High Court of Ireland Decisions

You are here: BAILII >> Databases >> High Court of Ireland Decisions >> Doolin v The Data Protection Commissioner [2020] IEHC 90 (21 February 2020)
URL: http://www.bailii.org/ie/cases/IEHC/2020/2020IEHC90.html
Cite as: [2020] IEHC 90

[New search] [Printable PDF version] [Help]

Page 1 ⇓

THE HIGH COURT

[2020] IEHC 90

[RECORD NO. 2019/211 CA]

IN THE MATTER OF THE DATA PROTECTION ACTS, 1988 AND 2003 AND IN THE

MATTER OF AN APPEAL UNDER SECTION 26 OF THE DATA PROTECTION ACTS, 1988

AND 2003

BETWEEN

CORMAC DOOLIN

APPELLANT

AND

THE DATA PROTECTION COMMISSIONER

RESPONDENT

AND

OUR LADY’S HOSPICE AND CARE SERVICES

NOTICE PARTY

JUDGMENT OF MS. JUSTICE HYLAND DELIVERED 21st FEBRUARY 2020

Introduction

1. This case raises a discrete question: whether CCTV footage viewed by the Appellant’s

employer, Our Lady’s Hospice and Care Services (“OLHCS”) was further processed by

OLHCS in breach of the Data Protection Act 1988 as amended (the “1988 Act”). In short,

the Appellant, an employee with OLHCS at the time of the alleged breach, makes the case

that the CCTV was viewed for a permissible use i.e. to prevent crime and promote staff

security and public safety, but that information derived from same was unlawfully further

processed for the purpose of disciplinary action against him qua employee of OLHCS.

Background

2. On 19th November 2015, OLHCS found a threatening graffiti message in a staff room

located in one of the buildings known as the Anna Gaynor house forming part of the

Hospice campus in Harold’s Cross in the following terms: “Kill all whites, ISIS is my life”.

This was reported to An Garda Siochana who advised OLHCS to review the CCTV footage

to identify the persons who had accessed, inter alia, the staff room (also described as the

tea room or break room) in the Anna Gaynor house for the period between 17th and 19th

November 2015. The Appellant was one of a number of staff members identified on the

CCTV footage accessing the staff room. Both parties agree that the CCTV footage was

only viewed once by Mr. Paul Gahan, Human Resources Manager and Mr. Tommy Beatty,

Capital Projects Manager on 20th November 2015 for the purpose of investigating the

graffiti incident. The Appellant’s case is that the subsequent use of the information from

that footage was a breach of s.2(1)(c)(ii) of the 1988 Act.

3. Section 2(1)(c)(ii) provides that personal data kept by a data controller (having been

obtained only for one or more specified purposes) shall not be further processed in a

manner incompatible with those purposes.

Chronology of Events

4. On 26th November 2015, OLHCS wrote to the Appellant stating that it had commenced a

formal investigation under its Disciplinary Policy into the following:

•

An offensive graffiti message which was found in the Anna Gaynor staff room.

Page 2 ⇓

•

The use of unauthorised breaks.

5. The Appellant was asked to attend a meeting on 1st December to progress the

investigation. Terms of reference, disciplinary policy and hours of work policy were

enclosed with the letter. A document entitled “Terms of reference” was exhibited to the

Affidavit of Cormac Doolin filed 20th August 2018 (Exhibit CD4). It refers to the graffiti

message and the viewing of the CCTV footage, and to staff members accessing the room

at unauthorised times. It notes OLHCS is conducting a fair, speedy and thorough

investigation into the matter. At paragraph 8 it states that if the outcome of the

investigation is that there is a reasonable belief that any employee is guilty of the alleged

gross misconduct, a disciplinary hearing may be convened.

6. On 26th November 2015 an email was sent from Paul Gahan of HR asking a Deirdre

Congdon to send out invites for investigation, inter alia, to the Appellant, with the two

terms of reference and to draft the letter in a way that refers to the two investigations. A

further letter was sent on 27th November 2015 in very similar terms to the letter of 26th

November referred to above identifying that formal investigations were taking place into:

•

An offensive graffiti message which was found in the Anna Gaynor staff room.

•

Staff members accessing the room at unauthorised times.

(Despite the reformulation of the terms of investigation in the second terms of reference,

in fact the conclusion of the Panel Report of 15th February 2016 discussed below was that

the Appellant had taken unauthorised breaks as opposed to a finding on access at

unauthorised times i.e. it reverted to the original formulation in the letter of 26th

November).

7. On 27th November 2015, a meeting was held between the persons conducting the

investigation and Mr. Ken White, building services manager. The notes of that meeting

were presumably obtained under a freedom of information request or in some other way

as the Appellant did not attend that meeting. That meeting refers to Mr. White receiving

two terms of reference as well as the disciplinary policy and hours of work policy. As

identified above only one terms of reference was exhibited. Mr. White was questioned

almost exclusively about break times for the Appellant and others and their reason for

being in the tea room where the graffiti incident took place.

8. On 1st December 2015, an investigation meeting took place with Mr. Doolin, Mr. Gahan

and Mr. Beatty. Mr. Gahan stated the role of the investigation panel was to establish the

facts pertaining to the incident of 19th November and the access to the Anna Gaynor Tea

Room at unauthorised times. The Appellant was questioned about his access to the room

and reference was made to the CCTV footage. Because OLHCS asserted that the

disciplinary proceedings continued solely on the basis of admissions by the Appellant

rather than information derived from the CCTV footage it is necessary to set out the

relevant extracts from the note of interview in this respect (Exhibit JVOD1).

Page 3 ⇓

“TB: The Gardai asked us to look at the CCTV for the days previous to identify if there

was a pattern. It came to light that you had accessed the room for 55 minutes on

the day in question, the day previous 46 minutes and 50 minutes on the Tuesday.

Why were you in the room?

CB: If work got on top of us we would take a break?

TB: Did you get your lunch break on those days?

CD: Yes I can’t remember exactly but I would remember if I did not get my lunch.

PG: Would there be a reason for you to be up there?

CD: On occasion we would go up.

PG: Your manager confirmed there were no tickets raised for that area on the days in

question so why were you there?

CD: For me personally, things got on top of me.

PG: Do you want to see the CCTV footage.

CD: Not at this present time no.

PG: So you took a break, is that fair to say?

CD: Sometimes.

PG: Just that week?

CD: For myself, yes.

PG: Is that a regular occurrence?

CD: If work was on top of me I might go off on my own and get some water.

PG: Do you think that is an appropriate way to deal with things getting on top of you?

CG: No I should have said it to my manger if I needed a break.

PG: Is there anything else you want to tell us?

CD: No I’m ok.”

9. On 15th January 2016, the Investigation Panel Report (the “Panel Report”) was produced

by Mr. Gahan and Mr. Beatty. That report refers to the CCTV footage showing staff

members accessing the room at unauthorised times. It states that if the outcome of the

investigation is that there is a reasonable belief that any employee is guilty of the alleged

gross misconduct, a disciplinary hearing may be convened. Under the heading “Findings”,

it is stated that in the course of the investigation the panel considered, inter alia, CCTV

Page 4 ⇓

footage on 17th, 18th and 19th November 2015 and the interview and record of meeting

with the Appellant. Under the heading “With respect to the access to the staff area

upstairs in Anna Gaynor House”, it states:

“The panel reviewed CCTV footage and Fob Access in line with OLH&CS Policy on

Closed Circuit Television in order to establish the facts in relation to a crime

(Offensive Graffiti) in consultation with Gardaí. The panel is satisfied that Mr Doolin

accessed the staff area upstairs in Anna Gaynor on three consecutive afternoons

(17th, 18th and 19th November) at times shown in the table below.

Name

Date

Time Accessed Time Left

Time Duration

Cormac Doolin

17th November

2015

15.11

16.04

53 Minutes

Cormac Doolin

18th November

2015

15.35

16.21

46 Minutes

(Cut-off)

19th November (Cut-off)

(Cut-off)

1 hour & (cut-

off)

10. Findings were also made in respect of times of unauthorised access, working hours, work

tickets in the staff area upstairs in Anna Gaynor, other rooms in the staff area upstairs in

Anna Gaynor. Then under the heading “Outcome”, the finding is as follows:

“Following a comprehensive consideration of the information obtained during this

investigation the panel have established on the balance of probabilities that

unauthorised breaks were taken by Mr. Cormac Doolin on the afternoons of

Tuesday 17th, Wednesday 18th and Thursday 19th November 2015”.

11. Under “Recommendations” the Panel recommended:

•

“Training is carried out with Mr Doolin in relation to Our Lady’s Hospice & Care

Services Hours of Work Policy.

•

Access through fobs for the staff area upstairs in Anna Gaynor is removed from Mr

Doolin and fobs are only issued by the Building Services Manger on a needs basis in

line with work tickets raised.

•

Mr Doolin is invited to a Disciplinary Hearing under Our Lady’s Hospice & Care

Services Disciplinary Procedure.

This report will be sent to Senior Management who will consider this report and

may make further recommendations as necessary.

Page 5 ⇓

The Occupational Health Services of Our Lady’s Hospice & Care Services remains

available to Mr Cormac Doolin.”

12. The following observations may be made about the Panel Report. The Report is solely in

respect of the investigation relating to staff members accessing the room at unauthorised

times. It clearly relies inter alia directly on the CCTV footage, identifying as it does the

precise times of entry and exit. Accordingly, it wholly undermines the claim of OLHCS that

the investigation into unauthorised access was solely made on the basis of admissions.

Finally, there is no reference at all to unauthorised access to the staff room being a

security issue contrary to the averments of Mr. O’Dwyer of the DPC discussed below.

13. By letter of 2nd February 2016 the Appellant is invited to a disciplinary hearing under the

formal disciplinary procedure. The letter states: “The matters to be considered at the

meeting are included in the final outcome report from the investigation (which you

received on 15th January 2016) Please find attached a copy of the disciplinary policy”.

14. No further documentation is exhibited and the outcome of the disciplinary hearing is not

apparent from the affidavits, although from submissions made at the hearing it appears

that the Appellant was given a minor sanction.

Legal Framework

Appeal on a point of law

15. This is an appeal on a point of law from the Circuit Court under s.26(3)(b) of the 1988

Act. As such, the scope of the review is as identified in cases such as Deely v. Information

Commissioner [2001] 3 IR 439, to the effect that a court is confined in its remit on

appeals on a point of law as follows:

(a) It cannot set aside findings of primary fact unless there is no evidence to support

such findings;

(b) It ought not to set aside inferences drawn from such facts unless such inferences

were ones which no reasonable decision-making body should draw.

documents and should do so if incorrect;

(d) If the conclusion reached by such bodies shows that they have taken an erroneous

view of the law, then that also is a ground for setting aside the resulting decision.

16. Insofar as appeals against decisions of the DPC to the Circuit Court are concerned, they

have been specifically considered by the Supreme Court in Nowak v. DPC [2016] 2 I.R.

585, where O’Donnell J. reached the conclusion that the applicable standard to apply is

that in Orange Ltd. v. Director of Telecoms (No. 2) [2000] 4 IR 159.

Purpose Limitation Principle

17. Section 2(1)(c) of the 1988 Act provides in relevant part as follows:

Page 6 ⇓

2(1) The data controller shall, as respects personal data kept by him or her, comply

with the following provisions:

“(c) The data -

(i) shall have been obtained only for one or more specified, explicit and

legitimate purposes,

(ii) shall not be further processed in a manner incompatible with that

purpose or those purposes”.

18. This section transposes Article 6(1)(b) of Directive 95/46/EC of the European Parliament

and of the Council of 24 October 1995 on the protection of individuals with regard to the

processing of personal data and on the free movement of such data, (“Directive 95/46”)

which provides, inter alia:

“1. Member States shall provide that personal data must be: …

(b) collected for specified, explicit and legitimate purposes and not further

processed in a way incompatible with those purposes. Further processing of

data for historical, statistical or scientific purposes shall not be considered as

incompatible provided that Member States provide appropriate safeguards”.

19. Article 6(2) places the obligation for compliance on the controller, providing that “It shall

be for the controller to ensure that paragraph 1 is complied with”.

20. The protection provided by Article 6(1)(b) is known as “purpose limitation” in the data

protection world. The concept of purpose limitation is explained by the Working Party 29

group (“WP29”), a group of experts from the Member States (now re-named under the

GDPR as the European Data Protection Board) that from time to time issue opinions on

aspects of Directive 95/46, and now on the GDPR.

21. Opinion 3/2013 on purpose limitation 00569/13/EN WP 203 (the “Opinion”) was adopted

on 2nd April 2013. Because I am told by both counsel in this case, Mr. Walsh BL for the

Appellant and Mr. Fennelly BL for the Respondent, that there is no case law of the CJEU or

the Irish courts interpreting Article 6(1), I will quote from this Opinion in extenso. I am

conscious this Opinion is simply an interpretation by a body (albeit a body with

considerable expertise in data protection) of the provisions of Directive 95/46 and such

opinions are not afforded any particular status in the Directive. Nonetheless, because it is

of assistance in understanding the scheme of Article 6(1), it is useful to set out in full

certain passages.

“III.2.1. General framework for compatibility assessment

The notion of 'further' processing

It is helpful to first clarify what constitutes 'further processing'. As explained earlier,

it follows from Article 6(1)(b) and recital 28 of the Directive that the purposes of

Page 7 ⇓

processing must be specified prior to, and in any event, not later than, the time

when the collection of personal data occurs.

When setting out the requirement of compatibility, the Directive does not

specifically refer to processing for the 'originally specified purposes' and processing

for 'purposes defined subsequently'. Rather, it differentiates between the very first

processing operation, which is collection, and all other subsequent processing

operations (including for instance the very first typical processing operation

following collection - the storage of data).

In other words: any processing following collection, whether for the purposes

initially specified or for any additional purposes, must be considered 'further

processing' and must thus meet the requirement of compatibility.

The notion of incompatibility

Rather than imposing a requirement of compatibility, the legislator chose a double

negation: it prohibited incompatibility. By providing that any further processing is

authorised as long as it is not incompatible (and if the requirements of lawfulness

are simultaneously also fulfilled), it would appear that the legislators intended to

give some flexibility with regard to further use. Such further use may fit closely

with the initial purpose or be different. The fact that the further processing is for a

different purpose does not necessarily mean that it is automatically incompatible:

this needs to be assessed on a case-by-case basis, as will be shown below.

In some situations, this additional flexibility may be needed to allow for a change of

scope or focus in situations where the expectations of society - or of the data

subjects themselves - have changed about what additional use the data may be put

to. It is also possible that when initially specifying the purpose, neither the

controller nor the data subject thought additional purposes would be necessary,

although it subsequently transpired that the data could indeed be very useful for

other things. In some of these (and similar) situations, a change of purpose may be

permissible, and further processing may be considered not incompatible, provided

that the compatibility test is satisfied” (page 21).

22. The Opinion goes on to identify four key factors to be considered during the compatibility

assessment:

The relationship between the purposes for which the data has been collected and

the purposes of further processing. The Opinion explains that the greater the

distance between the purposes of collection and the purposes of further processing,

the more problematic this would be for the compatibility assessment.

The context in which the data have been collected and the reasonable expectations

of the data subjects as to their further use. Here the Opinion explains that the issue

here is what a reasonable person in the data subject’s situation would expect his or

Page 8 ⇓

her data to be used for based on the context of the collection. Generally, the more

unexpected or surprising the further use is, the more likely it is that it would be

considered incompatible. Further the balance of power between the data subject

and data controller should be considered and in particular, an investigation should

be made as to whether the data subjects were obliged to provide the data under

law. The more specific and restrictive the context of collection, the more limitations

there are likely to be on further use.

The nature of the data and the impact of further processing on the data subjects.

Relevant impact may involve the way in which data are further processed. The

more negative or uncertain the impact of further processing, the unlikely it is to be

considered as compatible use. The availability of alternative methods to achieve the

objectives pursued by the controller, with less negative impact for the data subject,

would be a relevant consideration.

The safeguards applied by the controller to ensure fair processing and to prevent

any undue impact on the data subjects. Appropriate additional measures could

serve as compensation for the change of purpose, including additional steps taken

for the benefit of the data subjects, such as increased transparency with the

possibility to object or provide specific consent.

23. In summary, further processing for a different purpose is not automatically incompatible

but must be assessed on a case by case basis.

Complaint by Appellant

24. At some stage following the disciplinary procedure, the Appellant decided to make a

complaint to the DPC about the use of his data. Somewhat surprisingly, the original

complaint made by the Appellant on 17th June 2016 does not appear to be exhibited. An

email of 12th October 2017 is exhibited whereby the Appellant complains of the delay in

dealing with his complaint. By letter of 18th October 2017 Mr. O’Dwyer, deputy

commissioner of the DPC responds, acknowledging that progress has been slow but

identifies that queries have been put to OLHCS.

25. On 28th November 2017, the DPC wrote to the Appellant summarising the response of

OLHCS. The DPC summarised the Appellant’s complaint as being that OLHCS “used the

CCTV footage for disciplinary proceedings related to unauthorised breaks”. OLHCS stated

that the investigation panel did not view the CCTV after interviewing staff members. It

further stated that the footage showed staff entering the room, that there was no work-

related reason for them to be there, that in interviews they were asked their reason for

being in the room and some of them admitted to taking an unofficial additional break.

Disciplinary action was taken on the basis of that admission. Accordingly, OLHCS stated

that the Appellant’s personal information was not processed by it by using CCTV as part

of the disciplinary matter.

26. By email of 10th December 2017, the Appellant picked the DPC up on a

mischaracterisation of his complaint, stating:

Page 9 ⇓

“I have previously stated to your office and OLHCS Ltd. that, it was not CCTV

footage that was used to sanction me, it was data retrieved, processed and used in

an incorrect/unfair manner, from CCTV footage, that lead to my illegal sanction”.

27. I should say at this point that it was alleged that the Appellant had not made it clear in

the proceedings that this was his position. I do not accept that contention. At paragraph 5

of his first affidavit sworn on 20th August 2018, he refers to “the grounding for such

meeting (being 1 December 2015 meeting) having come from the unlawful further

processing of the CCTV footage”. At paragraph 7 of the same affidavit he refers to the

DPC erring in concluding that the “subsequent use of information gathered/processed for

a security purpose … could thereafter legitimately be used for a reason unrelated to either

security or safety…”. These paragraphs make clear the nature of his complaint.

Decision of the DPC

28. No reply to the email of 10 December 2017 is exhibited but on 27th July 2018 the DPC

writes to the Appellant formally issuing a decision. The DPC notes that in its response to

the Office, “OLHCS confirmed that the purpose for the use of CCTV by the Hospice at the

time of graffiti incident was for “Health & Safety/Security”. OLHCS provided a copy of the

relevant CCTV Policy, signature dated 30 June 2015, in which it stated that the use of

CCTV in OLHCS was to prevent crime and to promote staff security and public safety”

(paragraph 4).

29. At paragraph 5, the submissions of OLHCS were summarised, with OLHCS asserting that

“CCTV footage was not used for the purpose of the disciplinary hearing, and that the only

purpose for the use of the CCTV was for the investigation into a criminal matter with the

involvement of the Gardai. It advised that disciplinary action was taken on foot of the

staff admitting that they had been taking unsanctioned breaks”.

30. The DPC first asked whether OLHCS had a lawful basis as set out under s.2A of the Act for

processing the Appellant’s personal data. It concluded that OLHCS “had a legitimate

justification to access and view CCTV footage in order to make enquiries as to who had

carved the offensive and threatening material into the table in the staffroom. It was a

serious security issue which potentially gave rise to a threat to staff and it had to be

investigated. This included the necessity to view the CCTV footage as part of the

investigation” (paragraph 18)…. This Office is satisfied that the processing of your

personal data was in pursuit of security purposes and to prevent what your employer

deemed to be possible terrorist activity. This is in line with its CCTV policy in place at the

time of the incident, which states that the purposes of the CCTV system is to “prevent

crime and promote staff security and public safety” (paragraph 22). The DPC concluded

that OLHCS had a lawful basis under the legitimate interest provision set out in s.2A(d) of

the Acts for the very limited processing of the Appellant’s personal data.

31. The DPC then went on to consider whether the requirements of s.2(1)(c)(ii) had been

met, being that personal data must not be processed for purposes other than the purpose

for which it was originally collected. It found that:

Page 10 ⇓

“In this case, I am satisfied that your images captured on CCTV were processed in

connection with the investigation of a security incident when they were initially

viewed by the investigation team for that purpose alone. The information gathered

from that viewing may subsequently have been used for another purpose i.e.

disciplinary proceedings against you but this in my view does not constitute a

different purpose, because the CCTV images were not further processed for that

second purpose. If the images were further processed for that second purpose, for

example by downloading and use in the disciplinary proceedings against you, it

might constitute further processing for a different purpose but that did not happen

in your case and no further processing of your images occurred for the second

purpose. Accordingly, I find that the limited viewing of your personal images took

place exclusively for the security purpose for which the images were originally

collected and that no contravention of s.2(1)(c)(ii) occurred” (paragraph 26).

32. It is clear from the Decision that the exclusive basis upon which it was found that no

further processing had occurred was that the CCTV images had not been viewed in the

disciplinary proceedings against the Appellant. The Decision did not engage with what the

Appellant had clearly stated in his email of 10 December 2017, i.e. that it was not CCTV

footage that was used to sanction him but rather data retrieved and processed from the

CCTV footage.

The Proceedings

33. Following on from that Decision, the Appellant issued the within proceedings by

originating Notice of Motion on 18th October 2018 on the following sole ground of appeal:

In making the Decision, the DPC erred in fact and/or in law: (1) In determining that

the Appellant’s employer was not in violation of section 2, and in particular section

2(1)(c) of the Data Protection Acts applicable by reason of the said employer’s use

of the Appellant’s data for reasons unrelated to the purpose for which such data

was originally processed and/or in breach of the CCTV policy in being;”

34. The proceedings were grounded on an affidavit of the Appellant sworn 20th August 2018.

There was later an amendment to the relief sought to advance a claim of breach of fair

procedures. The Appellant has made clear that he does not wish to advance that

argument and so I do not consider it further. A supplemental Affidavit was sworn by the

Appellant on 12th October 2018 and exhibits case studies published by the DPC in its

Annual Reports.

35. Points of defence were filed on 8th November 2018 by the DPC as well as a replying

affidavit sworn by Mr. O’Dwyer on 7th November 2018. In this Affidavit, Mr. O’Dwyer

asserted that insofar as the CCTV footage formed the basis for the investigation meeting

of 1st December 2015, it was on foot of its processing for security purposes to include

those relating to the investigation of the graffiti incident (paragraph 8). He went on to

observe that the disciplinary action against the Appellant took place on the basis of his

own admissions in the investigation meeting, not on the basis of the CCTV footage

(paragraph 9). He concluded at paragraph 12 that there was no further processing of the

Page 11 ⇓

CCTV footage beyond that necessary for the security purposes relating to and arising from

the investigation of the graffiti incident and that the disciplinary action relating to taking

of breaks was based on admissions of the Appellant.

36. A further supplemental Affidavit of the Appellant was sworn on 6th December 2018. An

Affidavit of the Appellant (application to amend) was sworn on 20th December 2018. A

second replying Affidavit was sworn by Mr. O’Dwyer on 11th January 2019 and a replying

Affidavit was sworn by him on 11th January 2019 in relation to the application to amend.

37. Only one intervention in these proceedings was made by OLHCS and that was by an

affidavit sworn by Mr. Pierce of OLHCS on 8th March 2019 to address, inter alia, the

purpose for which the CCTV footage was processed. At paragraphs 3,3 4 and 5 he made

the following averments:

3. “We were advised to review the CCTV for the locus on a number of days (“the

Data”) to ascertain who had been in the break-room at the pertinent time and may

have effected the graffiti. For this purpose alone the CCTV for the 17th, 18th and

19th of November 2015 was reviewed by Mr Paul Gahan, Human Resources

Manager, and Mr Tommy Beatty, the newly appointed Capital Projects Manger and

previous Building Services Manager (in charge of Building Security and CCTV). In

the course of this review the Appellant was seen on the CCTV entering and exiting

the break room at the times set out. I say and believe that Mr Beatty, who in his

former role was very familiar with the Appellant’s work schedule, had a strong

suspicion that the Appellant was not authorised to be in the break room at the

given times.

4. I say and believe that Mr Ken White, the newly appointed Building Services

Manager, them ascertained from the OLHCS ticketing system (a system controlling

and logging access to areas for maintenance purposes) that the Appellant had no

authorisation to be in the break room at the given times for unknown reasons. The

Appellant was called to an investigatory meeting on the 1st of December 2015, in

the course of which the reason he gave for being in the break room without

authorisation, at the given times, was to take unauthorised breaks. As a result of

this admission sanctions were imposed on the Appellant.

5. I say that the Data was processed/reviewed on one occasion only, as set out

above, and not again thereafter, and the averment at paragraph 5 of the Grounding

Affidavit of the Appellant dated 20th August 2018, that there was “unlawful further

processing of the CCTV footage” is inaccurate and untrue”.

38. Thus Mr. Pierce is reflecting the consistent position of the DPC, that the disciplinary

process and sanctions were based on admissions and not the CCTV data or the use of it.

39. On 21st March 2019, the defence of the proceedings by the DPC took an unexpected turn.

Mr. O’Dwyer swore a third affidavit on 21st March 2019 at which stage he identified a new

basis for the further processing by OLHCS not identified by OLHCS either in the summary

Page 12 ⇓

given by the DPC of the submissions made to it by OLHCS, in the Affidavit of Mr. Pierce,

in the Panel Report or in any of the material exhibited to this appeal. It may be found at

paragraph 5, where he states:

“On the basis of the evidence before the Court, I say that it is clear beyond doubt

that the processing of the CCTV footage by OLHCS was for security purposes,

arising directly from and relating to the investigation of the graffiti incident. It is

clear that, in the particular circumstances of this case, the taking of unauthorised

breaks at an unauthorised location, the site of the graffiti incident, was a serious

and bona fide security issue and that the investigation by OLHCS and the

disciplinary action which resulted therefrom, arose directly out of and was directly

connected to this security issue, albeit that the sanction applied in the context of

the disciplinary action relied on admissions made by the Appellant himself”.

40. A further supplemental Affidavit was sworn by the Appellant on 27th March 2019. A reply

to this was sworn by Mr. O’Dwyer on 11th April 2019 in which he repeats the new claim

made in his third affidavit above at paragraph 10 as follows:

“In summary, there is no dispute that the Appellant was in the Anna Gaynor room

without authorisation and in contravention of the Hospice’s ticketing system at a

point in time that was relevant to the Hospice’s investigation into the graffiti

incident. Indeed, on his own account, this would have constituted Mr. Doolin as a

“suspect” for the purpose of that investigation. In the context of this investigation,

a minor sanction was imposed on Mr Doolin on foot of his admission (now accepted)

that he had taken unauthorised breaks in an unauthorised location in contravention

of the ticketing system. It is clear that, in the circumstances, the contravention of

the ticketing system and the taking of an unauthorised break were valid security

concerns on the part of the Hospice”.

Evidential Basis for Decision of Circuit Court

41. This approach set out at paragraph 5 of Mr. O’Dwyer’s third affidavit and paragraph 10 of

his fourth affidavit was reflected in the case made before the Circuit Court and this Court,

where the primary defence of the DPC is now that the further use of the information

gleaned from the CCTV in the disciplinary proceedings was in fact use for the original

purpose i.e. security purposes since unauthorised entry into the break room was a

security concern.

42. This marks a significant departure from the approach adopted in the Decision, where the

sole justification for rejecting the s.2(1)(c)(ii) argument was that, although there may

have been use of the material for a different purpose i.e. disciplinary proceedings against

the Appellant, this was not in fact a different purpose because the CCTV images were not

further processed for that second purpose, for example because they were not

downloaded and used in the disciplinary process. I find below that that conclusion is

erroneous as a matter of law due to an incorrect interpretation of processing. However,

its importance in this context is that it demonstrates the surprising shift in the approach

of the DPC during the life of these proceedings. The DPC has gone from finding no breach

Page 13 ⇓

because there was no further processing of the CCTV footage to asserting in these

proceedings no breach because any further processing was done for the purpose for

which the material was collected i.e. security.

43. This approach is quite different to the defence adopted by the DPC in the proceedings to

the effect that there was no further processing in the context of the disciplinary

proceeding since that process was founded exclusively on admissions made by the

Appellant – again reasoning that had not been identified in its original Decision as the

basis for the rejection of the s.2(1)(c)(ii).

44. What is remarkable about this new argument, i.e. that the use of the material derived

from the CCTV footage in the disciplinary proceedings was for security purposes, is that

there was no evidence at all to support this argument from OLHCS (as discussed further

below). Notwithstanding this, it became the sole basis for the rejection by the Circuit

Court of the Appellant’s appeal.

45. At page 94 of the transcript of the decision of the Circuit Court the trial judge recites in

full paragraph 5 of the third affidavit of Mr. O’Dwyer quoted above, and observes “Clearly,

it was a security issue, Mr. Doolin being in an unauthorised place taking unauthorised

breaks. In effect, he admitted a breach of security, i.e. by taking the unauthorised

breaks. The disciplinary action was taken on his admissions.” (lines 23 to 27). At page 95,

the trial judge held:

“I accept that in the circumstances Mr. Fennelly’s submission that the disciplinary

action by his employer against Mr. Doolin was taken for security purposes. In fact I

also accept, as has been argued, that there was one investigation, i.e. the graffiti

incident, not two investigations, as argued by Mr. Doolin’s counsel. In all the

circumstances, taking into account the facts in this case, I’m satisfied that Mr.

Doolin has not established that he’s satisfied the test for having this decision of the

Data Protection Commissioner overturned” (lines 2 to 8).

46. This conclusion was not surprising given that the trial judge relied heavily on the

averments of Mr. O’Dwyer at paragraph 5 and 6 of his third affidavit (see page 276 lines

6 to 21) and does not appear to have examined the underlying documents including the

Panel Report, the submissions of OLHCS as recorded in the DPC Decision, or considered

the absence any averment relating to security in the Affidavit of Mr. Pierce of 8th March

2019. A consideration of this material discloses that, as far as I can ascertain, at no point

in time did OLHCS ever justify the further processing of the material gleaned from the

CCTV footage in the disciplinary proceedings on the basis of security concerns. Rather, it

(a) made the point that the CCTV footage itself was only viewed for security purposes and

(b) that the disciplinary proceedings did not employ material derived from the footage but

were based exclusively on admissions made by the Appellant at the interview of 1

December 2015. The idea that the use of the information obtained from the CCTV footage

in the context of the disciplinary proceedings was for security purposes rather than for

disciplinary purposes does not find a basis in any of the material before me. There is

simply no evidence at all to this effect. Perhaps most significantly, as noted in my review

Page 14 ⇓

of the exhibited material above, the Panel Report makes no reference whatsoever to

unauthorised access to the tea room or unauthorised breaks being a security issue.

47. Indeed, the very fact that OLHCS asserted that the material was not used as a basis for

the disciplinary process and that the process was based on admissions makes it clear that

OLHCS were not justifying use of the derived material in the disciplinary process on

security grounds.

48. The Panel Report, dealing as it does only with the unauthorised breaks issue, reflects the

fact that OLHCS always approached the matter on the basis that the viewing of the CCTV

gave rise to two different matters: a security investigation and a disciplinary process. This

is reflected in the letters of 26th and 27th November and the internal email of 27th

November, as well as the Panel Decision itself. The question as to whether there were one

or two investigations was the cause of much controversy between the parties, with the

DPC placing significant emphasis on the fact that the Appellant had said in an email of 10

December 2017 to the DPC that there was a single investigation (CD4 to the grounding

Affidavit of the Appellant) but had then asserted in the course of the proceedings that

there were two investigations. This controversy seemed to me somewhat pointless. In

deciding whether there were one or two investigations, what is clearly most relevant is

the actions taken by OLHCS at the relevant time, rather than how the Appellant

characterised them some considerable time later when engaging in correspondence with

the DPC. The Appellant has no particular knowledge of the OLHCS processes, being at a

remove from them and therefore his characterisation of same is unlikely to be particularly

relevant.

49. The most obvious way to accurately identify what OLHCS did in this respect is to look at

the contemporaneous documentation, in particular the letters of 26th and 27th November

2015 and the internal email exchange of 27th November described above. On balance,

those documents indicate that there were two investigations and not one. However, the

real question is not whether there were one or two investigations but whether information

from the CCTV footage was used in the disciplinary process and for what purpose. As

noted above, the Panel Report of 15th February 2016 makes it clear that the data was

used in the investigation into the unauthorised breaks and that the unauthorised breaks

were not treated as raising any security issues.

50. Moreover, the evidence indicates that the use of the information from the CCTV footage in

the context of the disciplinary hearing was used for an entirely different purpose to that

for which it was collected. The purpose for which the material was collected was stated on

the sign beside the CCTV cameras - “Images are recorded for the purposes of health and

safety and crime prevention” (see exhibit CD 3, page 113 of book of pleadings). This was

reflected in the relevant CCTV Policy of OLHCS at the time, dated 30th June 2015, in

which it stated that the use of CCTV in OLHCS was to prevent crime and to promote staff

security and public safety. That Policy was amended on 8th August 2016, after the graffiti

incident, and now has the following addition at paragraph 1 – “…The purpose of the

system is to prevent crime and promote staff security and public safety. If, in the event of

Page 15 ⇓

viewing CCTV for the specified purpose, a disciplinary action is observed, the CCTV can be

used for the purpose of a disciplinary investigation. However, CCTV will not be viewed

solely for the purpose of monitoring staff”.

51. Had CCTV material been intended to be used for disciplinary purposes as well as the other

purpose identified, that would require to be identified (as indeed was subsequently done

in the policy amendment). If, at the time of collection, the policy was as it is now, none of

the above difficulties would have arisen. This is not intended in any way as a criticism of

OLHCS but rather to demonstrate that the draconian consequences of upholding the

Appellant’s claim as urged upon me by counsel for the DPC are unlikely. It was asserted

that such a finding would seriously hamper investigations of the kind carried out here. I

do not accept that. Where a processor wishes to use CCTV data for identified purposes, if

those purposes are clearly identified before the material is collected (assuming of course

that they are otherwise permissible purposes having regard to the Act) then the use of

such material is likely to be uncontroversial.

52. In summary the CCTV footage was collected for the express and exclusive purpose of

security and was used (permissibly) for that purpose but was also used for a distinct and

separate purpose, i.e. disciplinary proceedings into unauthorised breaks by an employee.

53. In the premises, it seems to me that there was no evidence upon which the Circuit Court

could safely conclude that the further processing in the context of the disciplinary hearing

was for security purposes, since the sole basis for this finding i.e. the averments of Mr.

O’Dwyer in his third affidavit, were not themselves grounded on any material put forward

by OLHCS.

54. I am therefore overturning the decision of the Circuit Court on the basis that there was no

evidence for the conclusion that the disciplinary action, in which information derived from

the CCTV footage was used, was carried out for security purposes.

Relevance of Appellant’s admissions

55. Although it formed no part of the DPC’s conclusions in the Decision (addressed below), for

the sake of completeness, I should address the argument of OLHCS, latterly adopted by

the DPC, that there was no further processing and the disciplinary proceedings were

based entirely on admissions of the Appellant. I have quoted above what OLHCS

characterise as the admissions of the Appellant made during the meeting of 1st December

2015. On the basis of those statements alone, it is difficult to conclude that OLHCS would

have been in a position to reach the conclusions reached in the report of 15th February

2016. The Appellant’s statements are vague, lacking in detail and inconclusive in respect

of unauthorised breaks. In any case, it is manifest from the Panel Report of 15th February

2015 that the disciplinary proceedings were not based exclusively on the Appellant’s

admissions. The Panel expressly refer to their consideration of the CCTV footage and

identify the precise entry and exit dates and times of unauthorised access to the staff

area in the Anna Gaynor house by the Appellant, which is expressly stated to come from

the CCTV footage and fob access. Indeed, no reference is made to any admissions in the

Report at all. Given the state of the evidence on this, it makes Mr. O’Dwyer’s averment at

Page 16 ⇓

paragraph 5 of his third affidavit to the effect that the “sanction applied in the context of

the disciplinary action relied on admissions made by the Appellant himself” very difficult

to understand.

Breach of s.26(1)(c)(ii)

56. Given my conclusion that the Circuit Court decision should be quashed, I am required to

decide if the decision of the DPC of 27 July 2018 that there was no breach of

s.26(1)(c)(ii) should be overturned, having regard to the principles identified above in

Deeley.

57. The sole basis for the DPC’s decision in that regard was that there had been no further

processing of the CCTV footage because that footage was not viewed again. As noted

above, the Appellant’s complaint was in respect of that data retrieved and processed from

the CCTV footage, and not use of the CCTV footage itself.

58. In the DPC decision, the Commissioner states that the Appellant’s images on CCTV were

processed in connection with the investigation of a security incident when they were

initially viewed by the investigation team. The letter goes on as follows:

“The information gathered from that viewing may subsequently have been used for

another purpose i.e. disciplinary proceedings against you, but this in my view does

not constitute a different purpose, because the CCTV images were not further

processed for that second purpose. If the images were further processed for that

second purpose, for example by downloading and use in the disciplinary

proceedings against you, it might constitute further processing for a different

purpose but that did not happen in your case and no further processing of your

images occurred for the second purpose.”

59. It is difficult to reconcile that statement with the express terms of the Panel Report. The

Panel Report describes the review of the CCTV footage as being “in order to establish the

facts in relation to a crime (Offensive Graffiti) in consultation with the Gardai”, goes on to

identify the precise dates and times the Appellant accessed the staff room by way of a

table and concludes that the Appellant accessed the staff area in Anna Gaynor on 3

consecutive afternoons at times shown in the table in the Report. The Report explicitly

states that they considered, inter alia, the CCTV footage. The information used by the

Panel to arrive at their conclusion that the Applicant had taken unauthorised breaks

derived inter alia from both the CCTV footage and fob access records. Accordingly, it is

indisputable that the information contained in the CCTV footage was used for the

disciplinary proceedings, which use constituted a different purpose from the one for which

the data was originally collected. The fact that it was not downloaded for use does not

mean no further processing took place.

60. In my view, applying the test in the DPC letter, this constitutes “further processing for the

second purpose” having regard to the wide definition of processing. One aspect of the

statutory definition of processing found at Section 1 of the Act is particularly apposite,

being “processing of or in relation to information or data, means performing any operation

Page 17 ⇓

or set of operations on the information or data, whether or not by automatic means,

including – (c) retrieving, consulting or using the information or data”.

61. Here, the operation in question that was performed on the CCTV footage was its use by

the investigation team to conclude that the Appellant accessed the staff area in Anna

Gaynor on three consecutive afternoons (17th, 18th and 19th November) at 15.11 and

15.35 and left at 16.04 and 16.21 (the times for 19th November appear to be obscured

on the copy of the Panel Report). That information was further used when the Panel

Report was passed on to a Panel convened for the disciplinary hearing as identified in the

letter of 2nd February 2016, being Audrey Brabazon and Kingsley Long (Exhibit CD4 to

the Affidavit of Cormac Doolin sworn 20th August 2018).

62. Accordingly, I conclude that as a matter of law, having regard to the definition of

processing in the Act, and contrary to the conclusion reached by the DPC, the CCTV

images were further processed.

Conclusion

63. For the reasons set out in the Decision, I:

(a) allow the appeal against the decision of the Circuit Court on the basis that there

was no evidence for the conclusion that the use of the CCTV footage or material

derived from it in the disciplinary hearing was for security purposes;

(b) conclude that the DPC made an error of law in holding that no further processing

took place as this conclusion was founded upon an incorrect interpretation of

“processing” having regard to the terms of s.2(1)(c)(ii).

64. Having regard to the above, I uphold the appeal and set aside the conclusions of the DPC

in the Decision to the effect that no contravention of s.2(1)(c)(ii) occurred.

65. I am conscious that s.26 simply provides for an appeal to the High Court on a point of law

but does not prescribe what should happen in the event of a successful appeal. I

therefore propose to hear the parties on the form of Order, including whether the matter

should be remitted to the DPC.

[Note: At a costs hearing on 25 February 2020, the parties indicated that no remittal

should be made to the DPC and an Order was made in the terms of paragraph 63 above].

Result: Appeal on a point of law from the Circuit Court pursuant to s.26 of the Data Protection Acts 1988-2003. Decision of Circuit Court quashed and decision of the Data Protection Commissioner of 27 July 2018 set aside.