McShane v Data Protection Commission

• Jurisdiction: Ireland
• Court: High Court
• Judge: Mr Justice Bolger
• Judgment Date: 19 October 2023
• Neutral Citation: [2023] IEHC 567
• Docket Number: [Record No. 2022/699JR]

Between

Eamon McShane

Applicant

and

Data Protection Commission

Respondent

and

Health Service Executive

Notice Party

[2023] IEHC 567

[Record No. 2022/699JR]

THE HIGH COURT

JUDICIAL REVIEW

Judicial review – Leave – Arguable case – Applicant seeking leave to judicially review the decision of the respondent – Whether the applicant had established an arguable case that he was entitled to proceed by way of judicial review

Facts: The applicant, Mr McShane, applied to the High Court for leave to judicially review the decision of the respondent, the Data Protection Commission, of 23 May 2022 on the applicant’s complaint of 15 December 2021 that his personal data held by his employer, the notice party, the Health Service Executive, was accessed without authority or consent. The respondent decided that the notice party could not be considered a controller of the applicant’s personal data stored on his work phone without their knowledge or agreement. The applicant sought leave to challenge that decision on the basis that the respondent did not take account of the work-related personal data on the phone that was processed by the notice party in connection with his employment and they should have defined the notice party as a data controller that processed that personal data. The respondent asserted that the applicant’s complaint related only to his non-work-related personal data and, in any event, that he had a statutory appeal available to him which he failed to avail of and he was therefore precluded from seeking judicial review of the decision.

Held by Bolger J that the respondent had a statutory function pursuant to s. 101(1)(f) of the Data Protection Act 2018 to “handle” a complaint and pursuant to s. 101(1)(g) to “examine the lawfulness of processing”. Bolger J held that the applicant had established an arguable case with a reasonable prospect of success that he made a complaint about his work-related personal data that was never handled or examined by the respondent, in breach of his statutory entitlements, and that the respondent unreasonably and unlawfully focused solely on his non-work-related personal data. Bolger J held that it was arguable that the applicant’s complaint that he had been denied his statutory entitlement to have his complaint handled and examined came within the exceptions to the default statutory remedy. Therefore, Bolger J held that the applicant had established an arguable case that he was entitled to proceed by way of judicial review. Referring to Petecel v Minister for Social Protection [2020] IESC 25, Bolger J was not satisfied that the applicant could be said to have raised specious points of law. Bolger J held that the applicant had established an arguable case that he would succeed in the reliefs he sought on the grounds he has identified. Bolger J held that if the applicant had established an arguable case that his complaint included his work-related personal data as well as his unauthorised non-work related data, then there was also an arguable case with a reasonable prospect of success that the notice party was a data controller that processed the applicant’s personal data and that the respondent, therefore, should have handled and examined that aspect of his complaint. Bolger J held that the definitions of “data controller” and “personal data” in the General Data Protection Regulation (EU) 2016/679 were wide enough to potentially cover the applicant’s complaint in relation to his work related personal data such that he had established an arguable case that the respondent erred in not finding the notice party to have been a data controller of the applicant’s personal data. Bolger J held that the applicant had established an arguable case that the respondent’s review of his complaint was overly narrow, and unreasonably and unlawfully focused solely on the applicant’s non-work related personal data.

Bolger J held that the applicant had satisfied the standard (as analysed by Charleton J in Burke v Minister for Education and Skills [2022] IESC 1) to assert an entitlement to leave. Therefore, Bolger J held that the applicant was entitled to leave to judicially review the decision of the respondent of 23 May 2022 on the grounds set out at para. 5 of the Statement of Grounds and to seek the relief set out at para. 4 thereof.

Application granted.

Counsel for the Applicant: Conor Power SC and William McLoughlin BL

Counsel for the Respondent: Donogh Hardiman BL

Counsel for the Notice Party: Eoin McCullough SC and Claire Hogan BL

JUDGMENT of Mr Justice Bolger delivered on the 19 ^th day of October 2023 .

Background

1 ...