A decision by the Data Protection Commissioner ordering Dublin Bus to release CCTV footage to an individual who was simultaneously undertaking a personal injuries action against Dublin Bus (arising from an alleged fall on a bus whilst a passenger) has been recently upheld by the High Court.
Dublin Bus appealed against an earlier order of the Circuit Court that it provide the CCTV footage to the applicant, requesting that the High Court find that the existence of legal proceedings between a requester seeking data and the relevant data controller bars the requester from making an access request under applicable data protection legislation.
In dismissing Dublin Bus's claim, Mr Justice Hedigan found that the existence of proceedings between a data requester and the data controller does not preclude the data requester making an access request under Section 4 of the Data Protection Acts 1988 and 2003 (the "Acts"), and nor does it justify the data controller refusing the request. In reaching this decision Justice Hedigan also noted that in effect "the appellant is seeking to carve out a new exception in the Acts, to the effect that whenever a data requester has instituted litigation against a data controller he or she is precluded from making a data access request under the Acts".
Both the Commissioner (in January 2011) and Judge Linnane in the Dublin Circuit Court (in July 2011) had previously found in favour of the requester.
Subject Access Requests
The subject access request (SAR) is a process under the Acts allowing individuals with the right to access any of their personal data held by third parties on payment of a fee, provided their request meets certain procedural requirements. Under Section 3 of the Acts, a requester has a right to find out, free of charge, if a person (an individual or an organisation) holds information about them. They also have a right to be given a description of the information and to be told the purpose(s) for holding their information. Under Section 4 of the Acts, a requester can obtain a copy of their personal data, whether held electronically or on paper, as photographs or as CCTV images. The applicant is also entitled to know where the information was obtained, how it has been used and if it has been disclosed to another party. The access request was rejected by Dublin Bus, on the grounds that any such information was prepared in anticipation of potential litigation, and as such was privileged. While an...