Court of Appeal - 2020/123: Difference between revisions

Revision as of 08:30, 1 June 2022

Court of Appeal - 2020/123

Court:	Court of Appeal (Ireland)
Jurisdiction:	Ireland
Relevant Law:	Data Protection Acts, 1988 and 2003, Section 2(1)(c)(ii) and Section 2D
Decided:	24.05.2022
Published:	24.05.2022
Parties:	The Data Protection Commissioner Cormac Doolin
National Case Number/Name:	2020/123
European Case Law Identifier:
Appeal from:
Appeal to:	Unknown
Original Language(s):	English
Original Source:	Courts Service (in English)
Initial Contributor:	czapla

The Irish Court of Appeal, in an appeal brought by the Irish DPC, ruled that personal data that was collected through CCTV for the purpose of crime prevention, could not be lawfully used for staff monitoring and disciplinary proceedings. The Court decided that such subsequent, secondary purpose, was incompatible with its original purpose.

English Summary

Facts

An Irish Hospice placed CCTV cameras in the staff tearoom, following advice from Gardai (Irish Police) after graffiti had been left on a table saying: "Kill all whites, ISIS is my life". The incident happened in 2015, shortly after terrorist attacks in Paris.

A sign was placed beside each camera which read: “Images are recorded for the purposes of health and safety and crime prevention.” The same information was included in the hospice policy. The CCTV footage, that was reviewed as part of security investigation, revealed numerous unauthorised breaks of the data subject, who was one the hospice employees at that time. Although there was no suggestion that the data subject had any involvement in the graffiti incident, the data collected from the CCTV prompted disciplinary proceedings against him. The data subject made a complaint to the DPC. The complaint was rejected, on the basis that the CCTV images were not processed beyond the original security purpose. It was argued by the hospice that the evidence for the data subject's disciplinary proceedings was based on records from a key fob used by the data subject to enter the tearoom. The data subject appealed to the Circuit Court. The Circuit Court upheld the DPC’s decision. The data subject appealed again to the High Court. The High Court found that the DPC incorrectly interpreted the term "processing" under the Data Protection Act 1988. The DPC appealed the decision to the Court of Appeal.

Holding

The Court of Appeal upheld the High Court decision.

The Court decided that:

1. The data subject was not made aware, at or before the time when the data was obtained, of the purpose for which the data was intended to be processed, contrary to the fair processing requirement of the Section 2D of the Data Protection Act 1988.

2. Based on the Court’s analysis of Article 29 of the Data Protection Directive of 1995 entitled “Working Party on the Protection of Individuals with regard to the Processing of Personal Data”, the CCTV data was used for a purpose other than, and incompatible with, the specified purpose, making such use unlawful. The incompatibility stemmed from the fact that the data subject was neither notified that the CCTV could be used for disciplinary purposes nor he ought reasonably to have expected such use.

Comment

Although this case is based on the Data Protection Acts that predate GDPR, the ruling continues to be relevant to the current legislative landscape, for at least two reasons:

1. The definition of data processing as it was formulated in the DPA 1988 was similar to the GDPR. The High Court and the Court of Appeal agreed that while the CCTV footage was neither downloaded nor further used as incriminating evidence for disciplinary proceedings, the fact that the CCTV footage triggered the disciplinary investigation amounted to data processing for that purpose.

2. The Court of Appeal’s decision further weighed on the fact that this type of processing could be considered incompatible with the original security purpose. The Court’s reasoning focused around principles of data transparency (notification to data subject) and the data subject’s reasonable expectation as to the secondary purpose of processing. Same principles around fair data processing exist in the GDPR Art. 5 and Recital 39 and the Irish DPA 2018.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the English original. Please refer to the English original for more details.

THE COURT OF APPEAL

UNAPPROVED
NO REDACTION NEEDED
Neutral Citation No [2022]
IECA 117

Court of Appeal Record Number: 2020/123
High Court Record Number: 2019/211CA
Circuit Court Record Number: 2018/5134

Noonan J.

Haughton J.
Ní Raifeartaigh J.

IN THE MATTER OF THE DATA PROTECTION ACTS, 1988 AND 2003

AND IN THE MATTER OF AN APPEAL UNDER SECTION 26 OF THE

DATA PROTECTION ACTS, 1988 AND 2003

BETWEEN/

THE DATA PROTECTION COMMISSIONER

APPELLANT

-AND-

CORMAC DOOLIN

RESPONDENT

-AND-

OUR LADY’S HOSPICE AND CARE SERVICES

NOTICE PARTY, - 2 -

JUDGMENT of Noonan J. delivered on the 24th day of May, 2022

1. This appeal concerns the alleged misuse of data collected by a security camera on an

employer’s premises for the purpose of disciplinary action against an employee. At the

outset, it is worth noting that this is the third appeal brought in these proceedings from a

decision of the appellant, the Data Protection Commissioner (“the DPC”) which concerns

the use of data relating to the respondent in this appeal, Mr. Doolin. The DPC’s original

decision, which was adverse to Mr. Doolin, was appealed by him to the Circuit Court, which

dismissed the appeal. Mr. Doolin appealed to the High Court, which allowed the appeal.

The DPC appeals to this Court against the judgment of the High Court. Following this

judgment, there is the potential for a further appeal to the Supreme Court. Needless to say,

the costs involved in all these appeals are very substantial and entirely disproportionate to

the issue concerned, where there is no obvious necessity for such a multiplicity of appeals.

2. The resultant delays in the final determination of an issue that arose as far back as

2015 is unfair to the parties, particularly Mr. Doolin. This is not to mention the amount of

scarce courttime absorbed by this litigation. Thesituationarising in this caseis by nomeans

unique as there are other similar statutory provisions providing for such layers of appeal. It

is to be hoped that the legislature will address this issue soon.

The Facts

3. Mr. Doolin was, at the relevant time, employed as a craftsman’s mate at Our Lady’s

th
Hospice in Harold’s Cross by the Notice Party (“OLHCS”). On the 19 November, 2015,

graffiti was discovered carved into a table in the staff tea room in a building at the Hospice,

knownasAnnaGaynorHouse,whichread:“Killall whites,ISISismy life”. Thisdiscovery,

coming as it did less than a week after the terror attacks at the Bataclan and elsewhere in, - 3 -

Paris on the 13 November, 2015, caused considerable concern to OLHCS who contacted

the Gardaí.

4. The tea room in question was accessible by the use of fobs issued to staff members,

including Mr. Doolin, and the area outside the door was monitored by a CCTV camera. The

Gardaí advised OLHCS to review the footage from this camera for a three-day period from

the 17 to the 19 November, 2015 so as to identify all persons entering the tea room during

that period. A viewing of the footage showed Mr. Doolin entering the room on a number of

occasions, although there is no suggestion that Mr. Doolin had any involvement in the

graffiti incident.

5. However, the information gathered from the CCTV footage suggested that Mr.

Doolin accessed the room for the purpose of taking unauthorised breaks, and this

subsequently became the subject of a disciplinary process against Mr. Doolin which resulted

in a sanction. Arising from this, Mr. Doolin made a complaint to the DPC claiming that the

use of the data from the CCTV constituted a breach of the Data Protection Act, 1988.

6. The footage was viewed on one occasion only on the 20 November, 2015 by two

members of OLHCS management, Mr. Paul Gahan, Human Recourses Manager, and Mr.

Tommy Beatty, Capital Projects Manager.

th
7. On the 26 November, 2015, OLHCS wrote to Mr. Doolin in a letter captioned “Re:

Investigation into Offensive Graffiti”. The letter indicated that a formal investigation was

being commenced into two matters, the graffiti and the use of unauthorised breaks.

8. The documents disclosed show that Mr. Gahan sent an email at 10.06am on the 26 th

November, 2015 asking a Deirdre Congdon that the letter being sent to persons under

investigation should refer to two investigations, suggesting the earlier letter preceded it. A, - 4 -

further letter was sent the next day, the 27 November, 2015, this time captioned “Re:

Formal Investigations” in the plural. The letter was otherwise in similar terms save that,

instead of referring to the use of unauthorised breaks, it now referred to accessing the room

at unauthorised times.

st
9. On the 1 December, 2015, a formal investigation meeting was held with Mr. Doolin

who was interviewed by Mr. Gahan and Mr. Beatty. Although some controversy

subsequently emerged about the availability of the minutes of that meeting, that is no longer

live in this appeal. The interview with Mr. Doolin appears to have been almost exclusively

focused on the taking of unauthorised breaks. He was shown an image of the graffiti and

asked if he had seen it on the table, but he said he did not notice anything on the table.

Beyondthat,theinterviewwasconcernedwithwhenandwhyMr.Doolinaccessedtheroom.

Mr. Beatty put the following question to him: -

“The Gardaí asked us to look at the CCTV for the days previous to identify if there

was a pattern. It came to light that you had accessed the room for 55 minutes on the

day in question, the day previous 46 minutes and 50 minutes on the Tuesday. Why

were you in the room?”

10. This question appears to demonstrate that Mr. Beatty and Mr. Gahan obtained

information from the CCTV as to the days on which Mr. Doolin was in the room and for

how long he was there. Mr. Doolin was asked if he wanted to see the CCTV footage and he

declined but he agreed that he had taken the breaks in question without telling his manager.

11. On the next day, the 2 December, 2015, Mr. Gahan wrote to Mr. Doolin sending him

a copy of the typed minutes of the interview. The letter was, perhaps surprisingly, captioned

“Re: Investigation into Offensive Graffiti” reflecting the first letter of the 26 November,

2015 which Mr. Gahan sought to have amended, as noted above., - 5 -

12. The investigation panel completed its report entitled “Final Investigation Outcome

th
Report” on the 15 January, 2016. The description of the investigation on the title page is:

“Investigation into staffmember(CormacDoolin)accessingtheAnnaGaynorHouse

tea room at unauthorised times.”

13. The report notes that CCTV footage and fob access to the room in question were

examined. It appears that the fob access is recorded so that times of entry were available to

the investigation panel. As the title to the report makes clear, it was concerned solely with

access by Mr. Doolin to the room at unauthorised times and not with any investigation of

Mr. Doolin in connection with the graffiti.

14. In that regard, the report expressly refers to the panel having reviewed the CCTV

footage and produces a table in the body of the report showing that Mr. Doolin accessed the

th th th
room on one occasion on each of the 17 , 18 and 19 November, 2015. In respect of each

occasion, the date is given, the time of the access, the time leaving the room and the duration

of the stay in the room. With regard to the times given, the report observes:

“Times of Unauthorised Access

The panel noted that CCTV footage timings are running approximately 16 minutes

fast.”

15. This appears to be a reference to the fact that the panel was able to identify accurate

timings from the fob records to establish that the timings on the CCTV were 16 minutes

ahead of real time. The outcome of the report was:

“Outcome, - 6 -

Following a comprehensive consideration of the information obtained during this

investigation the panel have established on the balance of probabilities that

unauthorised breaks were taken by Mr. Cormac Doolin on the afternoons of Tuesday

17 , Wednesday 18 and Thursday 19 November 2015.”

16. The investigation outcome thus makes clear that it was solely concerned with the

taking of unauthorised breaks and in fact makes no reference to any findings in connection

with the graffiti. Mr. Doolin subsequently received a disciplinary sanction.

17. It is also relevant to note that in September 2012, OLHCS published its Policy on

Closed Circuit Television. The introduction states as follows:

“The use of Closed Circuit Television (CCTV) in OLH&CS is part of the operational

system for security. The appropriateness of using CCTV on OLH&CS premises was

assessed as part of the commissioning process and was informed by historical

experience on the hospice campus. The purpose of the system is to prevent crime

and promote staff security and public safety.

OLH&CS ensures that its use of CCTV is carefully governed is (sic) in line with the

Data Protection Act 1998 & 2003 and other relevant legislation.” (my emphasis)

18. A sign was placed beside each camera which read:

“Images are recorded for the purposes of health and safety and crime prevention.”

The Relevant Legislation

19. This case is primarily concerned with the provisions of Section 2(1)(c)(ii) of the Data

Protection Act 1988 as amended by the Data Protection Act 2003. These have now been

replaced by the Data Protection Act 2018 which gives effect to Regulation (EU) 2016/679, - 7 -

(General Data Protection Regulation) which contains similar provisions, so the issue arising

here continues to have relevance.

20. Section 2 of the 1988 Act, as amended and insofar as relevant here, provides as

follows:

“(1) A data controller shall, as respects personal data kept by him or her, comply with

the following provisions:

(a) the data or, as the case may be, the information constituting the data shall

have been obtained, and the data shall be processed, fairly,

(b) the data shall be accurate and complete and, where necessary, kept up to

date,

(c) the data —

(i) shall have been obtained only for one or more specified, explicit and

legitimate purposes,

(ii) shall not be further processed in a manner incompatible with that

purpose or those purposes,

(iii) shall be adequate, relevant and not excessive in relation to the

purpose or purposes …”

21. Section1ofthe1988Actprovidesvariousrelevantdefinitionsincludingthatof“data”,

which equates to information in a form in which it can be processed.

22. Central to this appeal is the definition of “processing” which is as follows:

“ ‘Processing’ of or in relation to information or data, means performing any operation

or set of operations on the information or data, whether or not by automatic means,

including-, - 8 -

(a) obtaining, recording or keeping the information or data,

(b) collecting, organising,storing,alteringor adapting theinformation ordata,

(c) retrieving, consulting or using the information or data,

(d) disclosing the information or data by transmitting, disseminating or

otherwise making it available, or

(e) aligning, combining, blocking, erasing or destroying the information or

data;”

23. Section 2D of the 1988 Act, as inserted by the 2003 Act, upon which some reliance is

placed by Mr. Doolin, provides in relevant part:

“(1) Personal data shall not be treated, for the purposes of section 2(1)(a) of this Act,

as processed fairly unless —

(a) in the case of data obtained from the data subject, the data controller ensures,

so far as practicable, that the data subject has, is provided with, or has made

readily available to him or her, at least the information specified in subsection

(2) of this section …

(2) The information referred to in subsection (1)(a) of this section is:

…

(c) the purpose or purposes for which the data are intended to be processed…”

The DPC

24. Following upon the events described above, on the 17 June, 2016 Mr. Doolin made

a complaint to the DPC (the functions of the DPC have now been transferred to the Data, - 9 -

Protection Commission by virtue of the Act of 2018). The decision of the DPC was issued

on the 27 July, 2018. It summarises the complaint in the following terms:

“You submitted a complaint dated 17 June 2016 to this office alleging that your

employer, OLH&CS, used CCTV footage of you to sanction you for taking

unauthorised breaks… You acknowledged that OLH&CS had a legitimate reason to

view the CCTV footage in order to investigate the graffiti incident in line with its

CCTV policy. However, you expressed objection to the CCTV subsequently being

used for the monitoring of staff and for disciplinary proceedings, as this was not a

stated purpose in OLH&CS’s CCTV policy and not in line with Section 2(1)(c) of the

Acts.”

25. At para. 2, the DPC notes that:

“The data in question was personal data relating to you (consisting of your image

held on CCTV footage) as you can be identified from it and the data relates to you

as an individual.”

This observation is important as it reflects the view of the DPC that the data relating to Mr.

Doolin which were the subject of the complaint were confined to his image on the CCTV, a

point to which I will return.

26. The decision goes on to note (at para. 5) that the DPC was advised by OLHCS that

the disciplinary action that was taken against Mr. Doolin was on the basis of admissions

made by him and not on foot of the CCTV footage, which was not downloaded following

the single viewing.

27. The DPC considered that the purpose for which the CCTV was viewed, in furtherance

of the investigation into the graffiti incident, was a legitimate purpose (at para. 24):, - 10 -

“This Office is satisfied that the processing of your personal data in the form of a

limited viewing of the relevant CCTV footage, without downloading or further

processing of any kind was necessary for this purpose and did not go beyond the stated

purpose.” (my emphasis)

28. It is also notable from the decision that the DPC consistently refers to “an

investigation” having been undertaken by OLHCS, rather than “investigations”.

29. At para. 26, the DPC reached her conclusions in the following terms:

“I also considered whether the requirements of Section 2(1)(c)(ii) of the Acts had been

met by OLH&CS. This requires that personal data must not be processed for purposes

other than the purpose for which it was originally collected. In this case, I am satisfied

that your images captured on CCTV were processed in connection with the

investigation of a security incident when they were initially viewed by the

investigation team for that purpose alone. The information gathered from that viewing

may subsequently have been used for another purpose, i.e. disciplinary proceedings

against you, but this in my view does not constitute a different purpose, because the

CCTV images were not further processed for that second purpose. If the images were

further processed for that second purpose, for example by downloading and use in the

disciplinary proceedings against you, it might constitute further processing for a

different purpose, but that did not happen in your case and no further processing of

your images occurred for the second purpose.

27. Accordingly, I find that the limited viewing of your personal images took place

exclusively for thesecuritypurposeforwhich theimages wereoriginallycollectedand

that no contravention of Section 2(1)(c)(ii) occurred.”, - 11 -

30. The DPC accordingly found that no breach of the Data Protection Acts had occurred.

As can been seen from the foregoing comments, the DPC considered that Mr. Doolin’s data

wereconfinedtotheCCTVimages andbeyondthefirstandonlyviewingofthose,nofurther

processing occurred. This is strongly disputed by Mr. Doolin for reasons which will become

apparent.

The Circuit Court

31. As noted in the DPC’s decision, an appeal from her determination lay to the Circuit

Court under s. 26 of the Act. That appeal was heard by the Circuit Court (Her Honour Judge

Linnane) on the 1 May, 2019.

32. The matter proceeded in the normal way on affidavit. Mr. Doolin’s grounding

affidavits were responded to by Mr. John V. O’Dwyer, Deputy Commissioner in the Office

of the DPC. Mr. O’Dwyer’s first affidavit was sworn on the 7 February, 2018. At para. 8,

he refers to the minutes of the interview with Mr. Doolin on the 1 December, 2015 and

avers:

“8. … It is clear from the minutes that the investigation meeting was concerned with

the security issues presented by the graffiti incident and that the issue of the taking

of unauthorised breaks at unauthorised locations arose and was addressed in this

context. Having regard to the purpose and stage of the investigation, it would appear

that the issues were clearly and closely related. Contrary to what the Appellant has

asserted at paragraph 5 of the Grounding Affidavit, there was no ‘unlawful further

processing of the CCTV footage’. Insofar as the CCTV footage formed the basis for

the investigation meeting, it was on foot of its processing for security purposes, to

include those relating to the investigation of the graffiti incident, the appropriateness

of which the Appellant has acknowledged.”, - 12 -

33. These averments by Mr. O’Dwyer are, in reality, comments based on his interpretation

of the minutes of the meeting of the 1 December, 2015. It seems to me that this court is

equally well-equipped to interpret those minutes and, with respect to Mr. O’Dwyer, it is not

at all clear to me that the meeting was solely concerned with security issues or issues relating

to security. As I have noted already, while the graffiti incident was mentioned, the primary

focus of the meeting appears to have revolved around the taking of unauthorised breaks by

Mr. Doolin. How this is said to be a security issue or related to a security issue is not

explained by Mr. O’Dwyer, nor has it ever been explained by OLHCS. It is certainly not

explained in the Panel Report following this meeting in which the graffiti incident barely

merits a mention. However, Mr. O’Dwyer repeats the same assertions at para. 11 which

again are really little more than a statement of his opinion on the matter.

34. Asnoted, onecentral featureofthis caseis thatit has neverbeenexplainedbyOLHCS,

or indeed the DPC, how the taking of unauthorised breaks is said to amount to a security

issue. It will be recalled that the OLCHS’s policy document on CCTV specified that its

purpose was to prevent crime and promote staff security and public safety. The word

“security” in its natural and ordinary meaning, may be taken to refer to a danger or threat to

the safety of persons and/or property. It has never been explained how it is said that the

taking of unauthorised breaks by Mr. Doolin presented a danger or threat to the safety of

persons at the Hospice, be they staff or visitors, or the property of the Hospice or any person

present there.

35. There may of course be circumstances in which one might infer a security risk arising

from the taking of unauthorised breaks by, say, a security guard who left the property

unsupervised for a period of time. None of that arises in Mr. Doolin’s case so it is far from, - 13 -

clear or obvious, in the absence of explanation, how the taking of unauthorised breaks by

him could constitute a security issue or be related to such an issue.

36. In an affidavit replying to Mr. O’Dwyer’s first affidavit, Mr. Doolin makes a number

of observations including the fact that, during the course of the investigation into the graffiti

incident,OLHCSamendeditsCCTVpolicybytheamendmentoftheintroductoryparagraph

in the following terms:

“The purpose of the system is to prevent crime and promote staff security and public

safety. If, in the event of viewing CCTV for the specified purpose, a disciplinary

action is observed, the CCTV can be used for the purpose of a disciplinary

investigation. However, CCTV will not be viewed solely for the purpose of

monitoring staff.”

37. The sole affidavit sworn on behalf of the notice party was sworn by Ms. Pat Pierce, its

Data Protection Officer, who says that sanctions were imposed on Mr. Doolin as a result of

his admissions made at the meeting of the 1 December, 2015. As already averred by Mr.

O’Dwyer, Ms. Pierce reiterates that Mr. Doolin’s data were processed/reviewed on one

occasion only arising out of the single viewing.

38. Mr. O’Dwyer swore a third affidavit on the 21 March, 2019. In paragraph 5 of this

affidavit, Mr. O’Dwyer avers as follows:

“On the basis of the evidence before the court, I say that it is clear beyond doubt that

the processing of the CCTV footage by OLHCS was for security purposes, arising

directly from and relating to the investigation of the graffiti incident. It is clear that,

in the particular circumstances of this case, the taking of unauthorised breaks at an

unauthorised location, the site of the graffiti incident, was a serious and bona fide, - 14 -

securityissueandthattheinvestigationbyOLHCS,andthedisciplinaryactionwhich

resulted therefrom, arose directly out of and was directly connected to this security

issue, albeit that the sanction applied in the context of the disciplinary action relied

on admissions made by the applicant himself.”

39. As is subsequently pointed out in the judgment of the High Court, this averment by

Mr.O’Dwyeris,tosaytheleast,somewhatsurprising. Heappearstogoconsiderablyfurther

than in his previous affidavits, and indeed than Ms. Pierce, the notice party’s own Data

Protection Officer, in suggesting that the taking of unauthorised breaks at an unauthorised

location was a serious and bona fide security issue. What is more, Mr. O’Dwyer feels able

to express this conclusion “on the basis of the evidence before the Court”. However, as in

his previous affidavits, I cannot see any justification for this statement that is to be found in

the evidence before the Circuit Court. A similar conclusion was reached by the High Court

as will become apparent.

40. Following the hearing, Judge Linnane gave an ex tempore ruling. She appears to have

accepted that OLHCS carried out one investigation only (at Transcript, p. 93):

“It’s clear to me, as I say, that the processing of the footage was for that purpose,

namely security, arising directly from and relating to the investigation of the graffiti

incident.”

41. Shereliedforthat conclusionontheavermentofMr.O’DwyertowhichIhavereferred

and apparently also for the following statement (at Transcript, p. 94 and 95):

“Clearly, it was a security issue, Mr. Doolin being in an unauthorised place taking

unauthorised breaks. In effect, he admitted a breach of security, i.e. by taking the

unauthorised breaks. The disciplinary action was taken on his admissions …, - 15 -

Iaccept in thecircumstances [counsel fortheDPC’s]submissionthatthedisciplinary

action by his employer against Mr. Doolin was taken for security purposes. In fact I

also accept, as has been argued, that there was one investigation, i.e. the graffiti

incident, not two investigations, as argued by Mr. Doolin’s counsel. In all the

circumstances, taking intoaccount the facts ofthis case, I’m satisfiedthatMr.Doolin

has not established that he has satisfied the test for having this decision of the Data

Protection Commission overturned. Accordingly, I am dismissing his appeal.”

The High Court

42. Mr. Doolin appealed to the High Court on a point of law as provided for in s. 26(3)(b)

of the 1988 Act.

43. The High Court judge set out the background and chronology to the matter, noting as

follows with regard to the Panel Report (at para. 12):

“The following observations may be made about the Panel Report. The Report is

solely in respect of the investigation relating to staff members accessing the room at

unauthorised times. It clearly relies inter alia directly on the CCTV footage,

identifying as it does the precise times of entry and exit. Accordingly, it wholly

undermines the claim of OLHCS that the investigation into unauthorised access was

solely made on the basis of admissions. Finally, there is no reference at all to

unauthorised access to the staff room being a security issue contrary to the averments

of Mr. O’Dwyer of the DPC discussed below.”

44. The judge then set out the legal framework and in particular, the purpose limitation

principle appearing in s. 2(1)(c)(ii) of the Act which transposes Art. 6(1)(b) of Directive

95/46/EC (“the “Data Protection Directive”). She also made extensive reference to the, - 16 -

opinion of the Working Party 29 Group to which I will refer further, concerning the concept

of purpose limitation.

45. The judge referred to four key factors identified by the Working Party to be considered

during the compatibility assessment, the judge recognising that processing for a different

purpose is not automatically incompatible but must be assessed on a case-by-case basis. The

judge then referred to the decision of the DPC noting (at para. 32):

“It is clear from the Decision that the exclusive basis upon which it was found that

no further processing had occurred was that the CCTV images had not been viewed

in the disciplinary proceedings against the appellant. The Decision did not engage

with what the Appellant had clearly stated in his email of 10 December 2017, i.e. that

it was not CCTV footage that was used to sanction him but rather data retrieved and

processed from the CCTV footage.”

46. ThejudgereferredtoMr.O’Dwyer’sthirdaffidavit,mentionedabove,inthefollowing

terms (at para. 39):

st
“On 21 March 2019, the defence of the proceedings by the DPC took an unexpected

turn. Mr. O’Dwyer swore a third affidavit on 21 March 2019 at which stage he

identified anewbasis for thefurther processing by OLHCS not identifiedbyOLHCS

either in the summary given by the DPC of the submissions made to it by OLHCS,

in the Affidavit of Mr. (sic) Pierce, in the Panel Report or in any of the material

exhibited to this appeal.”

47. In dealing with theevidentialbasis forthedecisionoftheCircuit Court,theHighCourt

wascriticalofthefactthattheprimarydefenceoftheDPCnowadvancedwasthatthefurther

use of the information gathered from the CCTV was in fact used for its original purpose i.e., - 17 -

security. She said that this marked a significant departure from the approach adopted in the

Decision itself where the sole justification for rejecting the complaint was that although the

material may in fact have been used for a different purpose, it was not further processed for

that second purpose. She found that conclusion to be erroneous as a matter of law and

considered that there had been a surprising shift in the approach of the DPC during the life

of the proceedings.

48. The Court said (at para. 42):

“The DPC has gone from finding no breach because there was no further processing

of the CCTV footage to asserting in these proceedings no breach because any further

processing was done for the purpose for which the material was collected i.e.

security.”

49. She described this new argument as “remarkable” because there was no evidence at all

to support that argument, which became the sole basis for the rejection by the Circuit Court

of the appeal.

50. In commenting on what she perceived as this inconsistency, the judge was of the view

that the Circuit Court did not appear to have examined the underlying documents, including

the Panel Report, the submissions of OLHCS to the DPC or the absence of any averment
th
relating to security in the affidavit of Ms. Pierce of the 8 March, 2019. She continued (at

para. 46): -

“A consideration of this material discloses that, as far as I can ascertain, at no point

in time did OLHCS ever justify the further processing of the material gleaned from

the CCTV footage in the disciplinary proceedings on the basis of security concerns.

Rather, it (a) made the point that the CCTV footage itself was only viewed for, - 18 -

security purposes and (b) that the disciplinary proceedings did not employ material

derived from the footage but were based exclusively on admissions made by the

Appellant at the interview on 1 December 2015. The idea that the use of the

information obtained from the CCTV footage in the context of the disciplinary

proceedings was for security purposes rather than for disciplinary purposes does not

find a basis in any of the material before me. There is simply no evidence at all to

this effect. Perhaps most significantly, as noted in my review of the exhibited

material above, the Panel Report makes no reference whatsoever to unauthorised

access to the tea room or unauthorised breaks being a security issue.”

51. Although the judge felt that the issue of whether there were one or two investigations

was not particularly relevant, it appeared on balance that there were in fact two. At para. 50,

the judge said:

“… [T]he evidence indicates that the use of the information from the CCTV footage

in the context of the disciplinary hearing was used for an entirely different purpose

to that for which it was collected.”

52. The judge said that had the CCTV material been intended to be used for disciplinary

purposes as well as the other purpose identified, that would require to be identified, as was

subsequently done on the policy amendment. Her review of the decision led her to conclude

as follows:

“52. In summary the CCTV footage was collected for the express and exclusive

purpose of security and was used (permissibly) for that purpose but was also used for

adistinct and separatepurpose,i.e.disciplinaryproceedings intounauthorisedbreaks

by an employee., - 19 -

53. In the premises, it seems to methattherewas noevidenceupon whichtheCircuit

Court could safely conclude that the further processing in the context of the

disciplinary hearing was for security purposes, since the sole basis for this finding

i.e. the averments of Mr. O’Dwyer in his third affidavit, were not themselves

grounded on any material put forward by OLHCS.

54. I am therefore overturning the decision of the Circuit Court on the basis that

there was no evidence for the conclusion that the disciplinary action, in which

information derived from the CCTV footage was used, was carried out for security

purposes.”

53. Separately, the judge was of the view that Mr. O’Dwyer’s averment to the effect that

the sanction applied in the context of the disciplinary action relied on admissions made by

the appellant himself was difficult to understand in circumstances where the Panel Report

madenoreferencetoadmissionsbutratherexpresslyreferredtoaconsiderationoftheCCTV

footage and the information concerning the entry and exit dates and times which came from

that footage and the fob access.

54. In dealing with the alleged breach of s. 26(1)(c)(ii), the High Court said that it was

indisputable that the information contained in the CCTV footage was used for a different

purpose than the one for which the data were originally collected. The fact that it was not

downloaded does not mean that no further processing took place. She therefore considered

contrary to the DPC’s findings, the CCTV images were further processed.

55. She accordingly allowed the appeal., - 20 -

The Appeal to This Court

56. The first point that arises for consideration is whether an appeal to this court is

available at all.

57. Mr. Doolin argues that it is not, by virtue of s. 39 of the Courts of Justice Act, 1936

which regulates appeals from the Circuit Court to the High Court and provides that such

appeals shall be final and conclusive and not appealable. Certain well-known authorities are

th
relied on in that regard – see Kinahan v Baila (Unreported, Supreme Court, 18 July 1985),

PepperFinanceCorporationvCannon[2020]IESC2andBankofIrelandvGormley[2020]

IECA 102. Although Mr. Doolin objected to the DPC’s appeal on this basis both in his

respondent’s notice and written submissions, it was however conceded at the hearing of the

appeal by counsel for Mr. Doolin that reliance was no longer being placed on this point.

58. I think that concession was made properly. Prima facie, the position is that all

judgments of the High Court are appealable to this Court by virtue of Art. 34.4.1 of the

Constitution. Of particular significance also are the provisions of s. 26(3) of the 1988 Act

itself which provides as follows:

“(a) Subject to paragraph (b) of this subsection, a decision of the [Circuit Court]

under this section shall be final.

(b) An appeal may be brought to the High Court on a point of law against such a

decision; and references in this Act to the determination of an appeal shall be

construed as including references to the determination of any such appeal to

the High Court and of any appeal from the decision of that Court.” (my

emphasis), - 21 -

59. Accordingly, the statute itself appears to expressly recognise that an appeal does

indeed lie to this Court from the High Court.

60. There was little dispute between the parties as to the correct legal principles to be

applied to a statutory appeal of this kind. The High Court relied on Deely v Information

Commissioner [2001] 3 IR 439 where McKechnie J., then a judge of the High Court, said

the following regarding appeals to that court on a point of law (at 452):

“There is no doubt but that when a court is considering only a point of law, whether

by way of a restricted appeal or via a case stated, the distinction in my view being

irrelevant, it is, in accordance with established principles, confined as to its remit, in

the manner following:-

(a) it cannot set aside findings of primary fact unless there is no evidence to

support such findings;

(b) it ought not to set aside inferences drawn from such facts unless such

inferences were ones which no reasonable decision making body could draw;

(c) it can however, reverse such inferences, if the same were based on the

interpretation of documents and should do so if incorrect; and finally;

(d) if the conclusion reached by such bodies shows that they have taken an

erroneous view of the law, then that also is a ground for setting aside the

resulting decision.”

61. This approach was subsequently approved by the Supreme Court in Sheedy v

Information Commissioner & Ors. [2005] 2 IR 272., - 22 -

62. The form that such an appeal should take was discussed by the Supreme Court in

Orange Limited v Director of Telecoms (No. 2) [2000] 4 IR 159 where Keane C.J. said (at

184-5):

“In short, the appeal provided for under this legislation was not intended to take the

form of a re-examination from the beginning of the merits of the decision appealed

from culminating, it may be, in the substitution by the High Court of its adjudication

for that of the first defendant. It is accepted that, at the other end of the spectrum, the

High Court is not solely confined to the issues which might arise if the decision of

the first defendant was being challenged by way of judicial review. In the case of this

legislation at least, an applicant will succeed in having the decision appealed from

set aside where it establishes to the High Court as a matter of probability that, taking

the adjudicative process as a whole, the decision reached was vitiated by a serious

and significant error or a series of such errors. In arriving at a conclusion on that

issue, the High Court will necessarily have regard to the degree of expertise and

specialised knowledge available to the first defendant.”

63. In the context of appeals to the Circuit Court against decisions of the DPC, the

Supreme Court held in Nowak v The Data Protection Commissioner [2016] 2 IR 585 that

the standard of review identified by Keane C.J. in Orange was the appropriate standard to

apply.

64. In the course of oral submissions in this court, counsel for the DPC said that his case

rested upon three fundamental propositions:

(a) The CCTV footage was viewed on one occasion only for the purpose

specified in the Hospice CCTV Policy, namely security, and was not further

processed thereafter. Accordingly, no breach of the 1988 Act occurred., - 23 -

(b) Alternatively, if the CCTV footage was further processed by OLHCS, it was

so processed for the purpose of the Hospice policy, namely for a security

purpose.

(c) In the further alternative, if the court came to the conclusion that the CCTV

footage was further processed and such processing was not for a security

purpose, then it was for a purpose that was not incompatible with the security

purpose.

The Article 29 Working Party

65. Article 29 of the Data Protection Directive of 1995 is entitled “Working Party on the

Protection of Individuals with regard to the Processing of Personal Data”. Article 29.1

provides:

“1. A Working Party on the Protection of Individuals with regard to the Processing

of Personal Data, hereinafter referred to as “the Working Party”, is hereby set up.

It shall have advisory status and act independently.”

66. The Working Party is in fact an expert group comprising data regulation experts from

different Member States. Since the advent of GDPR, the same group has now been

rebranded as the European Data Protection Board. Its function is set out in Art. 30 as

includingadvisingtheEuropeanCommissiononissuesrelatedtodataprotection. Itprepares

an annual report on data protection in the EU and third countries which is transmitted to the

Commission,theEuropean Parliament and theCouncil ofEuropeandis published. Its views

and opinions have no particular legal status but are clearly influential and persuasive in the

context of interpreting the Directive., - 24 -

67. As the High Court judge pointed out, the issue arising in this case has not been to

date the subject of any decision of the Court of Justice of the European Union or of our

national courts. Accordingly, the High Court considered, and I agree, that regard can be had

to the views of the Working Party as an aid to the interpretation of the Directive and national

legislation which implements it, such as the 1988 Act.

68. On the 2 nd April, 2013, the Working Party issued an opinion on purpose limitation

which is quoted in some detail by the High Court judge. It is a lengthy document but

helpfully contains an executive summary which states (at p. 3):

“Purpose limitation protects data subjects by setting limits on how data controllers

are able to use their data while also offering some degree of flexibility for data

controllers. The concept of purpose limitation has two main building blocks:

personal data must be collected for ‘specified, explicit and legitimate’ purposes

(purpose specification) and not be ‘further processed in a way incompatible’ with

those purposes (compatible use).

Further processing for a different purpose does not necessarily mean that it is

incompatible: compatibility needs to be assessed on a case-by-case basis. A

substantive compatibility assessment requires an assessment of all relevant

circumstances. In particular, account should be taken of the following key factors:

- the relationship between the purposes for which the personal data have been

collected and the purposes of further processing;

- the context in which the personal data have been collected and the

reasonable expectations of the data subjects as to their further use;, - 25 -

- the nature of the personal data and the impact of the further processing on

the data subjects;

- the safeguards adopted by the controller to ensure fair processing and to

prevent any undue impact on the data subjects.

Processing of personal data in a way incompatible with the purpose as specified at

collection is against the law and therefore prohibited.”

69. The High Court cited a passage dealing with the general framework for compatibility

assessment which need not be reproduced.

70. As appears above, one of the key factors to be considered in the compatibility

assessment is the expectation of the data subjects as to the further use of their data. In this

regard, the Working Group observes (at p. 24):

“The second factor focuses on the specific context in which the data were collected

and the reasonable expectations of the data subjects as to their further use based on

that context. In other words, the issue here is what a reasonable person in the data

subject’s situation would expect his or her data to be used for based on the context

of the collection.”

71. Annex 4 to the opinion gives a number of illustrative examples of this factor, the first

of which appears at p. 56 as follows:

“Example One: Chatty Receptionist Caught on CCTV

A company installed a CCTV camera to monitor the main entrance to its building.

A sign informs people that CCTV is in operation for security purposes. CCTV

recordings show that the receptionist is frequently away from her desk and engages, - 26 -

in lengthy conversations while smoking near the entrance area covered by the CCTV

cameras. The recordings, combined with other evidence (such as complaints), show

that she often fails to take telephone calls, which is one of her duties.

Apart from any other CCTV concerns that may be raised by this case, in terms of the

compatibility assessment it can be accepted that a reasonable data subject would

assume from the notice that the cameras are there for security purposes only.

Monitoring whether or not an employee is appropriately carrying out her duties, such

as answering phone calls, is an unrelated purpose which could not be reasonably be

expected by the data subject. This gives a strong indication that the further use is

incompatible. Other factors, such as the potential negative impact on the employee

(for example, a possible disciplinary action), the nature of the data (video-footage),

the nature of the relationship (employment context, suggesting imbalance in power

and limited choice), and the lack of safeguards (such as, for example, notice about

further purposes beyond security) may also contribute to and confirm this

assessment.”

Were Mr. Doolin’s data processed more than once?

72. The first issue arising is whether Mr. Doolin’s data were processed more than once.

The DPC was of the view that they were not. In my opinion, there is a manifest error in that

conclusion, which is serious and significant.

73. The DPC found that the data in question were confined to the image of Mr. Doolin

on the CCTV footage. However, that footage disclosed information, or data, concerning Mr.

Doolin beyond merely his image. As the Panel Report records, it also disclosed where Mr.

Doolin was and when he was there. It disclosed, whether by itself or in combination with

the fob access records, the dates and times when Mr. Doolin entered the staff tea room, the, - 27 -

dates and times when he left the staff tea room and the duration of his stay in the room.

These are all specific pieces of information, or data, personal to Mr. Doolin above and

beyond merely his image.

74. Further, specific reliance was placed on these pieces of information or data to support

the disciplinary process pursued by OLHCS against Mr. Doolin.

75. The definition of “processing” appearing in s. 1 of the Act identifies five separate

operations, or sets of operations, that are to be regarded as “processing”. The first, (a),

includes obtaining or recording the information or data. Thus, the first processing of Mr.

Doolin’s data took place when the data were obtained by being recorded on the CCTV

footage. The DPC found in her decision, and argued again in this court, that this was not to

be regarded as processing and that the first processing occurred with the viewing of the

CCTV footage.

76. That does not appear to me to be consistent with the language of the 1988 Act which

in the definition of “processing” at (a) expressly provides that obtaining data is processing.

This is also consistent with the language of s. 2(1)(c) which provides at (i) that the data shall

have been obtained for specified purposes and at (ii) that it shall not be further processed in

a manner incompatible with that purpose or purposes. Clearly “further” processing can only

occur after prior processing which suggests that the obtaining of the data must be regarded

as a prior or first processing.

77. Asecond processing took place when thosedatawere retrieved andconsultedby being

viewed by Mr. Gahan and Mr. Beatty (subparagraph (c) of the definition of “processing”).

The third processing occurred when the data relating to the dates and times of access/egress

by Mr. Doolin to and from the staff tea room were used by being tabulated in the Panel, - 28 -

Report for the purpose of supporting a disciplinary sanction against him, (also subparagraph

(c)).

78. It is thus clear to my mind that the proposition that his data were processed on one

occasion only, by one viewing of the CCTV footage, cannot be correct, as the High Court

found.

79. The next issue that thus arises is whether the data were further processed for the

specified purpose, namely security.

Were Mr. Doolin’s data processed for the specified purpose?

80. As the High Court held, it seems to me that the critical error in the DPC’s Decision at

the outset was in determining that the personal data in issue were confined to Mr. Doolin’s

image. This inevitably led to further error, in particular with regard to whether there was

further processing or not. Further, the DPC appears to have considered that there was one

investigation only into thesecurity issueand thereforetheoutcomeofthatinvestigationmust

be regarded as security related and thus satisfied the purpose specification.

81. Here again, I agree with the conclusion of the High Court that there were plainly two

investigations or at minimum, one investigation into two different matters. The suggestion

that the disciplinary investigation arose out of admissions made by Mr. Doolin at the
st
interview on the 1 December, 2015 is manifestly incorrect as the evidence clearly

demonstrates that the investigation commenced before that date and thus could not have

originated from the admissions.

82. Becausethereweretwoinvestigations,itcannotbesaidthattheinvestigation,singular,

was for the purpose of security and by definition, its outcome must be for the same purpose.

As I have pointed out already, the title of the Panel Report does not even purport to refer to, - 29 -

security but in terms, describes the report as an “investigation into staff member (Cormac

Doolin) accessing the Anna Gaynor House Tea Room at unauthorised times.”

83. It is clearto metherefore thattheprocessingofMr.Doolin’sdatawas not forasecurity

purpose as the DPC contends. It was manifestly for a different purpose as the High Court

judge found, but of course that is not the end of the inquiry. It is necessary thereafter to carry

out a compatibility assessment and, in this regard, the DPC is critical of the High Court for

failing to take this additional necessary step.

Were Mr. Doolin’s data processed for a purpose that was not incompatible?

84. It will be recalled that the High Court held that the evidence indicated that the use of

the information from the CCTV footage was used for an entirely different purpose to that

for which it was collected. The DPC is correct in arguing that the mere fact that the data

were used for a different purpose does not mean that the use was unlawful. It is only where

the further processing occurs in a manner incompatible with the stated purpose that an

illegality arises.

85. It does seem to me from the fact that the judge said at several places in her judgment

that Mr. Doolin’s data were used for an entirely different purpose to the specified purpose,

it might reasonably be inferred that the judge implicitly considered the use of the data to

have been incompatible with the specified purpose. This would also appear to follow from

the fact that the judge made explicit reference to the Working Party opinion on the issue of

compatibility so that it could not be said that the judge overlooked the issue. In fairness to

the judge, it should also be remembered that neither the DPC nor the Circuit Court carried

out any compatibility analysis andin fact never reachedthatpoint as aresult oftheerroneous

finding that Mr. Doolin’s data were not processed further following the single viewing of

the CCTV., - 30 -

86. Even were it correct to say that the failure of the High Court to carry out a

compatibility analysis was erroneous, on one view of matters the case should be remitted to

the High Court to enable that analysis to be conducted. However, both parties urged on this

court that rather than remitting the matter, the court should determine the issue itself. I think

this is the sensible course, particularly in light of the comments I have made at the outset

concerning the cost and delay that have been incurred in these proceedings to date.

87. It was urged on the court by the DPC that there could be no doubt but that the initial

viewing of the CCTV was for a legitimate security purpose, namely that of identifying the

perpetrator of the graffiti as advised by An Garda Síochána. The DPC argues that there is

no analogy arising between the facts here and those of the example given by the Working

Party, despite the obvious similarities. The critical distinction, it is said, is that in the

Working Party example, the employer had no valid reason to view the CCTV and did so for

the improper purpose of monitoring an employee. That does not arise here as the viewing

was clearly legitimate.

88. Further, it was said that every employee entering the room for a defined period of

time had to be regarded as a suspect for the graffiti incident, including Mr. Doolin, and

accordingly the unauthorised access had a clear security dimension and was integral to the

investigation of the graffiti. It must follow, it was argued, that even if the disciplinary

process was not expressly for a security purpose, it was for a related purpose and thus not

incompatible with the specified purpose.

89. Counsel for the DPC suggested that on the logic of Mr. Doolin’s argument, if he had

been detected on the CCTV actually carving the graffiti into the table, while he might be

amenable to criminal sanction, he could not be disciplined for the same thing. While there

may be a superficial attraction to that argument, I think, on analysis, it is misconceived. In, - 31 -

such a scenario, the employee would face the disciplinary process for doing the very thing

which gave rise to the security issue in the first place. In that event it could not be argued

that the CCTV was being used for an unspecified purpose or one that was incompatible.

90. That appears to me however to be a world away from this case. The fact that the

viewing of the CCTV here was for the purpose of attempting to detect the perpetrator of the

offensive graffiti and damage to Hospice property is entirely irrelevant to the incidental

observation of Mr. Doolin taking unauthorised breaks. As I have already said, and as the

High Court found, there was absolutely no evidence that the taking of such breaks

represented a security issue in itself.

91. The logical conclusion of that argument is that, if, for example, another employee was

picked up on the camera smoking a cigarette in the corridor outside the tea room, contrary

to Hospice rules, the CCTV could equally be availed of to discipline that person. In that

scenario, the purpose of the original viewing remains legitimate and on the DPC’s argument,

it would follow that the processing of the data relating to the employee caught smoking must

be regarded as related to, and not incompatible with, the security purpose. That, in my view,

cannot be correct.

Conclusions

92. Central to the analysis, as the Directive and the 1988 Act make clear, is the concept of

notification of the purpose to the data subject. There is no dispute here but that the security

purpose, being the only specified purpose, was clearly identified in both the OLHCS CCTV

policy and the notices beside the cameras themselves. Section 2D of the Act, cited above,

makes clear that personal data shall not be treated as processed fairly unless the data subject

is made aware, at or before the time when the data is obtained, of the purpose for which the

data are intended to be processed., - 32 -

93. The Working Party opinion identifies, as one of the key factors in the compatibility

assessment, the reasonable expectations of the data subject as to the further use of their data.

It seems to me that it could not reasonably be said in the present case that Mr. Doolin had

either been notified that the CCTV could be used for disciplinary purposes or that there was

any basis upon which he ought reasonably to have expected such use. It seems to me the

contrary is much more likely to be the case.

94. Insofar, therefore, as it may be correct to say that the High Court overlooked the

compatibility analysis, in my judgment it is clear in the present case that Mr. Doolin’s data

were indeed used for a purpose other than, and incompatible with, the specified purpose. It

follows therefore that such use was unlawful.

95. I am therefore in agreement with the findings of the High Court and accordingly I

would dismiss this appeal.

96. With regard to costs, as Mr. Doolin has been entirely successful, it would seem to

follow that he is entitled to the costs of this appeal. If the DPC wishes to contend for a

different order, she will have liberty to apply within 14 days of the date of this judgment for

a short supplemental hearing on costs. If such hearing is requested and does not result in an

order different from that proposed, the DPC may additionally be liable for the costs of the

supplemental hearing. In default of such application, an order in the terms proposed will be

made.

97. As this judgment is delivered electronically, Haughton and Ní Raifeartaigh JJ. have

indicated their agreement with it.

@@ Line 81: / Line 81: @@
 == Comment ==
-''Share your comments here!''
+Although this case is based on the Data Protection Acts that predate GDPR, the ruling continues to be relevant to the current legislative landscape, for at least two reasons:
+. The definition of data processing as it was formulated in the DPA 1988 was similar to the GDPR. The High Court and the Court of Appeal agreed that while the CCTV footage was neither downloaded  nor further used as incriminating evidence for disciplinary proceedings, the fact that the CCTV footage triggered the disciplinary investigation amounted to data processing for that purpose.
+. The Court of Appeal’s decision further weighed on the fact that this type of processing could be considered incompatible with the original security purpose. The Court’s reasoning focused around principles of data transparency (notification to data subject) and the data subject’s reasonable expectation as to the secondary purpose of processing. Same principles around fair data processing exist in the GDPR Art. 5 and Recital 39 and the Irish DPA 2018.
 == Further Resources ==