Irish Court of Appeal

 

 

 

UNAPPROVED

THE COURT OF APPEAL

Neutral Citation Number [2022] IECA 95

Appeal Record Number: 2018/419

 

 

Faherty J.

Ní Raifeartaigh J.

Pilkington J.

 

 

BETWEEN/

 

AGNIESZKA NOWAK

 

APPELLANT

 

- AND –

 

 

THE DATA PROTECTION COMMISSIONER

 

RESPONDENT

 

 

 

Judgment of Ms. Justice Faherty delivered on the 13^th day of April 2022

 

 

1.              This matter comes before the Court by way of an appeal from the Order of the High Court (McDermott J.) of 26 July 2018 dismissing the appellant’s (hereinafter “the appellant” or “Ms. Nowak”) appeal on a point of law against the judgment and Order of the Circuit Court (Groarke P.) made on 6 February 2018 in which Ms. Nowak’s appeal against a decision of the respondent (hereinafter “the Data Protection Commissioner” or “the Commissioner”) of 9 December 2016 was dismissed. 

Background

2.             The background to the matter is as follows:  the appellant submitted a subject access request (“the Access Request”) to her former employer, Intesa Sanpaolo Life Limited (“ISPL”) on 7 September 2015.  The request was made under s.4 of the Data Protection Acts 1988 and 2003 (“the Acts”).  The section, in relevant part, provides:

‘4-(1)(a) Subject to the provisions of this Act, an individual shall, if he or she so requests a data controller by notice in writing-

(i) be informed by the data controller whether the data processed by or on behalf of the data controller include personal data relating to the individual,

(ii) if it does, be supplied by the data controller with a description of –

(I) the categories of data being processed by or on behalf of the data controller,

(II) the personal data constituting the data of which that individual is the data subject,

(III) the purpose or purposes of the processing, and

(IV) the recipients or categories of recipients to whom the data are or may be disclosed,

(iii) have communicated to him or her in intelligible form –

(I) the information constituting any personal data of which that individual is the data subject and

(II) any information known or available to the data controller as to the source of those data unless the communication of the information is contrary to the public interest, and

(iv) where the processing by automatic means of the data of which the individual is the data subject has constituted or is likely to constitute the sole basis for any decision significantly affecting him or her, be informed free of charge by the data controller of the logic involved in the processing, as soon as may be and in any event not more than 40 days after compliance by the individual with the provisions of this section and, where any of the information is expressed in terms that are not intelligible to the average person without explanation, the information shall be accompanied by an explanation of those terms.

(b) A request under paragraph (a) of this subsection that does not relate to all of its subparagraphs shall, in the absence of any indication to the contrary, be treated as relating to all of them.

…

(7) A notification of a refusal of a request made by an individual under and in compliance with the preceding provisions of this section shall be in writing and shall include a statement of the reasons for the refusal and an indication that the individual may complain to the Commissioner about the refusal.”

3.             Ms. Nowak’s request by letter dated 7 September 2015 was for:

“a copy of all documents (e-mails, memos, minutes, letters, etc.), held by [ISPL] on computer or in manual which constitute ‘personal data’ within the meaning of that term as set out in the Data Protection Acts 1988 & 2003, namely:

(1)          Entire copy of the personnel file

(2)          TMS Records since January 2011 including overtime worked

(3)          Emails between you and senior management of the Company regarding disciplinary matters which took place in 2011/2012 and recently”

The letter went on to state:

“… please bear in mind that if I am not satisfied with the response to my request I will, with no further notice to the Company, make a complaint to the Data Protection Commissioner… Finally, though the respondent has statutory 40 day[s] to comply with the request I trust and will appreciate if the Company replies soonest.”  

4.             Following an acknowledgment sent on 21 September 2015, under cover of a letter dated 14 October 2015, ISPL supplied Ms. Nowak with documentation pursuant to her request.

5.             On 20 October 2015, Ms. Nowak made a complaint to the Data Protection Commissioner pursuant to s.10(1)(a) of the Acts complaining that ISPL had failed to provide her personal data such as:

“(a) Completed Performance and Development Form 2014

(b) Confidential Mediation Agreement between myself and Lorraine McIntyre

(c) Follow-up email (dated 9^th December, 2011 13:10) to the email from Dave Sheehan to Ruth O’Sullivan, John Spollen.

(d) Email from A. Nowak to John Spollen and Lorraine McIntyre, cc. Ruth O’Sullivan dated 6 February 2012 10:40 and follow-up email dated 6 February 2012 11:01.

(e) E-mail re: Absence from Ruth O’Sullivan to Tommaso Sillan, Dave Sheehan dated 11 November 2009 12:03.

(f) E-mail re: Absence/force majeure leave from A. Nowak to Ruth O’Sullivan dated 17 November 2009 8:31 and follow-up emails in this relation

(g) E-mail from Ruth O’Sullivan to A. Novak dated 25 January 2012 11:06 re break allowance;

(h) A great deal of other communication re matter which arose in April 2015 between Ruth O’Sullivan and John Spollen, Dave Sheehan”

 The appellant also made complaint about entries made into her email box without her consent and the clearance of its contents. She claimed that ISPL breached the provisions of s.4(7) of the Acts in failing to inform her that she had a right to make a complaint to the Office of the Data Protection Commissioner (“ODPC”) if unsatisfied with the response to her request.  She also complained that there had been a failure to comply with the obligation pursuant to s. 4(1) of the Acts to notify her of any refusal in writing which ought to have included a statement of the reasons for the refusal and an indication that she could take her complaint to the ODPC.  Ms. Nowak further alleged that ISPL failed to supply “the description of personal data” and “to express the purpose of its holding and categories of recipients to whom the data are or may be disclosed”, as required by s.4(1)(a)(ii) of the Acts. 

6.             On 28 October 2015, an Information Officer within the Commissioner’s Office responded, advising the appellant that if there was any outstanding data that she considered contained personal data relating to her, she should contact her employer setting out in writing in the form of an itemised list what she considered to have been omitted from her personal data disclosure.  She was further advised that if she considered that her request was not responded to in a satisfactory manner she could contact the Commissioner’s Office again with a copy of the list of outstanding items and a copy of any response received.

7.             As regards the complaint that her email account had been accessed without her consent, Ms. Nowak was advised to raise that matter with her employer. Regarding the claimed breach of s.4(7) of the Acts, the Information Officer stated that it was not evident that Ms. Nowak’s Access Request had been refused and he thus indicated that the complaint in respect of refusal or notification of refusal might not arise.  Ms. Nowak was further advised that it was not clear from the correspondence that she had made any specific request under s.4 for a description of the data.

8.             The appellant replied to this correspondence on 11 November 2015 indicating that she did not intend to communicate further with her former employer on the matter and that she was exercising her rights under the Acts to make a complaint to the Data Protection Commissioner and that there was an obligation on the Commissioner pursuant to s.10(1)(b)(i) of the Acts to investigate her complaint.

9.             By letter dated 3 December 2015, an Investigation Officer in the ODPC informed the appellant that her complaint would be investigated using full legal powers if necessary to resolve the matter.  Ms. Nowak was informed that the investigation would focus on the personal data which it was alleged ISPL failed to supply and the complaint that ISPL had failed to comply with s.4(1)(a)(ii) of the Acts. She was further advised that the office would endeavour to reach an amicable resolution but that if this was not achievable “a complainant may ask the Commissioner to make a formal decision under Section 10… as to whether a contravention had occurred”.

10.         On 8 December 2015, the Investigation Officer wrote to ISPL advising that the Data Protection Commissioner had received a complaint from Ms. Nowak concerning the alleged failure of ISPL to comply in full with an access request submitted on 7 September 2015 and that the Commissioner had commenced an investigation of the complaint to establish the facts.  ISPL were advised as follows:

“The right of access to personal data is one of the key fundamental rights conferred on a data subject by the Acts and it is the responsibility of data controllers to give a copy of personal data to individual data subjects on request.  The Acts provide that access requests must be complied with within a period of forty days of receipt of the request.  Failure to notify a data subject in writing of the refusal of part of their access request and the reason for the refusal is unlawful under the Acts.”  

With reference to the personal data Ms. Nowak alleged she had not received, ISPL were required to write to her within 10 days and either “(1) fully meet the requirement of the access request…or (2) notify [Ms. Nowak] of your refusal of the access request and set out a statement of the reasons of refusal…” , with  a copy of their communication to Ms. Nowak to be sent to the Commissioner within 10 days of the date of the Investigation Officer’s letter.  Reference was made to “the intention of the Data Protection Commissioner to commence legal enforcement proceedings 14 days from the date of this letter if the matter is not progressed on the above basis…”.  

11.         ISPL replied to this correspondence on 16 December, advising that the Access Request was “clearly limited” to three categories of documents which were furnished to Ms. Nowak on 14 October 2015 and which ran to “several hundred copy documents”. The writer rejected any suggestion of a breach of s.4(1)(a)(ii) on the basis that the appellant’s request “was clearly limited to a request for copy documents/data under s.4(1)(a)(iii)” as evident from the first line of her request of 7 September 2015. ISPL pointed out that the copy of the Access Request provided to the Commissioner was not the same as the Access Request letter dated 7 September 2015 which it had received from Ms. Nowak. ISPL enclosed a copy of the letter they wrote to the appellant on foot of the correspondence from the Commissioner’s Office of 28 October 2015.

12.          On 18 December 2015 (apparently received by the ODPC on 5 January 2016) Ms. Nowak wrote to the Investigation Officer stating that the response of ISPL was unsatisfactory and called for an on-site investigation by the ODPC. She also sought reasons as to why the ODPC did not intend to investigate her complaint that ISPL had accessed her email box without her consent. 

13.         That letter was responded to by the Investigation Officer on 14 January 2016. He repeated the OPDC’s earlier view that it was not clear whether a data protection issue arose in relation to the employer having accessed Ms. Nowak’s work emails. As far as her call for an onsite investigation was concerned, the writer advised that the Commissioner “is considering authorising officers to carry out such an inspection in the near future”.   

14.         On 21 January 2016, the Investigation Officer wrote to ISPL with reference to Ms. Nowak’s complaint and ISPL’s response thereto as expressed in their letter of 16 December 2015 to the effect that the information in respect of which she had complained to the ODPC had not been included in the categories Ms. Nowak had identified in her Access Request of 7 September 2015 with the result no further personal data was sent to her.  The Investigation Officer stated:

“This Office considers that Ms Nowak made a valid access request for a copy of all her personal data and identified further data which she had not received in response to the access request. The list appears to this Office as being a valid identification of outstanding personal data not previously supplied and we would expect that ISPL supplies a copy of this personal data as soon as possible unless a valid exemption under the Acts can be applied to such data…”

ISPL were requested to supply a copy of this data within seven days. They were further requested to re-examine Ms. Nowak’s complaint that the provisions of s.4(1)(a)(ii) had been breached.

15.         In the event, ISPL agreed to make the second tranche of material available to the appellant.  As advised in a letter of 27 January 2016 to the Investigation Officer, ISPL agreed to this course of action even though - in their view - it did not fall within the request she had made on 7 September 2015.

16.         ISPL’s view was that they had honoured the original Access Request on 14 October 2015 given its specific nature. It had not constituted an open-ended request.  They also indicated that they had no difficulty in providing this additional data which had been provided to Ms. Nowak under cover of a letter of 27 January 2016, a copy of which they enclosed.

17.         ISPL went on to explain that they provided the data requested by Ms. Nowak on 7 September 2015 in accordance with s.4(1)(a)(iii) of the Acts because the letter from Ms. Nowak had expressly requested “copies” of material.  Albeit that ISPL accepted that under s.4(1)(b), a data request was to be treated as having been made under all of the subparagraphs of s.4(1)(a) in the absence of any indication to the contrary, in this instance there was a clear indication to the contrary from Ms. Nowak in the form of an expressed request for copies of specified material.  ISPL further indicated that if it had misunderstood the request concerning the documentation required and which had been enclosed with the letter of 27 January 2016 they would be more than willing to expand the search for Ms. Nowak’s personal data beyond that undertaken to date.

18.         In the letter sent to Ms. Nowak on 27 January 2016, ISPL duly enclosed the additional personal data to the extent that it existed and was available from the company’s system and records. Attached to the letter were two schedules containing details of: (i) the personal data then enclosed and (ii) the personal data which had previously been provided to the appellant.  This outlined the category of the document, the personal data involved, the purpose for the processing of the data and the categories of recipients to whom the data might be disclosed. 

19.         Consequent on the receipt of ISPL’s letter, on 2 February 2016 the Investigation Officer wrote to the appellant noting that she had been furnished by letter dated 27 January 2016 with what appeared to be a comprehensive response to the matters raised in her complaint.  He requested confirmation that Ms. Nowak considered her Access Request to have been dealt with satisfactorily.  If this was not the case she was requested to revert with specific details of any matters which remained to be resolved to her satisfaction.  In respect of Ms. Nowak’s complaint concerning access to her email account, the Investigation Officer noted that a copy of ISPL’s IT security policy had been furnished to her and, accordingly, he requested confirmation that the issue raised in that regard had been satisfactorily explained in the documents furnished.   

20.         Ms. Nowak replied by email dated 8 April 2016 stating:

“I have no further issues regarding this data access request.  Now, I request the decision of the DPC according to s.10 of the Acts to be issued (just to have a formal record of same) to the effect that ISPL breached the law by failing to comply with its statutory obligation to provide data within 40 days.”

21.         ISPL were informed by the Investigation Officer of the appellant’s request for a formal decision by letter of 12 April 2016. Insofar as ISPL in their 27 January 2016 letter stated that they had honoured Ms. Nowak’s request, the Investigation Officer opined:

“…this Office would maintain that the obligation is on a data controller…to supply a copy of all personal data in response to an access request made under Section 4 of the Acts regardless of whether an individual has also specified what information they are seeking. In this regard, if you wish to make any further comments in relation to the complaint, please do so within the next seven days.”

22.         Through its solicitors A & L Goodbody, by letter of 18 April 2016, ISPL submitted that it had complied with Ms. Nowak’s request, which was specific in its terms, on 14 October 2015.  ISPL had interpreted the 7 September Access Request “as being in respect of the three categories of personal data that [Ms. Nowak] had listed”.  ISPL’s position was that “by including the word ‘namely’ in her request, Ms. Nowak intentionally limited the scope of her request to those categories of documents alone”.  The letter further stated that if ISPL was to have provided “all personal data”, this would have yielded an enormous volume of documentation that was of no particular interest to Ms. Nowak given the quite focused nature of her request.  It was pointed out that following a subsequent subject access request received from Ms Nowak in February 2016, ISPL had in fact produced large volumes of emails to the extent that they constituted Ms Nowak’s personal data and that Ms. Nowak had complained that she did not wish to receive those documents.  According to ISPL, it was therefore clear that “Ms. Nowak herself has repudiated any suggestion that the September [Access Request] constituted a request for ‘all personal data’ rather than the 3 categories specifically listed.”  While ISPL did not dispute that Ms. Nowak was entitled to receive “all personal data” relating to her of which ISPL was the data controller when a request under s.4 of the Acts was made, ISPL did not agree that the 7 September 2015 request “could reasonably have been interpreted as having been a request for all ‘personal data’”.  The letter went on to state:

“3. It is notable that Ms. Nowak did not indicate to ISPL that she was dissatisfied with the 14th October, 2015 response. Instead she issued a complaint directly to your office. Whilst we accept that Ms. Nowak is entitled to adopt this course of action we would submit that this was not necessary or appropriate, as ISPL’s conduct demonstrated that it was (and indeed remains) willing to promptly respond to any s. 4 requests that Ms. Nowak makes.

4. When Ms. Nowak identified certain additional documentation which she believed to be outstanding (through correspondence with your office) this was provided without delay by ISPL to the extent that it was data controller of such data.”

23.         ISPL’s solicitors enclosed Ms. Nowak’s further request of 17 February 2016 which the company had treated as an access request albeit it was not stated to be a s.4 subject access request.  The company had treated this request as a request for all personal data relating to Ms. Nowak from 1 January 2009 until 20 August 2015 when her employment ceased.  The response of Ms. Nowak to the supply of this information was that it was “entirely unnecessary” and a “waste of time”.  According to ISPL, this response was supportive of their proposition that Ms. Nowak’s original request was of a much more limited nature than subsequently claimed by her.

The Commissioner’s Decision

24.         The decision of the Data Protection Commissioner issued on 9 December 2016.

25.         The Commissioner began by setting out Ms. Nowak’s complaint of 20 October 2015, the factual background to the complaint and the investigation process that ensued thereafter. Under the heading “Analysis and Finding In Relation To Your Complaint”, she then commenced her analysis by stating that she had considered, as requested by Ms. Nowak on 8 April 2016, “whether there was a breach by ISPL of its obligations under the Acts in relation to [Ms. Nowak’s ] access request dated 7 September 2015”, in particular whether there was a breach of s.4(1)(a) of the Acts insofar as Ms. Nowak claimed that ISPL did not provide her with a copy of her personal data within 40 days and her claim that ISPL did not provide her with the information set out at s.4(1)(a)(ii), namely a description of the categories of data, the personal data constituting the data, the purposes of processing and the recipients or categories of recipients to whom her personal data are or may be disclosed.

26.         The Commissioner went on to state:

“As noted above, the investigation conducted by this office established that you made a subject access request to ISPL by letter dated 7 September 2015 and that this request was accepted by ISPL as a valid subject access request under the Acts.  Assuming that the access request was also received on 7 September 2015, the statutory time limit ISPL to respond to your access request under the Acts was 17 October 2015.  In reaching my decision on your complaint, I have also proceeded on the basis that the copy access request which you provided to this office was not in fact an identical copy of the access request which was in fact submitted to ISPL. As set out above at paragraph 9, the access request which ISPL received from you differed to the one you sent to us with your Complaint in that it referred to ‘disciplinary matters’ rather than ‘matters’.  I am satisfied, having examined the copy access request from you which ISPL provided to this office, that the access request as submitted by you to ISPL dated 7 September 2015 referred to ‘disciplinary matters’ in relation to the third category personal data sought.”

27.          The Commissioner next turned to Ms. Nowak’s complaint that ISPL did not provide the personal data sought within the requisite 40 days.  She stated:

“22.  I note that your Access Request while referring in the first sentence for a request for “…a copy of all documents…” then proceeded to specify three categories of data which you were seeking.  In this regard I also note your use of the word ‘namely’ to denote those three categories.  Your use of the word ‘namely’ in describing the three categories of data was interpreted by ISPL as meaning that you required access to those three specific categories of data only rather that to all of the personal data which ISPL held about you.  ISPL provided you with copies of the three specified categories of data under cover of its letter dated 14 October 2015.  This occurred within the 40-day statutory period required under Section 4(1)(a) of the Acts.

23.  In your Complaint, you subsequently highlighted to this office - and not directly to ISPL as might be expected - that the Additional Personal Data… had not been provided to you by ISPL in response to the Access Request. … As described above, ISPL’s position that the Access Request was limited to the three categories of data specified in it and that the Additional Personal Data did not form part of any of those categories specified in the Access Request.

24.  In any event, the Additional Personal Data was furnished to you by ISPL under cover of its letter dated 27 January 2016 and in your email of 8 April 2016 you confirmed that you ‘had no further issues with this access request’.  By this statement, I understand that you considered your Access Request to have been complied with in full following the provision by ISPL to you of the Additional Personal Data and that you did not require any further personal data, above and beyond that already provided to you by ISPL, in order to satisfy your Access Request.

25.  The central issue for consideration is whether your Access Request was responded to in full by ISPL when it supplied you with the three categories of data specified in the Access Request.  In so considering this, I have had regard to the obligation upon a data subject in Section 4(3) of the Acts which states that:

‘an individual making an access request shall supply the data controller concerned with such information as he may reasonably require in order to locate any relevant personal data or information.’ (emphasis added).

This office’s interpretation and application of Section 4(1)(a) together with Section 4(3) (in particular the words ‘any relevant personal data or information’) is as follows. While a data subject has a statutory right to a copy of any personal data which is held about him or her by an organisation, where a data subject explicitly limits their access request to certain personal data, it is legitimate and appropriate for a data controller to provide solely the personal data which has been specified rather than all of the personal data which that data controller holds in relation to that data subject. In this regard, I would also point to this office’s guidance notes for individuals on making access requests…

26.  Having regard to the fact that you specified three categories of documents and used the term ‘namely’ to indicate those specific categories of data which you were seeking in your Access Request, I consider it reasonable that ISPL interpreted your Access Request as being limited solely to the personal data constituting those three specific categories. Further, I note ISPL’s position that the Additional Personal Data did not constitute any of the three specific categories of personal data set out in the Access Request. Accordingly, I find that the ISPL’s non-provision of the Additional Personal Data, in its substantive response dated 14 October 2015 to your Access Request, did not constitute a contravention of section 4(1)(a)” (emphasis in original).

28.         The Commissioner next addressed Ms. Nowak’s complaint that ISPL breached s.4(1)(a)(ii) of the Acts by failing, in its substantive response of 14 October 2015 to the Access Request, to provide Ms. Nowak with a description of the categories of data being processed by/on behalf of ISPL, the personal data constituting the data of which she was the data subject, the purpose or purposes of the processing and the recipients or categories of recipients to whom her data was being disclosed. 

29.         In considering the scope and extent of the obligation in s.4(1)(a)(ii), the Commissioner had regard to s.4(1)(b) of the Acts which provides:

“A request under paragraph (a) of this subsection that does not relate to all of its subparagraphs shall, in the absence of any indication to the contrary, be treated as relating to all of them.”

30.          The Commissioner considered that the key phrase in the provision was “in the absence of any indication to the contrary”.  She read the phrase as meaning that “where an individual makes a request under s. 4(1)(a) in general terms and does not make any further specification as to what is required, that the data controller must, by default, comply with the provisions of s. 4(1)(a)(i) to (iv) and provide the individual with the information specified in these subparagraphs. However, conversely, it is clearly the legislative intention that where an access request denotes a request for specific information (rather than a general request …), that these default information requirements in the subparagraphs of s. 4(1)(a) are lifted. Of further relevance is s. 4(9) of the Acts which states that the requirement in s. 4(1)(a)(iii) shall be complied with by supplying the data subject with a copy of the information concerned in permanent form (unless certain derogations apply).”

31.         She noted that the Access Request had requested “a copy of all documents”.  The Commissioner considered Ms. Nowak’s request for a “copy” a “clear indication” that Ms. Nowak was requesting her information in permanent or intelligible form under s. 4(1)(a)(iii) of the Acts. She went on to opine:

“As this was a clear indication of a request pursuant to a specific subparagraph rather than an Access Request in general terms under s. 4(1)(a), I consider that it was reasonable for ISPL to interpret the Access Request as being limited solely to copies of the three categories of personal data specified in the Access Request and to therefore assume that you were not seeking the descriptions relating to the data pursuant to section 4(1)(a)(ii) (emphasis in original).”

32.          Accordingly, the Commissioner found that ISPL was not in contravention of the Acts by failing to provide Ms. Nowak with a description relating to the data pursuant to s.4(1)(a)(ii) “as such obligation did not arise in these circumstances (emphasis in original).”

33.          The Commissioner’s conclusion was that ISPL did not contravene s.4 of the Acts in relation to its response dated 14 October 2015 to Ms. Nowak’s Access Request of 7 September 2015.

34.         As provided for in s. 26(1) of the Acts, an appeal lies to the Circuit Court from, inter alia, a decision of the Commissioner in relation to a complaint under s.10(1)(a). Section 26(3)(a) provides that the decision of the Circuit Court under the section shall be final subject to the entitlement to appeal the decision of the Circuit Court to the High Court on a point of law, as provided for in s.26(3)(b) which reads:

“An appeal may be brought to the High Court on a point of law against such a decision; and reference in this Act to the determination of an appeal shall be construed as including references to the determination of any such appeal to the High Court and of any appeal from the decision of that Court.”

The appeal to the Circuit Court

35.           Ms. Nowak duly appealed the Commissioner’s decision to the Circuit Court seeking, inter alia, the following reliefs:

1.      An order setting aside the Commissioner’s decision;

2.      An order remitting the complaint to the Commissioner;

3.      A declaration that the decision was vitiated by a serious and significant error or series of such errors;

4.      A declaration that the decision was wrong.

36.         The appeal was grounded on Ms. Nowak’a affidavit sworn 3 January 2017.  Mr. John O’Dwyer swore a replying affidavit on behalf of the Commissioner on 13 June 2017  and points of defence were delivered on the same date. By way of preliminary objection, the points of defence asserted that Ms. Nowak’s appeal had not been brought within the requisite 21 days from the receipt of the decision of 9 December 2016 and that the appeal failed to identify the error or errors alleged against the Commissioner. It was pleaded that for those reasons, the appeal should be dismissed in limine. Without prejudice to that, the Commissioner’s position was that the decision of 9 December 2016 was validly made within jurisdiction and that the Commissioner was entitled to reach the decision reached. Insofar as the appeal consisted of a challenge to the merits, it was denied that the decision was flawed. It was further pleaded that Ms. Nowak failed to establish that, taking the adjudicative process as a whole, the decision was vitiated by a serious and significant error or series of such errors and that if any errors were made, (which was denied) they fell short of the requisite threshold and were made within jurisdiction.  

37.         The ex tempore judgment the Circuit Court (Groarke P.) was delivered on 6 February 2018. The learned President determined as follows:

“[Ms. Nowak] made an access request seeking documents from the employer. [The Commissioner] interpreted, as did the employer, the word ‘namely’ as qualifying the general request. It does not seem to me that that Decision lacked rationale or reasonableness.

After a number of other arguments [Ms. Nowak] made her case set out in full in the correspondence here and these issues were followed up by the DPC who engaged with the employer. It initially did so by attempting conciliation with the employer as the DPC is entitled to do, some might say compelled to do so. The DPC engaged in correspondence to tease out and see if the employer could be more forthcoming. Ultimately…on 8 April 2016 [Ms. Nowak] wrote to the DPC and said

   ‘Dear Mr Ormond, I have no further issues regarding this Data Access Request’

This is rather plain and seems to me very final,

‘Now I request the decision of the DPC according to section 10 of the Acts to be issued (just to have a formal record of same) to the effect that ISPL breached the law by failing to comply with its statutory obligation to provide data within 40 days.’

Now as of April 2016 it seems to me that this is the only outstanding issue between Ms. Nowak and the DPC.

Be that as it may the DPC wasn’t happy to leave the matter at that and there were further matters still outstanding that it had to deal with. I see from the correspondence between the DPC, the employer and Ms. Nowak.  

Ultimately, the decision of [the Commissioner] was handed down on 9 December 2016. That decision did not just deal with the 40 day issue but it dealt with all issues raised in the appeal. [The Commissioner] could have taken that the email of April meant that issues except the 40 day issue were not to be determined. [The Commissioner] did not do so and the decision dealt with all issues in considerable detail.

Ms. Nowak says that the Commissioner was biased against her and I am paraphrasing here, her complaint is that the decision is irrational and illogical and wrong. A large, although not total part of Ms. Nowak's complaint is that information was furnished outside the 40 days and the Decision was vitiated on account of the consideration by [the Commissioner] of information not furnished within the 40 day limit. The argument of [Ms. Nowak] is fundamentally erroneous.

The argument of the employer and accepted by the [the Commissioner] is that the effect of the word ‘namely’ qualifies the access request. This is an entirely correct view on the part of the DPC

In an effort to satisfy Ms. Nowak, the DPC managed to obtain considerable cooperation from the employer.

There were various other matters but that is the fundamental argument raised by Ms. Nowak (the 40 days) and that is an erroneous view on her part. There is nothing in the statutory provisions which prohibits [the Commissioner] from considering material provided in excess of the 40 day limit.

The 40 day limit is a mandatory provision on the employer…the data controller, in relation to the documents sought. Failure to comply may give rise to a criminal prosecution. It does not prohibit [the Commissioner] in considering such documents in her decision and the argument just doesn’t stand up.

As I have already stated in my initial view the conclusion regarding the word namely is an entirely reasonable one.

The fundamental argument which Ms. Nowak brings to Court fails. The Decision given by the DPC on 9 December 2016 is an extensive and clear Decision in relatively simple and straightforward terms. It is reasoned, rational, lucid and entirely reasonable.

In those circumstances, I do not find that any of the arguments made by Ms. Nowak are substantiated. I dismiss her application accordingly.”  

38.          Following the dismissal of her appeal by the Circuit Court, as provided for in s.26(3)(b) of the Acts, Ms. Nowak appealed to the High Court on a point of law against the decision of the Circuit Court.  Her notice of appeal sets out as follows:

“(1) Did the learned Circuit Court Judge err in law in upholding the decision of the Data Protection Commissioner dated 9^th December, 2016?

(2) In particular, did the learned Circuit Court judge err in law in accepting that the data access request of 7 September 2015 was not general in nature and was limited to three categories of personal data?

(3) Was the replying affidavit of the Data Protection Commissioner invalid in circumstances where it was delivered, in breach of the direction of the Court, out of time?

(4) Consequently, did the learned Circuit Court Judge consequently have jurisdiction to hear counsel for [the] Commissioner at the hearing of the appeal?

(5) Was the service of the Commissioner's decision dated 9 December 2016 by email effective?” 

39.         The suggested points of law were elaborated upon by Ms. Nowak in submissions delivered shortly before the appeal of the Circuit Court Order commenced in the High Court on 12 June 2018. As noted by the High Court Judge, notwithstanding that Groarke P. did not accept the Commissioner’s submission that the appeal to the Circuit Court was out of time, extensive written submissions were made in relation to ground 5 concerning the service of the Commissioner's decision of 9 December 2016 by email. However, ground 5 was not pursued during the hearing in the High Court.

The High Court judgment

40.         McDermott J. first addressed grounds (3) and (4) of the appeal grounds.  He noted Ms. Nowak’s argument that the Circuit Court should not have heard any submissions from the respondent in view of the late filing of the respondent’s affidavit and points of defence.  He further noted the respondent’s argument that no prejudice had been caused to the appellant given that the Circuit Court appeal in any event only came on for hearing some eight months after the respondent’s late filing.  He observed that the appellant herself had filed a further affidavit late in the day without objection from the respondent.  He was satisfied that the Circuit Court had jurisdiction to enlarge the time and that the President of the Circuit Court had acted entirely within jurisdiction in permitting the Commissioner to defend the appeal notwithstanding the Commissioner’s failure to comply with the Circuit Court’s earlier direction as to time limits.

41.         The High Court Judge next turned to grounds (1) and (2) which he considered to be closely related.  He observed that the first ground was “widely drawn” and did not raise any specific question of law but rather simply posited that the President of the Circuit Court had erred in law in upholding the Commissioner’s decision of 9 December 2016.  He opined that the ground did not take issue with the legal principles applied by the President of the Circuit Court which had been agreed at the hearing to be those as set out in Orange v Director of Telecommunications Regulations & Anor (No.2) [2000] 4 IR 159, Ulster Bank Investment Funds Limited v. Financial Services Ombudsman [2006] IEHC 323 and Nowak v. Data Protection Commissioner [2016] IESC 18. McDermott J. distilled the relevant principles arising from the case law as follows:

·                The burden of proof lay with an appellant in any appeal to the Circuit Court to establish their case on the balance of probability;

·                The complaint against the Commissioner should be considered in the context of the adjudicative process as a whole;

·                The onus lay on the appellant to show that the decision reached by the statutory body was vitiated by a serious and significant error or a series of such errors;

·                When applying the test, the court should take account of the fact that the decision maker has a degree of expertise and specialist knowledge within the statutory framework of the Acts.

42.          He found that there was no suggestion that the President of the Circuit Court had deviated in any way from the principles applicable to an appeal of this kind to the Circuit Court and, accordingly, no issue of law arose in that regard.

43.         McDermott J. went on to note that the appellant’s legal submissions to the High Court sought to expand the issues that had arisen in respect of her complaint before the Commissioner and the Circuit Court which, if permitted, “would amount to a complete hearing de novo of the circuit appeal rather than the limited appeal contemplated by s.26(3) on a point of law”.  The High Court judge found that in expanding her grounds as she had,  the appellant had ignored the investigation carried out by the Commissioner and the Commissioner’s correspondence with her and ISPL in respect of outstanding issues which had led, ultimately, to the expression on the appellant’s part that she was totally satisfied that the issues the subject matter of her complaint of 20 October 2015 had been resolved apart from the fact that she wished to have a formal decision as to whether the documents released  by her employer had been released within the applicable statutory 40 days. 

44.         The Judge considered that the essence of the issue raised by Ms. Nowak was whether her initial request of 7 September 2015 had been appropriately addressed by ISPL in accordance with s.4 of the Acts.  Addressing this issue, he opined, at para.36:

“…It is clear that the employer always maintained that it was willing to furnish all personal data which was the subject of a request under the Act. It is also clear that the appellant sought copy documents of three categories of personal data from her employer in her letter of 7th September, 2015. It was not a general request made to the data controller. The appellant clearly knew what she wished to obtain and selected three categories from a wider category of documentation. When she used the word ‘namely’ she was clearly identifying the documents and could equally have said ‘that is to say’ or ‘specifically’ which have the same meaning. Once it is accepted as a matter of fact that she limited the categories of documents that were required it was open to the data controller to furnish those documents in compliance with that specific request. That was a reasonable and rational interpretation of the letter of 7th September. The respondent found that to be so when considering the complaint. I do not consider that the correspondence between the respondent and the former employer indicates a view taken by the respondent that the letter of 7th September embraced a wider request for all personal data.

…

It is abundantly clear that the employer at all material times would have complied with a more general request had it been in the general terms now suggested by the appellant. The court is satisfied that this was never a case about a data controller seeking to deprive the appellant of her statutory rights to personal data. Though I am satisfied that the employer's interpretation of the letter is entirely correct, the worst that could be said is that the employer may have misinterpreted the letter as a more limited request than that which was intended by the appellant. I am satisfied that had the appellant simply written to the employer seeking the additional material as suggested by the respondent she would have received a wholly positive response. When the Commissioner wrote for the same information or documentation it was furnished to him and to the appellant without difficulty. Indeed, the appellant later expressed satisfaction that all issues had been resolved with her former employer in respect of the documentation sought.”

45.         McDermott J. was satisfied that the documentation ISPL supplied on 14 October 2015 was done within the 40 day statutory period. He was satisfied that the President of the Circuit Court was correct in describing the request of 7 September 2015 as one which was not general in nature but limited to the three categories specified in the request. He was further satisfied that the Circuit Court President’s determination that the Commissioner did not err in similarly concluding was correct. McDermott J. went on to state:

“I do not consider that it is reasonable having made a specific request limited to three categories of documents [for Ms. Nowak] to complain to the Commissioner about a failure to comply with that request “on the basis that documents which were not specifically requested have not been furnished. At the very least I would expect a letter to be written before making such a complaint to the data controller pointing out that certain documentation had not been included and requesting a more general disclosure if that was what was genuinely sought.” (at para. 37)

46.         McDermott J. duly noted that a request for personal data under s.4(1)(a) which does not relate to all of the subparagraphs of s.4 shall in accordance with s.4(1)(b) “in the absence of any indication to the contrary, be treated as relating to all of them”. He was, however, satisfied that the letter of 7 September 2015 was a limited request and that it was “not a request of the [wide-ranging] nature envisaged by s. 4(1)(a) in respect of each of its subparagraphs”.  Accordingly, in the instant case, Ms. Nowak had given an “indication to the contrary” envisaged by s. 4(1)(b) and that it was “clearly open to an applicant to make a focused request for data under the terms of [the Acts]”.  As that had been done, there was, accordingly, no error of law by the Commissioner or the President of the Circuit Court in reaching their respective determinations.  The High Court Judge was also satisfied that it was reasonable to conclude that the information sought on 7 September 2015 had been furnished within the 40 days statutory period.  In all those circumstances, Ms. Nowak’s appeal was dismissed.

The appeal

47.         In her notice of appeal to this Court, Ms. Nowak advances the following grounds:

·                The High Court erred in law in upholding the finding of the Circuit Court Judge that the data access request was not general in nature and was limited to three categories of personal data and there was no breach of s.4 of the Data Protection Act 1988 (as amended);

·                The High Court Judge failed to answer the third and fourth questions of law set out in the notice of appeal to the High Court; and

·                The High Court Judge failed to give any sufficient weight to the oral and written submissions of the appellant and failed to further consider pleadings in reaching his decision.

48.         As made clear in her enhanced submissions, Ms. Nowak seeks an order from this Court setting aside the Order of the Circuit Court of 6 February 2018 and the judgment and Order of the High Court dated 26 July 2018 as well as the annulment of the Commissioner’s decision, with a remittal to the Commissioner of her complaint for reconsideration.

Discussion

49.         Ms. Nowak’s notice of appeal asserts that the High Court erred in law in upholding the decision of the Circuit Court that her access request was not general in nature being limited to three categories of documents and in holding that there was no breach of s.4 of the Acts.

50.         In relation to this ground, in her written submissions, the appellant identifies a number of discrete issues which, she submits, warrant the intervention of this Court on the basis that the High Court Judge erred. First, she says that the Commissioner erred in law and in fact in considering a list of wrongly withheld outstanding items of personal data sought by her to be additional data. This had the consequence of the Commissioner erroneously holding that ISPL did not contravene the 40-day statutory time limit.  Ms. Nowak submits that her request of 7 September 2015 was a general data access request and not a specific request.  She points to the fact that the Investigating Officer in his letter of 21 January 2016 to ISPL had considered that she had made a “valid request for all her personal data…”.  She asserts that this outstanding data wrongly become “additional data” once ISPL’s solicitors became involved.  She says that, ultimately, when that data was furnished on 27 January 2016, it was outside the requisite time limit and thus constituted a breach of s.4(1) of the Acts.   Ms. Nowak asserts that notwithstanding that the request she made to ISPL for all data (and, indeed, as understood by the Investigation Officer), the Commissioner nevertheless wrongfully categorised her request as being limited to three categories of data. Despite her expansive explanation, this wrongful categorisation was continued by the Circuit Court and the High Court when those courts upheld the Commissioner’s determination that the 40 day time limit was not breached and in holding that the data sought in October 2015 constituted additional data.

51.         Secondly, Ms. Nowak asserts that the Commissioner wrongly relied on the word “namely” in concluding that the Access Request was specific and confined to only three categories of data.  She argues that she had not used the word “namely” in her data request to limit personal data but rather to give a specific example for the data controller (ISPL) as per s.4(3) of the Acts, in order “to supply the data controller with such information as he may reasonably require to locate any relevant personal data or information”.  She points again to the Investigation Officer’s correct understanding of her request as a request for all her personal data, yet the Commissioner had wrongly isolated the word “namely” as entitling her to hold that the data request was limited to three categories of documents.

52.         Ms Nowak also asserts that the Commissioner’s incorrect interpretation of “a request for all documents” as a specific request allowed ISPL to be exempted from its obligation to comply with the provisions of s.4(1)(a)(ii) of the Acts.  She thus raises a point of law in relation to in the interpretation of s.4(1)(b) and of the Acts, claiming that s.4(1)(b) was misinterpreted by the Commissioner. Notably, this issue was not canvassed specifically by Ms. Nowak in her notice of appeal from the Circuit Court to the High Court albeit it was the subject of submissions to the High Court and clearly in the judgment under appeal, the High Court Judge addressed the issue.

53.          Ms. Nowak’s argument is that the Commissioner incorrectly interpreted s.4(1)(b) and that the High Court Judge was wrong to say this was not the case.  She asserts that she, Ms. Nowak, made no “indication to the contrary” despite what is set out at para. 31 of the decision of 9 December 2015.  That being the case, her contention is that the default position as set out s.4(1)(b) did apply to her in circumstances where in the absence of any indication to the contrary having been given, her access request was required to be treated as relating to all of the subparagraphs of s.4(1)(a)(ii). She submits that the Commissioner erred in stating that ISPL were not in breach of the Acts by failing to provide the data requested as provided for by s.4(1)(a)(ii) and that the Circuit Court and the High Court erred in law in affirming the Commissioner’s decision. The foregoing arguments constitute the nub of Ms. Novak’s appeal to this Court from the judgment and Order of the High Court.

An appeal on a point of law to the High Court

54.         The test for an appeal on a point of law to the High Court is that set out in Fitzgibbon v. The Law Society of Ireland [2015] 1 IR 516. There, Clarke J. stated, at para. 128:

“In one sense it may be said that the two types of points of law can legitimately be raised in an appeal which is limited on points of law alone. First, there may be an error of law in the determination of the first instance body. Second, it may be the case that the way in which the first instance body has reached its conclusions on the facts involves an error which amounts to an error in law. There may have been no evidence to support a finding or inferences may have been drawn from the facts which no reasonable decision-maker could have drawn. It follows that a higher degree of deference, so far as the facts are concerned, is paid by the appellate body to the decision of the first instance body in an appeal on a point of law only, as opposed to an appeal against error. In the latter case the court is entitled to form its own view on the proper inference to be drawn (although not on primary facts)” (at p. 559-560).

The foregoing extract was cited by McDermott J. at para. 28 of the judgment under appeal here.

55.         In Attorney General v. Davis [2018] 2 IR 357 (cited by Ms. Nowak in her submissions), the Supreme Court again considered the jurisdiction of a court in an appeal on a point of law, and in particular whether an appeal on a point of law may include an appeal against an error of fact.  McKechnie J. held, at para. 53, that a court may intervene to overturn on a point of law in the following circumstances:

·                In cases of errors of law as generally understood, to include those mentioned in Fitzgibbon;

·                In cases involving errors such as would give rise to judicial review, including, illegality, irrationality, defective or absence of reasoning and procedural errors of some significance;

·                Errors which may arise in the exercise of discretion which are plainly wrong, notwithstanding the latitude inherent in such exercise; and

·                Certain errors of fact.

56.         Drawing on Fitzgibbon and his own judgment in Deely v. Information Commissioner [2001] 3 IR 439, at para. 54 the learned judge identified three categories of errors of fact which may lead to intervention.  These are:

·         Findings of primary fact where there is no evidence to support them;

·         Findings of primary fact which no reasonable decision-making body could make; and

·         Inferences or conclusions; -

-Which are unsustainable by reason of any one or more of the matters listed above;

-Which could not follow or be deducible from the primary findings as made; or

-Which are based on an incorrect interpretation of documents.

57.         In the present case, for the reasons he set out in his judgment, McDermott J. was not satisfied that there were errors of the type contemplated in Fitzgibbon v. The Law Society of Ireland arising from the decision of the President of the Circuit Court.  I am satisfied that the finding of the High Court Judge in this regard was correct.  When the principles set out in Fitzgibbon and Attorney General v. Davis are applied, it is clear that there was no error of law made by the Commissioner or the President of the Circuit Court.

58.         Grounds (1) and (2) of Ms. Nowak’s notice of appeal from the decision of the Circuit Court were comprehensively addressed by the High Court Judge at paras. 34 -37 of his judgment. McDermott J. found (as had the Commissioner and the Circuit Court), that for the reasons he set out, that Ms. Nowak’s access request of 7 September 2015 was a focused request and not of a general nature.

59.         Notwithstanding the arguments now being canvassed by Ms. Nowak, it is clear from the Access Request of 7 September 2015 that it was a focused request.  It had two aspects.  First, Ms. Nowak sought a copy of specific documents.  Secondly, she qualified the limits of that request by use of the word “namely”.  In her Access Request, Ms. Nowak did not seek to ascertain whether ISPL were processing data in regard to her or the purpose of or a description of that processing.  Rather, the request was a focused one on the part of Ms. Nowak who was familiar with the legislation.  That is the crux of the case, to my mind, given the manner in which the Access Request was formulated.  I can find no error on the part of the High Court Judge when he opined “when [Ms. Nowak] used the word ‘namely’ she was clearly identifying the documents [she was seeking] and could have said ‘that is to say’ or ‘specifically’ which have the same meaning.”  In so opining, the learned Judge was clearly applying the dictionary definition of “namely”, as he was entitled to do, in my view.

60.         It is also clear from their correspondence of 21 September 2015, that ISPL treated the request as one for specific documents.  Noticeably, there was no response on the part of Ms. Nowak to ISPL’s initial reply to her to the effect that ISPL were misinterpreting the request she made.  Furthermore, it is of some note that when on 14 October 2015, ISPL furnished the documentation requested, Ms. Nowak did not then engage with her former employer or take issue with the manner in which her request was processed.  

61.         It is also of note that in Ms. Nowak’s complaint to the Commissioner of 28 October 2015, the eight items she specified in that complaint were not specified in her original request where she had specifically named the documents she required.

62.         In all the circumstances of this case, I am satisfied that the Commissioner’s conclusion as set out in the decision of 9 December 2016 that Ms. Nowak’s access request of 7 September 2015 was a limited request was a conclusion that the Commissioner could reasonably and logically arrive at.  Moreover, this conclusion was arrived at after a detailed and comprehensive assessment of all the relevant facts by the Commissioner, as found by the Circuit Court and the High Court.  The rationale for the Commissioner’s decision is clearly set out in her decision.  Her finding of fact in this regard was made in the context of Ms. Nowak’s very specific data access request. That was both a reasonable and appropriate finding having regard to the evidence that was before the Commissioner and an appropriate finding from which the Commissioner, the Circuit Court and the High Court could thus conclude that the Access Request of 7 September 2015 was a focused request which was complied with by ISPL within the requisite 40 days.

63.         Insofar as Ms. Nowak points to the Investigation Officer’s letter to ISPL of 21 January 2016 and the reference therein to the fact that the Office of the Data Commissioner “considers that Ms. Nowak made a valid access request for a copy of all her personal data …”, that letter emanated from the Investigation Officer and not from the Commissioner qua decision-maker.  In relying on this, Ms. Nowak has conflated the functions of the investigation and the decision-making processes and disregarded the logical and reasonable interpretation given by the Commissioner, the Circuit Court and the High Court to the request she made on 7 September 2015.  Further, and for the avoidance of doubt, I consider that the opinion of the Investigation Officer as expressed in the letter of 21 January 2016 was wrong insofar as it considered the request to be a general one and not limited, by the use of the word “namely”, to the categories enumerated by the appellant.     

64.         Ms. Nowak takes issue with the High Court Judge’s interpretation of s.4(1)(b) of the Acts. She urges on the Court her own interpretation of that provision, expressed as follows in her enhanced submissions:

“(a) If a data subject makes specific request for an information under one of the subparagraphs of s.4(1)(a) and makes an indication that he or she does not request other information (for example a description or categories of data, sources of data) a default requirement to provide information under all subparagraphs of s.4(1)(a) is lifted.

(b) If a data subject makes specific request for…information under one of the subparagraphs of s.4(1)(a) and did not make an indication that he or she does not requests [sic] other information (for example a description of or categories of data, sources of data), a default requirement to provide information under all subparagraphs of s.4(1)(a) still applies.”

65.            Ms. Nowak’s position is that she made no “indication to the contrary” in her access request.  She thus asserts that the interpretation put by the High Court Judge on s.4(1)(b) as set out at para. 38 of the High Court judgment is incorrect. 

66.         I do not find merit in Ms. Nowak’s submission that a proper interpretation or application of s.4(1)(a)(ii) or s.4(1)(b) for present purposes necessarily required an express statement or indication from her on 7 September 2015 that she was restricting her data access request to one or more of the subparagraphs in s. 4(1)(a) in order for the Commissioner to reach the decision she did. In my view, if the formulation of the data access request actually made by Ms. Nowak was such that the “indication to the contrary” was reasonably and logically capable of being derived therefrom, then that is a sufficient basis for the default provisions of s.4(1)(b) not to become operable. In other words, there was a clear basis upon which one could legitimately regard the access request as not relating to all of the subparagraphs of s.4(1)(a). I am satisfied this is what occurred here. As the learned High Court Judge properly observed, there was more than ample evidence for the Commissioner to conclude that the default provisions of s.4(1)(b) of the Acts did not come into operation in the circumstances of Ms. Nowak’s case because of the nature of the request she had made on 7 September 2015. Accordingly, the learned High Court Judge did not err in his interpretation of s.4(1)(b) or in his conclusion that the Commissioner and the Circuit Court had not erred in reaching their respective determinations on the issue. 

67.           Ms. Nowak alleges that that the Commissioner did not carry out an onsite investigation despite same having been contemplated by the Commissioner as evident from the contents of 21 January 2016 sent to ISPL.  She submits that the failure to carry out such an investigation led to the erroneous decision of 9 December 2016 and that this failure constitutes the kind of serious and significant error in the adjudicative process that enables a court to interfere with the Commissioner’s decision.

68.         By way of preliminary observation, I note that Ms. Nowak’s raising of this issue veers from the matters raised in her notice of appeal to this Court.  Moreover, this complaint did not feature in her notice of appeal to the High Court on a point of law albeit I accept that she raised the matter in her written submissions to the High Court.

69.         Ms. Nowak alleges a further serious and significant error on the part of the Commissioner in failing to investigate and make a determination in relation to her allegation of unauthorised access by ISPL to her work email box and the clearing out of its contents.  This, she states, was contrary to the mandatory action required to be taken by the Commissioner pursuant to s.4(1)(a) of the Acts.  She submits that the Commissioner eschewed her duty to investigate those elements of her complaint by directing her to make her own investigation.  Ms. Nowak says that this approach was contrary to the duty on the Commissioner to investigate all aspects of the complaint and make a decision using all powers conferred on her by the legislation. She says that she, Ms. Nowak, was not obliged by law to provide in her complaint any analysis of where she considered breaches of the Acts to have occurred.

70.         The appellant also alleges that the Commissioner erred in failing to determine whether ISPL breached s.4(7) of the Acts. She takes issue with the Commissioner’s letter of 28 October 2015 wherein she was advised that it was not evident that her access request was refused “so therefore this section may not apply”.  She points to the letter sent to her on 3 December 2015 (the notification of the commencement of the investigation) wherein it was stated that the investigation would focus on the personal data Ms. Nowak alleged had not been provided. This, Ms. Nowak says, completely disregarded her complaint that ISPL had failed to supply the items requested or to advise her that she had a right to make a complaint to the Commissioner in that regard. 

71.         Again, these matters were not specifically addressed in Ms. Nowak’s notice of appeal on a point of law to the High Court albeit that they were raised in her submissions to that court.

72.         In my view, Ms. Nowak’s complaints in the above regards (including her complaint that the matters were not addressed in the judgment under appeal) have to be considered in the context of the communications which passed between her and the Commissioner’s Office following the provision by ISPL of the material they supplied under cover of their letter of 27 January 2016.

73.         On 2 February 2016, the Investigation Officer wrote to Ms. Nowak observing that by their letter of 27 January 2016, ISPL appeared to have furnished a comprehensive response to Ms. Nowak’s data request and the Investigation Officer asked for confirmation from Ms. Nowak that her request had been dealt with satisfactorily.  If that was not the case, he asked for “details of any matters which remained to be resolved to [Ms. Nowak’s] satisfaction”.

74.         Ms. Nowak’s reply of 8 April 2016 was that she had “no further issues regarding [the] data access request” but she requested a decision in accordance with s.10 of the Acts “(just to have a formal record of same) to the effect that ISPL breached the law by failing to comply with its statutory obligation to provide data within 40 days”. 

75.         Now, some years later, Ms. Nowak purports to take issue with how the investigation was conducted and alleges a failure on the part of the Commissioner to investigate alleged unauthorised access by ISPL to her emails or apprise her of her rights under the legislation in issue here.

76.           I find no merit in these complaints, not least because Ms. Nowak did not in her notice of appeal to this Court expressly take issue with any alleged failure on the part of the High Court Judge to consider the Commissioner’s alleged failures in these regards albeit I accept that her written submissions addressed these issues. In any event, I note that at para. 35 of his judgment, the High Court Judge observed that from the contents of her letter of 8 April to the Commissioner’s Office Ms. Nowak “was satisfied that the issues the subject matter of her complaint of 20^th (sic) October had been resolved apart from the fact that she wished to have a formal decision as to whether documents released by the employer had been released with the applicable statutory period of 40 days”. That, to my mind, is sufficiently dispositive of the arguments Ms. Nowak advanced in her written submissions to the High Court. Even without delving into what point of law was purportedly being raised in her submissions, in my view, it is difficult to see how Ms. Nowak could maintain any complaint about any alleged failure on the part of the High Court Judge in failing to address the above matters given the very precise nature of Ms. Nowak’s communication to the Commissioner of 8 April 2016.

77.          Thus, for the reasons set out, I find no merit in Ms. Nowak’s submission that when she said on 8 April 2018 that no further issue arose, that was meant in the sense that no further issue arose save those as set out in her complaint of 14 October 2015. As I have already said, there more than an ample basis for the Commissioner to consider that the matter the appellant wished to have addressed was that set out in her letter of 8 April 2016, namely that she wished to have a decision as to whether ISPL breached the statutory 40 days time limit. 

78.         Ms. Nowak’s appeal to the High Court following the decision of the Circuit Court requested the High Court to consider five specific issues.  I am satisfied that the four live issues (grounds 1-4) raised by Ms. Nowak in her appeal notice were dealt with by the High Court Judge insofar as they required to be. I have already addressed the High Court Judge’s treatment of grounds (1) and (2).  Insofar as Ms. Nowak maintains in her notice of appeal to this Court that grounds (3) and (4) of her appeal grounds to the High Court were not considered by the High Court Judge, that is palpably not the case. At paras. 32-33 of his judgment, McDermott J.  expressly finds that the Circuit Court had jurisdiction to extend the time that had earlier been given for delivery of the Commissioner’s replying affidavit.  Furthermore, he found that the Circuit Court had acted within jurisdiction in hearing counsel for the Commissioner in the course of that appeal. There is therefore no basis for complaint that these matters were not addressed. As to the substantive findings made by McDermott J. regarding the jurisdiction of the Circuit Court, nothing Ms. Novak has said in the course of this appeal has persuaded me that the High Court Judge was incorrect in the conclusions he reached in respect of grounds (3) and (4) of her appeal notice. 

79.         Many of Ms. Nowak’s submissions before this Court consisted of the rehearsing of arguments that were made both before the Data Protection Commissioner and the Circuit Court. Much the same can be said of the issues she raised in the High Court. Accordingly, there is some merit in the respondent’s submission that Ms. Nowak has not engaged in this appeal either with the decision of the Circuit Court or, more significantly, with the very comprehensive judgment of the High Court. In any event, for the reasons set out, I am satisfied that none of the arguments canvassed by Ms. Nowak in her appeal to this Court is sufficient for the Court to find that the High Court erred in its treatment of her appeal on a point of law. Nor, for the reasons set out, is there any merit in her argument that her submissions were ignored either in the Circuit Court or the High Court.

80.         In effect, Ms. Nowak has not persuaded this Court that the High Court Judge erred in law in concluding that she had not surmounted the threshold set out in by Clarke J. in Fitzgibbon (or McKechnie J in Attorney General v. Davis) in establishing any error of law on the part of the Commissioner (or the Circuit Court). As Ms. Nowak  has failed to identify any point of law such as would warrant the intervention of this Court, I would dismiss her appeal accordingly.

81.         Ms. Nowak has not succeeded in her appeal. It follows that the respondent should be entitled to her costs. If, however, either party wishes to seek some different costs order to that proposed they should so indicate to the Court of Appeal Office within twenty one days of the receipt of the electronic delivery of this judgment, and a costs hearing will be scheduled, if necessary. If no indication is received within the twenty-one-day period, the Order of the Court, including the proposed costs order, will be drawn and perfected.

82.         As this judgment is being delivered electronically, Ní Raifeartaigh J. and Pilkington J. have indicated their agreement therewith and the orders I have proposed.  

Result:     Appeal Dismissed.