Filed By: GIBSON & ASSOCIATESSOLICITORS38 ARRAN QUAYDUBLIN 7

Record No: 2011/02390

AN CHUIRT CHUARDA(fHE CIRCUIT COURT)

DUBLIN CIRCUITCOUNTY OF THE CITY OF DUBLIN

BEFORE JUDGE LINNANE

tliTHE 4 DAY OF May 2011IN THE MATTER OF SECTION 26 OF THE DATA PROTECTION ACTS 1988 TO

2003

BETWEEN

-AND-

The Office of the Data Protection Commissioner

APPLICANT

RESPONDENT

The Respondent having been duly served with the Notice of Motion on behalf of theApplicant dated the 10th day of March 2011 herein appealing the decision of theRespondent dated the 15th February 2011 WHEREUPON and on reading thedocuments f'LIedand on hearing Counsel for the Applicant and Counsel for theRespondent

THE COURT DOTH ORDER that the Applicant's Appeal be and the same is herebydismissed.

THE COURT DOTH ORDER that the Respondent do recover costs of the Applicationfrom the Applicant, such costs to be taxed in default of agreement.THE COURT DOTH FURTHER ORDER that execution for costs hereon be stayed fora period of ten days. In the event of an Appeal to the High Court:, such stay to continuepending determination of the appeal should same be lodged, the stay being granted onthe basis that the appeal is prosecuted without delay.

BY THE COURT

Order settled by RENA QUINNDraft Order settled on 04/0512011

-Court Attendance

Client:

Date:

Case:

Matter:

Court:

Data Protection Commissioner (DAT001/0044)

Wednesday 4 May 2011(Civil Motions List began @ 10.00 am and hearing commenced at12.05pm)

~ v - Data Protection Commissioner(Circuit Court Record No. 2011/02390)

Trial of preliminary issue on Jurisdiction of the Court to hear StatutoryAppeal pursuant to Section 26 of the Data Protection Acts 1988 and2003

Circuit Court No. 22 before Judge Jacqueline Linnane (Civil MotionsList)

Attendees:Protection Commissioner),Solicitors for the Appellant)

(Office of the Data(Gibson & Associates,

Counsel: Paul Anthony McDermott BL for the Data Protection Commissioner andAndrew Fergus BL for the Appellant

Decision of the Court

Judge Linnane gave judgment in the following terms:

"It was agreed betweeJ1the parties that the preliminary issue be decided first as to whether the Court hadjurisdiction to entertain this appeal.

It is quite ciear, in my vieJP,from Section 10(1 )(b)(ii) and Section 26(1)(d) of the Act that it is onlY aJ

a result of an investigation of a complaint and where the CommisJioner makes the decision thereto thatan appeal lies under Section 26 to the Circuit Court. If there is no investigation because theCommis.rioner is 0/ the opinion that the mmplaint is friJ)o!ous or IJexatious, which the Commissioner iJentitled to do under Section 10(1)(b)(i), there is no rigbt 0/ appeal to this Court aJ"no decision has beenmade jo!!02!Jingan itwestigatiotl. That is 11£JI ruling. "

Having heard further submissions from the parties, Judge Linnane then made an orderfor costs in favour of the Commissioner, costs to be taxed in default of agreement. (Inthe event of an appeal; theJudge directed a stay on executing the costs order).

D."'.'l'OOl-0044-865527 -1

THE PARTIES~ SUBMISSIONS

First Calling

Wben the case was frrst called in the Civil Motions List, Judge Linnane commented thatit should have been put into the Civil Hearings List and she wasn't sure why it had beenput into her Motions list.

Judge Linnance said that she had not seen any papers connected with this appeal yet.Counsel for the Data Protection Commissioner ("DPC") informed the Court thatsubmissions had already been exchanged and lodged with the Circuit Court offrce for thiscase. Judge Linnane said that she would not deal with it in the current Motions List butshe would see if she could take it in the Hearings List later on when she knew what hadbeen sent over from the President's list.

Both parties indicated to the Court that the matter would take around 20 minutes to hearbut Judge Linnane commented that it sounded like it would take longer than that.

Hearing

(aJ Submissions/or the Respondent

Counsel for the DPC agreed that it was appropriate that he should put his arguments tothe Court first as the issue currendy before the Court had been raised by the respondent.

Counsel for the DPC explained to the Court that there was a preliminary issue relating tothe jurisdiction of the Court to hear this appeal and in circumstances where the Courthad ah'eady made a similar decision on jurisdiction (in the Nowak case) it seemedprudent to have the preliminary issue determined separate to any full hearing of thematter. Counsel noted that if the DPC was successful on this point it would end theappeal and if not the appeal could then be dealt with on its merits.

Counsel for the DPC then took the Court through Section 10 of the Data ProtectionActs 1988 and 2003 (the "DP A") regarding the powers of the DPC to investigate and theprocedure to be followed under Section 10(1)(b) of the DPA when a complaint isreceived.

Counsel for the DPC explained the background to this matter i.e. that the appellant was asecurity guard at the National GallelY of Ireland, that he had made various complaintsconcerning his employers and that he appeared to be in dispute with them. Counselnoted the Court would see from the DPA that there is a mandatory obligation on theDPC to investigate a complaint unless the matter is considered to be frivolous orvexatious. Counsel submitted that in this regard the word "unless" in Section 10(1)(b) (i)of the DPA was important because it showed the DPC had discretion to look intosomething to see if it merited the tUne and resources of its offrce to spent on it.

On the issue of "frivolous and vexatious", Counsel noted that the Court ",,':illbe familiarwith that phrase and that lawyers in particular know that there are certain connotations

D AT001-0044-86 5527-1

flowing from it i.e. that a case has no chance of success. The phrase does not impunethe bone fides of the person concerned and while the phrase might sound insulting, all itmeans is that the person has not raised any point worth investigating.

Counsel for the DPC then referred to the word "and" in Section 10(1)(b)(i) as to whathappens if the complaint is investigated. If the complaint is not investigated that is theend of the matter. However if there is an investigation then there could be an amicableresolution but if that is not possible the DPC then makes a decision, which the aggrievedparty can then appeal to the Court.

Counsel then took the Court through Section 26 of the DP A and in particular theprovision relating to appeals (Section 26(1)(d». Counsel noted that there was noindependent def111itionof the word "decision". In order to see what the word means,you need to look at Section 10 i.e. the decision referred to in Section 26 is that made inthe context of the DPC having investigated a complaint and then made a formaldecision. Counsel for the DPC submitted that the DPA do not allow for an appeal wherethe complaint never gets out of the starting blocks.

Counsel went on to address whether this meant that a person has no redress incircumstances where it was not open to hun to take an appeal under the DPA. Counselnoted that in such a situation the remedy of judicial review was available as the DPC is apublic body. Consequently an aggrieved party is not left without a remedy - he just doesnot have a statutory right of appeal in such circumstances.

Counsel then referred the Court to its previous decision last year in the case of Nowak v.Data Protection Commissioner (Circuit Court Record No. 2010/008035) and to the casenote in the Court Booklet before the Court. Counsel explained the background to thiscase i.e. the appellant had failed his accountancy exams and wanted to see his examscripts. The appellant argued that his exam scripts constituted personal informationhowever the DPC had said that his complaint was frivolous and vexatious. Counsel thenspecifically referred the Court to its judgment in this case (recorded at paragraph 4 of thenote).

Counsel acknowledged that in the Nowak case, matters had been slightly different in thatthe Court had heard the entire appeal at the same time as determining the jurisdictionissue. On the facts, the Court had also agreed with the DPC's decision [that the examscripts in question did not constitute personal data] (which it had gone on to look at afterthe issue of jurisdiction). Counsel asked the Court to follow its earlier ruling. Heconfirmed (from his mvn knowledge and research) that he was not aware of anydevelopments (in the High Court) relating to the law in this area since this Court'sprevious judgment. Counsel also noted that, equally, Counsel for tlle appellant had notidentified any further such developments in this area.

(b) Submissions for the Appellant

Andrew Fergus BL, Counsel for the appellant, then addressed the court.

Counsel submitted that the DPC was substituting the word "decision" for «outcome ofinvestigation" however there was notlling in the DPA justifying the use of such a

Dt\ TOOI-0044-865527- J

synonym. The DPC had taken the decision to deem the appellant's complaint frivolousand vexatious but, Counsel submitted, you could not divide out various sub strata ofdecisions. He noted that Counsel for the respondent had urged a particularinterpretation of Section 10(1)(b)(i) and (ii). Counsel for the appellant was of the viewthat the phrase "unless he is of the opinion" in Section 10(1)(b)(i) only applies to thedecision to investigate the complaint further (or not) and it does not apply to the acts inSection 10(1)(b)(ii). Counsel further submitted that the word "and" is still in operation inrelation to the second part of Section lO(l)(b) of the legislation i.e. that the DPC muststill notify an individual of the outcome of the decision.

Counsel for the appellant highlighted that under sub-section (1)(b) of Section 10, theDPC must do three things:

L Attempt to amicably resolve the complaint;2. Notify the outcome of the complaint to the complainant; and3. Notify the complainant of the right of appeaL

Counsel then referred the Court to the European Directive 95/46/EEC and in particularArticle 28(4) of that Directive which requires that a person lodging a claim be informedof the outcome of that claim. He pointed out that in this article there was no referenceto whether or not a complaint has been investigated etc. However, because the DPAmust be consistent "vith the Directive, the DPA must be read as envisaging thecomplainant being informed of the outcome of the complaint and of their right toappeal.

Counsel for the appellant noted that the DPC has argued that under Section 10(1)(b)(i)of the DP A, if a complaint was deemed frivolous or vexatious then that was the end ofthe matter and effectively the DPC was saying that Section 10(1)(b)(ii) subsequently doesnot apply i.e. that there is no onus on the DPC's office to reply to a complainant.However such an interpretation is not consistent with the Directive because according tothe Directive the complainant must be informed of the outcome of his complaint.Counsel argued that from the wording of Section 10(1)(b) of the DPA it is clear that the"unless" clause in Section 10(1)(b)(i) applies only to a decision to undertake aninvestigation but the "and" step still applies regardless.

Counsel made the final point that Order 60 of the Rules of tlle Circuit Courts refers tostatutory appeals made under the DP A. The interpretation attributed to this nue by theauthor of the annotated consolidated Circuit Court Rules reflects a plain reading of thelegislation. Counsel referred to his written legal submission on this point. Additionally,Counsel submitted that none of the Data Protection texts books say that there should bea division between different types of decisions for the pUl}Josesof an appeal under tlleDPA.

Counsel also informed the Court that he had reviewed the Dail debates and had comeacross nothing in the debates relating to the 1988 and the 2003 Acts which indicated thatthe Oireachtas wanted sub-strata of decisions to apply to appeals. Instead the most likelyinterpretation was that any decision of the DPC is capable of appeal and that isconsistent with Article 28 of the Directive and the requirement of a com:plai.rtailtto benotified of the outcome of the complaint. According to Counsel, there was no indication

D ;\TOn 1-0044-8(, 5527-1

-on the face of the DPA that there should be different types of decision. Therefore even adecision by the DPC to dismiss a complaint \vas, in effect, a decision.

At this point Judge Linnane stated that the decision being referred in the DPA was adecision as a result of an investigation, was it not? Counsel replied that it was simply adecision of the DPC in relation tel a complaint. As a matter of logic, a decision to rejectthe complaint as frivolous and vexatious in and of itself must be a decision of the DPC.

(c) Replies by Counsel/or the Respondent

On the issue of the Directive, Counsel accepted that the Ditective says that acomplainant must be informed of the outcome of the complaint, but he submitted thatthis requirement merely reflects the existing principles of Irish public law. Counsel notedthat Ireland had implemented the Directive by way of the DP A and that Member Stateshave discretion as to how to implement a Directive. There was no claim put before theCourt in this case that Section lOaf the DPA had not been properly implemented inIreland.

Counsel continued by stating that Counsel for the appellant was concerned with what isthe plain meaning of the DPA. Counsel for the DPC stated that a decision wassomething which only happens after an investigation, othenvise it would make no sensebecause Section 10(1)(b)(ii) begins by saying there must be an attempt at an amicableresolution. Counsel stated that the purpose of Section 10 was to save the limited timeand resources of the DPC and equally to save the funited time and resources of theCircuit Court. He argued that it made no sense if the DPC could weed out complaintsbut the Court then had to hear appeals on such complaints which were weeded out.

In relation to the point made on the annotated consolidated Circuit Court Rules, Counselsubmitted that the author had only read the relevant section of the DPA and taken aview on them. She obviously did not have the benefit of the Nowak decision when doingso whereas he did.

A further point was made that if appeals of this nature were allowed under the DPA, itwould in fact, be hard to appeal against a non-event. There would be nothing for theCourt to get its teeth into because the DPC had not in such circumstances investigatedthe complaint in question and reached a formal decision on it.

Finally, Counsel for the DPC noted, for the purposes of laying everything before theCourt, that the Nowak decision had since been appealed to the High Court in that anotice of appeal had been served however, d1.eappellant in that case had done nothingfurther to progress his appeal at this point.

(d) Replies by Counselfor the Appellant

Counsel for the appellant stated that there was nothing suggesting that it was theintention of the Oireachtas to limit the appeal system under the DPA and nor that byintroducing the anucable resolution provision into Section 10 by way of the 2003 Actthat this would JiJ.nitthe appeal system allowed for under the original 1988 Act.

DXl'OOl-0044-865527-1

In relation to the assertion that the Oireachtas had implemented the Directive correctly,Counsel noted that Article 28(4) required that a person must be informed of the outcomeof an appeal so Section lOaf the DP A had to be consistent with article. There wasnothing in the DPA to suggest that different types of decision were available to the DPC.

Counsel again submitted that the plain meaning of the DP A arrives at the sameconclusion as the author of the annotated consolidated Circuit Court Rules.

Counsel also noted, [in relation to the point that judicial review was the approptiate legalremedy in such a case] that to seek to judicially review a decision completely blind wouldbe an unfair onus on the applicant.

Finally, in relation to the Nowak case, Counsel for the appellant said t..~athe had receiveda note of this judgment but the ratio decidendi was not set out in it. He therefore urgedthe Court to reach a different decision to that in the Nowak case.

Judgment

Judge Linnane then gave her judgment in the following terms:

'1t was agreed between the parties that the prefiminary issue be decidedfirJt aJ to whether the Court hadjuriJdiction to enterlain thiJ appeaL

It iJ quite clear, in my view, from Section 10(1)(b )(ii) and Section 26(1 )(d) oj the Act that it is onlY asa reJult oj an investigation oj a complaint and )JJherethe Commissioner makes the decision thereto thatan appeal !£eJ under Section 26 to the Circuit Court. If there is no imJeJ-tigatiolt because theCommissioner is oj the opinion that the complaint is frivolous or vexatiouJ, which the CommiJJioner isentitled to do under Section 10(I)(b)(i), there iJ no right oj appeal to this Court aJ no decision has beenmade fol/owing an inveJtigation. That is my rttling. "

Counsel for the DPC then applied for the costs of the DPC on the basis thit costsfollow the event. He also pointed out to the Court that the Nowak decision had alreadybeen brought to the attention of the appellant in this case and they would have seen inthat note that the Court had awarded costs against Mr. Nowak. Counsel submitted thatthere was no reason why someone who comes afterwards should be in a better positionthan Mr. Nowak was in that case.

Counsel for the appellant asked that costs be stayed.

Judge Linnane stated that costs must follow the event and made the following orders:

III

III

Costs of the ruling on the preliminary decision were awarded to the DPC to betaxed in default of agreement;There was to be a stay on executing the costs order in the event of an appeal; andAny appeal should be brought without delay.

D ATOOl ~1I044-865527- 1

AN CHUIRT CHUARDATHE CIRCUIT COURT

Record No 2012/02787

DUBLIN CIRCUIT COUNTY OF THE CITY OF DUBLIN

IN THE MATTER OF THE DATA PROTECTION ACTS 1988AND 2003IN THE MATTER OF AN APPEAL PURSUANT TO SECTION 26 OF THE

DATA PROTECTION ACTS 1988AND 2003

Between:-

Appellant

-and-

DATA PROTECTION COMMISSIONERRespondent

NOTE OF THE HEARING AND JUDGMENT DELIVERED BY HISHONOUR JUDGE MATTHEW DEERY, THE PRESIDENT OF THE

CIRCUIT COURT, ON THE 9TH DAY OF MAY 2012

Client: Data Protection Commissioner _

Date: Wednesday 91hy 2012 (Heating c01Umencedat 1022 am)

Case: _v-Data Protection Commissioner(Circuit Court Record No. 2012/02787)

Matter: Heating of a Prelitninary Issue in relation to Jurisdiction in the context ofa Statutory Appeal pursuant to Section 26 of the Data Protection Acts1988 and 2003

Court: Circuit Court 28 before the President of the Circuit Court

Attendees: ~PC)_

Counsel: Paul Anthony McDermott BL for the Data Protection Commissioner("the Respondent")

DATOOI-0051-1126825<1

Submission By Counsel For The Respondent

Introduction

1. Counsel for the Respondent, Paul Anthony McDermott BL, began hissubmission by setting out the central issue for consideration by the Circuit Court("CC") as being whether or not the CC had jurisdiction to hear an appealpursuant to the Data Protection Acts 1988 and 2003 ("the Acts") against theRespondent's refusal to investigate a complaint made by the Appellant that \vasdeemed "frivolous and vexatious".

2. Counsel stated that Section 10 of the consolidated version of the Acts set out theprocedure to be followed by the DPC on receiving a complaint. He stated that aspart of that procedure, if a complaint is taken on and investigated, an attempt ismade to mediate and reach an amicable resolution in relation to the matter.Failing this, a formal decision is made by the DPC. That decision is subject to aright of appeal to the CC in favour of any aggrieved complainant. The decision ofthe CC is, itself, subject to a further right of appeal on a point of law to the HighCourt ("HC").

3. However, Counsel went on to point out that if the DPC is of the opinion that acomplaint made is "frivolous or vexatious", it is simply not taken on orinvestigated at all. He stated that the phrase "frivolous or vexatious" was notintended to be insulting - it simply conveyed a particular legal meaning that acase was not worth taking on as no possible breach of the Acts could beidentified. He pointed out that it was this rejection of a complaint as "frivolousor vexatious" that concerned the Court in the instant case and that the questionfor consideration by the Court was whether the opinion of the DPC that a casewas not worth taking on was capable of being appealed under the Acts.

4. The President intervened and questioned whether such an opinion could besubject to Judicial Review. Counsel responded by confirming that as the DPC is apublic body, judicial review remained available.

5. Courisel then proceeded to give a brief outline of the facts of the case. Heoutlined that the Appellant in this case appeared to be involved in a dispute \vithTrinity College Dublin ("TCD") concerning disciplinary proceedings takenagainst him by TeD. As patt of that dispute a medical examination appeared tohave been performed on the Appellant, who appeared unhappy with the mannerin which that examination had been obtained and the way in which the medicalinformation obtained had been passed on by the Junior Dean of TCD to othermembers of TeD staff. Counsel stated that the Appellant was alleging that theseactions amounted to breaches of his constitutional fights and his right to naturaljustice and, further, amounted to criminal actions in breach of the Public OrderActs. Counsel argued that the DPC had no role in investigating these matters andcould not have any involvement in that dispute. If the Appellant wished tochallenge the procedures followed by TCD as having been unfair or unlawful,this was a separate dispute bet\veen the Appellant and TCD - it had nothing todo with the Respondent.

D!\T001-0051-1126825-2

6. Counsel continued by pointing out that what was involved here was simply aninternal dispute within TCD. The information disclosed was only disclosed viainternal communications between staff within TCD, which is a single datacontroller for the purposes of the Acts. He stated that this was different to asituation where information is passed to the world at large and, as such, didnot give rise to a breach of the Acts.

7. Counsel concluded his outline of the facts by reiterating that the disputeinvolved here did not involve issues of data protection.

Reliefs Sought

8. Counsel outlined that the Appellant here was seeking two reliefs, namely:

(i) To appeal the refusal of the DPC to investigate his complaint; and

(ii) The removal of the DPC from office for failure to carry out his duties.Counsel stated that it was not open to the Court to the Appellant toseek the second reliefsought.

Affidavit

9. Counsel proceeded to examine the Affidavit grounding the Appellant's Noticeof Motion in some detail. He stated that the Affidavit outlined the Appellant'sdispute with the Junior Dean in some detail, accusing the Junior Dean ofattempted blackmail and deliberate leaking of sensitive personal data in orderto deliberately damage the good name of the Appellant and his standing withinTCD. The Affidavit further alleged that TCD had breached the criminal law.Finally, the Affidavit took issue with the fact that the DPC had notinvestigated the Appellant's complaint and stated that the DPC had a duty todo so.

10. Counsel went on to examine the letters and emails exhibited to both theAffidavit and the original complaint before the DPC. He stated that it wasclear from these docrunents that the dissemination of information involvedhere was internal, between staff members of TCD, in relation to the difficultiesthat have arisen with the Appellant. He stated that these communications alsomade reference to a disciplinary hearing within TCD in relation to theAppellant. Counsel pointed out that if the Appellant feels that the informationwas unfairly obtained or inappropriately disclosed, then the appropriate forllinto raise these grievances is at the hearing itself He concluded by stating thatthese materials confirmed the DPC's decision that there was no breach of theActs involved here as the Appellant's complaint concerned internalcommunications between a single data controller in relation to an internaldisciplinary procedure, and that these were not matters of data protection law.

Nowak v. Data Protection Commissioner

11. Counsel drew the Court's attention to a letter sent by the DPC to the Appellanton receipt of his Notice of Motion attempting to appeal the DPC refusal to

D:\T001-0051-1126825-Z

investigate his complaint. He stated that this letter informed the Appellant thata refusal by the DPC to investigate a complaint on the grounds that it isfrivolous or vexatious is not capable of appeal pursuant to the Acts in light of arecent HC decision of Birmingham J in the case of Nowak v. Data ProtectionCommissioner.

12. Counsel set out the finding in the Nowak Case that the jurisdiction of the CCto hear an appeal is only against a decision that has been arrived at after therehas been an investigation. He stated that this issue was fully argued before theHC, with legal teams on both sides and involving consideration of the parentDirective.

13. Counsel stated that while the Appellant may disagree with the decision of theHC in the Nowak Case, the rules of precedent dictate that neither the CC northe HC could assist him by overturning the decision made in the Nowak Case.

14. The President intervened and stated that the situation appeared akin to thatpertaining under the Rent Restrictions Acts, in that there must be adetermination before a right of appeal can arise. Counsel agreed with thisassessment.

Electronic Privacy Regulations

15. Counsel pointed out that the Appellant's complaint was also grounded on theprovisions of the European Communities (Electronic CommunicationsNetworks and Services) (Privacy and Electronic Communications)Regulations 2011 (S.l. No. 336 of 2011). Therefore; for completeness, hestated that these Regulations contain identical appeal provisions to thoseoutlined in the Data Protection Acts. Moreover, he pointed out that theseRegulations are aimed at mobile phone companies and those involved in thetelecommunications industry.

Submission By The Appellant

16. The Appellant handed a copy of written submissions into the court. I The Courtinvited him to read from these submissions. The essence of these submissionswas to the effect that the High Court judgment in the Nowak Case was amiscarriage of justice, denying individuals their right of appeal under the Actsand further amounted to an appalling waste of public funds.

17. He stated that he was seeking that the CC determine his appeal, as hiscomplaint concerned serious breaches of the Data Protection Acts and thecriminal law.

JUDGMENT DELIVERED BY HIS HONOUR JUDGE MATTHEW DEERY,THE PRESIDENT OF THE CIRCUIT COURT

I A copy of these submissions is now included in the office file in relation to these proceedIngs.

DATOOI-0051-1126825-2

18. The President commenced his decision by stating that the procedure envisagedunder the Data Protection Acts 1988 and 2003 was that it is only wherecomplaints are made, duly investigated, and a decision reached on foot of thatinvestigation, that an appeal to the CC arises.

19. The President went on to state that in some cases, complaints were notinvestigated as they were deemed frivolous or vexatious. He stated that thiswas provided for under the Acts, which set out that the DPC was not requiredto investigate complaints where he was the view that no breach of the Actswas involved. He went on to point out that it was clear that that was what wasinvolved in t.lJ.e instant case, as the complaint related to internalcommunications between staff in TCD, yet the Appellant had proceeded tobring an appeal to the CC.

20. Next, the President referred to the Nowak Case, and stated that the HC in thiscase had affirmed the view taken by the CC that it was not open to acomplainant to appeal a refusal by the DPC to investigate a complaint, havingformed the opinion that the complaint is one that is frivolous or vexatious.

21. The President stated that the Appellant had other potential avenues open tohim to review the finding of the DPC that his complaint was one withoutmerit, but that the avenue of appeal sought in this case fell within the confinesofthe HC decision in Nowak.

22. Accordingly, the appeal was dismissed.

23. In circumstances where the Appellant indicated that he would not be acceptingthe Court's ruling but would be appealing to the High Court, Counsel for theCommissioner sought an order for costs. (Note: the Appellant asserted that theNowak judgment is to be appealed to the Supreme Court). An Order for Costswas awarded made in favour of the Commissioner on the basis of the standardlUle that costs follow the event.

DATOOl-0051-1126825-2

AN CHUIRT CHUARDATHE CIRCUIT COURT

Record No 2011/00239

MIDLAND CIRCUIT COUNTY OF LONGFORD

IN THE MATTER OF THE DATA PROTECTION ACTS 1988AND 2003IN THE MATTER OF AN APPEAL PURSUANT TO SECTION 26 OF THE

DATA PROTECTION ACTS 1988AND 2003

Between:-

Appellant

-and-

DATA PROTECTION COMMISSIONER(substituted by Order of]udge Hunt made on 31"'January 2012

Respondent

Note of the Judgment delivered by His Honour Judge TonyHunt on the 2nd day of May 2012

1. Judge Hunt commenced his judgment by stating that although Counsel for theAppellant had attempted to suggest othenvise, he was satisfied that the decisionmade by the Data Protection Commissioner in this case was purely in relation tothe Appellant's complaint concerning the disclosure of his personal data byDermot Kehoe Supply and DIY Limited (I<':ehoe).

2. Judge Hunt summarised the facts of the matter in the following terms;

The Appellant's complaint to the Data Protection Commissioner aroseout of an accident that the Appellant had been involved in August 2007on Kehoe's premises that was captured on CCTV;

III The Appellant's employer requested and obtained a copy of the CCTVcapturing the incident from Kehoe, which was then passed on to their

DAT001-0047-1124155,1

insurer (Tudge Hunt commented that it appeared that the lnsurer werepart of the Quinn group.)

3. Judge Hunt then gave judgment in the following terms:

11II

III

In his view, the complaint raised in relation to the disclosure by Kehoeand suggesting that the Appellant's consent ought to have been obtainedand that the he ought to have been provided with a copy of his personaldata at this stage had some merit as a matter of fairness;

Ho\vever, as a matter of law, the decision of the Data ProtectionCommissioner was correct, so far as it related to the actions of Kehoe;

He stated that Kehoe ,vas entitled to maintain CCTV on his premisesunder the provisions of sections 2 and 2D of the Data Protection Acts.He weht on to state that Kehoe was entitled to disclose personal datacaptured on such CCTV once it fell ,·vithin one of the legitimisingconditions set out under section 2A of the Acts. He pointed out that oneof these permitted disclosure of personal data to a third party who had alegitimate interest in receiving that data. He stated that the disclosure ofthe CCTV footage in question in this case to the Appellant's employerwas clearly necessary in order to enable them to defend any subsequentpersonal injury claim brought by the Appellant. Judge Hunt commentedthat, as a by product of that disclosure, CCTV footage of the incident waspreserved, which might otherwise have been lost. Therefore, he statedthat this disclosure did not prejudice, but actually served the legitimateinterests of the Appellant;

Judge Hunt went on to comment that the facts of the case highlighted anapparent gap in the legislation, as the CCTV ought to have been disclosedto both parties as a matter of fairness. However, he stated that there wasno statutory basis for the complaints made by counsel on behalf of theAppellant and that, accordingly, there was a clear statutory basis for thedecision of the Commissioner;

Judge Hunt then observed that the decision of Birmingham J in Nowak v.Data Protection Commissioner had set an extremely high standard forsetting aside a decision of the Commissioner. He commented that whilehe would disagree with some of tlle findings of the Commissioner in thiscase, (namely, that Kehoe may have thought that the Appellant hadconsented to tlle disclosure of the eCTV to his employer), this was notsufficient to set aside tlle decision of the Commissioner in this case, asany error fell far short of tlle magnitude required by the Nowak decision.He then reiterated that there were legitimate reasons for the disclosure inany event;

The appeal was therefore dismissed.

4. Prior to any application for costs being made, Judge Hunt went on to commenton the conduct of the Quinn Group in tlus case and how they dealt with theAppellant, wluch he stated had been "far from satisfactory." He stated tllat it was

- 2-

beyond belief that they could have asserted a claim of privilege over the CCTVfootage in question and refused to provide the Appellant with a copy. Heobserved that it reflected poorly on the advisors of the Quinn Group and that hehoped the situation had changed since there had been a change of management.He concluded by stating that as a result of dus poor handling of the Appellant, he\vould not be awarding any costs against the Appellant in this case.

5. It was pointed out to Judge Hunt that the appeal in this case related to the DataProtection Conun1ssioner and was not in any way related to the actions of theQuinn Group. It was further pointed out that it was the actions of theConun1ssioner wruch actually secured a copy of the CCTV footage for theAppellant from the Quinn Group. However, the Judge responded that DataProtection Commissioner was simply performing a statutory function in tlUsregard and that there was no suggestion that the Appellant was anything butentitled to bring the complaint he made. He concluded that if a sinUlar case aroseagain, however, he would be minded to award costs against an Appellant in lightof trus decision.

D.t\:TOOI-0047-1124155-1 ·3-

Note of}udgment

Client: Data Protection Commissioner-

Date:

Case:

Matter:

Court:

Tuesday 16 November 2010(Hearing commenced at 11.15 am and judgment was given at 3.10 pm)

v - Data Protection Commissionerourt Record No. 2010/008035)

Trial of Statutory Appeal pursuant to Section 26 of the Data ProtectionActs 1988 and 2003/ Hearing of Respondent's Notice of Motion todismiss appeal

Circuit Court NO.22 before Judge Linnane

Attendees: (DPC); (PLS)

Counsel: Paul Anthony McDermott BL for the Data Protection Commissioner;Promsias O'Maolchalain BL (insuucted by Peter Connolly Solicitors) for

1. Judge Linnane commenced her judgment by stating that the first question whichthe Court had to consider was whether it had jurisdiction to entertain the appeal.

2. She then quoted Section 10(1)(b)(i) and Section 26(1)(d) of the Data ProtectionActs 1988 and 2003.

3. Judge Linnane summarised the facts of the matter and the reliefs sought inthe following terms:

The Appellant made a complaint to the Data Protection Commissioneron 1July 2010 and 14 July 2010 regarding his accountancy exam;

In a letter of reply by the Data Protection Commissioner of 21 July andagain on 11 August 2010, the Data Protection Commissioner made itclear that he was not imrestigating the complaints and cited Section10(1)(b) (i) of the Data Protection Act;

III The Data Protection Conunissioner indicated that the complaint wasfrivolous and vexatious and having examined tile materials submitted wasof the view that tile exam scripts of the Appellant were not personal data

D /\T001-0037 -792293-1-I -

III

within the meaning of the Acts and was not obliged to investigate 111

circumstances where no breach of the Acts could be identified;

The Data Protection Commissioner's view is that no decision was madewhich could be the subject matter of an appeal to this Court underSection 26 of the Acts and that only a decision follO\ving an investigationwhich had been conducted can be appealed;

On behalf of the Appellant it had been argued that the Data ProtectionCommissioner's finding that the complaint was vexatious or frivolous,was a decision giving a right of appeal. The notice of appeal seeks adeclaration, amongst others, that the complaints were neither frivolousnor vexatious and that exam scripts are personal data. On this basis theAppellant was clainUng that he is entitled to a copy of his exam scripts;and

There was also a cross appeal by the Data Protection Commissionerwhich argued that the Court has no jurisdiction to entertain an appeal butin the alternative that if the Court does entertain such an appeal, it shouldbe dismissed.

4. Judge Linnane then gave judgment in the following terms:

Ii

!II

In her view the reference to an appeal in Section 10(1}(b)(ii) envisages anappeal to this Court under Section 26 where the Data ProtectionCommissioner has conducted an investigation following a complaint andhas made a decision. This does not apply where the Data ProtectionCommissioner has not carried out an investigation because of a:complaintbeing frivolous or vexatious;

It was open to the Appellant to bring judicial review proceedings;

Even if the Court is wrong on the jurisdiction point and the Court doeshave jurisdiction to hear the appeal, in her view the Data ProtectionCommissioner's finding that the complaint was frivolous and vexatiousand unsustainable was reasonable and was not erroneous and should notbe set aside;

The Appellant's exam scripts are not personal data "vitlUnthe meaning ofSection 1 of the Data Protection Acts. Therefore there was no breach ofthe Acts and the Appellant was not entitled to copies of his exam scripts;and

The appeal was therefore dismissed.

5. Paul Anthony McDermott BL then made an application seeking the costs ofthe Data Protection Commissioner on the basis that costs should follow the

D/,TOOI-0037-792293-1 -2-

event and referred to S.L 374/ 1999 Circuit Court Rules (No.2) (Data ProtectionAct 1988) (a copy of which was handed into Court).

6. Counsel for the Appellant opposed the application for costs and pointed tothe decision letter of the Respondent (of 21 July 2010) being "less than clear in itsphraseology". He claimed that the letter was ambiguous and that the point oflaw which had been considered by the Court today was a matter of considerablepublic importance. On that basis he sought that no costs order be made.

7. Judge Linnane stated that in its earlier response of 29 June 2010, the DataProtection Commissioner had made it nystal clear to ti1e Appellant that therewas no prima facie basis for considering tint the Appellant did not receive copiesof his personal data.

8. As further grounds for opposing the application for costs, Counsel for theAppellant submitted that:

II ultimately that the Appellant would be appealing this judgment and in thisregard the decision of the Data Protection Commissioner could beconsidered something akin to the decision of a District Court Judge; and

it had not been necessaty for the Respondent to participate in this appealand Chartered Accountants Ireland could have participated in the appeal.It was unusual practice that the Data Protection Commissioner hadparticipated in the appeal and on that basis he asked that the Courtexercise its discretion not to make an order as to costs.

9. Judge Linnane responded that costs should follow the cause in this case. Shecommented that the Data Protection Commissioner had had to spend a lot oftime on this file and there was no reason not to have a costs order made. Shedismissed the appeal for the reasons already given and made an order for costs infavour of the Data Protection Commissioner to be taxed in default.

10. Counsel for the Appellant ti1en sought a stay on the Court's ord~r pending anappeal and indicated that judicial review proceedings \vould be taken. JudgeLinnane enquired as to who such judicial review proceedings would be takenagainst. Counsel for the Appellant responded that it seemed that the Appellantwas now being corralled into judicial review proceedings by the Respondent. TheJudge commented that this was not the case. Counsel for the Appellant said thatthe Appellant might have to judicially re\>Jew the Data ProtectionCommissioner's decision, this decision and the decision of CharteredAccountants Ireland. Judge Linnane pointed out that on that basis the Appellantmight have three sets of proceedings. Counsel responded that ti1e Appellantwould have to decide whether it was going to make an appeal to the High Courton a question of law.

DA.TOOI-0037-792293-1 - 3 -

11. Counsel for the Data Protection Commissioner stated that if the Court grants astay on its order the only logical stay would be a stay on the costs order pendingan appeal against Judge Linnane's decision. Counsel for the Data ProtectionCommissioner stated that the Court could not stay costs on the basis of any otheractions which might or might not be taken.

12. Judge Linnane agreed and granted a stay on the costs order pending anappeal of the decision of this Court. She directed that if the Appellant wasgoing to prosecute an appeal, he should do so quickly.

D{\TOOl~0037~792293-1 - 4-

"f

THE CIRCUIT COURT

RECORD NO: 1316/2011

BETWEEN

BUS ATHA CLIATH/DUBLIN BUS

APPELLANTAND

DATA PROTECTION COMMISSIONER

RESPONDENT

Judgment of Her Honour Judge Jacqueline Linnane delivered this fit...day of July, 2011

This is an appeal by Dublin Bus (DB) under s. 26 of the Data

Protection Acts (DPA) 1998-2003 against a decision of the Data

Protection Commissioner (DPC) made on 25th January, 2011 following an

investigation to issue an Enforcement Notice regarding the failure by

Dublin Bus to comply with an access request made by a Data Subject

(Mrs. in relation to CCTV footage which it held and had

recorded on a bus on which the Data Subject was travelling in October,

2008.

The background here is as follows:

The Data Subject was travelling on a bus on 3rd October, 2008 and

she claims that she fell down the steps of the bus while going upstairs.

An application to PIAB was made on 19th October, 2009 which was

required before the institution of any proceedings for personal injury.

Dublin Bus was informed of such an application and following a request

by her solicitor, Dublin Bus ananged for her solicitor to view the CCTV

footage on 29th January, 2010. This was followed up by an access request

from the Data Subject received on lill February, 2010 and the response

ofCIE Group Investigation Department on 16th February, 2010 was that

all documents and records in the office are prepared in contemplation of

litigation and their files fall within legal professional privilege.

Her solicitor then made a complaint to the DPC on her behalf on

13th April, 2010 and the DPC investigated the matter. The response of

Dublin Bus to the DPC on 31st May, 2010 was that an application had

been made to PlAB and that the CCTV footage was

preserved/downloaded solely for the purpose of the defence of any

litigation arising ftom the incident which had taken place on its bus on 3rd

October, 2008 and accordingly was privileged even if no proceedings had

been issued at that stage. A Plenary Summons was issued on behalf of

the Data Subject against DB on 23rd June, 2010 and a Defence was

delivered on 1st October, 2010. By letter of 14th April, 2011 Mrs.

oHcitor sought discovery from DB of various documents,

including the CCTV footage in question,

It is not disputed that the CCTV footage would come within an

application for discovery of documents in the litigation. It was also not

disputed by DB in the course of the investigation ofthe complaint by the

DPe that the CCTV footage constituted personal data within the meaning

of the DP Acts. In this regard s.l (1) defines "personal data" as meaning

data relating to a living individual who is or can be identified either from

the data or from the data in conjunction with other information that is in,

or is likely to come into, the possession of the data controller. Moreover

Kelleher's book on Privacy and Data Protection Law in Ireland at pp. 146

and 147 would confirm this wherein reference is made to the view of the

Article 26 Working Party and the case of Campbell v, lvIGN 2002 EWHC

499 - at para 8.50 of Kelleher's book it states:

2

"Only if a controller cannot identify an individual caught on

CCTVand it is not likely that he will come into possession of

information that would enable him to make that identification can

it be said that data derived from the CCTV is not personal data. "

The DPC took into account the argument advanced by DB before

making his decision- namely the question of privilege, the clear intention

by virtue of the application to PlAB of bringing a personal injuries action

by the Data Subject and the subsequent issuing of a Plenary Summons

and that the Data Subject was trying to usurp the function of the Court by

obtaining documents for the purpose of her litigation through the DPA

when this should more appropriately be dealt with by the Court.

These are the grounds set out in the Affidavit supporting the Notice

of Appeal but Dublin Bus sought to broaden the grounds of its appeal

before this Court and this Court ruled that as Dublin Bus is claiming that

the decision of the DPC was wrong, it was confined to the grounds it

advanced to the DPC during the course of his investigation and before the

DPC made its decision resulting in the Enforcement Notice which issued.

The Enforcement Notice was issued as the DPC decided that

Dublin Bus was in contravention of s. 4(1) of the Acts in failing to

comply with an access request made by the Data Subject. The DPA were

enacted to give effect to Directive 95/46/EC and the primary purpose was

to protect fundamental rights- being the right to privacy regarding the

processing of personal data and to check the accuracy of one's personal

data held by others.

Section 4 deals with the right of an individual to access to personal

data processed by a data controller relating to the individual. However,

s.s. 9 of s. 4 provides that the obligations imposed by S.s. (l)(a)(iii)

inserted by the Act of2003 of this section shall be complied with by

3

supplying the Data Subject with a copy ofthe information concerned in

permanent form unless

(a) The supply of such a copy is not possible or would

involve disproportionate effort, or

(b) The Data Subject agrees otherwise.

This provision does not apply in this instance and no argument has

been advanced that it does. Accordingly Counsel for the DPC argues that

the Durant case hereinafter referred to and UPOll which Dublin Bus relies

is irrelevant as the UK Data Protection Act of 1998 gives the Court

discretion as to whether to direct access to such data.

Section 5(1) provides certain exceptions to the right of access

given in s. 4 in that it does not apply inter alia to personal data (g) in

respect of which a claim of privilege could be maintained in proceedings

in a court in relation to communications between a client and his

professional legal advisers or between those advisers.

Counsel for the DPC argues that DB by allowing an inspection of

the CCTV footage to the data subject/her solicitor thereby waived any

privilege it claimed and in addition even if it was not waived DB does not

corne within the exception provided at s. 5(1)(g) referred to above. Mr.

n behalf of DB argues that the CCTV footage is a document

for discovery, it exists in anticipation of litigation and was prepared with

a view to communicating with him (although not yet communicated or

transmitted to him) and that as the Data Subject's request is tied in with

her litigation if this Court finds in favour of the DPC the whole concept

of litigation will change and it will constitute an interference by the DPC

with the role of the court in dealing with litigation, and that the High

Court by reason of the litigation has seisen.

4

Counsel for the DPC makes the point that there is no provision in

the DPA which precludes a Data Subject from exercising their right to

access personal data thereunder to which they are entitled to because they

are litigating before the Court. In relation to the Durant case relied upon

by DB, Counsel for the DPC points out there is a distinction between the

legislation here and the English legislation, which in respect of the latter

applies a test 0treasonableness and gives the Court a statutory discretion

as to whether to direct access to such data.

In the case of Durant v. Financial Services Authority 2003 EWCA

Civ 174 Mr. Durant sought information relating to an investigation by the

Financial Services Authority (FSA) of his complaints against Barclays

Banle He sought disclosure of information he claimed to be personal

data relating to him held by the FSA under s. 7 of the Data Protection

Act, 1998. He had been provided with some disclosure but sought more.

He had litigated against Barclays but this had been dismissed in 1993. He

made his requests in 2001. As stated he obtained disclosure of some

information but his further requests for information held on manual files

were refused on the basis that it was not personal data as defined by the

Act. As the judgment indicates he did not get to first base in his claim

against the FSA. In the Court of Appeal Auld LJ stated:-

"It is information about his complaints and the objects of

them, Barclays Bank and the FSA respectively. His claim is a

misguided attempt to use the machinery of the Act as a proxy for

third party discovery with a view to litigation or further

investigation, an exercise, moreover, seemingly unrestricted by

considerations of relevance. "

In addition s. 7(9) of that Act gives the Court discretion as to

whether to grant an order for access under that section.

5

With regard to the other case relied upon by Counsel for Dublin

Bus- Ezsias v. The Welsh Ministers 2007 EWHC B15 QB. In that case

Mr. Ezsias brought tribunal proceedings against his fanner employer, the

NHS Trust, claiming unfair dismissal. During the course of that case he

made a number of access requests for documents from the National

Assembly of Wales. Some documents were released but others were

withheld. It was clear his access requests were tied to and were to be

employed for his separate ongoing legal proceedings and to assist him in

same. At the time judgment was given he had sought disclosure of the

same documents in the course of his tribunal proceedings and these

would be available to him in those proceedings. An enormous amount of

documents had been generated related to his complaints, not to him. It

was held that the information generated by the complaint was not

personal data as defined by the Act. Mr. Ezsias also had complained to

the Ombudsman about the manner in which the National Assembly

responded to his complaints.

In referring to the Durant case Hickinbottom J. in his lengthy

judgment states that the information generated by these complaints is no

more Mr. Ezsias's personal data than the information generated by the

complaints made by Mr. Durant and access to that material could not

possibly be necessary for or even relevant to any protection of the

complainer's privacy. Paragraph 66 "The purpose of the Act is to protect

that privacy. To use the provisions of the Act to seek disclosure of

documents generated as the result of the applicant's own complaint, in

order tofurther a legal claim of the applicant against a third party is a

legal abuse. "

It is clear therefore that the decisions reached in the above cases

held that the information sought was not personal data as defined by the

Act and that the legislation in the UK gives the court discretion as to

6

whether to order access. Furthermore, Counsel for the DPC makes the

point that there are no exemptions from the right of access where civil

legal proceedings are contemplated or ongoing. This mirrors a document

entitled "Data Protection Technical Guidance- subject access requests

and legal proceedings" issued by the Information Commissioner's Office

in the UK. It goes on to state that in practice, subject access rights are

often used by individuals who are in dispute with the data controller.

"In many cases, they may intend to begin or have already

begun legal proceedings against the data controller and see s. 7 as

a way of obtaining additional information to assist in such

proceedings.

It has been suggested that recent case law, and in particular

Durant v. FSA 2003 EWCA Civ 1746, provides authorityfor data

controllers to refuse to comply with a subject access request where

the applicant is contemplating or has already begun legal

proceedings.

The Commissioner does not accept this proposition. He

takes the view that failing to comply with a subject access request

in such circumstances will, unless an exemption under the Act

applies, amount to a breach of the Sixth Data Protection principle.

The right of subject access is one of the cornerstones of Data

Protection legislation. If a data controller were able to avoid

complying with a subject access request in circumstances where

the data subject was contemplating or had begun legal proceedings

it would seriously undermine thisfundamental right.

However the courts do have discretion as to whether to

grant an order under s. 7 (9) and may be reluctant to exercise that

discretion where it is clear that the purpose of the request is to fuel

separate legal proceedings and, importantly, where the discovery

7

rules under the Civil Procedure Rules would provide a more

appropriate route to obtaining the information sought. "

In summary therefore it is clear in this case DB does not come

within the privilege exception provided for in Section 5(1)(g)of the DPA

and the U.K. DPA of 1998 is distinct from our legislation in that it

confers a discretion on the Court as to whether to grant an order for

access. Accordingly, in ail the circumstances here I am dismissing this

appeal.

~c~v.-a(~(LCAJ~

8

j

THE HIGH COURT

201072 C/\

Tuesday the 15th day of February 20 IIBEFORE MR JUSTICE HEDIGANBETWEEN

DATA PROTECTION COMMISSIONER

APKLLANTAND

RESPONDENT

THE HEALTH SI£RVICE EXECUTIVE

NOTICE PARTY

'Yhe Appeal on behalf of the Apellant herein from the Order of the

Circuit Judge fonlle County of Galway dated the 261h day of March 2010 coming

on for hearing 011 this day on Notice dated the 6th day of April 20 I0

Whereupon and on reading the said Notice the said Order ofthe

Circuit Court Judge the Pleadings and exhibits herein and on hearing Counsel for

the Appelant and Counsel for the Respondent

And IT Appearing that a settlement has been reached herein

By consent the Court doth vacate (i) the said Order ufthe 261h day of

March 2010 and (ii) the Order for costs in favour ofthc Respondent herein made

on the said date

And IT IS ORDERED that the Decision of the Data Commissioner

elated the 2lld day of Novem bel' 2009 be and is hereby am rmed

T. KenningtonREGISTRAR16th February 201 1

Eoin O'Connell & Co,Solicitors for the Plaintiff

Branigan Cosgrove FinneganSolicitors for the Defcnd<:111t

THE CIRCUIT COURTRecord No

THE WESTERN CIRCUIT COUNTY OF GALWAY

IN THE MATTER OF THE DATA PROTECTION ACT 1988-2003AND

IN THE MATTER OF AN APPEAL PURSUANT TO S 26 OF THEACT

Between:-

Appellant

-and-

THE DATA PROTECTION COMMISSIONERRespondent

- and-

THE HEALTH SERVICE EXECUTIVENotice Party

Ex Tempore Judgment of Groarke J delivered on 26 March 2010 atGalway Circuit Court

1) It is necessary to view the circumstances under which the HSE carneinto possession of the relevant documents. It was through itsemployment of doctors, hospital administrators and others. Hospitalemployees (especially doctors) have legal obligations to maintain theconfidentiality attaching to documents related to patients and theirtreatment. The law has always recognised that such documents are in

a special category, in that medical privilege applied to them. Theywere prepared on the basis of the patient's consent, and that the lawhas always protected and defended the special status of suchdocuments. The HSE was in possession of the documents onlybecause it employed the doctor. The HSE could not assume a waiverof privilege - which could only come from the patient - even if it wassued. Rather, the documents are held by the HSE for and on behalf ofthe patient.

2) Where litigation has begun whereby a claimant has to release allrelevant documents to a defendant. This is the law used in all suchcases.

3) The 1988 Act was enacted because of the ED Directive, and that theED in its wisdom provides that data ought to be available to othersand specified the circumstances for this. It is also reasonable that theActs also specify circumstances in which information/data should notbe made freely available.

4) Section 2A, deals with personal data, and section 2B, deals withsensitive personal data. The Acts recognised differences betweenthese two categories of data for good and historical reasons.

5) If the DPC was correct in his view, then there would be no differencebetween the two categories of data. This was not the intention of theActs and it would be demeaning and unfair if the DPC was correct.Personal data is dealt with under the Acts in one way, and sensitivepersonal data is dealt with in a different way. The qualifying criteriafor releasing the data were dealt with under sections 2A and 2B.

6) The data here does not come in under 2A.

7) The DPC says that section 8 is a catch-all proVISIOnbecause, asargued by the DPC, it deals with all personal data. The DPC says thatthere is no difference between personal data and sensitive personaldata. That is poppycock. What would be the point of identifyingsensitive personal data as a special category if it was caught under thecatch-all in section 8? Section 8 is not a catch-all provision.

2

8) Even if section 8 did apply, the relevant proviSIOn (section 8(£)referred to processing which was "required" for obtaining legaladvice, etc. This was a mandatory requirement, and was not the samething as processing which was essential or necessarily essential nordid it fall within the terms used by the HSE to justify disclosure of thedata. There was no proof that the disclosure in this case was"required", It was not enough to show that the disclosure was useD_'llor necessary. The HSE could have obtained the information byordinary legallueasures.

9) The DPC's decision was retrospective in that it was viewing mattersin the light of what had gone before (i.e. in respect of disclosureswhich had already taken -place) and it was giving a retrospectivedecision that everything was in order. The decision may have beendifferent if it was not retrospective.

10) The manner in which the HSE had obtained the informationwas an abuse of process, in that it transferred the documents frompatient files to lawyers, and not (for example) to other doctors. Theinformation was sacrosanct and was not to be released to just anyone.I cannot understand why the HSE did not follow normal procedures.

11) In relation to the DPC's investigation, and his reliance onassurances from the HSE's solicitors, this was not the proper way forthe matter to have been dealt with. The DPC is in a more seriousposition, and is required to ma1cea decision. Rather, however, in thiscase, the DPC effectively delegated his powers to the HSE'ssolicitors, and he said that this was very serious from the point of viewof the citizen.

12) I allow the appeal, set aside the decision and award theAppellant her costs against the DPC.

3

-Note of Ex-Tempore Judgment of Linnane, J (delivered on 12 February 2010)

Mayo VEC v Data Protection Commissioner

Circuit Court Record No. 00138/2008

Summary:

Judge Linnane allowed the Appeal and set aside the Enforcement Notice dated 9October 2009 on the basis that the Appellant was entitled to rely on section S(l)(f) of theData Protection Acts, 1988 - 2003 to refuse access to a medical report obtained by it inrelation to a Mrs_

Note of order outlined below.

Judgment of Linnane J:

I This is an appeal under section 26 of the Data Protection Acts (the DP A) from adecision made by the Data Protection Commissioner (the DPC) whereby he heldneither sections 5(1)(f) or (5)(1)(g) of the DPA applied and the Appellant, (theVEC), as data controller was obliged to provide the Data Subject, Mrs_\vitha copy of a medical report it had obtained on Mrs~'hich was sent to theVEC via its solicitors. This was followed up by an Enforcement Notice.

2 Earlier, in a letter of 26 June 2009, and again by letter dated 6 August 2009,regarding the exemptions provided by section 5(1)(g), the DPC contended tllatthe medical report was not exempt under the DPA by legal professional privilege,as only the accompanying docwnents created between the client and the legaladviser in connection to tllis medical report are covered by legal professionalprivilege and not the medical report.

3 The view of the DPC's office was that medical reports do not qualify for legalprivilege regardless of when or for what purpose they were created.

4 The reason given by the DPC as to why he contended the medical report was notexempt under s5(1)(f) of the DPA Acts is set out in the letter dated 1 September2009, the reason being that it was highly unlikely that a medical report makes anyspecific reference to a specific monetmy amount of possible liability.

5 Section 4 (1) of the DPA gives individuals a right to access personal data at theirrequest. The Enforcement Notice was issued under section lOaf the DP Abecause the DPC formed the view that the VEC was in contravention of section4(1).

6 i\S Counsel for the DPC in his submissions set out, the right of a person toaccess his personal data lies at the heart of Data Protection law. Sihce it is one of

DAT001·0022-633585- 1 TIT

·,. --the most fundamental rights to know what personal data is being held in respectof them, people need to know whether the processing of their data is lawful.

7 Equally legal professional privilege is a fundamental human right protected bycommon law and courts are vigilant in preserving same.

8 It was accepted by all sides that a medical report is personal data within themeaning of the DPA.

9 The background to how the report came into being IS important and IS asfollows:~

9.1 It was clear that this report was prepared in contemplation of litigation,already threatened and generated as result of the letter received from Mrs

solicitors in that regard.

9.2 By attending such a review, I\1.ts"would have had to understand thepurpose for which the report was being created by Dr. _ The letterdated 4 April 2008 to Mr~solicitors makes this clear.

9.3 Mrs_ater requested the medical report from the VEC's solicitors in2008. When her request was not complied \vith, Mrs~rote to the"lEC by letter dated 19 March 2009 seeking a coPy of the report underthe DPA. By letter dated 28 Match 2009, Mr~wrote to the DPCseeking assistance and as result of that letter, an investigation wascommenced by the DPc.

10

11

12

Whilst initially the VEC only claimed entitlement to refuse Mrs _ requeston the basis of the exemption for legal professional privilege undetS3())(g) of theDP A. The VEC later claimed by letter dated 4 September 2009 that the reportwas also exempt on the basis of section 5 (1)(f) of the DPA.

The VEC claimed it was entitled to refuse release of the report on the basis thatthe medical report in question falls within the exemptions provided by sectionsS(l)(g) and (f) of the DPA. It would appear that the proceedings threatened inthe letter from Mrs_solicitors sent to the VEe in September 2007 havenot yet materialised although a PlAB autllorisation has issued and so no doubt,proceedings will be issued shortly.

Section S(l)(f) of the DPA is an exception to the right of access and provides thatthe right of access to personal data does not apply to personal data:

'~'Otlsisting of an estimate of or kept for the pzoposes of estimating, the amount qlliabiliry of thedata controller cOllcenzed on foot of a claim for the payment of a J"timof mone)!, whether in respectojdamages or compellJ"atioll, in atry case in which the applicatiotl of the section wot/ld be likelY toprejudice the interests if the data controller in relation to the claim. "

DATODl-0022-63358S-1 -2-

.'-13 The submission made on behalf of the DPC is that the medical report does notcome \vithin this exception and even if it did, the release of the report does notprejudice the VEe.

14 In his written submissions, counsel for the DPC refers to an extract fromKelleher, Privacy and Data Protection Law in Ireland regarding the intention ofthe section and quotes as follows: ""It would be of great interest to at!J' litigant orcompensation claimant embroiled in a dispute with the data controller to have access to at!}injomJation relating to the lerN/ at which the controller would aHeJS itJ liabtii!)!. This prolJiJionallowJ,the data control fer to !YJJiJtJNch an accen request" (para 13.49).

15 It is further submitted that merely asserting prejudice is not enough. The DataController must establish some real risk of prejudice, In my view, it would beapparent to anyone familiar with the litigation process, particularly in relation tothe rules regarding tenders and lodgments of how that prejudice would arise.

16 S5(1)(g) provides that the right of access to personal data does not apply inrespect of data: <<.tn reJpect rif which a claim rifprivilege c014ldbe maintained in a court inrelation to communicatiotlJ between a cliettt and his profinional legal adviJers or between thoJ'elegal adviser.r."

17 In his submissions, Counsel for the DPC argues that a report is clearly notcommunicated between clients and its professional legal advisors or betweenthose legal advisers as Dr~s not a legal adviser. Reliance is made by theVEC in regards to this exemption on f fact that it comes within the ambit of legalprofessional privilege, That is, it was a confidential communication made afterlitigation \vas actually threatened and was made between a la'"vyerand an expertand the dominant purpose of the communication was for litigation. The medicalreport was obtained for the VEC by its solicitors and sent to the VEC by itssolicitors.

18 The Appellant also submits that legal professional privilege can only beoverridden by express statutory authority or by necessary implication.

Taking everything into account, my view is as follows:

19 The VEC is entitled to rely on the exemption in section 5(1)(1) of the DP A torefuse access to the report. The report was obtained for the purpose ofevaluating IvIrs_claun and prejudice would arise to the VEC in relation tothe threatened claim if it was furnished.

20 I do not accept the argument made by the DPC that to come '"vithill theexemption, the report would have to make specific reference to a specificmonetaq amount. That is not a function of a medical expert; that is for the legaladvisor to do having considered the report.

21 I do not accept the ,,'ie\vgiven by the DPC that medical reports do not qualify forlegal privilege regardless of when and for what PU11Josethey were created.

D.c\T001-0022-633585-1o

-.J -

22 This report was clearly obtained fro the VEe as a result of threatened personalinjuries litigation by the Data Subject. It was furnished to the VEe by theirsolicitor. Clearly it was a document contained in a comlnunication between 'VEeand its solicitors.

23 However, as I have found that the exemption under section 5(1)(f) applies, I donot have to expressly rule on section 5(1)(g) of the DPA.

The Formal Order to provide as follows:

1. Allow the appeal by the VEe and set aside the Enforcement Notice datedissued by the Respondent.

2. Costs to the VEC as against the Data Protection Commissioner to betaxed in default.

3. Stay on costs in the event of the appeal.

D ATOOI-0022-6335 85-1-4-

DUBLIN CIRCUIT

Record No: 0979312007AN CHUIRT CHUARDATHE CIRCUIT COURT

COUNTY OF THE CITY OF DUBLIN

IN THE MATTER OF AN APPEAL PURSUANT TO SECTION 26 OFTHE DATA PROTECTION ACTS 1998 AND 2003

Betwecn:-

SUNDAY NEWSPAPERS LIlVIITEDAppellant

-and-

DATA PROTECTION COMMISSIONERRespondent

Decision of Judge Linnane delivered on 15 April200S

This case came to the Circuit Court by way of an appeal pursuant to Section26 of the Data Protection Acts, 1988 and 2003 (the "Acts~') which wasbrought by Sunday Newspapers against an Information Notice issued by theData Protection Commissioner on 7 December 2007 pursuant to Section 12of the Acts. The Appellant seeks an Order that they do not have to complywitll"the terms of the Information Notice.

Section 28 of the Acts provides that 'fthe, whole or any part of anyproceedings under this Act may, at the discretion of the Court, be heardotherwise than in public", At the outset~it was agreed that this appeal couldproceed in public but that the names and identities of the complainantswould not be disclosed.

Section 12(1) of the Acts provides as follows:

"The Commissioner may, by notice in writing (referred to in this Actas an Information Notice served on a person) require the person tofurnish to him in writing within such time as may be specified in theNotice such information in relation to matters specified in the Noticeas is necessary or expedient for the performance by the Commissionerof his functions".

In these proceedings~ the Information Notice provides, inter alia, that

"I, Billy Hawkes, the Data Protection Commissioner, in exercise ofthe powers conferred on me by section 12 of the Data Protection Acts1988 and 2003, Hereby Give Notice, that I require you to furnish mein \:vriting, the foHowing information:

state whether Sunday Newspapers Ltd had in its possession personal datarelating to [the complainants] on the 11th September 2006~ being the datewhen an access request was made on their behalf by [the complainant's]solicitors to the editor of the Applicant. Furthermore, if the Appellantpossesses such personal data, it must provide the Data ProtectionCommissioner with a copy of that personal data.

This information is necessary or expedient for the perfonnance of my

functions."

The background to the Information Notice is that the complainants believethat the Appellant is in possession of data in respect of them and, on thatbasis, their solicitors had made an access request under sA for information.The response of the Appellant basically was that if any data existed it wasbeing processed for journalistic purposes. The Appellant cited Section 22Aof the Act which provides for an exception in this regard. The complainantsmade a complaint to the Data Protection Commissioner.

Section 10(1)(a) states that Hthe Commissioner may investigate, or cause tobe investigated whether any of the provisions of this Act have been, arebeing or are likely to be contravened in relation to an individual eitherwhere the individual complains to hhn of a contravention of any of thoseprovisions or he is otherwise of the opinion thai there may be such acontravention" .

2

Section 10(1)(b) provides that where a complaint is made to theCommissioner he shall investigate it unless he is of the opinion that it isfrivolous or vexatious.

Correspondence then ensued between the Commissioner and the Appellantresulting in the Information Notice which is under appeaL The Appellantwould neither confirm nor deny if it held any data in relation to thecomplainants and maintains that position whilst relying on Section 22A ofthe Acts. It says that it comes under s 22A and so does not have to complywith the Information Notice. The Data Protection Commissioner's positionis that it has a statutory duty to investigate and cannot adjudicate without theinformation sought.

In my view the Information Notice is to enable the Data ProtectionCommissioner to investigate the complaint. T can see no reason why theInformation Notice is invalid in any respect and the reason that theinformation is required is self evident. The Data Protection Commissionerneeds to know if the Appellant has any such data and needs to see it in orderfor the Commissioner before he makes a decision if the Section 22Aexemption applies. It is for the Data Protection Commissioner to determinewhether or not s 22A, relied on by the Appellant, applies to the data.

Section 3 and Section 4 of the Acts are expressly covered by Section 22Abut Sections 10 and 12 are not so included and therefore Section 22A cannotbe invoked to prevent the Commissioner from exercising his statutory dutyor from issuing the Information Notice.

I dismiss the appeal and Order that the Appellant must comply with theInformation Notice dated ih December within 21 days.

Brendan Kirwan B.L.

3

P~k\i~Paul A. McDermott B.L.

THE CIRCUIT COURT

Record No 3452/08

DUBLIN CIRCUIT COUNTY OF THE CITY Of DUBLIN

IN THE MATTER Of THE DATA PROTECTION ACTS 1988 & 20,03

Between:-

HOSPITALlER ORDER Of ST JOHN OF GOD

Appellant

-and.,.

THE DATA PROTECTION COMMISSIONER

Summary of judgment of Linnane J. on 27 November 2008

Linnane J. allowed the appeal.

Linnane J. ruled that the right of the data subject under section 6A(1) to request a datacontroller to cease processing personal data if that processing is causing substantial·andunwarranted damage or distress to the data subject or another person is subject to theprovisions of Section 6A(3) which sets out certain grounds where the right does notapply.

Judge Linnane referred to Section 6A(3)(b)(iv) which provides that Section 6A(1) doesnot apply in circumstances where the processing of the data is necessary to protect thevital interests of the data subject. In this case Linnane J.accepted the arguments putforward by the Appellant and agreed that the continued processing of the data subject'spersonal data was necessary to protect her vital interests.

Linnane J" went on to rule that, even she is incorrect in her finding on the vita! interestspoint, an error was made by the Data Protection Commissioner in finding that thedistress caused to the data subject was unwarranted. She ruled that the Data ProtectionCommissioner had made an error, having carried out the necessary balancing exercisefor determining whether the processing was unwarranted or nor, in finding that therights of the data subject outweighed the legitimate interests of the Appellant.

Linnane J. made an order allowing the appeal in the terms of the Appellant's Notice ofMotion and stated that it followed that the Enforcement Notice and the draft decision of .the Data Protection Commissioner no longer had any effect. Linnane J. also grantedliberty to apply if there were any problems with the order made.

Costs were awarded to the Appellant.

CAK\1848606.2