Court of Appeal - 2020/123
From GDPRhub
| Court of Appeal - 2020/123 | |
|---|---|
 | |
| Court: | Court of Appeal (Ireland) |
| Jurisdiction: | Ireland |
| Relevant Law: | Data Protection Acts, 1988 and 2003, Section 2(1)(c)(ii) and Section 2D |
| Decided: | 24.05.2022 |
| Published: | 24.05.2022 |
| Parties: | The Data Protection Commissioner Cormac Doolin |
| National Case Number/Name: | 2020/123 |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | English |
| Original Source: | Courts Service (in English) |
| Initial Contributor: | czapla |
The Irish Court of Appeal, in an appeal brought by the Irish DPC, ruled that personal data that was collected through CCTV for the purpose of crime prevention, could not be lawfully used for staff monitoring and disciplinary proceedings. The Court decided that such subsequent, secondary purpose, was incompatible with its original purpose.
English Summary
Facts
An Irish Hospice placed CCTV cameras in the staff tearoom, following advice from Gardai (Irish Police) after graffiti had been left on a table saying: "Kill all whites, ISIS is my life". The incident happened in 2015, shortly after terrorist attacks in Paris.
A sign was placed beside each camera which read: “Images are recorded for the purposes of health and safety and crime prevention.” The same information was included in the hospice policy. The CCTV footage, that was reviewed as part of security investigation, revealed numerous unauthorised breaks of the data subject, who was one the hospice employees at that time. Although there was no suggestion that the data subject had any involvement in the graffiti incident, the data collected from the CCTV prompted disciplinary proceedings against him. The data subject made a complaint to the DPC. The complaint was rejected, on the basis that the CCTV images were not processed beyond the original security purpose. It was argued by the hospice that the evidence for the data subject's disciplinary proceedings was based on records from a key fob used by the data subject to enter the tearoom. The data subject appealed to the Circuit Court. The Circuit Court upheld the DPC’s decision. The data subject appealed again to the High Court. The High Court found that the DPC incorrectly interpreted the term "processing" under the Data Protection Act 1988. The DPC appealed the decision to the Court of Appeal.
Holding
The Court of Appeal upheld the High Court decision.
The Court decided that:
1. The data subject was not made aware, at or before the time when the data was obtained, of the purpose for which the data was intended to be processed, contrary to the fair processing requirement of the Section 2D of the Data Protection Act 1988.
2. Based on the Court’s analysis of Article 29 of the Data Protection Directive of 1995 entitled “Working Party on the Protection of Individuals with regard to the Processing of Personal Data”, the CCTV data was used for a purpose other than, and incompatible with, the specified purpose, making such use unlawful. The incompatibility stemmed from the fact that the data subject was neither notified that the CCTV could be used for disciplinary purposes nor he ought reasonably to have expected such use.
Comment
Although this case is based on the Data Protection Acts that predate GDPR, the ruling continues to be relevant to the current legislative landscape, for at least two reasons:
1. The definition of data processing as it was formulated in the DPA 1988 was similar to the GDPR. The High Court and the Court of Appeal agreed that while the CCTV footage was neither downloaded nor further used as incriminating evidence for disciplinary proceedings, the fact that the CCTV footage triggered the disciplinary investigation amounted to data processing for that purpose.
2. The Court of Appeal’s decision further weighed on the fact that this type of processing could be considered incompatible with the original security purpose. The Court’s reasoning focused around principles of data transparency (notification to data subject) and the data subject’s reasonable expectation as to the secondary purpose of processing. Same principles around fair data processing exist in the GDPR Art. 5 and Recital 39 and the Irish DPA 2018.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
THE COURT OF APPEAL
UNAPPROVED
NO REDACTION NEEDED
Neutral Citation No [2022]
IECA 117
Court of Appeal Record Number: 2020/123
High Court Record Number: 2019/211CA
Circuit Court Record Number: 2018/5134
Noonan J.
Haughton J.
Ní Raifeartaigh J.
IN THE MATTER OF THE DATA PROTECTION ACTS, 1988 AND 2003
AND IN THE MATTER OF AN APPEAL UNDER SECTION 26 OF THE
DATA PROTECTION ACTS, 1988 AND 2003
BETWEEN/
THE DATA PROTECTION COMMISSIONER
APPELLANT
-AND-
CORMAC DOOLIN
RESPONDENT
-AND-
OUR LADY’S HOSPICE AND CARE SERVICES
NOTICE PARTY, - 2 -
JUDGMENT of Noonan J. delivered on the 24th day of May, 2022
1. This appeal concerns the alleged misuse of data collected by a security camera on an
employer’s premises for the purpose of disciplinary action against an employee. At the
outset, it is worth noting that this is the third appeal brought in these proceedings from a
decision of the appellant, the Data Protection Commissioner (“the DPC”) which concerns
the use of data relating to the respondent in this appeal, Mr. Doolin. The DPC’s original
decision, which was adverse to Mr. Doolin, was appealed by him to the Circuit Court, which
dismissed the appeal. Mr. Doolin appealed to the High Court, which allowed the appeal.
The DPC appeals to this Court against the judgment of the High Court. Following this
judgment, there is the potential for a further appeal to the Supreme Court. Needless to say,
the costs involved in all these appeals are very substantial and entirely disproportionate to
the issue concerned, where there is no obvious necessity for such a multiplicity of appeals.
2. The resultant delays in the final determination of an issue that arose as far back as
2015 is unfair to the parties, particularly Mr. Doolin. This is not to mention the amount of
scarce courttime absorbed by this litigation. Thesituationarising in this caseis by nomeans
unique as there are other similar statutory provisions providing for such layers of appeal. It
is to be hoped that the legislature will address this issue soon.
The Facts
3. Mr. Doolin was, at the relevant time, employed as a craftsman’s mate at Our Lady’s
th
Hospice in Harold’s Cross by the Notice Party (“OLHCS”). On the 19 November, 2015,
graffiti was discovered carved into a table in the staff tea room in a building at the Hospice,
knownasAnnaGaynorHouse,whichread:“Killall whites,ISISismy life”. Thisdiscovery,
coming as it did less than a week after the terror attacks at the Bataclan and elsewhere in, - 3 -
Paris on the 13 November, 2015, caused considerable concern to OLHCS who contacted
the Gardaí.
4. The tea room in question was accessible by the use of fobs issued to staff members,
including Mr. Doolin, and the area outside the door was monitored by a CCTV camera. The
Gardaí advised OLHCS to review the footage from this camera for a three-day period from
the 17 to the 19 November, 2015 so as to identify all persons entering the tea room during
that period. A viewing of the footage showed Mr. Doolin entering the room on a number of
occasions, although there is no suggestion that Mr. Doolin had any involvement in the
graffiti incident.
5. However, the information gathered from the CCTV footage suggested that Mr.
Doolin accessed the room for the purpose of taking unauthorised breaks, and this
subsequently became the subject of a disciplinary process against Mr. Doolin which resulted
in a sanction. Arising from this, Mr. Doolin made a complaint to the DPC claiming that the
use of the data from the CCTV constituted a breach of the Data Protection Act, 1988.
6. The footage was viewed on one occasion only on the 20 November, 2015 by two
members of OLHCS management, Mr. Paul Gahan, Human Recourses Manager, and Mr.
Tommy Beatty, Capital Projects Manager.
th
7. On the 26 November, 2015, OLHCS wrote to Mr. Doolin in a letter captioned “Re:
Investigation into Offensive Graffiti”. The letter indicated that a formal investigation was
being commenced into two matters, the graffiti and the use of unauthorised breaks.
8. The documents disclosed show that Mr. Gahan sent an email at 10.06am on the 26 th
November, 2015 asking a Deirdre Congdon that the letter being sent to persons under
investigation should refer to two investigations, suggesting the earlier letter preceded it. A, - 4 -
further letter was sent the next day, the 27 November, 2015, this time captioned “Re:
Formal Investigations” in the plural. The letter was otherwise in similar terms save that,
instead of referring to the use of unauthorised breaks, it now referred to accessing the room
at unauthorised times.
st
9. On the 1 December, 2015, a formal investigation meeting was held with Mr. Doolin
who was interviewed by Mr. Gahan and Mr. Beatty. Although some controversy
subsequently emerged about the availability of the minutes of that meeting, that is no longer
live in this appeal. The interview with Mr. Doolin appears to have been almost exclusively
focused on the taking of unauthorised breaks. He was shown an image of the graffiti and
asked if he had seen it on the table, but he said he did not notice anything on the table.
Beyondthat,theinterviewwasconcernedwithwhenandwhyMr.Doolinaccessedtheroom.
Mr. Beatty put the following question to him: -
“The Gardaí asked us to look at the CCTV for the days previous to identify if there
was a pattern. It came to light that you had accessed the room for 55 minutes on the
day in question, the day previous 46 minutes and 50 minutes on the Tuesday. Why
were you in the room?”
10. This question appears to demonstrate that Mr. Beatty and Mr. Gahan obtained
information from the CCTV as to the days on which Mr. Doolin was in the room and for
how long he was there. Mr. Doolin was asked if he wanted to see the CCTV footage and he
declined but he agreed that he had taken the breaks in question without telling his manager.
11. On the next day, the 2 December, 2015, Mr. Gahan wrote to Mr. Doolin sending him
a copy of the typed minutes of the interview. The letter was, perhaps surprisingly, captioned
“Re: Investigation into Offensive Graffiti” reflecting the first letter of the 26 November,
2015 which Mr. Gahan sought to have amended, as noted above., - 5 -
12. The investigation panel completed its report entitled “Final Investigation Outcome
th
Report” on the 15 January, 2016. The description of the investigation on the title page is:
“Investigation into staffmember(CormacDoolin)accessingtheAnnaGaynorHouse
tea room at unauthorised times.”
13. The report notes that CCTV footage and fob access to the room in question were
examined. It appears that the fob access is recorded so that times of entry were available to
the investigation panel. As the title to the report makes clear, it was concerned solely with
access by Mr. Doolin to the room at unauthorised times and not with any investigation of
Mr. Doolin in connection with the graffiti.
14. In that regard, the report expressly refers to the panel having reviewed the CCTV
footage and produces a table in the body of the report showing that Mr. Doolin accessed the
th th th
room on one occasion on each of the 17 , 18 and 19 November, 2015. In respect of each
occasion, the date is given, the time of the access, the time leaving the room and the duration
of the stay in the room. With regard to the times given, the report observes:
“Times of Unauthorised Access
The panel noted that CCTV footage timings are running approximately 16 minutes
fast.”
15. This appears to be a reference to the fact that the panel was able to identify accurate
timings from the fob records to establish that the timings on the CCTV were 16 minutes
ahead of real time. The outcome of the report was:
“Outcome, - 6 -
Following a comprehensive consideration of the information obtained during this
investigation the panel have established on the balance of probabilities that
unauthorised breaks were taken by Mr. Cormac Doolin on the afternoons of Tuesday
17 , Wednesday 18 and Thursday 19 November 2015.”
16. The investigation outcome thus makes clear that it was solely concerned with the
taking of unauthorised breaks and in fact makes no reference to any findings in connection
with the graffiti. Mr. Doolin subsequently received a disciplinary sanction.
17. It is also relevant to note that in September 2012, OLHCS published its Policy on
Closed Circuit Television. The introduction states as follows:
“The use of Closed Circuit Television (CCTV) in OLH&CS is part of the operational
system for security. The appropriateness of using CCTV on OLH&CS premises was
assessed as part of the commissioning process and was informed by historical
experience on the hospice campus. The purpose of the system is to prevent crime
and promote staff security and public safety.
OLH&CS ensures that its use of CCTV is carefully governed is (sic) in line with the
Data Protection Act 1998 & 2003 and other relevant legislation.” (my emphasis)
18. A sign was placed beside each camera which read:
“Images are recorded for the purposes of health and safety and crime prevention.”
The Relevant Legislation
19. This case is primarily concerned with the provisions of Section 2(1)(c)(ii) of the Data
Protection Act 1988 as amended by the Data Protection Act 2003. These have now been
replaced by the Data Protection Act 2018 which gives effect to Regulation (EU) 2016/679, - 7 -
(General Data Protection Regulation) which contains similar provisions, so the issue arising
here continues to have relevance.
20. Section 2 of the 1988 Act, as amended and insofar as relevant here, provides as
follows:
“(1) A data controller shall, as respects personal data kept by him or her, comply with
the following provisions:
(a) the data or, as the case may be, the information constituting the data shall
have been obtained, and the data shall be processed, fairly,
(b) the data shall be accurate and complete and, where necessary, kept up to
date,
(c) the data —
(i) shall have been obtained only for one or more specified, explicit and
legitimate purposes,
(ii) shall not be further processed in a manner incompatible with that
purpose or those purposes,
(iii) shall be adequate, relevant and not excessive in relation to the
purpose or purposes …”
21. Section1ofthe1988Actprovidesvariousrelevantdefinitionsincludingthatof“data”,
which equates to information in a form in which it can be processed.
22. Central to this appeal is the definition of “processing” which is as follows:
“ ‘Processing’ of or in relation to information or data, means performing any operation
or set of operations on the information or data, whether or not by automatic means,
including-, - 8 -
(a) obtaining, recording or keeping the information or data,
(b) collecting, organising,storing,alteringor adapting theinformation ordata,
(c) retrieving, consulting or using the information or data,
(d) disclosing the information or data by transmitting, disseminating or
otherwise making it available, or
(e) aligning, combining, blocking, erasing or destroying the information or
data;”
23. Section 2D of the 1988 Act, as inserted by the 2003 Act, upon which some reliance is
placed by Mr. Doolin, provides in relevant part:
“(1) Personal data shall not be treated, for the purposes of section 2(1)(a) of this Act,
as processed fairly unless —
(a) in the case of data obtained from the data subject, the data controller ensures,
so far as practicable, that the data subject has, is provided with, or has made
readily available to him or her, at least the information specified in subsection
(2) of this section …
(2) The information referred to in subsection (1)(a) of this section is:
…
(c) the purpose or purposes for which the data are intended to be processed…”
The DPC
24. Following upon the events described above, on the 17 June, 2016 Mr. Doolin made
a complaint to the DPC (the functions of the DPC have now been transferred to the Data, - 9 -
Protection Commission by virtue of the Act of 2018). The decision of the DPC was issued
on the 27 July, 2018. It summarises the complaint in the following terms:
“You submitted a complaint dated 17 June 2016 to this office alleging that your
employer, OLH&CS, used CCTV footage of you to sanction you for taking
unauthorised breaks… You acknowledged that OLH&CS had a legitimate reason to
view the CCTV footage in order to investigate the graffiti incident in line with its
CCTV policy. However, you expressed objection to the CCTV subsequently being
used for the monitoring of staff and for disciplinary proceedings, as this was not a
stated purpose in OLH&CS’s CCTV policy and not in line with Section 2(1)(c) of the
Acts.”
25. At para. 2, the DPC notes that:
“The data in question was personal data relating to you (consisting of your image
held on CCTV footage) as you can be identified from it and the data relates to you
as an individual.”
This observation is important as it reflects the view of the DPC that the data relating to Mr.
Doolin which were the subject of the complaint were confined to his image on the CCTV, a
point to which I will return.
26. The decision goes on to note (at para. 5) that the DPC was advised by OLHCS that
the disciplinary action that was taken against Mr. Doolin was on the basis of admissions
made by him and not on foot of the CCTV footage, which was not downloaded following
the single viewing.
27. The DPC considered that the purpose for which the CCTV was viewed, in furtherance
of the investigation into the graffiti incident, was a legitimate purpose (at para. 24):, - 10 -
“This Office is satisfied that the processing of your personal data in the form of a
limited viewing of the relevant CCTV footage, without downloading or further
processing of any kind was necessary for this purpose and did not go beyond the stated
purpose.” (my emphasis)
28. It is also notable from the decision that the DPC consistently refers to “an
investigation” having been undertaken by OLHCS, rather than “investigations”.
29. At para. 26, the DPC reached her conclusions in the following terms:
“I also considered whether the requirements of Section 2(1)(c)(ii) of the Acts had been
met by OLH&CS. This requires that personal data must not be processed for purposes
other than the purpose for which it was originally collected. In this case, I am satisfied
that your images captured on CCTV were processed in connection with the
investigation of a security incident when they were initially viewed by the
investigation team for that purpose alone. The information gathered from that viewing
may subsequently have been used for another purpose, i.e. disciplinary proceedings
against you, but this in my view does not constitute a different purpose, because the
CCTV images were not further processed for that second purpose. If the images were
further processed for that second purpose, for example by downloading and use in the
disciplinary proceedings against you, it might constitute further processing for a
different purpose, but that did not happen in your case and no further processing of
your images occurred for the second purpose.
27. Accordingly, I find that the limited viewing of your personal images took place
exclusively for thesecuritypurposeforwhich theimages wereoriginallycollectedand
that no contravention of Section 2(1)(c)(ii) occurred.”, - 11 -
30. The DPC accordingly found that no breach of the Data Protection Acts had occurred.
As can been seen from the foregoing comments, the DPC considered that Mr. Doolin’s data
wereconfinedtotheCCTVimages andbeyondthefirstandonlyviewingofthose,nofurther
processing occurred. This is strongly disputed by Mr. Doolin for reasons which will become
apparent.
The Circuit Court
31. As noted in the DPC’s decision, an appeal from her determination lay to the Circuit
Court under s. 26 of the Act. That appeal was heard by the Circuit Court (Her Honour Judge
Linnane) on the 1 May, 2019.
32. The matter proceeded in the normal way on affidavit. Mr. Doolin’s grounding
affidavits were responded to by Mr. John V. O’Dwyer, Deputy Commissioner in the Office
of the DPC. Mr. O’Dwyer’s first affidavit was sworn on the 7 February, 2018. At para. 8,
he refers to the minutes of the interview with Mr. Doolin on the 1 December, 2015 and
avers:
“8. … It is clear from the minutes that the investigation meeting was concerned with
the security issues presented by the graffiti incident and that the issue of the taking
of unauthorised breaks at unauthorised locations arose and was addressed in this
context. Having regard to the purpose and stage of the investigation, it would appear
that the issues were clearly and closely related. Contrary to what the Appellant has
asserted at paragraph 5 of the Grounding Affidavit, there was no ‘unlawful further
processing of the CCTV footage’. Insofar as the CCTV footage formed the basis for
the investigation meeting, it was on foot of its processing for security purposes, to
include those relating to the investigation of the graffiti incident, the appropriateness
of which the Appellant has acknowledged.”, - 12 -
33. These averments by Mr. O’Dwyer are, in reality, comments based on his interpretation
of the minutes of the meeting of the 1 December, 2015. It seems to me that this court is
equally well-equipped to interpret those minutes and, with respect to Mr. O’Dwyer, it is not
at all clear to me that the meeting was solely concerned with security issues or issues relating
to security. As I have noted already, while the graffiti incident was mentioned, the primary
focus of the meeting appears to have revolved around the taking of unauthorised breaks by
Mr. Doolin. How this is said to be a security issue or related to a security issue is not
explained by Mr. O’Dwyer, nor has it ever been explained by OLHCS. It is certainly not
explained in the Panel Report following this meeting in which the graffiti incident barely
merits a mention. However, Mr. O’Dwyer repeats the same assertions at para. 11 which
again are really little more than a statement of his opinion on the matter.
34. Asnoted, onecentral featureofthis caseis thatit has neverbeenexplainedbyOLHCS,
or indeed the DPC, how the taking of unauthorised breaks is said to amount to a security
issue. It will be recalled that the OLCHS’s policy document on CCTV specified that its
purpose was to prevent crime and promote staff security and public safety. The word
“security” in its natural and ordinary meaning, may be taken to refer to a danger or threat to
the safety of persons and/or property. It has never been explained how it is said that the
taking of unauthorised breaks by Mr. Doolin presented a danger or threat to the safety of
persons at the Hospice, be they staff or visitors, or the property of the Hospice or any person
present there.
35. There may of course be circumstances in which one might infer a security risk arising
from the taking of unauthorised breaks by, say, a security guard who left the property
unsupervised for a period of time. None of that arises in Mr. Doolin’s case so it is far from, - 13 -
clear or obvious, in the absence of explanation, how the taking of unauthorised breaks by
him could constitute a security issue or be related to such an issue.
36. In an affidavit replying to Mr. O’Dwyer’s first affidavit, Mr. Doolin makes a number
of observations including the fact that, during the course of the investigation into the graffiti
incident,OLHCSamendeditsCCTVpolicybytheamendmentoftheintroductoryparagraph
in the following terms:
“The purpose of the system is to prevent crime and promote staff security and public
safety. If, in the event of viewing CCTV for the specified purpose, a disciplinary
action is observed, the CCTV can be used for the purpose of a disciplinary
investigation. However, CCTV will not be viewed solely for the purpose of
monitoring staff.”
37. The sole affidavit sworn on behalf of the notice party was sworn by Ms. Pat Pierce, its
Data Protection Officer, who says that sanctions were imposed on Mr. Doolin as a result of
his admissions made at the meeting of the 1 December, 2015. As already averred by Mr.
O’Dwyer, Ms. Pierce reiterates that Mr. Doolin’s data were processed/reviewed on one
occasion only arising out of the single viewing.
38. Mr. O’Dwyer swore a third affidavit on the 21 March, 2019. In paragraph 5 of this
affidavit, Mr. O’Dwyer avers as follows:
“On the basis of the evidence before the court, I say that it is clear beyond doubt that
the processing of the CCTV footage by OLHCS was for security purposes, arising
directly from and relating to the investigation of the graffiti incident. It is clear that,
in the particular circumstances of this case, the taking of unauthorised breaks at an
unauthorised location, the site of the graffiti incident, was a serious and bona fide, - 14 -
securityissueandthattheinvestigationbyOLHCS,andthedisciplinaryactionwhich
resulted therefrom, arose directly out of and was directly connected to this security
issue, albeit that the sanction applied in the context of the disciplinary action relied
on admissions made by the applicant himself.”
39. As is subsequently pointed out in the judgment of the High Court, this averment by
Mr.O’Dwyeris,tosaytheleast,somewhatsurprising. Heappearstogoconsiderablyfurther
than in his previous affidavits, and indeed than Ms. Pierce, the notice party’s own Data
Protection Officer, in suggesting that the taking of unauthorised breaks at an unauthorised
location was a serious and bona fide security issue. What is more, Mr. O’Dwyer feels able
to express this conclusion “on the basis of the evidence before the Court”. However, as in
his previous affidavits, I cannot see any justification for this statement that is to be found in
the evidence before the Circuit Court. A similar conclusion was reached by the High Court
as will become apparent.
40. Following the hearing, Judge Linnane gave an ex tempore ruling. She appears to have
accepted that OLHCS carried out one investigation only (at Transcript, p. 93):
“It’s clear to me, as I say, that the processing of the footage was for that purpose,
namely security, arising directly from and relating to the investigation of the graffiti
incident.”
41. Shereliedforthat conclusionontheavermentofMr.O’DwyertowhichIhavereferred
and apparently also for the following statement (at Transcript, p. 94 and 95):
“Clearly, it was a security issue, Mr. Doolin being in an unauthorised place taking
unauthorised breaks. In effect, he admitted a breach of security, i.e. by taking the
unauthorised breaks. The disciplinary action was taken on his admissions …, - 15 -
Iaccept in thecircumstances [counsel fortheDPC’s]submissionthatthedisciplinary
action by his employer against Mr. Doolin was taken for security purposes. In fact I
also accept, as has been argued, that there was one investigation, i.e. the graffiti
incident, not two investigations, as argued by Mr. Doolin’s counsel. In all the
circumstances, taking intoaccount the facts ofthis case, I’m satisfiedthatMr.Doolin
has not established that he has satisfied the test for having this decision of the Data
Protection Commission overturned. Accordingly, I am dismissing his appeal.”
The High Court
42. Mr. Doolin appealed to the High Court on a point of law as provided for in s. 26(3)(b)
of the 1988 Act.
43. The High Court judge set out the background and chronology to the matter, noting as
follows with regard to the Panel Report (at para. 12):
“The following observations may be made about the Panel Report. The Report is
solely in respect of the investigation relating to staff members accessing the room at
unauthorised times. It clearly relies inter alia directly on the CCTV footage,
identifying as it does the precise times of entry and exit. Accordingly, it wholly
undermines the claim of OLHCS that the investigation into unauthorised access was
solely made on the basis of admissions. Finally, there is no reference at all to
unauthorised access to the staff room being a security issue contrary to the averments
of Mr. O’Dwyer of the DPC discussed below.”
44. The judge then set out the legal framework and in particular, the purpose limitation
principle appearing in s. 2(1)(c)(ii) of the Act which transposes Art. 6(1)(b) of Directive
95/46/EC (“the “Data Protection Directive”). She also made extensive reference to the, - 16 -
opinion of the Working Party 29 Group to which I will refer further, concerning the concept
of purpose limitation.
45. The judge referred to four key factors identified by the Working Party to be considered
during the compatibility assessment, the judge recognising that processing for a different
purpose is not automatically incompatible but must be assessed on a case-by-case basis. The
judge then referred to the decision of the DPC noting (at para. 32):
“It is clear from the Decision that the exclusive basis upon which it was found that
no further processing had occurred was that the CCTV images had not been viewed
in the disciplinary proceedings against the appellant. The Decision did not engage
with what the Appellant had clearly stated in his email of 10 December 2017, i.e. that
it was not CCTV footage that was used to sanction him but rather data retrieved and
processed from the CCTV footage.”
46. ThejudgereferredtoMr.O’Dwyer’sthirdaffidavit,mentionedabove,inthefollowing
terms (at para. 39):
st
“On 21 March 2019, the defence of the proceedings by the DPC took an unexpected
turn. Mr. O’Dwyer swore a third affidavit on 21 March 2019 at which stage he
identified anewbasis for thefurther processing by OLHCS not identifiedbyOLHCS
either in the summary given by the DPC of the submissions made to it by OLHCS,
in the Affidavit of Mr. (sic) Pierce, in the Panel Report or in any of the material
exhibited to this appeal.”
47. In dealing with theevidentialbasis forthedecisionoftheCircuit Court,theHighCourt
wascriticalofthefactthattheprimarydefenceoftheDPCnowadvancedwasthatthefurther
use of the information gathered from the CCTV was in fact used for its original purpose i.e., - 17 -
security. She said that this marked a significant departure from the approach adopted in the
Decision itself where the sole justification for rejecting the complaint was that although the
material may in fact have been used for a different purpose, it was not further processed for
that second purpose. She found that conclusion to be erroneous as a matter of law and
considered that there had been a surprising shift in the approach of the DPC during the life
of the proceedings.
48. The Court said (at para. 42):
“The DPC has gone from finding no breach because there was no further processing
of the CCTV footage to asserting in these proceedings no breach because any further
processing was done for the purpose for which the material was collected i.e.
security.”
49. She described this new argument as “remarkable” because there was no evidence at all
to support that argument, which became the sole basis for the rejection by the Circuit Court
of the appeal.
50. In commenting on what she perceived as this inconsistency, the judge was of the view
that the Circuit Court did not appear to have examined the underlying documents, including
the Panel Report, the submissions of OLHCS to the DPC or the absence of any averment
th
relating to security in the affidavit of Ms. Pierce of the 8 March, 2019. She continued (at
para. 46): -
“A consideration of this material discloses that, as far as I can ascertain, at no point
in time did OLHCS ever justify the further processing of the material gleaned from
the CCTV footage in the disciplinary proceedings on the basis of security concerns.
Rather, it (a) made the point that the CCTV footage itself was only viewed for, - 18 -
security purposes and (b) that the disciplinary proceedings did not employ material
derived from the footage but were based exclusively on admissions made by the
Appellant at the interview on 1 December 2015. The idea that the use of the
information obtained from the CCTV footage in the context of the disciplinary
proceedings was for security purposes rather than for disciplinary purposes does not
find a basis in any of the material before me. There is simply no evidence at all to
this effect. Perhaps most significantly, as noted in my review of the exhibited
material above, the Panel Report makes no reference whatsoever to unauthorised
access to the tea room or unauthorised breaks being a security issue.”
51. Although the judge felt that the issue of whether there were one or two investigations
was not particularly relevant, it appeared on balance that there were in fact two. At para. 50,
the judge said:
“… [T]he evidence indicates that the use of the information from the CCTV footage
in the context of the disciplinary hearing was used for an entirely different purpose
to that for which it was collected.”
52. The judge said that had the CCTV material been intended to be used for disciplinary
purposes as well as the other purpose identified, that would require to be identified, as was
subsequently done on the policy amendment. Her review of the decision led her to conclude
as follows:
“52. In summary the CCTV footage was collected for the express and exclusive
purpose of security and was used (permissibly) for that purpose but was also used for
adistinct and separatepurpose,i.e.disciplinaryproceedings intounauthorisedbreaks
by an employee., - 19 -
53. In the premises, it seems to methattherewas noevidenceupon whichtheCircuit
Court could safely conclude that the further processing in the context of the
disciplinary hearing was for security purposes, since the sole basis for this finding
i.e. the averments of Mr. O’Dwyer in his third affidavit, were not themselves
grounded on any material put forward by OLHCS.
54. I am therefore overturning the decision of the Circuit Court on the basis that
there was no evidence for the conclusion that the disciplinary action, in which
information derived from the CCTV footage was used, was carried out for security
purposes.”
53. Separately, the judge was of the view that Mr. O’Dwyer’s averment to the effect that
the sanction applied in the context of the disciplinary action relied on admissions made by
the appellant himself was difficult to understand in circumstances where the Panel Report
madenoreferencetoadmissionsbutratherexpresslyreferredtoaconsiderationoftheCCTV
footage and the information concerning the entry and exit dates and times which came from
that footage and the fob access.
54. In dealing with the alleged breach of s. 26(1)(c)(ii), the High Court said that it was
indisputable that the information contained in the CCTV footage was used for a different
purpose than the one for which the data were originally collected. The fact that it was not
downloaded does not mean that no further processing took place. She therefore considered
contrary to the DPC’s findings, the CCTV images were further processed.
55. She accordingly allowed the appeal., - 20 -
The Appeal to This Court
56. The first point that arises for consideration is whether an appeal to this court is
available at all.
57. Mr. Doolin argues that it is not, by virtue of s. 39 of the Courts of Justice Act, 1936
which regulates appeals from the Circuit Court to the High Court and provides that such
appeals shall be final and conclusive and not appealable. Certain well-known authorities are
th
relied on in that regard – see Kinahan v Baila (Unreported, Supreme Court, 18 July 1985),
PepperFinanceCorporationvCannon[2020]IESC2andBankofIrelandvGormley[2020]
IECA 102. Although Mr. Doolin objected to the DPC’s appeal on this basis both in his
respondent’s notice and written submissions, it was however conceded at the hearing of the
appeal by counsel for Mr. Doolin that reliance was no longer being placed on this point.
58. I think that concession was made properly. Prima facie, the position is that all
judgments of the High Court are appealable to this Court by virtue of Art. 34.4.1 of the
Constitution. Of particular significance also are the provisions of s. 26(3) of the 1988 Act
itself which provides as follows:
“(a) Subject to paragraph (b) of this subsection, a decision of the [Circuit Court]
under this section shall be final.
(b) An appeal may be brought to the High Court on a point of law against such a
decision; and references in this Act to the determination of an appeal shall be
construed as including references to the determination of any such appeal to
the High Court and of any appeal from the decision of that Court.” (my
emphasis), - 21 -
59. Accordingly, the statute itself appears to expressly recognise that an appeal does
indeed lie to this Court from the High Court.
60. There was little dispute between the parties as to the correct legal principles to be
applied to a statutory appeal of this kind. The High Court relied on Deely v Information
Commissioner [2001] 3 IR 439 where McKechnie J., then a judge of the High Court, said
the following regarding appeals to that court on a point of law (at 452):
“There is no doubt but that when a court is considering only a point of law, whether
by way of a restricted appeal or via a case stated, the distinction in my view being
irrelevant, it is, in accordance with established principles, confined as to its remit, in
the manner following:-
(a) it cannot set aside findings of primary fact unless there is no evidence to
support such findings;
(b) it ought not to set aside inferences drawn from such facts unless such
inferences were ones which no reasonable decision making body could draw;
(c) it can however, reverse such inferences, if the same were based on the
interpretation of documents and should do so if incorrect; and finally;
(d) if the conclusion reached by such bodies shows that they have taken an
erroneous view of the law, then that also is a ground for setting aside the
resulting decision.”
61. This approach was subsequently approved by the Supreme Court in Sheedy v
Information Commissioner & Ors. [2005] 2 IR 272., - 22 -
62. The form that such an appeal should take was discussed by the Supreme Court in
Orange Limited v Director of Telecoms (No. 2) [2000] 4 IR 159 where Keane C.J. said (at
184-5):
“In short, the appeal provided for under this legislation was not intended to take the
form of a re-examination from the beginning of the merits of the decision appealed
from culminating, it may be, in the substitution by the High Court of its adjudication
for that of the first defendant. It is accepted that, at the other end of the spectrum, the
High Court is not solely confined to the issues which might arise if the decision of
the first defendant was being challenged by way of judicial review. In the case of this
legislation at least, an applicant will succeed in having the decision appealed from
set aside where it establishes to the High Court as a matter of probability that, taking
the adjudicative process as a whole, the decision reached was vitiated by a serious
and significant error or a series of such errors. In arriving at a conclusion on that
issue, the High Court will necessarily have regard to the degree of expertise and
specialised knowledge available to the first defendant.”
63. In the context of appeals to the Circuit Court against decisions of the DPC, the
Supreme Court held in Nowak v The Data Protection Commissioner [2016] 2 IR 585 that
the standard of review identified by Keane C.J. in Orange was the appropriate standard to
apply.
64. In the course of oral submissions in this court, counsel for the DPC said that his case
rested upon three fundamental propositions:
(a) The CCTV footage was viewed on one occasion only for the purpose
specified in the Hospice CCTV Policy, namely security, and was not further
processed thereafter. Accordingly, no breach of the 1988 Act occurred., - 23 -
(b) Alternatively, if the CCTV footage was further processed by OLHCS, it was
so processed for the purpose of the Hospice policy, namely for a security
purpose.
(c) In the further alternative, if the court came to the conclusion that the CCTV
footage was further processed and such processing was not for a security
purpose, then it was for a purpose that was not incompatible with the security
purpose.
The Article 29 Working Party
65. Article 29 of the Data Protection Directive of 1995 is entitled “Working Party on the
Protection of Individuals with regard to the Processing of Personal Data”. Article 29.1
provides:
“1. A Working Party on the Protection of Individuals with regard to the Processing
of Personal Data, hereinafter referred to as “the Working Party”, is hereby set up.
It shall have advisory status and act independently.”
66. The Working Party is in fact an expert group comprising data regulation experts from
different Member States. Since the advent of GDPR, the same group has now been
rebranded as the European Data Protection Board. Its function is set out in Art. 30 as
includingadvisingtheEuropeanCommissiononissuesrelatedtodataprotection. Itprepares
an annual report on data protection in the EU and third countries which is transmitted to the
Commission,theEuropean Parliament and theCouncil ofEuropeandis published. Its views
and opinions have no particular legal status but are clearly influential and persuasive in the
context of interpreting the Directive., - 24 -
67. As the High Court judge pointed out, the issue arising in this case has not been to
date the subject of any decision of the Court of Justice of the European Union or of our
national courts. Accordingly, the High Court considered, and I agree, that regard can be had
to the views of the Working Party as an aid to the interpretation of the Directive and national
legislation which implements it, such as the 1988 Act.
68. On the 2 nd April, 2013, the Working Party issued an opinion on purpose limitation
which is quoted in some detail by the High Court judge. It is a lengthy document but
helpfully contains an executive summary which states (at p. 3):
“Purpose limitation protects data subjects by setting limits on how data controllers
are able to use their data while also offering some degree of flexibility for data
controllers. The concept of purpose limitation has two main building blocks:
personal data must be collected for ‘specified, explicit and legitimate’ purposes
(purpose specification) and not be ‘further processed in a way incompatible’ with
those purposes (compatible use).
Further processing for a different purpose does not necessarily mean that it is
incompatible: compatibility needs to be assessed on a case-by-case basis. A
substantive compatibility assessment requires an assessment of all relevant
circumstances. In particular, account should be taken of the following key factors:
- the relationship between the purposes for which the personal data have been
collected and the purposes of further processing;
- the context in which the personal data have been collected and the
reasonable expectations of the data subjects as to their further use;, - 25 -
- the nature of the personal data and the impact of the further processing on
the data subjects;
- the safeguards adopted by the controller to ensure fair processing and to
prevent any undue impact on the data subjects.
Processing of personal data in a way incompatible with the purpose as specified at
collection is against the law and therefore prohibited.”
69. The High Court cited a passage dealing with the general framework for compatibility
assessment which need not be reproduced.
70. As appears above, one of the key factors to be considered in the compatibility
assessment is the expectation of the data subjects as to the further use of their data. In this
regard, the Working Group observes (at p. 24):
“The second factor focuses on the specific context in which the data were collected
and the reasonable expectations of the data subjects as to their further use based on
that context. In other words, the issue here is what a reasonable person in the data
subject’s situation would expect his or her data to be used for based on the context
of the collection.”
71. Annex 4 to the opinion gives a number of illustrative examples of this factor, the first
of which appears at p. 56 as follows:
“Example One: Chatty Receptionist Caught on CCTV
A company installed a CCTV camera to monitor the main entrance to its building.
A sign informs people that CCTV is in operation for security purposes. CCTV
recordings show that the receptionist is frequently away from her desk and engages, - 26 -
in lengthy conversations while smoking near the entrance area covered by the CCTV
cameras. The recordings, combined with other evidence (such as complaints), show
that she often fails to take telephone calls, which is one of her duties.
Apart from any other CCTV concerns that may be raised by this case, in terms of the
compatibility assessment it can be accepted that a reasonable data subject would
assume from the notice that the cameras are there for security purposes only.
Monitoring whether or not an employee is appropriately carrying out her duties, such
as answering phone calls, is an unrelated purpose which could not be reasonably be
expected by the data subject. This gives a strong indication that the further use is
incompatible. Other factors, such as the potential negative impact on the employee
(for example, a possible disciplinary action), the nature of the data (video-footage),
the nature of the relationship (employment context, suggesting imbalance in power
and limited choice), and the lack of safeguards (such as, for example, notice about
further purposes beyond security) may also contribute to and confirm this
assessment.”
Were Mr. Doolin’s data processed more than once?
72. The first issue arising is whether Mr. Doolin’s data were processed more than once.
The DPC was of the view that they were not. In my opinion, there is a manifest error in that
conclusion, which is serious and significant.
73. The DPC found that the data in question were confined to the image of Mr. Doolin
on the CCTV footage. However, that footage disclosed information, or data, concerning Mr.
Doolin beyond merely his image. As the Panel Report records, it also disclosed where Mr.
Doolin was and when he was there. It disclosed, whether by itself or in combination with
the fob access records, the dates and times when Mr. Doolin entered the staff tea room, the, - 27 -
dates and times when he left the staff tea room and the duration of his stay in the room.
These are all specific pieces of information, or data, personal to Mr. Doolin above and
beyond merely his image.
74. Further, specific reliance was placed on these pieces of information or data to support
the disciplinary process pursued by OLHCS against Mr. Doolin.
75. The definition of “processing” appearing in s. 1 of the Act identifies five separate
operations, or sets of operations, that are to be regarded as “processing”. The first, (a),
includes obtaining or recording the information or data. Thus, the first processing of Mr.
Doolin’s data took place when the data were obtained by being recorded on the CCTV
footage. The DPC found in her decision, and argued again in this court, that this was not to
be regarded as processing and that the first processing occurred with the viewing of the
CCTV footage.
76. That does not appear to me to be consistent with the language of the 1988 Act which
in the definition of “processing” at (a) expressly provides that obtaining data is processing.
This is also consistent with the language of s. 2(1)(c) which provides at (i) that the data shall
have been obtained for specified purposes and at (ii) that it shall not be further processed in
a manner incompatible with that purpose or purposes. Clearly “further” processing can only
occur after prior processing which suggests that the obtaining of the data must be regarded
as a prior or first processing.
77. Asecond processing took place when thosedatawere retrieved andconsultedby being
viewed by Mr. Gahan and Mr. Beatty (subparagraph (c) of the definition of “processing”).
The third processing occurred when the data relating to the dates and times of access/egress
by Mr. Doolin to and from the staff tea room were used by being tabulated in the Panel, - 28 -
Report for the purpose of supporting a disciplinary sanction against him, (also subparagraph
(c)).
78. It is thus clear to my mind that the proposition that his data were processed on one
occasion only, by one viewing of the CCTV footage, cannot be correct, as the High Court
found.
79. The next issue that thus arises is whether the data were further processed for the
specified purpose, namely security.
Were Mr. Doolin’s data processed for the specified purpose?
80. As the High Court held, it seems to me that the critical error in the DPC’s Decision at
the outset was in determining that the personal data in issue were confined to Mr. Doolin’s
image. This inevitably led to further error, in particular with regard to whether there was
further processing or not. Further, the DPC appears to have considered that there was one
investigation only into thesecurity issueand thereforetheoutcomeofthatinvestigationmust
be regarded as security related and thus satisfied the purpose specification.
81. Here again, I agree with the conclusion of the High Court that there were plainly two
investigations or at minimum, one investigation into two different matters. The suggestion
that the disciplinary investigation arose out of admissions made by Mr. Doolin at the
st
interview on the 1 December, 2015 is manifestly incorrect as the evidence clearly
demonstrates that the investigation commenced before that date and thus could not have
originated from the admissions.
82. Becausethereweretwoinvestigations,itcannotbesaidthattheinvestigation,singular,
was for the purpose of security and by definition, its outcome must be for the same purpose.
As I have pointed out already, the title of the Panel Report does not even purport to refer to, - 29 -
security but in terms, describes the report as an “investigation into staff member (Cormac
Doolin) accessing the Anna Gaynor House Tea Room at unauthorised times.”
83. It is clearto metherefore thattheprocessingofMr.Doolin’sdatawas not forasecurity
purpose as the DPC contends. It was manifestly for a different purpose as the High Court
judge found, but of course that is not the end of the inquiry. It is necessary thereafter to carry
out a compatibility assessment and, in this regard, the DPC is critical of the High Court for
failing to take this additional necessary step.
Were Mr. Doolin’s data processed for a purpose that was not incompatible?
84. It will be recalled that the High Court held that the evidence indicated that the use of
the information from the CCTV footage was used for an entirely different purpose to that
for which it was collected. The DPC is correct in arguing that the mere fact that the data
were used for a different purpose does not mean that the use was unlawful. It is only where
the further processing occurs in a manner incompatible with the stated purpose that an
illegality arises.
85. It does seem to me from the fact that the judge said at several places in her judgment
that Mr. Doolin’s data were used for an entirely different purpose to the specified purpose,
it might reasonably be inferred that the judge implicitly considered the use of the data to
have been incompatible with the specified purpose. This would also appear to follow from
the fact that the judge made explicit reference to the Working Party opinion on the issue of
compatibility so that it could not be said that the judge overlooked the issue. In fairness to
the judge, it should also be remembered that neither the DPC nor the Circuit Court carried
out any compatibility analysis andin fact never reachedthatpoint as aresult oftheerroneous
finding that Mr. Doolin’s data were not processed further following the single viewing of
the CCTV., - 30 -
86. Even were it correct to say that the failure of the High Court to carry out a
compatibility analysis was erroneous, on one view of matters the case should be remitted to
the High Court to enable that analysis to be conducted. However, both parties urged on this
court that rather than remitting the matter, the court should determine the issue itself. I think
this is the sensible course, particularly in light of the comments I have made at the outset
concerning the cost and delay that have been incurred in these proceedings to date.
87. It was urged on the court by the DPC that there could be no doubt but that the initial
viewing of the CCTV was for a legitimate security purpose, namely that of identifying the
perpetrator of the graffiti as advised by An Garda Síochána. The DPC argues that there is
no analogy arising between the facts here and those of the example given by the Working
Party, despite the obvious similarities. The critical distinction, it is said, is that in the
Working Party example, the employer had no valid reason to view the CCTV and did so for
the improper purpose of monitoring an employee. That does not arise here as the viewing
was clearly legitimate.
88. Further, it was said that every employee entering the room for a defined period of
time had to be regarded as a suspect for the graffiti incident, including Mr. Doolin, and
accordingly the unauthorised access had a clear security dimension and was integral to the
investigation of the graffiti. It must follow, it was argued, that even if the disciplinary
process was not expressly for a security purpose, it was for a related purpose and thus not
incompatible with the specified purpose.
89. Counsel for the DPC suggested that on the logic of Mr. Doolin’s argument, if he had
been detected on the CCTV actually carving the graffiti into the table, while he might be
amenable to criminal sanction, he could not be disciplined for the same thing. While there
may be a superficial attraction to that argument, I think, on analysis, it is misconceived. In, - 31 -
such a scenario, the employee would face the disciplinary process for doing the very thing
which gave rise to the security issue in the first place. In that event it could not be argued
that the CCTV was being used for an unspecified purpose or one that was incompatible.
90. That appears to me however to be a world away from this case. The fact that the
viewing of the CCTV here was for the purpose of attempting to detect the perpetrator of the
offensive graffiti and damage to Hospice property is entirely irrelevant to the incidental
observation of Mr. Doolin taking unauthorised breaks. As I have already said, and as the
High Court found, there was absolutely no evidence that the taking of such breaks
represented a security issue in itself.
91. The logical conclusion of that argument is that, if, for example, another employee was
picked up on the camera smoking a cigarette in the corridor outside the tea room, contrary
to Hospice rules, the CCTV could equally be availed of to discipline that person. In that
scenario, the purpose of the original viewing remains legitimate and on the DPC’s argument,
it would follow that the processing of the data relating to the employee caught smoking must
be regarded as related to, and not incompatible with, the security purpose. That, in my view,
cannot be correct.
Conclusions
92. Central to the analysis, as the Directive and the 1988 Act make clear, is the concept of
notification of the purpose to the data subject. There is no dispute here but that the security
purpose, being the only specified purpose, was clearly identified in both the OLHCS CCTV
policy and the notices beside the cameras themselves. Section 2D of the Act, cited above,
makes clear that personal data shall not be treated as processed fairly unless the data subject
is made aware, at or before the time when the data is obtained, of the purpose for which the
data are intended to be processed., - 32 -
93. The Working Party opinion identifies, as one of the key factors in the compatibility
assessment, the reasonable expectations of the data subject as to the further use of their data.
It seems to me that it could not reasonably be said in the present case that Mr. Doolin had
either been notified that the CCTV could be used for disciplinary purposes or that there was
any basis upon which he ought reasonably to have expected such use. It seems to me the
contrary is much more likely to be the case.
94. Insofar, therefore, as it may be correct to say that the High Court overlooked the
compatibility analysis, in my judgment it is clear in the present case that Mr. Doolin’s data
were indeed used for a purpose other than, and incompatible with, the specified purpose. It
follows therefore that such use was unlawful.
95. I am therefore in agreement with the findings of the High Court and accordingly I
would dismiss this appeal.
96. With regard to costs, as Mr. Doolin has been entirely successful, it would seem to
follow that he is entitled to the costs of this appeal. If the DPC wishes to contend for a
different order, she will have liberty to apply within 14 days of the date of this judgment for
a short supplemental hearing on costs. If such hearing is requested and does not result in an
order different from that proposed, the DPC may additionally be liable for the costs of the
supplemental hearing. In default of such application, an order in the terms proposed will be
made.
97. As this judgment is delivered electronically, Haughton and Ní Raifeartaigh JJ. have
indicated their agreement with it.
