The recent High Court case of Martin v the Data Protection Commissioner ("DPC") has clarified the DPC's powers and obligations when investigating complaints. The case concerned a complaint by an individual regarding the alleged verbal disclosure of information in breach of his data protection rights. Given the lack of documentary evidence of the disclosure, the complainant requested an oral hearing before the DPC. The DPC declined to grant such a hearing and the complainant brought proceedings challenging this decision.
In the case, the court found that data subjects are not entitled to an oral hearing before the DPC, even where there is a conflict of evidence. We take a look at the key aspects to this decision and the potential legal impact it might have.
Background to Martin v DPC
In 2012, Mr Martin made a complaint to the DPC. This related to an alleged breach of his data protection rights by a Credit Union and, in particular, a director of the Credit Union. Mr Martin alleged that the director verbally disclosed information to Mr Martin's father relating to outstanding loans that Mr Martin had with the Credit Union. The Credit Union and the director denied that any such verbal disclosure occurred.
Responding to Mr Martin's complaint, the DPC's Office found that it was not possible to form a definitive opinion on a complaint that concerns verbal disclosure without documentary evidence. Following this, Mr Martin's solicitors requested that an oral hearing be arranged to resolve the factual dispute. The DPC's Office replied stating that there was no provision or obligation for the DPC to do so.
While this was on-going, a formal decision was issued by the DPC, Ms Helen Dixon. She found that there was no evidence that any verbal disclosure containing Mr Martin's personal data was made by the Credit Union or by the director.
No oral hearing
Mr Justice Haughton, of the High Court, agreed with the position taken by the DPC. He stated that nothing in Irish or EU law either required or empowered the DPC to conduct an oral hearing of a complaint. According to the judge, EU data protection law did not oblige member states to establish supervisory bodies, such as the DPC, with the power to conduct oral hearings. Furthermore, the judge took the view that the Data Protection Acts 1988 and 2003 could not be interpreted as giving the DPC the power to conduct an oral hearing.
The judge added that the power to hold an oral hearing is very significant and...