Fox v DPC - 25 April 2024

• Judgment Date: 25 April 2024
• Issuer: Court of Appeal
• Year: 2024

APPROVED

NOT REDACTED

THE COURT OF APPEAL

Record Number: 2023/280

High Court Record Number: 2022/80CA

Circuit Court Record Number: 2019/8215

Neutral Citation Number [2024] IECA 92

IN THE MATTER OF THE DATA PROTECTION ACTS 1998 - 2003

AND IN THE MATTER OF AN APPEAL UNDER SECTION 26

OF THE DATA PROTECTION ACTS 1988 - 2003

Noonan J.

Binchy J.

Butler J.

BETWEEN/

DAVID FOX

APPELLANT

-AND-

THE DATA PROTECTION COMMISSIONER

RESPONDENT

JUDGMENT of Mr. Justice Noonan delivered on the 25th day of April, 2024

1.This appeal arises from a data access request made by the appellant over 14 years ago.

It is the third appeal by the appellant, who has at all times been self-represented, from a

decision of the respondent made in 2019. The multiplicity of appeals provided for under the

Data Protection Acts has previously been the subject of comment by this Court - see Doolin

v The Data Protection Commissioner [2022] IECA 117 at para. 1 - 2. In our courts system,

the vast majority of first instance decisions may be appealed only once. There is no obvious

justification for so many appeals in this instance. As this case amply demonstrates, the effect

is great delay, enormous cost and a significant drain on court resources. This is not in the

interests of the parties or the public. Reform is long overdue.

Background

2.The appellant was employed by the National Gallery of Ireland (“the NGI”) as an

attendant for over 20 years. His employment was terminated by letter of the 28th November,

2011.

3.On the 10th December, 2010, the appellant submitted a data access request to the NGI.

The appellant was not satisfied with the response received and made a complaint to the

respondent. For reasons set out in the judgment of the High Court (Heslin J. [2023] IEHC

529), the complaint was ultimately reformulated on the 27thOctober, 2016 and after a

lengthy investigation, the respondent issued a detailed written decision on the 14th

November, 2019. Prior to that, on the 2nd August, 2019, the respondent provided a draft of

her decision to the appellant and afforded him the opportunity of making submissions on the

draft, which he took.

4.The appellant originally complained of seven separate matters, recorded in the

respondent’s decision and quoted in para. 8 of the judgment of the High Court:

“Your Complaint

You submitted an updated complaint to this office dated 27 October 2016 against

NGI alleging the following:

(1) That NGI processed your personal data, while monitoring your use of your

work mobile telephone.

(2) That NGI had held covert files in relation to you.

(3) That NGI had installed covert CCTV to monitor employees.

(4) That NGI failed to provide you with access to your all (sic) personal

information in response to an access request you had submitted to it.

(5) That NGI processed your personal data, while monitoring the content of

your work email.

(6) That NGI failed to ensure the return of your personal data following the

conclusion of a contract with a data processor.

(7) That NGI obtained your biometric data without being transparent about

the purpose for which it was obtained.”

5.The respondent upheld complaints (1), (2), (6) and (7), but rejected (3), (4), and (5).

It is the latter three which are the subject of the appellant’s appeals herein. A helpful

summary of the respondent’s determination regarding these complaints is set out in the High

Court judgment:

“Complaint 3

10. With respect to complaint 3, the Commissioner decided that, in circumstances

where the NGI was faced with the theft of property from a secure storeroom and this

theft raised further security concerns, the NGI had a legitimate interest in processing

the Appellant’s personal data by installing a covert security camera for the purposes