Early Access to “Specified Information”: Constitutional and Article 8 ECHR Requirements in Garda Vetting

High Court (Ireland), [2026] IEHC 261, Barr J, 30 April 2026
Proceedings: Judicial review (Record Nos. 2025/246 JR and 2025/272 JR)

1. Introduction

This joined judicial review concerned two serving members of An Garda Síochána (“the applicants”) who were the subject of a referral of “specified information” to the Garda National Vetting Bureau (“NVB”) by the Garda Síochána Ombudsman Commission (“GSOC”), a “scheduled organisation” under the National Vetting Bureau (Children and Vulnerable Persons) Act 2012 (as amended) (“the 2012 Act”).

The referral arose from an arrest of a juvenile following a dangerous pursuit in November 2018 and a complaint alleging excessive force. GSOC investigated under the Garda Síochána Act 2005, sent a file to the DPP, and simultaneously notified the applicants that it would make a s.19 referral of specified information to the NVB. The DPP later directed no prosecution, and GSOC later discontinued any further action (including not initiating a discipline investigation under s.95 of the 2005 Act).

The applicants’ central grievance was structural: although they knew a damaging referral existed, they were denied sight of its contents and any opportunity to correct or contest it unless and until a future vetting disclosure request was made and the Chief Bureau Officer (“CBO”) formed a preliminary view that disclosure might be made. They alleged breaches of constitutional fair procedures (including good name) and Article 8 ECHR.

Key issues

  • Whether the GSOC referral was out of time to challenge and/or premature under s.19 of the 2012 Act.
  • Whether the CBO had a “gatekeeper” duty to assess specified information on receipt (before entry on the NVB register).
  • Whether later events (no prosecution; GSOC discontinuance) required amendment/correction under s.19(4).
  • Whether the scheme in ss.10, 15 and 19 is unconstitutional and incompatible with the ECHR because it defers access and submissions until the disclosure stage.
  • Whether an “alternative remedy” via the Data Protection Act 2018 precluded judicial review.

2. Summary of the Judgment

Barr J held:

  • No breach of the 2012 Act by respondents: the applicants failed to establish unlawful action by GSOC, the NVB, or other respondents under the Act.
  • Time bar: the applicants were out of time to challenge GSOC’s June 2024 decision to refer specified information (Order 84 time limits).
  • Not premature: in any event, GSOC did not act prematurely; the relevant investigation had concluded for s.19 purposes.
  • No “gatekeeper” assessment on receipt: the CBO was not obliged to assess specified information upon receipt; assessment is undertaken at the s.15 disclosure stage.
  • No mandatory correction from later events: no prosecution and discontinuance did not, of themselves, make the specified information “incorrect or otherwise inaccurate” for s.19(4) purposes.
  • Alternative remedy rejected: the Data Protection route did not bar the constitutional/ECHR challenge.
  • Constitutionality: ss.10, 15 and 19 are repugnant to the Constitution insofar as they fail to provide any mechanism for an affected person to see and make submissions on specified information held on the NVB register unless and until a vetting request is made and disclosure is preliminarily contemplated.
  • ECHR: the same provisions are incompatible with the ECHR (in breach of Article 8) for materially the same reason: indefinite retention without a meaningful opportunity to access/contest the data outside the disclosure process.
  • Relief limits: the Court refused orders to remove or disclose the information in these proceedings, stressing it could not “insert” new statutory mechanisms into the 2012 Act.

3. Analysis

3.1 Precedents Cited and Their Influence

(a) Timing and the nature of s.19 notifications: MP v The Teaching Council of Ireland

The judgment’s statutory interpretation is anchored in MP v The Teaching Council of Ireland [2019] IEHC 102 and its affirmance on appeal (MP v The Teaching Council [2019] IECA 204). Those decisions characterised s.19 as a collection mechanism with a low threshold (“bona fide concern”), and treated the disclosure-stage process in s.15 as the locus for proportionality and reasonableness before information is released to a third party.

Barr J used MP to reject two of the applicants’ core statutory arguments:

  • “Prematurity”: MP supports that the obligation to notify arises when the scheduled organisation forms the concern at (generally) the end of its process; GSOC’s process had effectively reached that stage when it decided to send a file to the DPP.
  • No “gatekeeper” role on receipt: the deliberate omission of “reasonable” from s.19 (contrasted with its function at s.15) supports the conclusion that the NVB does not adjudicate the merits when data is first lodged.

Notably, Barr J relied on MP for statutory construction, yet reached a different conclusion on constitutional timing: even if the statutory scheme reserves process rights to the disclosure stage, the Constitution (and Article 8) may require earlier access and participation because the retention itself is materially prejudicial.

(b) Alternative remedy doctrine: EMI Records (Ireland) Limited v The Data Protection Commissioner and related authorities

The respondents invoked the principle that judicial review should be refused where an adequate statutory appeal exists, relying on EMI Records (Ireland) Limited v The Data Protection Commissioner [2013] IESC 34 and classic statements in The State (Abbeyglen Properties) v Corporation of Dublin [1984] IR 381. Barr J accepted those general principles, noting their flexible application in Stefan v Minister for Justice [2001] 4 IR 203 and the “more appropriate remedy” approach in McGoldrick v An Bord Pleanála [1997] 1 IR 497.

However, he refused to treat the Data Protection complaint process as an “alternative remedy” that displaced judicial review because:

  • the judicial review targeted the legality of decisions under the 2012 Act and the validity/compatibility of that legislative scheme, not a first-instance decision for which the 2018 Act provides a bespoke appeal; and
  • even if relevant, constitutional validity and ECHR incompatibility are issues not determinable through the Data Protection Commission route (cf. Koczan v Financial Services Ombudsman [2010] IEHC 407 on limits of statutory appeals for certain categories of legal challenge).

(c) Constitutional fair procedures and “the right to be heard”: Dellway v NAMA

The constitutional pivot was the timing of audi alteram partem. The Court relied on Dellway v NAMA 2011 IESC 14 to frame the “right to be heard” as arising before a decision that may materially affect rights/interests is finally made.

The respondents argued that “no effect” occurs until disclosure is contemplated; Barr J rejected that characterisation. The material effect, in his analysis, is created by the State’s indefinite retention of highly discreditable information without any mechanism to access or contest it—producing a “chilling effect” irrespective of whether it is disclosed to any third party.

(d) Article 8 ECHR and retention of personal data: Strasbourg line of authority

Barr J drew heavily on the Strasbourg jurisprudence that mere retention of personal data can constitute an interference with private life:

  • S and Marper v United Kingdom (30562/04 & 30566/04): retention of biometric data post-acquittal/discontinuance; emphasis on stigmatisation and presumption of innocence concerns.
  • Catt v United Kingdom (43514/15): “extremism database”; “mere storing” as interference; concern about meaningful review, chilling effect, and indefinite retention.
  • MM v the United Kingdom (24029/07): need for clear rules and safeguards governing collection, duration, use, destruction, and independent review.
  • Vavricka & Ors v The Czech Republic (47621/13): “necessary in a democratic society” test; pressing social need, relevant and sufficient reasons, proportionality, and margin of appreciation.

Domestically, the Court also cited GS v Commissioner of An Garda Síochána [2017] IEHC 190 (applying Rotaru v Romania (2000) 8 BHRC 449 (28341/95)) for the proposition that retention on a State register can engage the right to private life.

Using these authorities, Barr J held that the NVB scheme—indefinite retention, absence of periodic review, absence of any access/contest mechanism until the uncertain event of a future vetting request— was a disproportionate interference with Article 8 rights, not shown to be “necessary in a democratic society” on the evidence/justifications advanced.

3.2 Legal Reasoning: How the Court Reached Its Conclusions

(a) Statutory legality vs constitutional/ECHR validity

A striking feature is the Court’s two-track analysis:

  • Track 1 (statutory compliance): GSOC and the NVB acted within the architecture of the 2012 Act as previously construed in MP; the CBO’s assessment obligations are triggered at disclosure, not receipt; later non-prosecution does not automatically invalidate a previously formed bona fide concern.
  • Track 2 (higher-law scrutiny): even if the actors complied with the statute, the statute’s architecture itself was constitutionally and conventionally deficient because it deferred fair procedures and data-subject participation too far into the lifecycle of the interference.

(b) The constitutional “harm” occurs at retention, not only at disclosure

The Court treated the applicants’ predicament as present and continuing: they knew an allegation-based “risk to children/vulnerable persons” marker existed, but were structurally prevented from knowing what it was and from correcting it. Barr J considered this intrinsically damaging to:

  • good name (because the information must be “highly discreditable”);
  • privacy (State retention of personal data bearing on reputation and risk); and
  • fair procedures (no meaningful opportunity to contest accuracy at the point the State stores and preserves it indefinitely).

The Court also treated the statutory “workaround”—inviting the person to consent to a third party’s vetting request to trigger s.15 procedures—as practically and constitutionally inadequate, likening it to “Russian roulette” because the person must gamble on an unknown dossier and cannot secure finality (a “No Trace” result does not expunge the data).

(c) Lack of “strong reasons” for delaying access

The Court highlighted what was not argued: there was no case that earlier disclosure to the data subject would prejudice policing, national security, informant privilege, or the protection of children/vulnerable persons—particularly because the statutory scheme already contemplates disclosure to the subject at the disclosure stage. In that context, the Court found no pressing justification for deferring the right to see and respond to the data.

(d) Remedy restraint: declarations, not judicial “rewriting”

Although finding unconstitutionality and ECHR incompatibility, Barr J refused the applicants’ specific operational reliefs (e.g., mandatory disclosure, deletion, quashing the referral), chiefly because:

  • the Court did not know the actual contents of the specified information (so could not responsibly order removal or quash a referral); and
  • ordering disclosure or building a submissions mechanism would amount to inserting new procedures into the statute, beyond the permissible scope of injunctive relief.

The case therefore underscores a remedial gap: a successful constitutional/ECHR challenge may yield declarations yet not immediately deliver the practical access the applicants seek, leaving implementation to legislative amendment and/or subsequent tailored litigation.

3.3 Impact

(a) For the 2012 Act and vetting practice

The central precedent is that indefinite retention of “specified information” without a mechanism for the data subject to access and contest it—unless a vetting disclosure request arises—is unconstitutional and Article 8-incompatible. If upheld on appeal and operationalised by legislative reform, the NVB regime may require:

  • a defined process enabling subjects to obtain the specified information held about them (or an adequate gist),
  • a timely opportunity to make submissions on accuracy/meaning/context,
  • an independent review mechanism, and
  • retention limits and/or meaningful periodic review (especially where allegations never crystallise into findings).

(b) For “soft intelligence” databases beyond vetting

The reasoning may resonate beyond vetting where the State retains adverse, allegation-based intelligence about identifiable persons for long periods without: (i) notice of contents, (ii) correction pathways, or (iii) review. The Court’s emphasis on stigmatisation and chilling effects echoes S and Marper v United Kingdom and Catt v United Kingdom, potentially inviting wider scrutiny of Irish retention regimes.

(c) Litigation strategy and procedural timing

Practitioners should note the Court’s strict approach to judicial review time limits for challenging a s.19 referral decision (knowledge of intention to refer was enough to start time running), even though the constitutional holding concerned ongoing retention. This may push future litigants to:

  • bring protective proceedings promptly upon notice of referral, while simultaneously pursuing broader constitutional/ECHR relief; and
  • separate challenges to discrete decisions (referral, refusal to correct) from systemic challenges to the statutory architecture.

4. Complex Concepts Simplified

  • “Specified information”: allegation- or finding-based information suggesting a risk of harm to children/vulnerable persons, kept by the NVB and potentially disclosed on vetting.
  • “Scheduled organisation”: a regulator/body (including GSOC) legally required to refer specified information to the NVB once it has a bona fide concern (s.19).
  • “Bona fide concern” vs “reasonable belief”: the statutory threshold for referral is a genuine concern (low threshold); the higher threshold of reasonableness, necessity and proportionality is applied when deciding disclosure (s.15).
  • “Gatekeeper role”: the argument that the NVB should screen referrals before storing them; the Court rejected that as a matter of statutory interpretation.
  • “No Trace”: a vetting outcome indicating nothing is disclosed; it does not necessarily mean the NVB holds no underlying specified information.
  • Repugnant to the Constitution: the Court’s conclusion that the impugned statutory provisions cannot stand insofar as they operate without earlier access and submissions; it is a validity finding, not merely a critique of administration.
  • Declaration of incompatibility (ECHR): a formal declaration under the ECHR framework that the statute conflicts with the Convention; it signals the need for legislative response but does not, of itself, rewrite the statute.
  • “Chilling effect”: the deterrent or inhibiting impact on a person’s life/choices caused by knowing the State holds damaging information that may surface later.

5. Conclusion

D.OC v Garda Siochana Ombudsman Commission and Ors, K.L. v. Garda Siochana Ombudsman Commission and Ors [2026] IEHC 261 draws a decisive constitutional and Convention line: where the State retains highly discreditable, allegation-based “specified information” on a vetting register indefinitely, fair procedures and Article 8 require a mechanism for timely access and meaningful submissions before (and not only if) disclosure is contemplated.

At the same time, the decision demonstrates remedial discipline: even after finding ss.10, 15 and 19 unconstitutional and Article 8-incompatible in their operation, the Court would not order deletion or disclosure in the absence of statutory authority or clarity as to the information’s content. The practical effect is to place the immediate burden on legislative correction, while signalling that “soft intelligence” retention schemes must be paired with real, accessible safeguards for the individuals concerned.