Martin v Data Protection Commissioner

• Jurisdiction: Ireland
• Judge: Mr. Justice Haughton
• Judgment Date: 10 August 2016
• Neutral Citation: [2016] IEHC 479
• Docket Number: [2015 No. 165 JR]
• Court: High Court
• Date: 10 August 2016

BETWEEN

KEVIN MARTIN

APPLICANT

AND

THE DATA PROTECTION COMMISSIONER

RESPONDENT

[2016] IEHC 479

Haughton Robert J.

[2015 No. 165 JR]

THE HIGH COURT

JUDICIAL REVIEW

Information Technology & Data Protection – S. 10 of the Data Protection Acts, 1988 and 2003 – Breach of data protection rights – Conflict of evidence of facts – Judicial review – Right to fair procedures – Statutory decision within jurisdiction – Oral hearing – Remedy of appeal

Facts: The applicant, in the present case, filed an application for judicial review to seek various declaratory and injunctive reliefs against the respondent who had refused to further investigate the applicant's data protection complaints by means of oral hearing. The applicant contended that the decision of the respondent did not conclude a breach of data protection rights of the applicant in the absence of documentary evidence breached the applicant's right to fair procedures and thus, an order directing the respondent to conduct an oral hearing should be passed. The respondent contended that the reliefs sought by the applicant were misconceived and moot in the circumstances where the final decision was made. The respondent further contended that statutory framework did not provide for an oral hearing power to the respondent and that the applicant had more appropriate remedy of appeal to the Circuit Court.

Mr. Justice Haughton dismissed the proceedings brought by the applicant. The Court found that the applicant's challenge to the decision of the respondent was moot as the respondent had made a statutory decision after the investigation of complaints in compliance of s. 10(1) (a) of the 1988 and 2003 Acts and the decision had been made within the jurisdiction. The Court found that the respondent did not have express or implied power under the 1988 and 2003 Acts to conduct an oral hearing and that the requirement of natural and constitutional justice did not confer the respondent with inherent power to conduct an oral hearing in relation to disputed facts arising on the investigation of the complaint. The Court held that the applicant had a remedy to appeal the decision of the respondent to the Circuit Court, which would have afforded an oral hearing to the applicant and resolved the factual dispute in relation to the disclosure of personal data.

JUDGMENT of Mr. Justice Haughton delivered on the 10th day of August, 2016

Introduction

1 In this application for judicial review the applicant seeks a number of declaratory and injunctive reliefs against the Data Protection Commissioner (‘the respondent’ or ‘the Commissioner’) arising from a letter dated 16th February, 2015 from the respondent's investigating officer Mr. Frank Bergin (‘Mr. Bergin’) to the applicant's solicitors wherein the respondent's office refused to further investigate the applicant's data protection complaint by means of an oral hearing to enable the respondent to form its own view on an unresolved conflict of evidence, namely whether the alleged breach of the applicant's data protection rights had occurred.

2 The applicant seeks:-

i) a declaration that the decision of the respondent contained in the 16th February, 2015 letter outlined above breached the applicant's constitutional right to fair procedures;

ii) an order of certiorari quashing the decision of the respondent;

iii) an order of mandamus directing the respondent to conduct an oral hearing in relation to the applicant's complaint to enable it to form a view on the unresolved conflict of evidence to enable it to determine whether a breach of the applicant's data protection rights had occurred;

iv) an order of mandamus directing the respondent to make a formal decision on the applicant's data protection complaint; and

v) damages and costs.

3 While a number of issues are raised in the Statement of Opposition, including whether the proceedings are moot, the substantive issue is whether the respondent is empowered by law to conduct an oral hearing to resolve a relevant conflict of interest arising on investigation of a complaint of contravention of the Data Protection Act, 1988 and 2003 (‘the Acts’, which term includes the Data Protection Act, 1988, as amended).

Factual Background

4 The Acts are intended to provide for the protection of individuals with regard to the control and processing of personal data. The respondent is required pursuant to s. 10 of the Acts to investigate, or cause to be investigated, whether any of the provisions of the Acts have been, or are being, or are likely to be, contravened in relation to an individual either where the individual complains to it or it is otherwise of the opinion that there may be such a contravention.

5 By way of a letter dated 20th December, 2012, solicitors acting on behalf of the applicant submitted a complaint to the respondent alleging that his data protection rights had been breached and asking that the respondent conduct an investigation into the alleged breach.

6 The circumstances of the complaint are as follows. The applicant is a member of St. Raphael's Credit Union, 1-2 Fox & Geese, Naas Road, Dublin 22 (‘the Credit Union’) since 2004. On or about January, 2012, the applicant received a letter from the Credit Union asking him to contact a named representative in relation to his loan account. The applicant is said to have attempted on a number of occasions to contact the representative but was unsuccessful. The Credit Union again wrote to the applicant in February, 2012 requesting him to contact the same representative regarding his loan account. It is averred that the applicant again attempted to contact the named representative but was unsuccessful.

7 On 5th March, 2012, the applicant emailed the named representative seeking to set up an appointment with the Credit Union and indicating his availability to meet. This is stated in the affidavit of the applicant dated 20th March, 2015 to be the last time the Credit Union contacted him before the events which were the subject of the data protection complaint.

8 In his affidavit dated 20th March, 2015, the applicant avers that he was contacted by his father on 17th November, 2012 by way of a telephone call during which he indicated that a Mr. Frank McGrath came to his home claiming to be from the Credit Union. The details of the telephone call and the complaint were outlined as follows in a letter dated 16th August, 2013 from the respondent to solicitors for the applicant:-

‘In correspondence received by this Office from your firm, Mr Martin outlines his version of events surrounding Mr. McGrath's visit to the home of his father :

‘ On the day that Mr McGrath called to Greendale road, I received a phone call from my father, he informed me that a man had called to the house claiming to be from the credit union, he said his name was Frank; had had no identification on view and did not offer any. He informed my father that he was from St Raphael's Garda credit union and that he was looking for Kevin Martin. My father told him that I did not live at that address and that I hadn't for many years. My father invited him into the house in order to give him my phone number. Mr. McGrath informed my father that I ‘had substantial loans with the credit union that were in difficulty’ and that I was avoiding contact and not responding to correspondence. He was also in possession of documents which my father described as ‘looking like accounts statements and having St Raphael's credit union header’ Mr McGrath did not leave any contact details, calling card etc’’

9 The applicant further states at para. 7 of his affidavit dated 20th March, 2015 that Mr. McGrath ‘proceeded to show my father a folder containing my private and confidential financial statements. The man stated that my loans had been restructured and discussed my repayment schedule.’

10 The applicant then issued the letter of 20th December, 2012 to the respondent detailing his complaint. He then received a letter dated 9th January, 2013 in which the respondent indicated that the Commissioner under s. 10 of the Acts would ‘investigate your complaint using our full legal powers if necessary to resolve the matter…’. The investigation was carried out by Mr. Bergin, investigating officer, on behalf of the respondent.

11 By way of a further letter dated 31st January, 2013, the respondent informed the applicant's solicitors, Lawlor Partner Solicitors, that it had contacted the Credit Union as part of its investigations which acknowledged that its representative had gone to the applicant's father's house but denied that he had discussed or disclosed any sensitive or personal information.

12 The investigation continued, Mr. Bergin sent letters dated 12th June, 2013 and 12th July, 2013, requesting responses from the Credit Union, who replied by letters dated, inter alia, 28th June, 2013 and 6th August, 2013. From these responses it emerged that the Credit Union had no electronic record of the meeting between Mr. McGrath and Mr. Martin Snr., and only had Mr. McGrath's record of the outcome of the visit entered on their Credit Control System as of 30th November, 2012. This records the date of their meeting as being 24th November, 2012 as opposed to the applicant's assertion that it was on 17th November, 2012.

13 The letter of 16th August, 2013 provides details of the Credit Union's ‘version of events surrounding Mr McGrath's visit to Mr Martin Senior's home’ as follows:-

‘I have spoken to Mr McGrath concerning the visit and he had informed me that he has a clear and accurate recollection of his discussion with Mr Martin's father. He has informed me that on the date in question he identified himself to Mr Martin Senior as an officer of St Raphael's Garda Credit Union Limited.

He was invited into the gentleman's home. He informs me that the conversation was limited to inquiring as to...