Doolin v The Data Protection Commissioner (Unapproved)

Factual and Procedural Background

This appeal arises from a complaint concerning the use of CCTV data collected by Company A on its premises, specifically regarding the processing of data relating to the Respondent, an employee. In November 2015, offensive graffiti was discovered in a staff tea room at Company A's facility. The area was secured by fob access and monitored by CCTV. Following Gardaí advice, Company A reviewed CCTV footage over three days to identify persons accessing the tea room. The Respondent was seen entering the room multiple times but was not implicated in the graffiti incident.

Information from the footage suggested the Respondent took unauthorised breaks, leading to a disciplinary process and sanction. The Respondent complained to the Appellant, the Data Protection Commissioner ("DPC"), alleging breach of the Data Protection Acts 1988 and 2003. The DPC found no breach, concluding the CCTV footage was viewed once for a legitimate security purpose and not further processed.

The Respondent appealed to the Circuit Court, which dismissed the appeal. The Respondent then appealed to the High Court, which allowed the appeal, finding errors in the DPC's conclusions. The Appellant now appeals to this Court of Appeal against the High Court's judgment.

Legal Issues Presented

1. Whether the data relating to the Respondent were processed more than once contrary to the DPC's finding.
2. Whether the further processing of the Respondent's data was for the original specified purpose (security) or for an incompatible purpose (disciplinary proceedings).
3. Whether the use of the CCTV data for disciplinary purposes constituted a breach of the purpose limitation principle under the Data Protection Acts 1988 and 2003.
4. Whether an appeal to this Court from the High Court decision was permissible under the relevant statutory provisions.

Arguments of the Parties

Appellant's Arguments

• The CCTV footage was viewed on one occasion only for the legitimate purpose of security as specified in Company A's CCTV policy and was not further processed thereafter.
• Alternatively, if further processing occurred, it was for the same security purpose and thus not incompatible.
• In the further alternative, any further processing was compatible with the original security purpose.
• The disciplinary action was based on admissions made by the Respondent at an investigative meeting, not on the CCTV footage itself.
• The appeal to this Court is properly brought under the statutory framework despite initial objections.

Respondent's Arguments

• The Respondent contends that his data were processed more than once, contrary to the DPC's conclusion.
• The CCTV footage disclosed more than just the Respondent's image; it revealed times and durations of access, which were used in disciplinary proceedings.
• The disciplinary investigation was separate from the security investigation into the graffiti and was not a security matter.
• The use of the data for disciplinary purposes was not notified to the Respondent and was incompatible with the original purpose, thus unlawful.
• The DPC's shift in argument regarding the purpose of processing during the proceedings was inconsistent and unsupported by evidence.

Table of Precedents Cited

Precedent	Rule or Principle Cited For	Application by the Court
Kinahan v Baila (Unreported, Supreme Court, 18 July 1985)	Finality of appeals from Circuit Court to High Court under s. 39 Courts of Justice Act 1936.	Initially relied upon by Respondent to argue against appeal to this Court; later conceded not to apply.
Pepper Finance Corporation v Cannon [2020] IESC 2	Appeal rights and finality of Circuit Court decisions.	Referenced in discussion of appealability; no final bar to appeal to this Court found.
Bank of Ireland v Gormley [2020] IECA 102	Appeal rights and statutory interpretation of appeal provisions.	Considered in assessing availability of appeal to this Court.
Deely v Information Commissioner [2001] 3 IR 439	Standards for appeals on points of law; scope of review by appellate courts.	Applied to define the limited scope of appellate review on points of law.
Sheedy v Information Commissioner & Ors. [2005] 2 IR 272	Approval of Deely principles on appeals on points of law.	Confirmed the approach to appellate review in data protection appeals.
Orange Limited v Director of Telecoms (No. 2) [2000] 4 IR 159	Standard of review for appeals against administrative decisions; error of law and serious error standard.	Guided the Court's approach to reviewing the High Court's decision.
Nowak v The Data Protection Commissioner [2016] 2 IR 585	Appropriate standard of review in appeals against DPC decisions.	Endorsed the High Court's application of the serious error standard in this context.

Court's Reasoning and Analysis

The Court first addressed the availability of the appeal, concluding that under the relevant statutory provisions and constitutional principles, the appeal from the High Court to this Court was permissible. The Court then considered the factual and legal issues concerning data processing.

The Court agreed with the High Court that the DPC erred in concluding that the Respondent's data were processed on only one occasion. The definition of "processing" under the Data Protection Acts includes obtaining, viewing, and using data, and the Court found that the Respondent's data were processed multiple times: first when recorded by CCTV, then when viewed by management, and again when data such as entry and exit times were extracted and used in the disciplinary report.

The Court further accepted that there were two investigations: one into the graffiti (security purpose) and a separate disciplinary investigation into unauthorised breaks. The disciplinary use of the data was not for the original specified purpose of security, nor was it compatible with that purpose.

The Court considered the compatibility assessment principles from the Article 29 Working Party's opinion, emphasizing the importance of the data subject's reasonable expectations and notification of purpose. Company A's CCTV policy and notices only specified security purposes, and there was no indication that disciplinary use was notified or expected.

The Court rejected the Appellant's argument that the disciplinary use was related or compatible with the security purpose, noting that the disciplinary investigation was distinct and unrelated to any security threat. The Court found no evidence supporting the DPC's later assertion that the disciplinary action was a bona fide security issue.

Accordingly, the Court concluded that the use of the Respondent's data for disciplinary purposes was a further processing for an incompatible purpose, constituting an unlawful breach of the Data Protection Acts.

Holding and Implications

The Court DISMISSED the Appellant's appeal.

The effect of this decision is that the High Court's judgment allowing the Respondent's appeal against the DPC's decision is upheld. The Court confirms that the processing of the Respondent's data for disciplinary purposes was unlawful due to incompatibility with the originally specified purpose of security. The Respondent is entitled to costs of this appeal, with liberty granted to the Appellant to apply for a different costs order within 14 days.

No new legal precedent was set beyond affirming the application of established data protection principles relating to purpose limitation and compatibility of processing under the relevant Acts and Directive.