Fox v The Data Protection Commissioner
| Jurisdiction | Ireland |
| Judge | Mr. Justice Mark Heslin |
| Judgment Date | 25 September 2023 |
| Neutral Citation | [2023] IEHC 529 |
| Court | High Court |
| Docket Number | HIGH COURT RECORD NO. 2022 80 CA |
In the Matter of the Data Protection Acts 1988–2003
And in the Matter of An Appeal Under Section 26 of the Data Protection Acts 1988–2003
[2023] IEHC 529
HIGH COURT RECORD NO. 2022 80 CA
CIRCUIT COURT RECORD NO. 2019 / 8215
THE HIGH COURT
Point of law – Jurisdiction – Data Protection Acts 1988–2003 s. 10 – Appellant seeking to appeal on a point of law against a decision of the Circuit Court dismissing an appeal against a decision of the respondent – Whether a point of law was identified in the appellant’s originating notice of motion
Facts: The appellant, Mr Fox, appealed to the High Court, on a point of law, against a 25 April 2022 decision of the Circuit Court (Judge O’Connor) dismissing an appeal against a decision of the respondent, the Data Protection Commissioner, dated 14 November 2019. The decision by the Commissioner was made pursuant to s. 10 of the Data Protection Acts 1988–2003. The appellant’s originating notice of motion was dated 5 May 2022. The motion gave notice that the appellant sought: “orders allowing within the appeal (sic) setting aside the cited decisions made by the Circuit Court and the Data Protection Commissioner and an order for costs in my favour”. The following is a verbatim setting out of the balance of the appellant’s originating motion: “AND FURTHER TAKE NOTICE that the grounds of the appeals are that, in making the decision, the Circuit Court erred in fact and/or in law. 1. In upholding that the Data Protection Commissioner’s decision that my employer was not in violation of s. 2 of the Data Protection Acts 1988 and 2003 and other applicable laws concerning the matter, by reason of the said employer’s covert and unconsented secondary processing, unfair collection and retention of my Data of my data (sic) using a covert camera disguised as a motion sensor, for reasons that were excessive and unjustified. 2. In upholding that the Data Protection Commissioner’s decision that my employer was not in violation of s. 2 and 4 of the Data Protection Acts 1988 and 2003 by reason of the said employer’s collection of my data by unconsented secondary processing, unfair collection and retention of my Data, and denying me my right to establish the existence of personal data and my right to access said personal data. 3. In upholding that the Data Protection Commissioner’s decision that my employer was not in violation of s. 2 of the Data Protection Acts 1988 and 2003, Article 8 of the European Convention on Human Rights, Articles 7 and 8 of the European Charter of Fundamental Rights, applicable by reason of the said employer’s unconsented and unfair collection of my data and accessing and reading the contents of my private correspondences without prior warn od (sic) the nature and extent of the intrusion into my privacy”.
Held by Heslin J that, on a plain reading of the originating notice of motion, the appellant simply asserted that the Circuit Court’s error was in upholding the Commissioner’s decision on complaints 1, 2 and 3 (which correspond to complaints 3, 4 and 5 as originally made). It did not seem to Heslin J that a point of law was identified in the said motion. Heslin J held that the High Court had no jurisdiction to consider a point of law not identified in the appellant’s originating notice of motion. Heslin J held that none was identified and the appeal must fail. Lest he was wrong to determine the matter on the foregoing basis, Heslin J was satisfied that the plethora of points which the appellant had sought to raise in the appeal comprised a combination of: (i) an attempt to re-run, on the merits, the process which took place before the Commissioner; and (ii) an invitation to the High Court to reach a different decision, based on bare assertions unsupported by evidence, with respect to issues that were not raised before the Commissioner or before the Circuit Court, and which included a collateral attack on the Circuit Court’s discovery order.
Heslin J’s preliminary view was that the appropriate approach to costs was to follow the normal rule and to make an order for the respondent’s costs against the appellant.
Appeal dismissed.
Judgment of Mr. Justice Mark Heslin delivered on the 25th day of September 2023
. This case comes before the court by way of an appeal, on a point of law, against a 25 April 2022 decision of the Circuit Court (His Honour Judge O'Connor) dismissing an appeal against a decision of the Respondent (otherwise “the Commissioner”) dated 14 November 2019 (“the decision”).
. The decision by the Commissioner was made pursuant to s. 10 of the Data Protection Acts 1988–2003 (“the Acts”), para. 10 (1) (a) of which, under the heading “Enforcement of data protection” begins as follows:-
“The Commissioner may investigate, or cause to be investigated, whether any of the provisions of this Act have been, are being or are likely to be contravened…in relation to an individual either where the individual complains to him of a contravention of any of those provisions or he is otherwise of opinion that there may be such a contravention…”.
. The Appellant was employed by the National Gallery of Ireland (“the NGI”) as an attendant from 1991. His contract of employment was terminated by the NGI by letter dated 28 November 2011, arising from allegations that he sent emails to a third party which contained information of a security sensitive nature. The Appellant takes issue with this description of the emails.
. The Appellant submitted a complaint to the Commissioner dated 10 December 2010. The Commissioner formed the view that the complaint was “frivolous or vexatious” within the meaning of those terms as used in s. 10 (1)(b)(i) of the Acts.
. The Appellant contested this determination by way of a statutory appeal which was brought under s. 26 of the Acts. The Commissioner's position was upheld by decisions in the Circuit Court and High Court and a further appeal was made to the Court of Appeal.
. Prior to determination of the matter by the Court of Appeal, the Supreme Court delivered a decision in Nowak v. Data Protection Commissioner [2016] IESC 18 on 28 April 2016. In essence, the Supreme Court decided that a statutory appeal lies against an opinion formed by the Commissioner that a complaint ought not to be investigated on the basis of a view formed by the Commissioner that the complaint was “frivolous or vexatious”.
. In the wake of the Supreme Court's judgment, the Commissioner conceded the appeal to the Court of Appeal and, pursuant to terms agreed between the Commissioner and the Appellant, a re-constituted complaint was submitted, dated 27 October 2016.
. On internal p. 2 of the Decision, the relevant complaint by the Appellant to the Commissioner is summarised in the following terms:-
“ Your Complaint
You submitted an updated complaint to this office dated 27 October 2016 against NGI alleging the following:
(1) That NGI processed your personal data, while monitoring your use of your work mobile telephone.
(2) That NGI had held covert files in relation to you.
(3) That NGI had installed covert CCTV to monitor employees.
(4) That NGI failed to provide you with access to your all (sic) personal information in response to an access request you had submitted to it.
(5) That NGI processed your personal data, while monitoring the content of your work email.
(6) That NGI failed to ensure the return of your personal data following the conclusion of a contract with a data processor.
(7) That NGI obtained your biometric data without being transparent about the purpose for which it was obtained.
For the purpose of making this decision, the investigation conducted by this office has had regard to all of the materials submitted by both parties since 2010”.
. It has never been suggested that the foregoing is not an accurate summary of the Appellant's complaint. In circumstances where the Commissioner decided four of the seven issues in favour of the Appellant, only complaints 3, 4 and 5 are of relevance for present purposes.
. With respect to complaint 3, the Commissioner decided that, in circumstances where the NGI was faced with the theft of property from a secure storeroom and this theft raised further security concerns, the NGI had a legitimate interest in processing the Appellant's personal data by installing a covert security camera for the purposes of detecting an offence. The Commissioner further found that, under s. 2 A (1) (d) of the Acts, the NGI had a legal basis for processing the Appellant's personal data by installing a covert CCTV camera. In addition, the Commissioner concluded that there had been no breach of s. 2 D (1) of the Acts, as it would not have been practicable for NGI to provide the Appellant with information relating to the processing of his personal information recorded on a covert CCTV camera.
. With respect to complaint 4, the Commissioner found that the NGI did not contravene s. 4 of the Acts, as it provided the Appellant with access to his personal data to the extent possible within the statutory time frame, in that the NGI provided access to a certain amount of the Appellant's personal data and sought clarification from him regarding what he considered to be outstanding, which clarification the Appellant failed to provide.
. With respect to complaint 5, the Commissioner found that the NGI had a legal basis, under s. 2 A (1) (d) of the Acts, for processing the Appellant's personal data contained in the email messages in question. The Commissioner also concluded that the processing of the Appellant's personal data was compliant with the fair processing requirements set out under s. 2 D (1) of the Acts.
. On any view, the Commissioner's decision (which runs to 44 pages)...
To continue reading
Request your trial