Data Controller breaches several provisions in its processing of Sensitive Personal Data [2007] IEDPC 2 (2 August 2007)
I received a complaint in May 2006 from a data subject regarding the use by her former employer, B.H., of two medical reports relating to her. The data subject had been involved in an industrial accident at work in April 2002 which subsequently resulted in a prolonged absence from the workplace. During this absence, the data subject pursued a personal injuries claim against B.H.. As part of this process, at the request of the solicitor acting on behalf of B.H.'s insurers, she attended a consultant neurologist on two occasions for medical evaluation in 2003 and 2004. Early in 2005, the data subject became aware that the medical reports compiled as a result of those evaluations were in the possession of B.H.. Through her solicitor, the data subject made an access request to B.H. for copies of the medical reports. She was advised in writing that, as these reports were obtained in the context of her personal injury proceedings, her access request should be addressed to the solicitors,
P.O. & Son, acting for the insurers. Shortly afterwards, the data subject's contract of employment was terminated. The decision by B.H. to terminate the employment was stated to be on the basis of the medical evidence available to the company, including the medical reports compiled in 2003 and 2004 in the context of the data subject's personal injury claim. Following her dismissal, the data subject brought a claim to the Labour Relations Commission against B.H. under the Unfair Dismissals Act 1977 to 2001. A hearing in relation to this case took place in April 2006 and the data subject alleged that, in the course of the hearing, copies of the medical reports were furnished by B.H. to herself, to the Rights Commissioner and to all present. These medical reports had not been previously provided to her in response to her access request.
My Office conducted a detailed and extensive investigation of this complaint. This focused on 2 primary data protection issues, namely the use of the medical reports obtained to defend an insurance claim to support the dismissal of the data subject and the disclosure of those same medical reports at a labour relations hearing. The company's solicitor stated that the medical reports of the consultant neurologist were obtained for the legitimate purpose of defending personal injury proceedings instituted by the data subject and that the medical reports were also employed and required for the legitimate purpose of defending separate legal proceedings against B.H. under the Unfair Dismissals Acts 1977 to 2001. It submitted that Section 2(1)(c)(i) of the Acts specifically envisages that the data may be obtained and used for more than one purpose, provided that both purposes are legitimate. It went on to state that Section 2(1)(c) (ii) of the Acts only prohibits further processing insofar as that processing is incompatible with the original purpose or purposes. It argued that the use of the reports to defend legal proceedings against B.H. under the Unfair Dismissals Act could not be said to be incompatible with the original purpose as the original purpose was to defend legal proceedings instituted by the data subject and the subsequent use was to also defend legal proceedings, albeit separate proceedings by the data subject.
The data subject sought a decision on her complaint under Section 10(1)(b(ii) of the Acts in June 2007. In my analysis of the data protection issues arising from this complaint, I found that the medical reports in question constitute 'sensitive personal data' within the meaning of the Acts. The medical reports were commissioned on behalf of B.H.'s insurers, by its solicitors, for the purpose of the defence of the High Court personal injury claim instituted by the data subject. The reports were, however, used for three purposes:
They were used for the purpose for which they were generated in the first place, i.e. for the defence by B.H.'s insurers of the High Court personal injury claim instituted by the data subject.
They were used in the decision taken by B.H. to terminate the employment of the data subject.
They were used to defend legal proceedings taken by the data subject against B.H. under the Unfair Dismissals Act at a hearing in April 2006.
No data protection issue arose in relation to the first use of the medical reports by B.H.'s insurers in the context of its defence of the personal injury claim brought by the data subject.
With regard to the second use by B.H. of the medical reports in the decision to terminate the data subject's employment, this was done without the data subject's consent. The general requirements that must be complied with by a data controller under the Acts in relation to the personal data of a data subject include the following:
the data shall have been obtained only for one or more specified, explicit and legitimate purposes
the data shall not be further processed in a manner incompatible with that purpose or those purposes
the data subject is informed of the purposes or purposes for which the data are intended to be processed.
The consent of the data subject is the default position, as it were, for the fair processing and obtaining of personal data. Where it is absent, the data controller may not process personal data unless it can find another basis in the Acts. The Acts provide for the following exemptions which were potentially applicable in the present case:
the processing is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the fundamental rights and freedoms or legitimate interests of the data subject (Section 2A (1)(d));
and (because sensitive data is involved)
the processing is required for the purpose of obtaining legal advice or for the purposes of, or in connection with, legal proceedings or prospective legal proceedings or is otherwise necessary for the purpose of establishing, exercising or defending legal rights (Section 2B (b)( vii)).
All of these conditions must be met.
In my analysis of this complaint, I considered that the purpose for which the medical reports were originally obtained (the defence by B.H.'s insurers of the High Court personal injury claim instituted by the data subject) was not compatible with their further use to support the data controller's decision to dismiss the data subject. I considered that, in the absence of the data subject's consent, this processing of the data subject's sensitive personal data constituted a breach of the Acts.
With regard to the third use by B.H. of the medical reports to defend legal proceedings under the Unfair Dismissals Act, the same considerations arose in relation to the further use of the sensitive personal data at a hearing before a Rights Commissioner in April 2006, with the aggravating factor that the sensitive personal data was further disclosed to those involved in the hearing.
However, I had to consider if the processing of personal data in this case might benefit from the exemption in Section 8(f) of the Acts which provides that: "Any restrictions in this Act on the processing of personal data do not apply if the processing is ...required...for the purposes of, or in the course of, legal proceedings in which the person making the disclosure is a party or a witness."
I formed the opinion that this exemption cannot apply to sensitive personal data which has already been improperly processed to support the decision (dismissal) which was the subject matter of the legal process. I concluded that the use of the medical records to defend the Unfair Dismissals claim constituted a further breach of the Acts.
For completeness, my Decision in this case also found that B.H. had failed to comply fully with an access request made by the data subject.
This case demonstrates the care which data controllers must exercise in the processing of all personal data, including sensitive personal data, in its possession. It is unacceptable for a data controller to seek to take advantage of personal data which may be in its possession and to use it for some purpose unrelated to the purpose for which it was originally obtained.