seeking the costs of the Data Protection Commissioner on the basis that costs should follow the

D/,TOOI-0037-792293-1

-2-

event and referred to S.L 374/ 1999 Circuit Court Rules (No.2) (Data Protection Act 1988) (a copy of which was handed into Court).

6.

Counsel for the Appellant opposed the application for costs and pointed to the decision letter of the Respondent (of 21 July 2010) being "less than clear in its phraseology". He claimed that the letter was ambiguous and that the point of law which had been considered by the Court today was a matter of considerable public importance. On that basis he sought that no costs order be made.

7.

Judge Linnane stated that in its earlier response of 29 June 2010, the Data Protection Commissioner had made it nystal clear to ti1e Appellant that there was no prima facie basis for considering tint the Appellant did not receive copies of his personal data.

8.

As further grounds for opposing Appellant submitted that:

II

the application

for costs, Counsel for the

ultimately that the Appellant would be appealing this judgment and in this regard the decision of the Data Protection Commissioner could be considered something akin to the decision of a District Court Judge; and it had not been necessaty for the Respondent to participate in this appeal and Chartered Accountants Ireland could have participated in the appeal. It was unusual practice that the Data Protection Commissioner had participated in the appeal and on that basis he asked that the Court exercise its discretion not to make an order as to costs.

9.

Judge Linnane responded that costs should follow the cause in this case. She commented that the Data Protection Commissioner had had to spend a lot of time on this file and there was no reason not to have a costs order made. She dismissed the appeal for the reasons already given and made an order for costs in favour of the Data Protection Commissioner to be taxed in default. Counsel for the Appellant ti1en sought a stay on the Court's ord~r pending an appeal and indicated that judicial review proceedings \vould be taken. Judge Linnane enquired as to who such judicial review proceedings would be taken against. Counsel for the Appellant responded that it seemed that the Appellant was now being corralled into judicial review proceedings by the Respondent. The Judge commented that this was not the case. Counsel for the Appellant said that the Appellant might have to judicially re\>Jew the Data Protection Commissioner's decision, this decision and the decision of Chartered Accountants Ireland. Judge Linnane pointed out that on that basis the Appellant might have three sets of proceedings. Counsel responded that ti1e Appellant would have to decide whether it was going to make an appeal to the High Court on a question of law.

10.

DA.TOOI-0037-792293-1

-3-

11.

Counsel for the Data Protection Commissioner stated that if the Court grants a stay on its order the only logical stay would be a stay on the costs order pending an appeal against Judge Linnane's decision. Counsel for the Data Protection Commissioner stated that the Court could not stay costs on the basis of any other actions which might or might not be taken. Judge Linnane agreed and granted a stay on the costs order pending an appeal of the decision of this Court. She directed that if the Appellant was going to prosecute an appeal, he should do so quickly.

12.

D{\TOOl~0037~792293-1

- 4-

"f

THE CIRCUIT COURT

RECORD NO: 1316/2011
BETWEEN

BUS ATHA CLIATH/DUBLIN

BUS

APPELLANT
AND

DATA PROTECTION

COMMISSIONER

RESPONDENT
Judgment of Her Honour Judge Jacqueline Linnane delivered this day of July, 2011
This is an appeal by Dublin Bus (DB) under s. 26 of the Data Protection Acts (DPA) 1998-2003 against a decision of the Data Protection Commissioner investigation (DPC) made on 25th January, 2011 following an Notice regarding the failure by

fit...

to issue an Enforcement

Dublin Bus to comply with an access request made by a Data Subject (Mrs. in relation to CCTV footage which it held and had

recorded on a bus on which the Data Subject was travelling in October,

2008.
The background here is as follows: The Data Subject was travelling on a bus on 3rd October, 2008 and she claims that she fell down the steps of the bus while going upstairs. An application to PIAB was made on 19th October, 2009 which was required before the institution of any proceedings for personal injury.

Dublin Bus was informed of such an application and following a request by her solicitor, Dublin Bus ananged for her solicitor to view the CCTV

footage on 29th January, 2010. This was followed up by an access request from the Data Subject received on lill February, 2010 and the response ofCIE Group Investigation Department on 16th February, 2010 was that all documents and records in the office are prepared in contemplation of litigation and their files fall within legal professional privilege. Her solicitor then made a complaint to the DPC on her behalf on 13th April, 2010 and the DPC investigated the matter. The response of Dublin Bus to the DPC on 31 st May, 2010 was that an application had been made to PlAB and that the CCTV footage was preserved/downloaded solely for the purpose of the defence of any litigation arising ftom the incident which had taken place on its bus on 3rd October, 2008 and accordingly was privileged even if no proceedings had been issued at that stage. A Plenary Summons was issued on behalf of the Data Subject against DB on 23rd June, 2010 and a Defence was delivered on 1st October, 2010. By letter of 14th April, 2011 Mrs. oHcitor sought discovery from DB of various documents, including the CCTV footage in question, It is not disputed that the CCTV footage would come within an application for discovery of documents in the litigation. It was also not disputed by DB in the course of the investigation ofthe complaint by the DPe that the CCTV footage constituted personal data within the meaning of the DP Acts. In this regard s.l (1) defines "personal data" as meaning data relating to a living individual who is or can be identified either from the data or from the data in conjunction with other information that is in, or is likely to come into, the possession of the data controller. Moreover Kelleher's book on Privacy and Data Protection Law in Ireland at pp. 146 and 147 would confirm this wherein reference is made to the view of the Article 26 Working Party and the case of Campbell v, lvIGN 2002 EWHC 499 - at para 8.50 of Kelleher's book it states:
2

"Only if a controller cannot identify an individual caught on CCTVand it is not likely that he will come into possession of information that would enable him to make that identification can it be said that data derived from the CCTV is not personal data. " The DPC took into account the argument advanced by DB before making his decision- namely the question of privilege, the clear intention by virtue of the application to PlAB of bringing a personal injuries action by the Data Subject and the subsequent issuing of a Plenary Summons and that the Data Subject was trying to usurp the function of the Court by obtaining documents for the purpose of her litigation through the DPA when this should more appropriately be dealt with by the Court. These are the grounds set out in the Affidavit supporting the Notice of Appeal but Dublin Bus sought to broaden the grounds of its appeal before this Court and this Court ruled that as Dublin Bus is claiming that the decision of the DPC was wrong, it was confined to the grounds it advanced to the DPC during the course of his investigation and before the DPC made its decision resulting in the Enforcement Notice which issued. The Enforcement Notice was issued as the DPC decided that Dublin Bus was in contravention of s. 4(1) of the Acts in failing to comply with an access request made by the Data Subject. The DP A were enacted to give effect to Directive 95/46/EC and the primary purpose was to protect fundamental rights- being the right to privacy regarding the processing of personal data and to check the accuracy of one's personal data held by others. Section 4 deals with the right of an individual to access to personal data processed by a data controller relating to the individual. However, s.s. 9 of s. 4 provides that the obligations imposed by S.s. (l)(a)(iii) inserted by the Act of2003 of this section shall be complied with by

supplying the Data Subject with a copy ofthe information concerned in permanent form unless (a) The supply of such a copy is not possible or would involve disproportionate effort, or (b) The Data Subject agrees otherwise.

This provision does not apply in this instance and no argument has been advanced that it does. Accordingly Counsel for the DPC argues that the Durant case hereinafter referred to and UPOll which Dublin Bus relies is irrelevant as the UK Data Protection Act of 1998 gives the Court discretion as to whether to direct access to such data. Section 5(1) provides certain exceptions to the right of access given in s. 4 in that it does not apply inter alia to personal data (g) in respect of which a claim of privilege could be maintained in proceedings in a court in relation to communications between a client and his professional legal advisers or between those advisers. Counsel for the DPC argues that DB by allowing an inspection of the CCTV footage to the data subject/her solicitor thereby waived any privilege it claimed and in addition even if it was not waived DB does not corne within the exception provided at s. 5(1)(g) referred to above. Mr. n behalf of DB argues that the CCTV footage is a document for discovery, it exists in anticipation of litigation and was prepared with a view to communicating with him (although not yet communicated or transmitted to him) and that as the Data Subject's request is tied in with her litigation if this Court finds in favour of the DPC the whole concept of litigation will change and it will constitute an interference by the DPC with the role of the court in dealing with litigation, and that the High Court by reason of the litigation has seisen.

Counsel for the DPC makes the point that there is no provision in the DPA which precludes a Data Subject from exercising their right to

access personal data thereunder to which they are entitled to because they are litigating before the Court. In relation to the Durant case relied upon by DB, Counsel for the DPC points out there is a distinction between the legislation here and the English legislation, which in respect of the latter applies a test 0treasonableness and gives the Court a statutory discretion

as to whether to direct access to such data. In the case of Durant v. Financial Services Authority 2003 EWCA Civ 174 Mr. Durant sought information relating to an investigation by the

Financial Services Authority (FSA) of his complaints against Barclays Banle He sought disclosure of information he claimed to be personal data relating to him held by the FSA under s. 7 of the Data Protection Act, 1998. He had been provided with some disclosure but sought more. He had litigated against Barclays but this had been dismissed in 1993. He made his requests in 2001. As stated he obtained disclosure of some information but his further requests for information held on manual files were refused on the basis that it was not personal data as defined by the Act. As the judgment indicates he did not get to first base in his claim

against the FSA. In the Court of Appeal Auld LJ stated:-

"It is information about his complaints and the objects of them, Barclays Bank and the FSA respectively. His claim is a misguided attempt to use the machinery of the Act as a proxy for third party discovery with a view to litigation or further investigation, an exercise, moreover, seemingly unrestricted by considerations of relevance. "
In addition s. 7(9) of that Act gives the Court discretion as to whether to grant an order for access under that section.

With regard to the other case relied upon by Counsel for Dublin Bus- Ezsias v. The Welsh Ministers 2007 EWHC B15 QB. In that case Mr. Ezsias brought tribunal proceedings against his fanner employer, the NHS Trust, claiming unfair dismissal. During the course of that case he

made a number of access requests for documents from the National Assembly of Wales. Some documents were released but others were

withheld. It was clear his access requests were tied to and were to be employed for his separate ongoing legal proceedings and to assist him in same. At the time judgment was given he had sought disclosure of the

same documents in the course of his tribunal proceedings and these would be available to him in those proceedings. An enormous amount of

documents had been generated related to his complaints, not to him. It was held that the information generated by the complaint was not

personal data as defined by the Act. Mr. Ezsias also had complained to the Ombudsman about the manner in which the National Assembly

responded to his complaints. In referring to the Durant case Hickinbottom judgment J. in his lengthy

states that the information generated by these complaints is no

more Mr. Ezsias's personal data than the information generated by the complaints made by Mr. Durant and access to that material could not possibly be necessary for or even relevant to any protection of the complainer's privacy. Paragraph 66 "The purpose of the Act is to protect

that privacy. To use the provisions of the Act to seek disclosure of documents generated as the result of the applicant's own complaint, in order tofurther a legal claim of the applicant against a third party is a legal abuse. "
It is clear therefore that the decisions reached in the above cases held that the information sought was not personal data as defined by the

Act and that the legislation in the UK gives the court discretion as to

whether to order access. Furthermore, Counsel for the DPC makes the point that there are no exemptions from the right of access where civil legal proceedings are contemplated or ongoing. This mirrors a document entitled "Data Protection Technical Guidance- subject access requests and legal proceedings" issued by the Information Commissioner's Office in the UK. It goes on to state that in practice, subject access rights are often used by individuals who are in dispute with the data controller. "In many cases, they may intend to begin or have already begun legal proceedings against the data controller and see s. 7 as a way of obtaining additional information to assist in such proceedings. It has been suggested that recent case law, and in particular Durant v. FSA 2003 EWCA Civ 1746, provides authorityfor data controllers to refuse to comply with a subject access request where the applicant is contemplating or has already begun legal proceedings. The Commissioner does not accept this proposition. He takes the view that failing to comply with a subject access request in such circumstances will, unless an exemption under the Act applies, amount to a breach of the Sixth Data Protection principle. The right of subject access is one of the cornerstones of Data Protection legislation. If a data controller were able to avoid complying with a subject access request in circumstances where the data subject was contemplating or had begun legal proceedings it would seriously undermine thisfundamental right. However the courts do have discretion as to whether to grant an order under s. 7 (9) and may be reluctant to exercise that discretion where it is clear that the purpose of the request is to fuel separate legal proceedings and, importantly, where the discovery
7

rules under the Civil Procedure Rules would provide a more appropriate route to obtaining the information sought. " In summary therefore it is clear in this case DB does not come within the privilege exception provided for in Section 5(1)(g)of the DP A and the U.K. DPA of 1998 is distinct from our legislation in that it confers a discretion on the Court as to whether to grant an order for access. Accordingly, in ail the circumstances here I am dismissing this appeal.

~c~v.-a(~
(LCAJ~

THE HIGH COURT

201072 C/\

Tuesday the 15th day of February 20 II BEFORE MR JUSTICE HEDIGAN BETWEEN

DATA PROTECTION COMMISSIONER

APKLLANT
AND

RESPONDENT

THE HEALTH SIRVICE EXECUTIVE NOTICE PARTY

'Yhe Appeal on behalf of the Apellant herein from the Order of the Circuit Judge fonlle County of Galway dated the 261h day of March 2010 coming

on for hearing

011

this day on Notice dated the 6th day of April 20 I0

Whereupon and on reading the said Notice the said Order ofthe Circuit Court Judge the Pleadings and exhibits herein and on hearing Counsel for
the Appelant and Counsel for the Respondent

And IT Appearing that a settlement has been reached herein By consent the Court doth vacate (i) the said Order ufthe 261h day of March 2010 and (ii) the Order for costs in favour ofthc Respondent herein made on the said date And IT IS ORDERED that the Decision of the Data Commissioner
elated the 2
lld

day of Novem bel' 2009 be and is hereby am rmed T. Kennington

REGISTRAR

16th February 201 1

Eoin O'Connell & Co,

Solicitors for the Plaintiff

Branigan Cosgrove Finnegan

Solicitors for the Defcnd<:111t

THE CIRCUIT COURT Record No THE WESTERN CIRCUIT COUNTY OF GALWAY

IN THE MATTER OF THE DATA PROTECTION ACT 1988-2003 AND IN THE MATTER OF AN APPEAL PURSUANT TO S 26 OF THE

ACT
Between:-

Appellant
-and-

THE DATA PROTECTION

COMMISSIONER Respondent

- and-

THE HEALTH SERVICE EXECUTIVE Notice Party

Ex Tempore Judgment of Groarke J delivered on 26 March 2010 at Galway Circuit Court

1) It is necessary to view the circumstances under which the HSE carne into possession of the relevant documents. It was through its employment of doctors, hospital administrators and others. Hospital employees (especially doctors) have legal obligations to maintain the confidentiality attaching to documents related to patients and their treatment. The law has always recognised that such documents are in

a special category, in that medical privilege applied to them. They were prepared on the basis of the patient's consent, and that the law has always protected and defended the special status of such documents. The HSE was in possession of the documents only because it employed the doctor. The HSE could not assume a waiver of privilege - which could only come from the patient - even if it was sued. Rather, the documents are held by the HSE for and on behalf of the patient. 2) Where litigation has begun whereby a claimant has to release all relevant documents to a defendant. This is the law used in all such cases. 3) The 1988 Act was enacted because of the ED Directive, and that the ED in its wisdom provides that data ought to be available to others and specified the circumstances for this. It is also reasonable that the Acts also specify circumstances in which information/data should not be made freely available. 4) Section 2A, deals with personal data, and section 2B, deals with sensitive personal data. The Acts recognised differences between these two categories of data for good and historical reasons. 5) If the DPC was correct in his view, then there would be no difference between the two categories of data. This was not the intention of the Acts and it would be demeaning and unfair if the DPC was correct. Personal data is dealt with under the Acts in one way, and sensitive personal data is dealt with in a different way. The qualifying criteria for releasing the data were dealt with under sections 2A and 2B. 6) The data here does not come in under 2A. 7) The DPC says that section 8 is a catch-all proVISIOnbecause, as argued by the DPC, it deals with all personal data. The DPC says that there is no difference between personal data and sensitive personal data. That is poppycock. What would be the point of identifying sensitive personal data as a special category if it was caught under the catch-all in section 8? Section 8 is not a catch-all provision.

8) Even if section 8 did apply, the relevant proviSIOn (section 8() referred to processing which was "required" for obtaining legal advice, etc. This was a mandatory requirement, and was not the same thing as processing which was essential or necessarily essential nor did it fall within the terms used by the HSE to justify disclosure of the data. There was no proof that the disclosure in this case was "required", It was not enough to show that the disclosure was useD_'ll or necessary. The HSE could have obtained the information by ordinary legallueasures. 9) The DPC's decision was retrospective in that it was viewing matters in the light of what had gone before (i.e. in respect of disclosures which had already taken -place) and it was giving a retrospective decision that everything was in order. The decision may have been different if it was not retrospective. 10) The manner in which the HSE had obtained the information was an abuse of process, in that it transferred the documents from patient files to lawyers, and not (for example) to other doctors. The information was sacrosanct and was not to be released to just anyone. I cannot understand why the HSE did not follow normal procedures. 11) In relation to the DPC's investigation, and his reliance on assurances from the HSE's solicitors, this was not the proper way for the matter to have been dealt with. The DPC is in a more serious position, and is required to ma1cea decision. Rather, however, in this case, the DPC effectively delegated his powers to the HSE's solicitors, and he said that this was very serious from the point of view of the citizen. 12) I allow the appeal, set aside the decision and award the Appellant her costs against the DPC.

Note of Ex-Tempore

Judgment

of Linnane,

J (delivered

on 12 February 2010)

Mayo VEC v Data Protection Circuit Court Record No.

Commissioner

00138/2008

Summary: Judge Linnane allowed the Appeal and set aside the Enforcement Notice dated 9 October 2009 on the basis that the Appellant was entitled to rely on section S(l)(f) of the Data Protection Acts, 1988 - 2003 to refuse access to a medical report obtained by it in relation to a Mrs_ Note of order outlined below. Judgment I of Linnane

J:

This is an appeal under section 26 of the Data Protection Acts (the DP A) from a decision made by the Data Protection Commissioner (the DPC) whereby he held neither sections 5(1)(f) or (5)(1)(g) of the DPA applied and the Appellant, (the VEC), as data controller was obliged to provide the Data Subject, Mrs_\vith a copy of a medical report it had obtained on Mrs~'hich was sent to the VEC via its solicitors. This was followed up by an Enforcement Notice. Earlier, in a letter of 26 June 2009, and again by letter dated 6 August 2009, regarding the exemptions provided by section 5(1)(g), the DPC contended tllat the medical report was not exempt under the DPA by legal professional privilege, as only the accompanying docwnents created between the client and the legal adviser in connection to tllis medical report are covered by legal professional privilege and not the medical report. The view of the DPC's office was that medical reports do not qualify for legal privilege regardless of when or for what purpose they were created. The reason given by the DPC as to why he contended the medical report was not exempt under s5(1)(f) of the DPA Acts is set out in the letter dated 1 September 2009, the reason being that it was highly unlikely that a medical report makes any specific reference to a specific monetmy amount of possible liability. Section 4 (1) of the DPA gives individuals a right to access personal data at their request. The Enforcement Notice was issued under section lOaf the DP A because the DPC formed the view that the VEC was in contravention of section 4(1).
i\S

Counsel for the DPC in his submissions set out, the right of a person to access his personal data lies at the heart of Data Protection law. Sihce it is one of

DAT0010022-633585- 1

TIT

the most fundamental rights to know what personal data is being held in respect of them, people need to know whether the processing of their data is lawful. 7 Equally legal professional privilege is a fundamental human right protected by common law and courts are vigilant in preserving same. It was accepted by all sides that a medical report is personal data within the meaning of the DPA. The background follows:~ 9.1 to how the report came into being
IS

, . --

important and

IS

as

It was clear that this report was prepared in contemplation of litigation, already threatened and generated as result of the letter received from Mrs solicitors in that regard. By attending such a review, I\1.ts"would have had to understand the purpose for which the report was being created by Dr. _ The letter dated 4 April 2008 to Mr~solicitors makes this clear. Mrs_ater requested the medical report from the VEC's solicitors in 2008. When her request was not complied \vith, Mrs~rote to the "lEC by letter dated 19 March 2009 seeking a coPy of the report under the DPA. By letter dated 28 Match 2009, Mr~wrote to the DPC seeking assistance and as result of that letter, an investigation was commenced by the D Pc.

9.2

9.3

10

Whilst initially the VEC only claimed entitlement to refuse Mrs _ request on the basis of the exemption for legal professional privilege undetS3())(g) of the DP A. The VEC later claimed by letter dated 4 September 2009 that the report was also exempt on the basis of section 5 (1)(f) of the DPA. The VEC claimed it was entitled to refuse release of the report on the basis that the medical report in question falls within the exemptions provided by sections S(l)(g) and (f) of the DPA. It would appear that the proceedings threatened in the letter from Mrs_solicitors sent to the VEe in September 2007 have not yet materialised although a PlAB autllorisation has issued and so no doubt, proceedings will be issued shortly. Section S(l)(f) of the DPA is an exception to the right of access and provides that the right of access to personal data does not apply to personal data: '~'Otlsisting of an estimate of or kept for the pzoposes of estimating, the amount qlliabiliry of the data controller cOllcenzed on foot of a claim for the payment of a J"tim of mone)!, whether in respect oj damages or compellJ"atioll, in atry case in which the applicatiotl of the section wot/ld be likelY to prejudice the interests if the data controller in relation to the claim. "

11

12

DATODl-0022-63358S-1

-2-

13

The submission made on behalf of the DPC is that the medical report does not come \vithin this exception and even if it did, the release of the report does not prejudice the VEe. In his written submissions, counsel for the DPC refers to an extract from Kelleher, Privacy and Data Protection Law in Ireland regarding the intention of the section and quotes as follows: ""It would be of great interest to at!J' litigant or compensation claimant embroiled in a dispute with the data controller to have access to at!} injomJation relating to the lerN/ at which the controller would aHeJS itJ liabtii!)!. This prolJiJion allowJ,the data control fer to !YJJiJtJNch an accen request" (para 13.49). It is further submitted that merely asserting prejudice is not enough. The Data Controller must establish some real risk of prejudice, In my view, it would be apparent to anyone familiar with the litigation process, particularly in relation to the rules regarding tenders and lodgments of how that prejudice would arise. S5(1)(g) provides that the right of access to personal data does not apply in respect of data: <<.tn reJpect rif which a claim rifprivilege c014ldbe maintained in a court in relation to communicatiotlJ between a cliettt and his profinional legal adviJers or between thoJ'e legal adviser.r." In his submissions, Counsel for the DPC argues that a report is clearly not communicated between clients and its professional legal advisors or between those legal advisers as Dr~s not a legal adviser. Reliance is made by the VEC in regards to this exemption on f fact that it comes within the ambit of legal professional privilege, That is, it was a confidential communication made after litigation \vas actually threatened and was made between a la'"vyerand an expert and the dominant purpose of the communication was for litigation. The medical report was obtained for the VEC by its solicitors and sent to the VEC by its solicitors. The Appellant also submits that legal professional privilege can only be overridden by express statutory authority or by necessary implication.

.'-

14

15

16

17

18

Taking everything into account, my view is as follows:

19 The VEC is entitled to rely on the exemption in section 5(1)(1) of the DP A to refuse access to the report. The report was obtained for the purpose of evaluating IvIrs_claun and prejudice would arise to the VEC in relation to the threatened claim if it was furnished. I do not accept the argument made by the DPC that to come '"vithill the exemption, the report would have to make specific reference to a specific monetaq amount. That is not a function of a medical expert; that is for the legal advisor to do having considered the report. I do not accept the ,,'ie\vgiven by the DPC that medical reports do not qualify for legal privilege regardless of when and for what PU11Jose they were created.

20

21

D.c\ T001-0022-633585-1
o -.J -

22

This report was clearly obtained fro the VEe as a result of threatened personal injuries litigation by the Data Subject. It was furnished to the VEe by their solicitor. Clearly it was a document contained in a comlnunication between 'VEe and its solicitors. However, as I have found that the exemption under section 5(1)(f) applies, I do not have to expressly rule on section 5(1)(g) of the DPA.

23

The Formal Order to provide as follows: 1. Allow the appeal by the VEe and set aside the Enforcement Notice dated issued by the Respondent. 2. Costs to the VEC as against the Data Protection Commissioner to be taxed in default. 3. Stay on costs in the event of the appeal.

D ATOOI-0022-6335

85-1

-4-

Record No: 0979312007 AN CHUIRT CHUARDA

THE CIRCUIT COURT DUBLIN CIRCUIT COUNTY OF THE CITY OF DUBLIN

IN THE MATTER OF AN APPEAL PURSUANT TO SECTION THE DATA PROTECTION ACTS 1998 AND 2003

26 OF

Betwecn:SUNDAY NEWSPAPERS LIlVIITED Appellant

-and-

DATA PROTECTION

COMMISSIONER Respondent

Decision of Judge Linnane delivered on 15 April200S

This case came to the Circuit Court by way of an appeal pursuant to Section 26 of the Data Protection Acts, 1988 and 2003 (the "Acts~') which was brought by Sunday Newspapers against an Information Notice issued by the Data Protection Commissioner on 7 December 2007 pursuant to Section 12 of the Acts. The Appellant seeks an Order that they do not have to comply witll"the terms of the Information Notice.

Section 28 of the Acts provides that 'fthe, whole or any part of any proceedings under this Act may, at the discretion of the Court, be heard otherwise than in public", At the outset~it was agreed that this appeal could proceed in public but that the names and identities of the complainants would not be disclosed.
Section 12(1) of the Acts provides as follows:

"The Commissioner may, by notice in writing (referred to in this Act as an Information Notice served on a person) require the person to furnish to him in writing within such time as may be specified in the Notice such information in relation to matters specified in the Notice as is necessary or expedient for the performance by the Commissioner of his functions". In these proceedings~ the Information Notice provides, inter alia, that

"I, Billy Hawkes, the Data Protection Commissioner, in exercise of the powers conferred on me by section 12 of the Data Protection Acts 1988 and 2003, Hereby Give Notice, that I require you to furnish me in \:vriting, the foHowing information: state whether Sunday Newspapers Ltd had in its possession personal data relating to [the complainants] on the 11th September 2006~ being the date when an access request was made on their behalf by [the complainant's] solicitors to the editor of the Applicant. Furthermore, if the Appellant possesses such personal data, it must provide the Data Protection Commissioner with a copy of that personal data. This information is necessary or expedient for the perfonnance of my functions."
The background to the Information Notice is that the complainants believe

that the Appellant is in possession of data in respect of them and, on that

basis, their solicitors had made an access request under sA for information. The response of the Appellant basically was that if any data existed it was being processed for journalistic purposes. The Appellant cited Section 22A of the Act which provides for an exception in this regard. The complainants made a complaint to the Data Protection Commissioner. Section 10(1)(a) states that Hthe Commissioner may investigate, or cause to be investigated whether any of the provisions of this Act have been, are being or are likely to be contravened in relation to an individual either where the individual complains to hhn of a contravention of any of those provisions or he is otherwise of the opinion thai there may be such a

contravention" .

Section 10(1)(b) provides that where a complaint is made to the Commissioner he shall investigate it unless he is of the opinion that it is frivolous or vexatious. Correspondence then ensued between the Commissioner and the Appellant resulting in the Information Notice which is under appeaL The Appellant would neither confirm nor deny if it held any data in relation to the complainants and maintains that position whilst relying on Section 22A of the Acts. It says that it comes under s 22A and so does not have to comply with the Information Notice. The Data Protection Commissioner's position is that it has a statutory duty to investigate and cannot adjudicate without the information sought. In my view the Information Notice is to enable the Data Protection Commissioner to investigate the complaint. T can see no reason why the Information Notice is invalid in any respect and the reason that the information is required is self evident. The Data Protection Commissioner needs to know if the Appellant has any such data and needs to see it in order for the Commissioner before he makes a decision if the Section 22A exemption applies. It is for the Data Protection Commissioner to determine whether or not s 22A, relied on by the Appellant, applies to the data. Section 3 and Section 4 of the Acts are expressly covered by Section 22A but Sections 10 and 12 are not so included and therefore Section 22A cannot be invoked to prevent the Commissioner from exercising his statutory duty or from issuing the Information Notice. I dismiss the appeal and Order that the Appellant must comply with the Information Notice dated ih December within 21 days.

P~k\i~
Brendan Kirwan B.L. Paul A. McDermott B.L.

THE CIRCUIT

COURT

Record No 3452/08

DUBLIN CIRCUIT

COUNTY OF THE CITY Of DUBLIN

IN THE MATTER Of THE DATA PROTECTION ACTS 1988 & 20,03

Between:-

HOSPITALlER

ORDER Of ST JOHN OF GOD Appellant -and.,.

THE DATA PROTECTION

COMMISSIONER

Summary of judgment

of Linnane J. on 27 November 2008

Linnane J. allowed the appeal. Linnane J. ruled that the right of the data subject under section 6A(1) to request a data controller to cease processing personal data if that processing is causing substantialand unwarranted damage or distress to the data subject or another person is subject to the provisions of Section 6A(3) which sets out certain grounds where the right does not apply. Judge Linnane referred to Section 6A(3)(b)(iv) which provides that Section 6A(1) does not apply in circumstances where the processing of the data is necessary to protect the vital interests of the data subject. In this case Linnane J.accepted the arguments put forward by the Appellant and agreed that the continued processing of the data subject's personal data was necessary to protect her vital interests. Linnane J" went on to rule that, even she is incorrect in her finding on the vita! interests point, an error was made by the Data Protection Commissioner in finding that the distress caused to the data subject was unwarranted. She ruled that the Data Protection Commissioner had made an error, having carried out the necessary balancing exercise for determining whether the processing was unwarranted or nor, in finding that the rights of the data subject outweighed the legitimate interests of the Appellant. Linnane J. made an order allowing the appeal in the terms of the Appellant's Notice of Motion and stated that it followed that the Enforcement Notice and the draft decision of . the Data Protection Commissioner no longer had any effect. Linnane J. also granted liberty to apply if there were any problems with the order made. Costs were awarded to the Appellant.

CAK\1848606.2