O’Brien v DPC – 20 February 2026

• Judgment Date: 20 February 2026
• Year: 2026
• Issuer: High Court

1

APPROVED

THE HIGH COURT

[2026] IEHC 250

Record No.:2022/309 MCA

BETWEEN:

DENIS O’BRIEN

Appellant

-and-

THE DATA PROTECTION COMMISSION

Respondent

-and-

RED FLAG CONSULTING LIMITED

First named Notice Party

-and-

THE ATTTORNEY GENERAL

Second named Notice Party

JUDGMENT of Lankford J. delivered on 20th day of February 2026

2

1. This is an appeal pursuant to Section 150 of the Data Protection Act 2018 (“the 2018

Act”) from a decision of the Data Protection Commission (“the DPC”) dated 4

November 2022, in which the DPC dismissed a complaint made by the Appellant, Mr

Denis O’Brien, concerning the handling of a data subject access request submitted to

the first named Notice Party, Red Flag Consulting Limited (“Red Flag”). Section 150(5)

provides that a data subject or other person affected by a legally binding decision of the

DPC under Chapter 2 or 3 of the 2018 Act may, within 28 days from the date on which

the notice of the decision is received by him or her, appeals against the decision. A

legally binding decision includes a decision under Section 109(5)(b) of the Act, which

this is. Section 150(6) provides that on hearing an appeal under Section 150(5) the Court

can annul the decision, substitute its own determination for the decision or dismiss the

appeal.

2. While the originating notice of motion and grounding affidavit did not identify grounds

of appeal, same were subsequently set out in a Grounds of Appeal affidavit wherein the

Appellant identified six grounds of appeal. These were refined/amended in

submissions. In the course of oral hearing before the Court three issues were identified

for determination namely:

(i) Whether the DPC was correct in holding that Red Flag was entitled

to rely upon Section 60(3)(a)(iv) of the 2018 Act in circumstances

where the Appellant argued that the section was not consistent with

Article 23 General Data Protection Regulation EU 2016/679

(“GDPR”),

(ii) Whether the DPC correctly dealt with documents, claimed to be the

subject of legal professional privilege,

(iii) Whether the DPC was correct in holding that Red Flag had not

applied a blanket refusal to the Appellant’s access request and that

its refusal to provide a copy of personal data which might reveal the

identity of its client was justified under Article 15(4) GDPR on the

basis that it would adversely affect the right to confidentiality.

3. As the first issue amounted to an argument that Section 60 (3)(a)(iv) was incompatible

with Article 23 GDPR, an order was made that the Attorney General be put on notice

of the application, to allow him to defend the legislation should he wish to do so. In due

course the Attorney General made submissions which are before the Court along with

extensive submissions from the Appellant, Red Flag and the DPC.