McShane v Data Protection Commission - 3 April 2025

• Judgment Date: 03 April 2025
• Issuer: High Court
• Year: 2025

1

[2025] IEHC 191

THE HIGH COURT

JUDICIAL REVIEW

[2022/699JR]

BETWEEN:

EAMON MCSHANE

APPLICANT

AND

DATA PROTECTION COMMISSION

RESPONDENT

AND

HEALTH SERVICE EXECUTIVE

NOTICE PARTY

JUDGMENT of Mr. Justice Barry O’Donnell delivered on the 3rd day of April, 2025

INTRODUCTION

1. This is the judgment of the court in respect of a challenge by way of judicial review to

a decision made by the respondent. The decision arose from a complaint by the applicant

concerning the notice party. The complaint was processed and decided by reference to the

powers of the respondent under the Data Protection Act 2018 (the 2018 Act) and the underlying

legislation, the General Data Protection Regulation (EU) 2016/679 (GDPR).

2

2. The applicant in this case is a fire prevention officer employed by the Notice Party (“the

HSE”). On the 15 December 2021, he made a complaint to the respondent (“the DPC”) in

respect of a data breach concerning personal data on a phone that had been provided to him by

the HSE in connection with his work. The complaint gave rise to exchanges between the

applicant, the DPC and the HSE. On the 23 May 2022, the DPC decided that the matter should

be concluded on the basis that the HSE was not a “ data controller” for the purposes of the

relevant legislation. The reason for the decision was the HSE had not authorised or permitted

the applicant to use his work phone for personal use. The decision, which was in the form of

an email to the applicant’s solicitors, noted, inter alia: “Based on the information you have

provided to this office, there is no basis for which the HSE could be considered the controller

of your client’s personal data that he himself stored on his HSE issued phone without their

apparent knowledge or agreement.”

PROCEDURAL HISTORY AND THE GRANT OF LEAVE

3. The initial ex parte application was opened on the 15 August 2022 and adjourned to the

23 January 2023. On the 23 January 2023, the High Court directed that the application for leave

should be made on notice to the other parties. The consequent decision of the High Court is set

out in a judgment of Bolger J. dated the 19 October 2023. It is clear from that judgment that

one of the bases on which the DPC and HSE resisted the grant of leave was that the applicant

had not pursued a statutory appeal remedy. However, the court determined that leave should be

granted, and that the applicant had “satisfied the not very high standard … to assert an

entitlement to leave”. Hence, on the 19 October 2023 the High Court granted leave to the

applicant to bring these judicial review proceedings.