In the Matter for Mount Carmel Medical Group (South Dublin) Ltd

• Jurisdiction: Ireland
• Judge: Mr. Justice Keane
• Judgment Date: 07 July 2015
• Neutral Citation: [2015] IEHC 450
• Court: High Court
• Docket Number: [2014 No. 48 COS]
• Date: 07 July 2015

[2015] IEHC 450

THE HIGH COURT

Keane J.

[2014 No. 48 COS]

IN THE MATTER OF MOUNT CARMEL MEDICAL GROUP (SOUTH DUBLIN) LIMITED (IN LIQUIDATION)

AND IN THE MATTER OF THE COMPANIES ACTS 1963 TO 2012

The Companies Act – Data Protection (Access Modification) (Health) Regulations 1989 – Declaratory judgments – O. 19, r. 29 of the Rules of the Superior Courts 1986 – Custodian of records – Directive 95/46/EC of the European Parliament

Facts: The liquidators in the proceedings sought a declaration that St. James Hospital, with whom the liquidators had been given liberty to enter into an identified record transfer and management agreement, will become the data controller of the records with effect from the transfer of the records. The liquidators also sought a declaration that in the event they will need the access to the records, they will be entitled to those.

Mr. Justice Keane refused to grant both the declarations to the liquidators. The Court held that under Directive 95/46/EC of the European Parliament, the data could be held by a single person and jointly with others. The Court held that the power to grant a declaration should be exercised sparingly and with due care and caution. The Court found that the grant of declaration that the St. James Hospital should be the exclusive data controller would be contrary to the Constitution as the persons whose records were being held would have no recourse against the liquidators for any loss and mishandling of their records that could likely occur in future. The Court held that since St. James Hospital had already shown its willingness to enter into the proposed contract, no useful purpose would be served to seek such a declaration that if granted would affect the rights and liabilities of several people in the future.

JUDGMENT of Mr. Justice Keane delivered on the 7th July 2015

Introduction

1 This is the Court's ruling on part of an application brought by the official liquidators ('the liquidators') of Mount Carmel Medical Group (South Dublin) Limited ('the company').

2. In the material part of an Order made on the 15th December 2014, the Court:

(i) Granted liberty to the liquidators to enter into an identified Record Transfer and Management Agreement ('the proposed contract') with St. James's Hospital ('SJH').

(ii) Granted liberty to the liquidators to pay out of the assets of the company the support and maintenance fees to certain identified service providers in connection with the operation of the contract.

(iii) Directed the liquidators, following the execution of the contract, to transfer the medical records ('the records') currently held by or on behalf of the company to SJH.

3 The Court adjourned the application for further argument in respect of the following two other reliefs sought:

(iv) A declaration that SJH will become the data controller of the records with effect from the transfer of the records.

(v) A declaration that, in the event of the liquidators requiring access to the records for the purpose of the liquidation of the company, they will be entitled to such access and SJH shall be at liberty to disclose such Records to the liquidators.

4 On the 18th February 2015, the Court ordered that the Data Protection Commissioner ('the DPC') be joined as a notice party to the application pursuant to the provisions of Order 15, rule 13 of the Rules of the Superior Court or the inherent jurisdiction of the Court.

The liquidation

5 By Order made on the 5th February 2014, the Court officially appointed the liquidators and directed that the company be wound up. Prior to being wound up, the company operated Mount Carmel Hospital in Churchtown, Dublin.

The data

6 As one would expect, the company routinely created and maintained medical records concerning the persons treated as patients in the hospital. The liquidators estimate that the company currently holds approximately 280,000 records relating to approximately 118,000 patients, dating back to circa 1946. The records include paper files, electronic files, x-rays, blood samples and tissue samples. In addition, there is an x-ray server machine that holds approximately 1.7 million digital images. The liquidators have been advised, and there can be no doubt, that these records fall within the definition of both 'personal data' and 'sensitive personal data' under the Data Protection Acts 1988 and 2003 ('the DPA'), and that the company is the 'data controller' of the data contained in those records as it relates to patients of the hospital as 'data subjects' under that legislation.

7 Nor is there any doubt that the special provisions of the Data Protection (Access Modification) (Health) Regulations 1989 ('the Regulations') apply to the data contained in the records in so far as they constitute 'health data' under those regulations; that is, data relating to physical or mental health. Regulation 5(1) prohibits a data controller, such as the company, who is not a health professional from supplying or withholding health data in response to a data access request from a data subject without first consulting with the appropriate health professional.

8 As of the 20th November 2014, the liquidators had received 1,202 data access requests.

9 The DPA do not stipulate any period for which data must be retained by a data controller. Quite the contrary, s. 2(1)(c)(iv) of the DPA requires that personal data shall not be kept for longer than is necessary for the specific, explicit and legitimate purpose or purposes for which it was obtained.

10 In identifying the necessary data retention period, the liquidators point to Health Service Executive ('HSE') Guidelines which, they assert, while not legally binding, recommend that medical records be retained for various periods ranging up to thirty years in some instances and in perpetuity in the case of blood samples.

The obligations of the company and of the liquidators

11 There is an obvious cost associated both with the retention of records and with meeting the obligations imposed upon a data controller under the DPA in respect of the personal data contained in such records. Because the records contain health data, the liquidators have retained on a part-time basis the services of a senior nurse, who they believe has the necessary experience and qualifications to advise, as an 'appropriate health professional', on the extent to which health data may be supplied in response to any request by a data subject without causing harm to that person, in accordance with the requirements of the Regulations.

12 The cost of the storage and retrieval of the records; the employment of an appropriate health professional; and the provision of the relevant personal data in response to each request rank as continuing expenses in the liquidation. The liquidators acknowledge that such cost is unavoidable for as long as the relevant records are retained by the company and it remains the data controller of the personal data contained in them.

13 Conscious of those costs, the liquidators have considered, and have described to the Court, two specific options for addressing the company's record storage and data protection obligations in future. The first, simply stated, is the maintenance of the status quo as just described. The second involves the transfer of the relevant records and – as the liquidators envisage – the transfer of the statutory role of data controller in relation to them to another entity, specifically, SJH, pursuant to the terms of the proposed contract.

14 The liquidators have costed each of the two options they describe for an indicative five year period. The total cost of the first option for that period is €636,500 and that of the second option is €430,100. The liquidators have prepared an 'estimated outcome account' as at the 10th October 2014 by reference to the implementation of the second option, suggesting an anticipated distribution of approximately 4% of the value of the debts owed to the preferential creditors, but have confirmed that there are sufficient funds in the liquidation to meet the cost of either option (at least for that period). The preferential creditors are the Revenue Commissioners and the Department of Social Protection. They will be the beneficiaries of the relevant cost saving, if it can be properly effected. The liquidators are officers of the court and are under a duty to the creditors of the company not to incur any unnecessary or unreasonable expense in the conduct of the liquidation.

15 SJH has indicated that it is willing to enter into the proposed contract subject to the approval of the Court.

The proposed contract

16 The liquidators have exhibited a copy of the proposed contract. In general terms, it provides for the transfer of the records from the company to SJH and for the provision of certain defined services by SJH in respect of the records, in consideration for the payment of agreed charges by the company to SJH.

17 A number of specific provisions of the proposed contract are of particular relevance to the present application. Clause 4.1 provides:

'At any reasonable time following the date on which the transfer of the Records from [the company] to [SJH] has been completed in accordance with this clause 4 and Schedule 3, and on receipt of reasonable notice, [SJH] shall:

(a) give [the company] and/or [the liquidators] access to, and allow copies to be taken of, the Records as [the company] and/or [the liquidators] may reasonably require; and

(b) allow [the company] and/or the liquidator to take possession of any paper originals of the Records that are still in the possession of [SJH], to the extent reasonably required to take action in respect of any costs, claims, damages, losses, expenses and liabilities arising as a result of, or in connection with, the liquidation of [the company].'

18 Clause 11 states:

'11.1...