|
Judgment | Title: | Murphy v Callinan | | Neutral Citation: | [2018] IESC 59 | | Supreme Court Record Number: | 435/12 | | High Court Record Number : | 2006 4967 P | | Date of Delivery: | 30/11/2018 | | Court: | Supreme Court | | Composition of Court: | Clarke C.J., Dunne J., Baker J. | | Judgment by: | Baker J. | | Status: | Approved | | Result: | Appeal dismissed | | | |
2
THE SUPREME COURT
Appeal No. 435/2012
Clarke C. J.
Dunne J.
Baker J. BETWEEN/ PETER MURPHY
APPELLANT
-AND-
GARY CALLINAN, JULIE CARROLL, AND ARB UNDERWRITING LIMITED, THE COMMISSIONER OF AN GARDA SÍOCHÁNA
IRELAND AND THE ATTORNEY GENERAL
RESPONDENTS
JUDGMENT of Ms. Justice Baker delivered on the 30 th day of November, 2018
1. This is an appeal from the dismissal of these plenary proceedings by MacMenamin J. on 9 May 2012 on the application for non-suit brought by the defendants at the conclusion of the plaintiff's evidence.
2. The plaintiff, a litigant in person, runs a motor trading business. He commenced the action by plenary summons dated 24 October 2006, after his motor insurance policy with ARB Underwriting Ltd. ("ARB"), the third named defendant, was cancelled as he was considered to have falsely stated on the policy application form that he had never been convicted of any motoring offence or of any criminal non-motoring offence. The information on foot of which the policy was cancelled came to the attention of ARB from the first defendant, a member of An Garda Síochána who, at all material times, acted in his professional capacity.
3. The proceedings were issued against six defendants, four of whom, the first, fourth, fifth, and sixth will be collectively referred to as the "State defendants". The second named defendant was, at all material times, acting as an employee of ARB, and she and the third defendant will be collectively referred to as "ARB" as the claim against her relates to her actions in the course of her employment.
Background
4. The plaintiff never contested the cancellation of the motor insurance policy and accepted the returned premia. After the cancellation, he exercised his right of access pursuant to the then operative data protection legislation, the Data Protection Act 1988, as amended by the Data Protection (Amendment) Act 2003 transposing Directive 95/46/EC on the Protection of Individuals with Regard to the Processing of Personal Data ("the 1988 Act") and thereafter requested that the State defendants and ARB erase/rectify data showing criminal convictions for fraud.
5. The plaintiff's claim before MacMenamin J., as well as the related judicial review proceedings, have at their core a contention as to the accuracy of the records of the previous convictions of the plaintiff held by the State defendants and ARB and an assertion that the State should no longer keep record of stale or old convictions.
6. The Plaintiff's pleaded claims against the State defendants are, in essence, twofold: (i) A claim in injurious falsehood that, in breach of section 20(1) of the Defamation Act 1961 (the "1961 Act"), the first defendant knew, or ought to have known, that the information held by An Garda Síochána concerning his past convictions was false and inaccurate and that communication of that data would damage the Plaintiff's vehicle dealership business and was unlawful.
(ii) A claim in negligence, breach of duty, and breach of Constitutional rights as a result of the communication of incorrect data to the second and third defendants.
7. The plaintiff's claim against ARB is for damages for breach of statutory duty under the 1988 Act on account of its pleaded failure to rectify identified errors in the data it holds concerning him.
8. It is important to observe that the complaints concern events in 2006 and requests under the 1988 Act made between June and September of that year, and the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation) ("GDPR") and changes made by the Data Protection Act 2018 are not engaged.
9. MacMenamin J. dismissed the plaintiff's claim in the light of the evidence and applied the principles identified by the Supreme Court in Hetherington v. Ultra Tyre Services Ltd. [1993] 2 IR 535, and O'Toole v. Healy [1993] 2 IR 544, although he noted that a court was not, as a result of the approach identified in those authorities, precluded from engaging in some degree in an analysis or scrutiny of the evidence.
10. No error is identified in that approach taken by the trial judge. The judicial review proceedings
11. The appellant issued separate proceedings by way of judicial review on 23 January 2007 (the "Judicial Review proceedings") involving the same parties and, essentially, the same facts as those upon which he relies in these plenary proceedings.
12. The Judicial Review proceedings were heard and determined in the High Court and an ex tempore judgment was delivered by Charleton J. on 25 July 2008. He made the factual determination that both answers given by the plaintiff on the proposal form were wrong "whether as a result of being filled in quickly or by an agent".
13. The applicant's appeal of that decision was dismissed by the Supreme Court and an ex tempore judgment was given by Fennelly J. on 12 June 2009 with which the other judges agreed. The plenary proceedings and the findings of the High Court
14. The plaintiff continued to pursue this plenary action after the determination by the Supreme Court of the Judicial Review proceedings and ARB made an application for dismissal on the grounds of res judicata . Having taken the view that "as a matter of justice" the plaintiff "should be given the opportunity of completing his evidence […] being cross-examined […] and calling his son", MacMenamin J. fairly postponed the consideration of the application until the plaintiff finished his oral evidence. Only two witnesses gave evidence, the plaintiff and his son, and the matter then proceeded as an application for a non-suit by the State defendants before any evidence was called by the defendants and where they had indicated that they would go into evidence if the application was refused.
15. The grounds of that application by the State defendants were that the plaintiff had not made out a prima facie case and/or that the plaintiff's claim (or part thereof) was res judicata and/or an abuse of process.
16. ARB's application that the matters were res judicata was then revisited and re-submitted.
17. In his written judgment dismissing the plaintiff's claim against the second and third defendants for damages, MacMenamin J. found, inter alia : (a) That the plenary action and the earlier judicial review proceedings cannot be dissociated from each other as the issue in the judicial review was the integrity of the conviction records;
(b) That the plaintiff was in fact convicted of an offence pursuant to s. 18 of the Theft and Fraud Offences Act 2001 in the District Court for possession of a stolen chequebook. On appeal, the Circuit Court found the facts proved and, without proceeding to a conviction, dismissed the charge under the Probation Act and that this order of the Circuit Court on appeal was not equivalent to a finding of not guilty;
(c) That the plaintiff did have recorded criminal convictions for matters other than traffic road offences, and "a couple" of convictions under the Road Traffic Acts from the early 1990s;
(d) That the plaintiff had failed to make out any loss.
18. At p. 17 of his ruling, the conclusion of MacMenamin J. was that the matter was res judicata in its strict sense, as the matters in issue had already been determined in a way that met the test set out in the authorities, that courts had "exercised their judicial mind on the issue", the words used by Shaw L.J. in Bradshaw v McMullan [1920] 2 IR 412. In the alternative, he concluded that the plaintiff should not be permitted to proceed with this action on the grounds that to do so would be an abuse of court process.
19. In regard to the claim against the State defendants for injurious falsehood, MacMenamin J. did not rely on a finding of res judicata and made other findings against the plaintiff which were dispositive, inter alia : (a) The proofs had not been met and no evidence was adduced either by interrogatories or by direct evidence of an unlawful publication;
(b) That the evidence adduced on the conviction order under s 18 of the Theft and Fraud Offences Act 2001 and the road traffic offences establishes the truth of the relevant statements.
20. In dismissing the plaintiff's claim against the State defendants for negligence, breach of duty, and breach of constitutional rights, MacMenamin J. found, inter alia : a) That the claims "overlap in every respect those which were made in the judicial review proceedings";
b) That the plaintiff "simply has not addressed the question as to whether it is open to him to by-pass the Commissioner, and simply pursue an action for negligence or breach of constitutional rights" and this amounted to "contributory negligence" on his part;
c) That the plaintiff failed to make out any negligence or loss and that "any loss which he sustained was as a result of his own actions".
21. The conclusion of MacMenamin J. in regard to the claim against ARB was that the plaintiff had not made a prima facie case with regard to his claim for negligence or injurious falsehood and that the complaints regarding data breach "should, appropriately, in the first instance, have been dealt with by the Data Commissioner". The grounds of appeal
22. The grounds of appeal are argued as deriving from what the appellant describes as "incompetent record keeping" of the Garda Commissioner, and the appeal against the defendants generally is that they ought to be held accountable by a competent court for their breaches of his rights as data subject.
23. The appellant pleads ten grounds of appeal which I propose quoting in full: "(1) The State defendants breach of the An Garda Síochána Act 2005 triggered the initiation of the action. They were not held accountable for the breach.
(2) In the face of admission and evidence produced by the State defendants of nine wrongful convictions on the Court Outcomes record kept on the plaintiff for a period of circa 34 years, a total of fourteen entries erased, numerous alterations and ongoing wrongful entries on the Court Outcomes record kept of the plaintiff, in defiance of the plaintiff's constitutional right to his good name the court failed to remedy the matters or hold the State defendants accountable.
(3) The fourth named defendant's incompetent record keeping in relation to the Plaintiff is itself evidence of negligence.
(4) The fourth named defendant's incompetent method of processing the Court Outcomes database is itself evidence of negligence.
(5) The court enunciated on the issue raised by "PM9" of my Book of Exhibits in my favour during the hearing and determined the issue against me in the written judgment.
(6) Incontrovertible evidence was offered to the court that the matter is not res judicata.
(7) The remedies given by the Data Protection Acts are in addition to not to the exclusion of any remedies in tort sec. 7 DPA 1988.
(8) In the circumstance of the case herein, it is not necessary to allege or prove special damage in the tort of injurious falsehood. Section 20(1) of the Defamation Act 1961.
(9) Despite evidence adduced of both sets of defendants abusing the process of the court throughout the proceedings they were not held accountable.
(10) The determination of the High Court undermines the integrity of the domestic jurisprudence in that it is open to the lawbreakers and tortfeasors to pursue the victim of their lawlessness for their legal costs."
24. They can be usefully considered under the following headings: (i) As against the State defendants, that the failure to erase or correct its records regarding the criminal convictions of the appellant amounted to a breach of his constitutional right to a good name, and is negligent. (Grounds 1 to 5 inclusive and Ground 9);
(ii) That the remedies under the 1988 Act in regard to a data breach do not exclude the remedies for which s. 7 of the Act of 1988 provides (Ground 7);
(iii) That the trial judge misdirected himself in law in failing to have regard to the fact that the plaintiff's claim for damages for injurious falsehood did not require proof of special damage on account of the provisions of s. 20 of the 1961 Act; (Ground 8);
(iv) That the trial judge misdirected himself in coming to a determination that some of the matters raised in the plenary proceedings were res judicata . (Ground 6). Abuse of process: Ground 7
25. The appellant identifies inaccuracies in the databases held by An Garda Síochána, and also points to the fact that some of the records held by An Garda Síochána are of such antiquity as to amount to stale convictions for the purposes of the Criminal Justice (Spent Convictions and Certain disclosures) Act 2016.
26. A number of corrections were made to the appellant's personal data held by the Garda Commissioner, some of which arose from the fact that another person of the same name with the same day and month of birth, but a different year, is recorded as having convictions which were wrongly attributed to him. Those errors were rectified following his complaints in 1999 as a result of which twenty-two entries which appeared in a printout he received from An Garda Síochána in 1999 were reduced, altered, and corrected so the relevant data in July 2001 showed nine entries only. The plaintiff subsequently sought corrections and erasures in correspondence with An Garda Síochána in 2001 and 2006 and the relevant database in 2006, when the proceedings commenced, showed two classes of records, thirteen entries in all of which eight were what he described as "old" and five "recent". He had, in the meantime, made a complaint that the alternation of the old Punt records to Euro amounted to an unlawful alteration of the record and in breach of his rights, gave the impression that the records "endows the offences with a modern character", and obscures the fact that they relate to incidents from the mid-1990s.
27. For the reasons that will be apparent, I do not propose examining each of the various incidents and complaints regarding the databases of which the plaintiff complains. These complaints were the subject matter of the judicial review proceedings in which Mr. Murphy sought an order of mandamus directed to the Garda Commissioner and ARB to correct or erase some of his personal data, and the grounding affidavit in which he exhibited his data subject request and responses ran to several pages.
28. The Supreme Court endorsed the approach of Charleton J. in regard to the primacy of the statutory remedy both on account of the scheme of the 1988 Act, which conferred certain powers on the then Data Protection Commissioner and provided for an appeal to the High Court against a determination, but also because, as Charleton J. had held, the right to seek erasure or correction is one derived from the data protection legislation and without which no general right in law exists. Fennelly J. agreed with that proposition and the conclusion of Charleton J. that "the Act in my view creates a remedy within itself".
29. The judicial review proceedings were not dealing with the relief in damages sought by the plaintiff in the plenary action, but only with the claim of the plaintiff for an order of mandamus , and I will return later to the question as to whether the conclusions of the Judicial Review proceedings can amount to an operative res judicata in the claim for damages. But I will first deal with the question of whether the plenary action is an abuse of process.
30. MacMenamin J. noted that the plaintiff had given no satisfactory account in the course of the hearing before him, or in cross-examination, when it was put to him, as to why he did not pursue his complaint with the Data Protection Commissioner, even after the Supreme Court delivered its judgment in 2012. He records that the plaintiff's answer, when probed, was that he had "wanted to bring this action on so that somebody would be looking at the records and deciding what is right and wrong". MacMenamin J. noted, at para. 72 of his ruling, that the task of engaging with the records is vested in the Data Protection Commissioner and that to permit the plaintiff to pursue a remedy other than through that means would be to "countenance an abuse of process".
31. The appellant argues that the plenary action was wrongly characterised as an abuse of process and that the courts retain the jurisdiction to award damages for breach of duty arising from a data breach. He relies on s. 7 of the 1988 Act, which provides as follows: "For the purposes of the law of torts and to the extent that that law does not so provide, a person, being a data controller or a data processor, shall, so far as regards the collection by him of personal data or information intended for inclusion in such data or his dealing with such data, owe a duty of care to the data subject concerned: Provided that, for the purposes only of this section, a data controller shall be deemed to have complied with the provisions of section 2 (1) (b) of this Act if and so long as the personal data concerned accurately record data or other information received or obtained by him from the data subject or a third party and include (and, if the data are disclosed, the disclosure is accompanied by)-
(a) an indication that the information constituting the data was received or obtained as aforesaid,
(b) if appropriate, an indication that the data subject has informed the data controller that he regards the information as inaccurate or not kept up to date, and
(c) any statement with which, pursuant to this Act, the data are supplemented."
32. In simple terms, that section imposes a duty of care on a processor or controller of data, and creates a presumption that that duty of care has been complied with by a data controller who accurately records data or other information received or obtained by him or her from the data subject or a third party in the circumstances outlined.
33. The plaintiff's claim in negligence is pleaded broadly against the State defendants, and more narrowly against the ARB defendants, but essentially, it is founded in an assertion that the relevant parties had an obligation to process and protect the plaintiff's data in a fair manner and, in particular in the light of his allegations, to keep it accurate, complete, and up to date. That general proposition is one that indeed finds reflection in the policies and provisions of the data protection legislation generally, albeit the provisions of the Data Protection Act 2018 create a more complex scheme of protection.
34. Section 7 of the 1988 Act has the effect that the court is entitled to award damages for breach of duty to a data subject arising from the negligent processing of police data. Accordingly, in my view, MacMenamin J. was not correct insofar as he held that the claim in damages is not well founded as it seeks to bypass a statutory scheme and that the claim is an abuse of process.
35. Section 7 preserves the judicial remedy for breach of the duty of care by the data controller. A claim for damages for breach of the duty of care is not an abuse of process merely on account of the fact that there exists a statutory scheme by which correction, erasure or other alternation of data may be achieved. Thus, it seems to me that the appellant must succeed on ground 7 of his notice of appeal. But the matter does not end there. The claim in negligence: Grounds 1 to 5 incl., and ground 9
36. The claim for damages is grounded in tort, and the 1988 Act does not create a new cause of action or strict liability.
37. Feeney J. considered the matter in some detail in his judgement in Collins v. FBD Insurance Plc. [2013] IEHC 137, where he allowed an appeal from an order of the Circuit Court which had awarded the plaintiff damages pursuant to s. 7 of the 1988 Act. The question for determination by the High Court was whether the plaintiff was entitled to damages pursuant to s. 7 of the 1988 Act and, if so, the quantum of such damages.
38. That judgment was not opened to us in the appeal but seems to me to correctly state the legal principles and I propose to therefore consider it in some detail. In Collins v. FBD Insurance Plc ., the claim also concerned a dispute between the plaintiff and the insurers who provided him with motor insurance. The plaintiff had complained to the Data Protection Commissioner in regard to certain breaches of his data rights. The plaintiff, in the course of the High Court appeal, acknowledged that he had suffered no out-of-pocket expenses or special damages arising from the breaches of the data protection legislation which had been subject to a determination by the Data Protection Commissioner. The claim therefore was one for general damages. At para. 4.4 of his judgment, Feeney J. concluded as follows: "Section 7 is limited and goes no further than providing for a duty of care that is a duty of care within the law of torts. To obtain a compensation for a breach of duty of care, it is necessary for a claimant to establish that there has been a breach, that there has been damage and that the breach caused such damage. The tort of negligence, unlike the tort of trespass to person, requires proof of damage. Such requirement is demonstrated in the judgment of Clark J. in Larkin v. Dublin City Council [2008] 1 IR 391…. A person seeking compensation arising from a breach of statutory duty under an Act must establish that the loss or damage that such person has suffered flowed from the breach, unless the statutory duty involved is one of strict liability. Here, the statute does not provide for strict liability and for me to interpret s. 7 of the Data Protection Acts as enabling a claimant to benefit from an award of damages for non-pecuniary loss, would be for me to expand the scope of s. 7 beyond that provided for in the Act or required by the Directive. The Directive in issue in this case requires for there to be compensation for damage suffered and s. 7 does not extend beyond that obligation. Section 7 provides an obligation of duty of care and allows for a remedy under the law of torts and the law of torts generally provides for compensation to be based upon certain criteria which includes the proof of damage."
39. A plaintiff claiming breach of a duty of care in the management or processing of data is not relieved of the obligation to show that there has been a breach and to establish a causative connection between the breach and a loss. The 1988 Act does not create a new tort, and a breach of the rights of a data subject is not actionable in itself without proof of negligence or breach of a duty of care, or proof of loss.
40. As stated by Feeney J. in Collins v. FBD Insurance Plc ., at para. 3.6: "It is also the case that s. 7 in the Irish legislation does not, on the face of it, provide for compensation for strict liability or for the automatic payment of compensation but limits compensation to the existence of a duty of care within the law of torts. It is consistent with the general principles of the Irish law of torts that a person seeking compensation arising from a breach of statutory duty must establish that the loss or damage which they have sustained flowed from that breach unless the statutory duty involved is one of strict liability. The Directive does not provide for strict liability or the automatic payment of compensation nor does s. 7 of the Irish legislation so provide, either by its express terms or by reference to a duty of care within the law of torts".
41. I agree with that statement of the legal effect of the provisions of s. 7 of the 1988 Act.
42. MacMenamin J., in paras. 47 et seq. of his judgment, considered that the plaintiff had not adduced any evidence that the data was processed or obtained in an unfair manner by ARB or its servants or agents. He asked the rhetorical question "where was the unfairness?", and noted that the plaintiff had not adduced even prima facie evidence that any unfairness occurred in the processing of his personal data by ARB. It is essential, in that context, to bear in mind that the plaintiff makes no complaint that the cancellation of his policy was wrongful, and his complaint relates solely to the accuracy of the records. The new data protection regime followed the coming into force on May 25 2018 of the GDPR. The Data Protection Act 2018 implementing GDPR permits an individual to seek compensation from the court for breaches of data subject rights even in the absence of any material damage or financial loss. But s. 7 of the 1988 Act, on which the plaintiff relies, whilst it did expressly create a duty of care on a data controller in regard to personal data, did not make the breach of data subject rights actionable without proof of negligence or a causative connection to an alleged material damage or other loss.
43. Further, MacMenamin J. correctly determined a data subject must engage fairly with a data controller, and the plaintiff offered no explanation as to why he did not respond to the open offer from ARB made in open court to correct any errors he could identify. MacMenamin J. was correct to find that the failure to avail of the statutory remedy did amount to contributory negligence.
44. For these reasons, I consider that MacMenamin J. was perfectly correct in his ruling that the claim of the plaintiff had to fail on account of the fact that he adduced no evidence of negligence or of loss. Res judicata: Ground 6
45. As the Judicial Review proceedings did not concern the right of a data subject to seek damages in the general law of tort and did not consider the provisions of s. 7 of the 1988 Act, the argument that the claim in the plenary proceedings must fail by reason of it being res judicata is wrong at law. The appellant, to that extent, succeeds in ground 6. The claim for damages for injurious falsehood: Ground 8
46. The key to the conclusion to which MacMenamin J. came in relation to the plaintiff's claim in injurious falsehood was that the plaintiff had adduced no evidence regarding any publication of the allegedly incorrect data and, as I have observed, the only oral evidence heard was evidence from the plaintiff himself and conversations between him and the first defendant. While the plaintiff is correct that as a matter of law it was not necessary for him to establish any special loss where the claim is one of injurious falsehood, MacMenamin J. determined the claim and that that had to fail for absence of evidence of publication.
47. I see no error in the approach of MacMenamin J. who, as he was required to, accepted the plaintiff's case at its highest and tested the claim in particular against the uncontroverted finding that the plaintiff had failed to adduce evidence of publication. The plaintiff is a litigant in person and may well have considered that the affidavit evidence in the Judicial Review proceedings or that the replies for particulars or other pleadings amount to evidence of publication. The stark fact is that they are not, and the plaintiff's evidence at the plenary hearing failed to establish an essential proof of the tort of which he claimed. MacMenamin J. was correct in the approach he took. Bias
48. In the course of his oral submission to this Court, the plaintiff appellant made an assertion that two of the judges who sat on the Supreme Court panel in the Judicial Review proceedings were objectively biased for the reasons identified there by him. The plaintiff appellant alleged that two members of the Supreme Court had relevant links to him, and that one member of that Court had acted for him in the past. He did not identify how the nature of his alleged prior interactions with the relevant judges were of such a nature as to give rise to a perception of bias, and it seems from his oral submissions that the links of which he complained were purely professional.
49. The allegations of alleged bias were not raised before the Supreme Court which determined the Judicial Review proceedings in 2012, and the appellant offers no explanation as to why he permitted the Supreme Court to engage upon the hearing of the appeal without any complaint from him, and it seems to me to be simply too late for him to now pursue the argument. In Goode Concrete v. CRCH Plc. [2015] IESC 70, the Supreme Court emphasised the desirability that an application regarding alleged bias be made to the relevant court alleged to be guilty of such bias. Furthermore, I am unclear as to the purpose of the argument of alleged bias.
50. Quite apart from that consideration, the decision of the Supreme Court in the Judicial Review proceedings is final and this Court may not now engage upon any consideration of that decision which would fail to respect its final and conclusive nature. Other matters raised in the appeal
51. In the course of the hearing before this Court, the appellant drew our attention to correspondence with An Garda Síochána in 2017 and 2018 regarding recent data protection access request to it on account of what he identified as incorrect entries. These matters and complaints post-date the proceedings now under appeal, and cannot fall for consideration here.
52. That approach must also be taken to the argument made by the plaintiff appellant that some of the recorded convictions ought to be treated as spent under the Criminal Justice (Spent Convictions and Certain disclosures) Act 2016 which was not in existence at the time the present proceedings were commenced or concluded. Conclusion
53. The appellant has a strongly held and well-articulated complaint regarding the storage and processing of certain personal data by the defendants. He complains that the State defendants wrongly retained and continued to retain incorrect data concerning his previous criminal convictions and on account of the failure to treat some of the very old records as "spent".
54. MacMenamin J. determined inter alia that the action was an abuse of process and the issue of res judicata arose, and for the reason stated, I do not consider that he was correct in this.
55. However, he was correct in his primary determination that the plaintiff had not established a prima facie case on the evidence. In regard to the claim in negligence and for breach of the duty of care under s.7 of the 1988 Act, because the appellant had not shown any negligence or unfairness in the processing of his personal data, nor had he established any loss. In the claim for injurious falsehood, because the appellant had failed to establish the essential element of publication.
56. MacMenamin J. was accordingly correct to accede to the application by the defendants for a non-suit.
57. Therefore, I conclude that the appeal must fail, albeit that the appellant must succeed in grounds 6 and 7 of his notice of appeal. | |
|
