Freely Available British and Irish Public Legal Information
[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback]
Irish Court of Appeal
You are here: BAILII >> Databases >> Irish Court of Appeal >> Doolin v The Data Protection Commissioner (Unapproved) [2022] IECA 117 (24 May 2022)
URL: http://www.bailii.org/ie/cases/IECA/2022/2022IECA117.html
Cite as: [2022] IECA 117
[New search] [Printable PDF version] [Help]
THE COURT OF APPEAL
UNAPPROVED
NO REDACTION NEEDED Neutral Citation No [2022] IECA 117
Court of Appeal Record Number: 2020/123
High Court Record Number: 2019/211CA
Circuit Court Record Number: 2018/5134
Noonan J.
Haughton J.
Ní Raifeartaigh J.
IN THE MATTER OF THE DATA PROTECTION ACTS, 1988 AND 2003 AND IN THE MATTER OF AN APPEAL UNDER SECTION 26 OF THE DATA PROTECTION ACTS, 1988 AND 2003
BETWEEN/
THE DATA PROTECTION COMMISSIONER
APPELLANT
-AND-
CORMAC DOOLIN
RESPONDENT
-AND-
OUR LADY’S HOSPICE AND CARE SERVICES
NOTICE PARTY
JUDGMENT of Noonan J. delivered on the 24th day of May, 2022
1. This appeal concerns the alleged misuse of data collected by a security camera on an employer’s premises for the purpose of disciplinary action against an employee. At the outset, it is worth noting that this is the third appeal brought in these proceedings from a decision of the appellant, the Data Protection Commissioner (“the DPC”) which concerns the use of data relating to the respondent in this appeal, Mr. Doolin. The DPC’s original decision, which was adverse to Mr. Doolin, was appealed by him to the Circuit Court, which dismissed the appeal. Mr. Doolin appealed to the High Court, which allowed the appeal. The DPC appeals to this Court against the judgment of the High Court. Following this judgment, there is the potential for a further appeal to the Supreme Court. Needless to say, the costs involved in all these appeals are very substantial and entirely disproportionate to the issue concerned, where there is no obvious necessity for such a multiplicity of appeals.
2. The resultant delays in the final determination of an issue that arose as far back as 2015 is unfair to the parties, particularly Mr. Doolin. This is not to mention the amount of scarce court time absorbed by this litigation. The situation arising in this case is by no means unique as there are other similar statutory provisions providing for such layers of appeal. It is to be hoped that the legislature will address this issue soon.
The Facts
3. Mr. Doolin was, at the relevant time, employed as a craftsman’s mate at Our Lady’s Hospice in Harold’s Cross by the Notice Party (“OLHCS”). On the 19th November, 2015, graffiti was discovered carved into a table in the staff tea room in a building at the Hospice, known as Anna Gaynor House, which read: “Kill all whites, ISIS is my life”. This discovery, coming as it did less than a week after the terror attacks at the Bataclan and elsewhere in Paris on the 13th November, 2015, caused considerable concern to OLHCS who contacted the Gardaí.
4. The tea room in question was accessible by the use of fobs issued to staff members, including Mr. Doolin, and the area outside the door was monitored by a CCTV camera. The Gardaí advised OLHCS to review the footage from this camera for a three-day period from the 17th to the 19th November, 2015 so as to identify all persons entering the tea room during that period. A viewing of the footage showed Mr. Doolin entering the room on a number of occasions, although there is no suggestion that Mr. Doolin had any involvement in the graffiti incident.
5. However, the information gathered from the CCTV footage suggested that Mr. Doolin accessed the room for the purpose of taking unauthorised breaks, and this subsequently became the subject of a disciplinary process against Mr. Doolin which resulted in a sanction. Arising from this, Mr. Doolin made a complaint to the DPC claiming that the use of the data from the CCTV constituted a breach of the Data Protection Act, 1988.
6. The footage was viewed on one occasion only on the 20th November, 2015 by two members of OLHCS management, Mr. Paul Gahan, Human Recourses Manager, and Mr. Tommy Beatty, Capital Projects Manager.
7. On the 26th November, 2015, OLHCS wrote to Mr. Doolin in a letter captioned “Re: Investigation into Offensive Graffiti”. The letter indicated that a formal investigation was being commenced into two matters, the graffiti and the use of unauthorised breaks.
8. The documents disclosed show that Mr. Gahan sent an email at 10.06am on the 26th November, 2015 asking a Deirdre Congdon that the letter being sent to persons under investigation should refer to two investigations, suggesting the earlier letter preceded it. A further letter was sent the next day, the 27th November, 2015, this time captioned “Re: Formal Investigations” in the plural. The letter was otherwise in similar terms save that, instead of referring to the use of unauthorised breaks, it now referred to accessing the room at unauthorised times.
9. On the 1st December, 2015, a formal investigation meeting was held with Mr. Doolin who was interviewed by Mr. Gahan and Mr. Beatty. Although some controversy subsequently emerged about the availability of the minutes of that meeting, that is no longer live in this appeal. The interview with Mr. Doolin appears to have been almost exclusively focused on the taking of unauthorised breaks. He was shown an image of the graffiti and asked if he had seen it on the table, but he said he did not notice anything on the table. Beyond that, the interview was concerned with when and why Mr. Doolin accessed the room. Mr. Beatty put the following question to him: -
“The Gardaí asked us to look at the CCTV for the days previous to identify if there was a pattern. It came to light that you had accessed the room for 55 minutes on the day in question, the day previous 46 minutes and 50 minutes on the Tuesday. Why were you in the room?”
10. This question appears to demonstrate that Mr. Beatty and Mr. Gahan obtained information from the CCTV as to the days on which Mr. Doolin was in the room and for how long he was there. Mr. Doolin was asked if he wanted to see the CCTV footage and he declined but he agreed that he had taken the breaks in question without telling his manager.
11. On the next day, the 2nd December, 2015, Mr. Gahan wrote to Mr. Doolin sending him a copy of the typed minutes of the interview. The letter was, perhaps surprisingly, captioned “Re: Investigation into Offensive Graffiti” reflecting the first letter of the 26th November, 2015 which Mr. Gahan sought to have amended, as noted above.
12. The investigation panel completed its report entitled “Final Investigation Outcome Report” on the 15th January, 2016. The description of the investigation on the title page is:
“Investigation into staff member (Cormac Doolin) accessing the Anna Gaynor House tea room at unauthorised times.”
13. The report notes that CCTV footage and fob access to the room in question were examined. It appears that the fob access is recorded so that times of entry were available to the investigation panel. As the title to the report makes clear, it was concerned solely with access by Mr. Doolin to the room at unauthorised times and not with any investigation of Mr. Doolin in connection with the graffiti.
14. In that regard, the report expressly refers to the panel having reviewed the CCTV footage and produces a table in the body of the report showing that Mr. Doolin accessed the room on one occasion on each of the 17th, 18th and 19th November, 2015. In respect of each occasion, the date is given, the time of the access, the time leaving the room and the duration of the stay in the room. With regard to the times given, the report observes:
“Times of Unauthorised Access
The panel noted that CCTV footage timings are running approximately 16 minutes fast.”
15. This appears to be a reference to the fact that the panel was able to identify accurate timings from the fob records to establish that the timings on the CCTV were 16 minutes ahead of real time. The outcome of the report was:
“Outcome
Following a comprehensive consideration of the information obtained during this investigation the panel have established on the balance of probabilities that unauthorised breaks were taken by Mr. Cormac Doolin on the afternoons of Tuesday 17th, Wednesday 18th and Thursday 19th November 2015.”
16. The investigation outcome thus makes clear that it was solely concerned with the taking of unauthorised breaks and in fact makes no reference to any findings in connection with the graffiti. Mr. Doolin subsequently received a disciplinary sanction.
17. It is also relevant to note that in September 2012, OLHCS published its Policy on Closed Circuit Television. The introduction states as follows:
“The use of Closed Circuit Television (CCTV) in OLH&CS is part of the operational system for security. The appropriateness of using CCTV on OLH&CS premises was assessed as part of the commissioning process and was informed by historical experience on the hospice campus. The purpose of the system is to prevent crime and promote staff security and public safety.
OLH&CS ensures that its use of CCTV is carefully governed is (sic) in line with the Data Protection Act 1998 & 2003 and other relevant legislation.” (my emphasis)
18. A sign was placed beside each camera which read:
“Images are recorded for the purposes of health and safety and crime prevention.”
The Relevant Legislation
19. This case is primarily concerned with the provisions of Section 2(1)(c)(ii) of the Data Protection Act 1988 as amended by the Data Protection Act 2003. These have now been replaced by the Data Protection Act 2018 which gives effect to Regulation (EU) 2016/679 (General Data Protection Regulation) which contains similar provisions, so the issue arising here continues to have relevance.
20. Section 2 of the 1988 Act, as amended and insofar as relevant here, provides as follows:
“(1) A data controller shall, as respects personal data kept by him or her, comply with the following provisions:
(a) the data or, as the case may be, the information constituting the data shall have been obtained, and the data shall be processed, fairly,
(b) the data shall be accurate and complete and, where necessary, kept up to date,
(c) the data —
(i) shall have been obtained only for one or more specified, explicit and legitimate purposes,
(ii) shall not be further processed in a manner incompatible with that purpose or those purposes,
(iii) shall be adequate, relevant and not excessive in relation to the purpose or purposes …”
21. Section 1 of the 1988 Act provides various relevant definitions including that of “data”, which equates to information in a form in which it can be processed.
22. Central to this appeal is the definition of “processing” which is as follows:
“ ‘Processing’ of or in relation to information or data, means performing any operation or set of operations on the information or data, whether or not by automatic means, including-
(a) obtaining, recording or keeping the information or data,
(b) collecting, organising, storing, altering or adapting the information or data,
(c) retrieving, consulting or using the information or data,
(d) disclosing the information or data by transmitting, disseminating or otherwise making it available, or
(e) aligning, combining, blocking, erasing or destroying the information or data;”
23. Section 2D of the 1988 Act, as inserted by the 2003 Act, upon which some reliance is placed by Mr. Doolin, provides in relevant part:
“(1) Personal data shall not be treated, for the purposes of section 2(1)(a) of this Act, as processed fairly unless —
(a) in the case of data obtained from the data subject, the data controller ensures, so far as practicable, that the data subject has, is provided with, or has made readily available to him or her, at least the information specified in subsection (2) of this section …
(2) The information referred to in subsection (1)(a) of this section is:
…
(c) the purpose or purposes for which the data are intended to be processed…”
The DPC
24. Following upon the events described above, on the 17th June, 2016 Mr. Doolin made a complaint to the DPC (the functions of the DPC have now been transferred to the Data Protection Commission by virtue of the Act of 2018). The decision of the DPC was issued on the 27th July, 2018. It summarises the complaint in the following terms:
“You submitted a complaint dated 17 June 2016 to this office alleging that your employer, OLH&CS, used CCTV footage of you to sanction you for taking unauthorised breaks… You acknowledged that OLH&CS had a legitimate reason to view the CCTV footage in order to investigate the graffiti incident in line with its CCTV policy. However, you expressed objection to the CCTV subsequently being used for the monitoring of staff and for disciplinary proceedings, as this was not a stated purpose in OLH&CS’s CCTV policy and not in line with Section 2(1)(c) of the Acts.”
25. At para. 2, the DPC notes that:
“The data in question was personal data relating to you (consisting of your image held on CCTV footage) as you can be identified from it and the data relates to you as an individual.”
This observation is important as it reflects the view of the DPC that the data relating to Mr. Doolin which were the subject of the complaint were confined to his image on the CCTV, a point to which I will return.
26. The decision goes on to note (at para. 5) that the DPC was advised by OLHCS that the disciplinary action that was taken against Mr. Doolin was on the basis of admissions made by him and not on foot of the CCTV footage, which was not downloaded following the single viewing.
27. The DPC considered that the purpose for which the CCTV was viewed, in furtherance of the investigation into the graffiti incident, was a legitimate purpose (at para. 24):
“This Office is satisfied that the processing of your personal data in the form of a limited viewing of the relevant CCTV footage, without downloading or further processing of any kind was necessary for this purpose and did not go beyond the stated purpose.” (my emphasis)
28. It is also notable from the decision that the DPC consistently refers to “an investigation” having been undertaken by OLHCS, rather than “investigations”.
29. At para. 26, the DPC reached her conclusions in the following terms:
“I also considered whether the requirements of Section 2(1)(c)(ii) of the Acts had been met by OLH&CS. This requires that personal data must not be processed for purposes other than the purpose for which it was originally collected. In this case, I am satisfied that your images captured on CCTV were processed in connection with the investigation of a security incident when they were initially viewed by the investigation team for that purpose alone. The information gathered from that viewing may subsequently have been used for another purpose, i.e. disciplinary proceedings against you, but this in my view does not constitute a different purpose, because the CCTV images were not further processed for that second purpose. If the images were further processed for that second purpose, for example by downloading and use in the disciplinary proceedings against you, it might constitute further processing for a different purpose, but that did not happen in your case and no further processing of your images occurred for the second purpose.
27. Accordingly, I find that the limited viewing of your personal images took place exclusively for the security purpose for which the images were originally collected and that no contravention of Section 2(1)(c)(ii) occurred.”
30. The DPC accordingly found that no breach of the Data Protection Acts had occurred. As can been seen from the foregoing comments, the DPC considered that Mr. Doolin’s data were confined to the CCTV images and beyond the first and only viewing of those, no further processing occurred. This is strongly disputed by Mr. Doolin for reasons which will become apparent.
The Circuit Court
31. As noted in the DPC’s decision, an appeal from her determination lay to the Circuit Court under s. 26 of the Act. That appeal was heard by the Circuit Court (Her Honour Judge Linnane) on the 1st May, 2019.
32. The matter proceeded in the normal way on affidavit. Mr. Doolin’s grounding affidavits were responded to by Mr. John V. O’Dwyer, Deputy Commissioner in the Office of the DPC. Mr. O’Dwyer’s first affidavit was sworn on the 7th February, 2018. At para. 8, he refers to the minutes of the interview with Mr. Doolin on the 1st December, 2015 and avers:
“8. … It is clear from the minutes that the investigation meeting was concerned with the security issues presented by the graffiti incident and that the issue of the taking of unauthorised breaks at unauthorised locations arose and was addressed in this context. Having regard to the purpose and stage of the investigation, it would appear that the issues were clearly and closely related. Contrary to what the Appellant has asserted at paragraph 5 of the Grounding Affidavit, there was no ‘unlawful further processing of the CCTV footage’. Insofar as the CCTV footage formed the basis for the investigation meeting, it was on foot of its processing for security purposes, to include those relating to the investigation of the graffiti incident, the appropriateness of which the Appellant has acknowledged.”
33. These averments by Mr. O’Dwyer are, in reality, comments based on his interpretation of the minutes of the meeting of the 1st December, 2015. It seems to me that this court is equally well-equipped to interpret those minutes and, with respect to Mr. O’Dwyer, it is not at all clear to me that the meeting was solely concerned with security issues or issues relating to security. As I have noted already, while the graffiti incident was mentioned, the primary focus of the meeting appears to have revolved around the taking of unauthorised breaks by Mr. Doolin. How this is said to be a security issue or related to a security issue is not explained by Mr. O’Dwyer, nor has it ever been explained by OLHCS. It is certainly not explained in the Panel Report following this meeting in which the graffiti incident barely merits a mention. However, Mr. O’Dwyer repeats the same assertions at para. 11 which again are really little more than a statement of his opinion on the matter.
34. As noted, one central feature of this case is that it has never been explained by OLHCS, or indeed the DPC, how the taking of unauthorised breaks is said to amount to a security issue. It will be recalled that the OLCHS’s policy document on CCTV specified that its purpose was to prevent crime and promote staff security and public safety. The word “security” in its natural and ordinary meaning, may be taken to refer to a danger or threat to the safety of persons and/or property. It has never been explained how it is said that the taking of unauthorised breaks by Mr. Doolin presented a danger or threat to the safety of persons at the Hospice, be they staff or visitors, or the property of the Hospice or any person present there.
35. There may of course be circumstances in which one might infer a security risk arising from the taking of unauthorised breaks by, say, a security guard who left the property unsupervised for a period of time. None of that arises in Mr. Doolin’s case so it is far from clear or obvious, in the absence of explanation, how the taking of unauthorised breaks by him could constitute a security issue or be related to such an issue.
36. In an affidavit replying to Mr. O’Dwyer’s first affidavit, Mr. Doolin makes a number of observations including the fact that, during the course of the investigation into the graffiti incident, OLHCS amended its CCTV policy by the amendment of the introductory paragraph in the following terms:
“The purpose of the system is to prevent crime and promote staff security and public safety. If, in the event of viewing CCTV for the specified purpose, a disciplinary action is observed, the CCTV can be used for the purpose of a disciplinary investigation. However, CCTV will not be viewed solely for the purpose of monitoring staff.”
37. The sole affidavit sworn on behalf of the notice party was sworn by Ms. Pat Pierce, its Data Protection Officer, who says that sanctions were imposed on Mr. Doolin as a result of his admissions made at the meeting of the 1st December, 2015. As already averred by Mr. O’Dwyer, Ms. Pierce reiterates that Mr. Doolin’s data were processed/reviewed on one occasion only arising out of the single viewing.
38. Mr. O’Dwyer swore a third affidavit on the 21st March, 2019. In paragraph 5 of this affidavit, Mr. O’Dwyer avers as follows:
“On the basis of the evidence before the court, I say that it is clear beyond doubt that the processing of the CCTV footage by OLHCS was for security purposes, arising directly from and relating to the investigation of the graffiti incident. It is clear that, in the particular circumstances of this case, the taking of unauthorised breaks at an unauthorised location, the site of the graffiti incident, was a serious and bona fide security issue and that the investigation by OLHCS, and the disciplinary action which resulted therefrom, arose directly out of and was directly connected to this security issue, albeit that the sanction applied in the context of the disciplinary action relied on admissions made by the applicant himself.”
39. As is subsequently pointed out in the judgment of the High Court, this averment by Mr. O’Dwyer is, to say the least, somewhat surprising. He appears to go considerably further than in his previous affidavits, and indeed than Ms. Pierce, the notice party’s own Data Protection Officer, in suggesting that the taking of unauthorised breaks at an unauthorised location was a serious and bona fide security issue. What is more, Mr. O’Dwyer feels able to express this conclusion “on the basis of the evidence before the Court”. However, as in his previous affidavits, I cannot see any justification for this statement that is to be found in the evidence before the Circuit Court. A similar conclusion was reached by the High Court as will become apparent.
40. Following the hearing, Judge Linnane gave an ex tempore ruling. She appears to have accepted that OLHCS carried out one investigation only (at Transcript, p. 93):
“It’s clear to me, as I say, that the processing of the footage was for that purpose, namely security, arising directly from and relating to the investigation of the graffiti incident.”
41. She relied for that conclusion on the averment of Mr. O’Dwyer to which I have referred and apparently also for the following statement (at Transcript, p. 94 and 95):
“Clearly, it was a security issue, Mr. Doolin being in an unauthorised place taking unauthorised breaks. In effect, he admitted a breach of security, i.e. by taking the unauthorised breaks. The disciplinary action was taken on his admissions …
I accept in the circumstances [counsel for the DPC’s] submission that the disciplinary action by his employer against Mr. Doolin was taken for security purposes. In fact I also accept, as has been argued, that there was one investigation, i.e. the graffiti incident, not two investigations, as argued by Mr. Doolin’s counsel. In all the circumstances, taking into account the facts of this case, I’m satisfied that Mr. Doolin has not established that he has satisfied the test for having this decision of the Data Protection Commission overturned. Accordingly, I am dismissing his appeal.”
The High Court
42. Mr. Doolin appealed to the High Court on a point of law as provided for in s. 26(3)(b) of the 1988 Act.
43. The High Court judge set out the background and chronology to the matter, noting as follows with regard to the Panel Report (at para. 12):
“The following observations may be made about the Panel Report. The Report is solely in respect of the investigation relating to staff members accessing the room at unauthorised times. It clearly relies inter alia directly on the CCTV footage, identifying as it does the precise times of entry and exit. Accordingly, it wholly undermines the claim of OLHCS that the investigation into unauthorised access was solely made on the basis of admissions. Finally, there is no reference at all to unauthorised access to the staff room being a security issue contrary to the averments of Mr. O’Dwyer of the DPC discussed below.”
44. The judge then set out the legal framework and in particular, the purpose limitation principle appearing in s. 2(1)(c)(ii) of the Act which transposes Art. 6(1)(b) of Directive 95/46/EC (“the “Data Protection Directive”). She also made extensive reference to the opinion of the Working Party 29 Group to which I will refer further, concerning the concept of purpose limitation.
45. The judge referred to four key factors identified by the Working Party to be considered during the compatibility assessment, the judge recognising that processing for a different purpose is not automatically incompatible but must be assessed on a case-by-case basis. The judge then referred to the decision of the DPC noting (at para. 32):
“It is clear from the Decision that the exclusive basis upon which it was found that no further processing had occurred was that the CCTV images had not been viewed in the disciplinary proceedings against the appellant. The Decision did not engage with what the Appellant had clearly stated in his email of 10 December 2017, i.e. that it was not CCTV footage that was used to sanction him but rather data retrieved and processed from the CCTV footage.”
46. The judge referred to Mr. O’Dwyer’s third affidavit, mentioned above, in the following terms (at para. 39):
“On 21st March 2019, the defence of the proceedings by the DPC took an unexpected turn. Mr. O’Dwyer swore a third affidavit on 21st March 2019 at which stage he identified a new basis for the further processing by OLHCS not identified by OLHCS either in the summary given by the DPC of the submissions made to it by OLHCS, in the Affidavit of Mr. (sic) Pierce, in the Panel Report or in any of the material exhibited to this appeal.”
47. In dealing with the evidential basis for the decision of the Circuit Court, the High Court was critical of the fact that the primary defence of the DPC now advanced was that the further use of the information gathered from the CCTV was in fact used for its original purpose i.e. security. She said that this marked a significant departure from the approach adopted in the Decision itself where the sole justification for rejecting the complaint was that although the material may in fact have been used for a different purpose, it was not further processed for that second purpose. She found that conclusion to be erroneous as a matter of law and considered that there had been a surprising shift in the approach of the DPC during the life of the proceedings.
48. The Court said (at para. 42):
“The DPC has gone from finding no breach because there was no further processing of the CCTV footage to asserting in these proceedings no breach because any further processing was done for the purpose for which the material was collected i.e. security.”
49. She described this new argument as “remarkable” because there was no evidence at all to support that argument, which became the sole basis for the rejection by the Circuit Court of the appeal.
50. In commenting on what she perceived as this inconsistency, the judge was of the view that the Circuit Court did not appear to have examined the underlying documents, including the Panel Report, the submissions of OLHCS to the DPC or the absence of any averment relating to security in the affidavit of Ms. Pierce of the 8th March, 2019. She continued (at para. 46): -
“A consideration of this material discloses that, as far as I can ascertain, at no point in time did OLHCS ever justify the further processing of the material gleaned from the CCTV footage in the disciplinary proceedings on the basis of security concerns. Rather, it (a) made the point that the CCTV footage itself was only viewed for security purposes and (b) that the disciplinary proceedings did not employ material derived from the footage but were based exclusively on admissions made by the Appellant at the interview on 1 December 2015. The idea that the use of the information obtained from the CCTV footage in the context of the disciplinary proceedings was for security purposes rather than for disciplinary purposes does not find a basis in any of the material before me. There is simply no evidence at all to this effect. Perhaps most significantly, as noted in my review of the exhibited material above, the Panel Report makes no reference whatsoever to unauthorised access to the tea room or unauthorised breaks being a security issue.”
51. Although the judge felt that the issue of whether there were one or two investigations was not particularly relevant, it appeared on balance that there were in fact two. At para. 50, the judge said:
“… [T]he evidence indicates that the use of the information from the CCTV footage in the context of the disciplinary hearing was used for an entirely different purpose to that for which it was collected.”
52. The judge said that had the CCTV material been intended to be used for disciplinary purposes as well as the other purpose identified, that would require to be identified, as was subsequently done on the policy amendment. Her review of the decision led her to conclude as follows:
“52. In summary the CCTV footage was collected for the express and exclusive purpose of security and was used (permissibly) for that purpose but was also used for a distinct and separate purpose, i.e. disciplinary proceedings into unauthorised breaks by an employee.
53. In the premises, it seems to me that there was no evidence upon which the Circuit Court could safely conclude that the further processing in the context of the disciplinary hearing was for security purposes, since the sole basis for this finding i.e. the averments of Mr. O’Dwyer in his third affidavit, were not themselves grounded on any material put forward by OLHCS.
54. I am therefore overturning the decision of the Circuit Court on the basis that there was no evidence for the conclusion that the disciplinary action, in which information derived from the CCTV footage was used, was carried out for security purposes.”
53. Separately, the judge was of the view that Mr. O’Dwyer’s averment to the effect that the sanction applied in the context of the disciplinary action relied on admissions made by the appellant himself was difficult to understand in circumstances where the Panel Report made no reference to admissions but rather expressly referred to a consideration of the CCTV footage and the information concerning the entry and exit dates and times which came from that footage and the fob access.
54. In dealing with the alleged breach of s. 26(1)(c)(ii), the High Court said that it was indisputable that the information contained in the CCTV footage was used for a different purpose than the one for which the data were originally collected. The fact that it was not downloaded does not mean that no further processing took place. She therefore considered contrary to the DPC’s findings, the CCTV images were further processed.
55. She accordingly allowed the appeal.
The Appeal to This Court
56. The first point that arises for consideration is whether an appeal to this court is available at all.
57. Mr. Doolin argues that it is not, by virtue of s. 39 of the Courts of Justice Act, 1936 which regulates appeals from the Circuit Court to the High Court and provides that such appeals shall be final and conclusive and not appealable. Certain well-known authorities are relied on in that regard - see Kinahan v Baila (Unreported, Supreme Court, 18th July 1985), Pepper Finance Corporation v Cannon [2020] IESC 2 and Bank of Ireland v Gormley [2020] IECA 102. Although Mr. Doolin objected to the DPC’s appeal on this basis both in his respondent’s notice and written submissions, it was however conceded at the hearing of the appeal by counsel for Mr. Doolin that reliance was no longer being placed on this point.
58. I think that concession was made properly. Prima facie, the position is that all judgments of the High Court are appealable to this Court by virtue of Art. 34.4.1 of the Constitution. Of particular significance also are the provisions of s. 26(3) of the 1988 Act itself which provides as follows:
“(a) Subject to paragraph (b) of this subsection, a decision of the [Circuit Court] under this section shall be final.
(b) An appeal may be brought to the High Court on a point of law against such a decision; and references in this Act to the determination of an appeal shall be construed as including references to the determination of any such appeal to the High Court and of any appeal from the decision of that Court.” (my emphasis)
59. Accordingly, the statute itself appears to expressly recognise that an appeal does indeed lie to this Court from the High Court.
60. There was little dispute between the parties as to the correct legal principles to be applied to a statutory appeal of this kind. The High Court relied on Deely v Information Commissioner [2001] 3 IR 439 where McKechnie J., then a judge of the High Court, said the following regarding appeals to that court on a point of law (at 452):
“There is no doubt but that when a court is considering only a point of law, whether by way of a restricted appeal or via a case stated, the distinction in my view being irrelevant, it is, in accordance with established principles, confined as to its remit, in the manner following:-
(a) it cannot set aside findings of primary fact unless there is no evidence to support such findings;
(b) it ought not to set aside inferences drawn from such facts unless such inferences were ones which no reasonable decision making body could draw;
(c) it can however, reverse such inferences, if the same were based on the interpretation of documents and should do so if incorrect; and finally;
(d) if the conclusion reached by such bodies shows that they have taken an erroneous view of the law, then that also is a ground for setting aside the resulting decision.”
61. This approach was subsequently approved by the Supreme Court in Sheedy v Information Commissioner & Ors. [2005] 2 IR 272.
62. The form that such an appeal should take was discussed by the Supreme Court in Orange Limited v Director of Telecoms (No. 2) [2000] 4 IR 159 where Keane C.J. said (at 184-5):
“In short, the appeal provided for under this legislation was not intended to take the form of a re-examination from the beginning of the merits of the decision appealed from culminating, it may be, in the substitution by the High Court of its adjudication for that of the first defendant. It is accepted that, at the other end of the spectrum, the High Court is not solely confined to the issues which might arise if the decision of the first defendant was being challenged by way of judicial review. In the case of this legislation at least, an applicant will succeed in having the decision appealed from set aside where it establishes to the High Court as a matter of probability that, taking the adjudicative process as a whole, the decision reached was vitiated by a serious and significant error or a series of such errors. In arriving at a conclusion on that issue, the High Court will necessarily have regard to the degree of expertise and specialised knowledge available to the first defendant.”
63. In the context of appeals to the Circuit Court against decisions of the DPC, the Supreme Court held in Nowak v The Data Protection Commissioner [2016] 2 IR 585 that the standard of review identified by Keane C.J. in Orange was the appropriate standard to apply.
64. In the course of oral submissions in this court, counsel for the DPC said that his case rested upon three fundamental propositions:
(a) The CCTV footage was viewed on one occasion only for the purpose specified in the Hospice CCTV Policy, namely security, and was not further processed thereafter. Accordingly, no breach of the 1988 Act occurred.
(b) Alternatively, if the CCTV footage was further processed by OLHCS, it was so processed for the purpose of the Hospice policy, namely for a security purpose.
(c) In the further alternative, if the court came to the conclusion that the CCTV footage was further processed and such processing was not for a security purpose, then it was for a purpose that was not incompatible with the security purpose.
The Article 29 Working Party
65. Article 29 of the Data Protection Directive of 1995 is entitled “Working Party on the Protection of Individuals with regard to the Processing of Personal Data”. Article 29.1 provides:
“1. A Working Party on the Protection of Individuals with regard to the Processing of Personal Data, hereinafter referred to as “the Working Party”, is hereby set up.
It shall have advisory status and act independently.”
66. The Working Party is in fact an expert group comprising data regulation experts from different Member States. Since the advent of GDPR, the same group has now been rebranded as the European Data Protection Board. Its function is set out in Art. 30 as including advising the European Commission on issues related to data protection. It prepares an annual report on data protection in the EU and third countries which is transmitted to the Commission, the European Parliament and the Council of Europe and is published. Its views and opinions have no particular legal status but are clearly influential and persuasive in the context of interpreting the Directive.
67. As the High Court judge pointed out, the issue arising in this case has not been to date the subject of any decision of the Court of Justice of the European Union or of our national courts. Accordingly, the High Court considered, and I agree, that regard can be had to the views of the Working Party as an aid to the interpretation of the Directive and national legislation which implements it, such as the 1988 Act.
68. On the 2nd April, 2013, the Working Party issued an opinion on purpose limitation which is quoted in some detail by the High Court judge. It is a lengthy document but helpfully contains an executive summary which states (at p. 3):
“Purpose limitation protects data subjects by setting limits on how data controllers are able to use their data while also offering some degree of flexibility for data controllers. The concept of purpose limitation has two main building blocks: personal data must be collected for ‘specified, explicit and legitimate’ purposes (purpose specification) and not be ‘further processed in a way incompatible’ with those purposes (compatible use).
Further processing for a different purpose does not necessarily mean that it is incompatible: compatibility needs to be assessed on a case-by-case basis. A substantive compatibility assessment requires an assessment of all relevant circumstances. In particular, account should be taken of the following key factors:
- the relationship between the purposes for which the personal data have been collected and the purposes of further processing;
- the context in which the personal data have been collected and the reasonable expectations of the data subjects as to their further use;
- the nature of the personal data and the impact of the further processing on the data subjects;
- the safeguards adopted by the controller to ensure fair processing and to prevent any undue impact on the data subjects.
Processing of personal data in a way incompatible with the purpose as specified at collection is against the law and therefore prohibited.”
69. The High Court cited a passage dealing with the general framework for compatibility assessment which need not be reproduced.
70. As appears above, one of the key factors to be considered in the compatibility assessment is the expectation of the data subjects as to the further use of their data. In this regard, the Working Group observes (at p. 24):
“The second factor focuses on the specific context in which the data were collected and the reasonable expectations of the data subjects as to their further use based on that context. In other words, the issue here is what a reasonable person in the data subject’s situation would expect his or her data to be used for based on the context of the collection.”
71. Annex 4 to the opinion gives a number of illustrative examples of this factor, the first of which appears at p. 56 as follows:
“Example One: Chatty Receptionist Caught on CCTV
A company installed a CCTV camera to monitor the main entrance to its building. A sign informs people that CCTV is in operation for security purposes. CCTV recordings show that the receptionist is frequently away from her desk and engages in lengthy conversations while smoking near the entrance area covered by the CCTV cameras. The recordings, combined with other evidence (such as complaints), show that she often fails to take telephone calls, which is one of her duties.
Apart from any other CCTV concerns that may be raised by this case, in terms of the compatibility assessment it can be accepted that a reasonable data subject would assume from the notice that the cameras are there for security purposes only. Monitoring whether or not an employee is appropriately carrying out her duties, such as answering phone calls, is an unrelated purpose which could not be reasonably be expected by the data subject. This gives a strong indication that the further use is incompatible. Other factors, such as the potential negative impact on the employee (for example, a possible disciplinary action), the nature of the data (video-footage), the nature of the relationship (employment context, suggesting imbalance in power and limited choice), and the lack of safeguards (such as, for example, notice about further purposes beyond security) may also contribute to and confirm this assessment.”
Were Mr. Doolin’s data processed more than once?
72. The first issue arising is whether Mr. Doolin’s data were processed more than once. The DPC was of the view that they were not. In my opinion, there is a manifest error in that conclusion, which is serious and significant.
73. The DPC found that the data in question were confined to the image of Mr. Doolin on the CCTV footage. However, that footage disclosed information, or data, concerning Mr. Doolin beyond merely his image. As the Panel Report records, it also disclosed where Mr. Doolin was and when he was there. It disclosed, whether by itself or in combination with the fob access records, the dates and times when Mr. Doolin entered the staff tea room, the dates and times when he left the staff tea room and the duration of his stay in the room. These are all specific pieces of information, or data, personal to Mr. Doolin above and beyond merely his image.
74. Further, specific reliance was placed on these pieces of information or data to support the disciplinary process pursued by OLHCS against Mr. Doolin.
75. The definition of “processing” appearing in s. 1 of the Act identifies five separate operations, or sets of operations, that are to be regarded as “processing”. The first, (a), includes obtaining or recording the information or data. Thus, the first processing of Mr. Doolin’s data took place when the data were obtained by being recorded on the CCTV footage. The DPC found in her decision, and argued again in this court, that this was not to be regarded as processing and that the first processing occurred with the viewing of the CCTV footage.
76. That does not appear to me to be consistent with the language of the 1988 Act which in the definition of “processing” at (a) expressly provides that obtaining data is processing. This is also consistent with the language of s. 2(1)(c) which provides at (i) that the data shall have been obtained for specified purposes and at (ii) that it shall not be further processed in a manner incompatible with that purpose or purposes. Clearly “further” processing can only occur after prior processing which suggests that the obtaining of the data must be regarded as a prior or first processing.
77. A second processing took place when those data were retrieved and consulted by being viewed by Mr. Gahan and Mr. Beatty (subparagraph (c) of the definition of “processing”). The third processing occurred when the data relating to the dates and times of access/egress by Mr. Doolin to and from the staff tea room were used by being tabulated in the Panel Report for the purpose of supporting a disciplinary sanction against him, (also subparagraph (c)).
78. It is thus clear to my mind that the proposition that his data were processed on one occasion only, by one viewing of the CCTV footage, cannot be correct, as the High Court found.
79. The next issue that thus arises is whether the data were further processed for the specified purpose, namely security.
Were Mr. Doolin’s data processed for the specified purpose?
80. As the High Court held, it seems to me that the critical error in the DPC’s Decision at the outset was in determining that the personal data in issue were confined to Mr. Doolin’s image. This inevitably led to further error, in particular with regard to whether there was further processing or not. Further, the DPC appears to have considered that there was one investigation only into the security issue and therefore the outcome of that investigation must be regarded as security related and thus satisfied the purpose specification.
81. Here again, I agree with the conclusion of the High Court that there were plainly two investigations or at minimum, one investigation into two different matters. The suggestion that the disciplinary investigation arose out of admissions made by Mr. Doolin at the interview on the 1st December, 2015 is manifestly incorrect as the evidence clearly demonstrates that the investigation commenced before that date and thus could not have originated from the admissions.
82. Because there were two investigations, it cannot be said that the investigation, singular, was for the purpose of security and by definition, its outcome must be for the same purpose. As I have pointed out already, the title of the Panel Report does not even purport to refer to security but in terms, describes the report as an “investigation into staff member (Cormac Doolin) accessing the Anna Gaynor House Tea Room at unauthorised times.”
83. It is clear to me therefore that the processing of Mr. Doolin’s data was not for a security purpose as the DPC contends. It was manifestly for a different purpose as the High Court judge found, but of course that is not the end of the inquiry. It is necessary thereafter to carry out a compatibility assessment and, in this regard, the DPC is critical of the High Court for failing to take this additional necessary step.
Were Mr. Doolin’s data processed for a purpose that was not incompatible?
84. It will be recalled that the High Court held that the evidence indicated that the use of the information from the CCTV footage was used for an entirely different purpose to that for which it was collected. The DPC is correct in arguing that the mere fact that the data were used for a different purpose does not mean that the use was unlawful. It is only where the further processing occurs in a manner incompatible with the stated purpose that an illegality arises.
85. It does seem to me from the fact that the judge said at several places in her judgment that Mr. Doolin’s data were used for an entirely different purpose to the specified purpose, it might reasonably be inferred that the judge implicitly considered the use of the data to have been incompatible with the specified purpose. This would also appear to follow from the fact that the judge made explicit reference to the Working Party opinion on the issue of compatibility so that it could not be said that the judge overlooked the issue. In fairness to the judge, it should also be remembered that neither the DPC nor the Circuit Court carried out any compatibility analysis and in fact never reached that point as a result of the erroneous finding that Mr. Doolin’s data were not processed further following the single viewing of the CCTV.
86. Even were it correct to say that the failure of the High Court to carry out a compatibility analysis was erroneous, on one view of matters the case should be remitted to the High Court to enable that analysis to be conducted. However, both parties urged on this court that rather than remitting the matter, the court should determine the issue itself. I think this is the sensible course, particularly in light of the comments I have made at the outset concerning the cost and delay that have been incurred in these proceedings to date.
87. It was urged on the court by the DPC that there could be no doubt but that the initial viewing of the CCTV was for a legitimate security purpose, namely that of identifying the perpetrator of the graffiti as advised by An Garda Síochána. The DPC argues that there is no analogy arising between the facts here and those of the example given by the Working Party, despite the obvious similarities. The critical distinction, it is said, is that in the Working Party example, the employer had no valid reason to view the CCTV and did so for the improper purpose of monitoring an employee. That does not arise here as the viewing was clearly legitimate.
88. Further, it was said that every employee entering the room for a defined period of time had to be regarded as a suspect for the graffiti incident, including Mr. Doolin, and accordingly the unauthorised access had a clear security dimension and was integral to the investigation of the graffiti. It must follow, it was argued, that even if the disciplinary process was not expressly for a security purpose, it was for a related purpose and thus not incompatible with the specified purpose.
89. Counsel for the DPC suggested that on the logic of Mr. Doolin’s argument, if he had been detected on the CCTV actually carving the graffiti into the table, while he might be amenable to criminal sanction, he could not be disciplined for the same thing. While there may be a superficial attraction to that argument, I think, on analysis, it is misconceived. In such a scenario, the employee would face the disciplinary process for doing the very thing which gave rise to the security issue in the first place. In that event it could not be argued that the CCTV was being used for an unspecified purpose or one that was incompatible.
90. That appears to me however to be a world away from this case. The fact that the viewing of the CCTV here was for the purpose of attempting to detect the perpetrator of the offensive graffiti and damage to Hospice property is entirely irrelevant to the incidental observation of Mr. Doolin taking unauthorised breaks. As I have already said, and as the High Court found, there was absolutely no evidence that the taking of such breaks represented a security issue in itself.
91. The logical conclusion of that argument is that, if, for example, another employee was picked up on the camera smoking a cigarette in the corridor outside the tea room, contrary to Hospice rules, the CCTV could equally be availed of to discipline that person. In that scenario, the purpose of the original viewing remains legitimate and on the DPC’s argument, it would follow that the processing of the data relating to the employee caught smoking must be regarded as related to, and not incompatible with, the security purpose. That, in my view, cannot be correct.
Conclusions
92. Central to the analysis, as the Directive and the 1988 Act make clear, is the concept of notification of the purpose to the data subject. There is no dispute here but that the security purpose, being the only specified purpose, was clearly identified in both the OLHCS CCTV policy and the notices beside the cameras themselves. Section 2D of the Act, cited above, makes clear that personal data shall not be treated as processed fairly unless the data subject is made aware, at or before the time when the data is obtained, of the purpose for which the data are intended to be processed.
93. The Working Party opinion identifies, as one of the key factors in the compatibility assessment, the reasonable expectations of the data subject as to the further use of their data. It seems to me that it could not reasonably be said in the present case that Mr. Doolin had either been notified that the CCTV could be used for disciplinary purposes or that there was any basis upon which he ought reasonably to have expected such use. It seems to me the contrary is much more likely to be the case.
94. Insofar, therefore, as it may be correct to say that the High Court overlooked the compatibility analysis, in my judgment it is clear in the present case that Mr. Doolin’s data were indeed used for a purpose other than, and incompatible with, the specified purpose. It follows therefore that such use was unlawful.
95. I am therefore in agreement with the findings of the High Court and accordingly I would dismiss this appeal.
96. With regard to costs, as Mr. Doolin has been entirely successful, it would seem to follow that he is entitled to the costs of this appeal. If the DPC wishes to contend for a different order, she will have liberty to apply within 14 days of the date of this judgment for a short supplemental hearing on costs. If such hearing is requested and does not result in an order different from that proposed, the DPC may additionally be liable for the costs of the supplemental hearing. In default of such application, an order in the terms proposed will be made.
97. As this judgment is delivered electronically, Haughton and Ní Raifeartaigh JJ. have indicated their agreement with it.
Result: Appeal Dismissed