High Court of Ireland Decisions

THE HIGH COURT

JUDICIAL REVIEW

[2023] IEHC 567

[Record No. 2022/699JR]

BETWEEN

EAMON MCSHANE

APPLICANT

AND

 

DATA PROTECTION COMMISSION

RESPONDENT

AND

 

HEALTH SERVICE EXECUTIVE

NOTICE PARTY

 

JUDGMENT of Mr Justice Bolger delivered on the 19^th day of October 2023.

 

Background

1.            This is an application made on notice to the respondent notice party for leave to judicially review the respondent’s decision of 23 May 2022 on the applicant’s complaint of 15 December 2021 that his personal data held by his employer, the notice party, was accessed without authority or consent. The respondent decided that the notice party could not be considered a controller of the applicant’s personal data stored on his work phone without their knowledge or agreement.

2.            The applicant made a complaint to the respondent on 15 December 2021 about his personal data and attached a copy of a letter from his solicitor dated 24 September 2021 which set out that his personal data held by the notice party had been breached and that his online accounts had been accessed. From the outset, the respondent focussed on the applicant’s non-work-related personal data. For example, the respondent’s first substantive response in an email of 14 April 2022 asked the applicant to set out how the notice party could be deemed a controller for personal data processed in apparent contravention of the notice party’s ICT Acceptable Use Policy.

3.            The respondent wrote to the applicant’s solicitor on 23 May 2022 advising that they had concluded their file because the notice party could not be considered the controller of the applicant’s personal data that he stored on his work-issued phone without the notice party’s knowledge or agreement. The applicant seeks leave to challenge that decision in these proceedings on the basis that the respondent did not take account of the work-related personal data on the phone that was processed by the notice party in connection with his employment and they should have defined the notice party as a data controller that processed that personal data.

4.            The respondent asserts that the applicant’s complaint related only to his non-work-related personal data and, in any event, that he had a statutory appeal available to him which he failed to avail of and he is therefore precluded from seeking judicial review of the decision.

The standard of review

5.            The parties agree on the standard of review, i.e., “an arguable case with a reasonable prospect of success” (as per Charleton J. at para. 20 of his judgment in Burke v. Minister for Education and Skills [2022] IESC 1).

Availability of a statutory appeal

6.            The default position is that a party should avail of a statutory appeal rather than judicial review, as recognised by Clarke J. in EMI Records (Ireland) Ltd & ors v. Data Protection Commissioner & Eircom Plc [2013] IESC 34. However, Clarke J. also acknowledged the possibility of an exception to that general rule where “an appeal will not permit the person aggrieved to adequately ventilate the basis of their complaint against the initial decision” (at para. 4.9). In my recent decision in I.B. v. HSE [2023] IEHC 537, I identified such an exception where an applicant had been denied their statutory entitlement to an investigation of their complaint. I drew a distinction between a failure to investigate a complaint and an incorrect analysis of the complaint. There is an arguable case that a similar criticism can be made of this respondent’s decision i.e., that they never investigated the applicant’s complaint about his work-related personal data.

7.            The respondent has a statutory function pursuant to s. 101(1)(f) of the Data Protection Act 2018, as amended, to “handle” a complaint and pursuant to s. 101(1)(g) to “examine the lawfulness of processing”. This applicant has established an arguable case with a reasonable prospect of success that he made a complaint about his work-related personal data that was never handled or examined by the respondent, in breach of his statutory entitlements, and that the respondent unreasonably and unlawfully focused solely on his non-work-related personal data. It is arguable that the applicant’s complaint that he has been denied his statutory entitlement to have his complaint handled and examined comes within the exceptions to the default statutory remedy.  The applicant has, therefore, established an arguable case that he is entitled to proceed by way of judicial review.

Sidestepping the statutory time limits

8.            The respondent accuses the applicant of sidestepping his failure to bring a statutory appeal within time. O’Malley J. in Petecel v. Minister for Social Protection [2020] IESC 25 recognised that an applicant “might attempt to ‘sidestep’ the proper utilisation of the statutory appeals process by asserting specious points of law in judicial review proceedings” (at para. 112). Whether that has occurred is something best dealt with on a case-by-case basis, given the discretionary nature of judicial review relief.  In the within case, I am not satisfied at this stage that the applicant can be said to have raised specious points of law as I am satisfied that he has established an arguable case that he will succeed in the reliefs he seeks on the grounds he has identified.

Defining data controller

9.            The applicant has established an arguable case that his complaint included his work-related personal data as well as his unauthorised non-work related data. If that is found to be so, then there is also an arguable case with a reasonable prospect of success that the notice party was a data controller that processed the applicant’s personal data and that the respondent, therefore, should have handled and examined that aspect of his complaint. The definitions of “data controller” and “personal data” in the General Data Protection Regulation (EU) 2016/679 are wide enough to potentially cover the applicant’s complaint in relation to his work related personal data such that he has established an arguable case that the respondent erred in not finding the notice party to have been a data controller of the applicant’s personal data.

10.         The Opinion of the Advocate General in VB v. Natsionalna agentsia za prihodite (Case C-340/21) set out the potentially wide scope of the verification and review that a national authority (referred to in the Opinion as “the national court”) such as the respondent may be required to conduct in assessing the appropriateness of the technical and organisational measures implemented by the data controller. At para. 84 of the Opinion, the Advocate General said:-

“when verifying whether the technical and organisational measures implemented by the controller of personal data are appropriate, the national court hearing the action must carry out a review which extends to a specific analysis of both the content of those measures and the manner in which they were applied as well as their practical effects”.

These comments illustrate the potentially wide scope of a national authority’s obligations of review when presented with a claim that a person’s personal data has been breached.  The applicant has established an arguable case that the respondent’s review of his complaint was overly narrow, and unreasonably and unlawfully focused solely on the applicant’s non-work related personal data.

Conclusions

11.         The applicant has satisfied the not very high standard (as analysed by Charleton J. in Burke) to assert an entitlement to leave. The applicant is, therefore, entitled to leave to judicially review the decision of the respondent of 23 May 2022 on the grounds set out at para. 5 of the Statement of Grounds and to seek the relief set out at para. 4 thereof.

12.         I will put the matter in for mention before me at 10.30am on 1 November 2023 to finalise the orders to be made.

 

Counsel for the Applicant:  Conor Power SC and William McLoughlin BL

Counsel for the Respondent:  Donogh Hardiman BL

Counsel for the Notice Party:  Eoin McCullough SC and Claire Hogan BL