Citation Codes
Equivalent Citations
citation codes
See more information ...
Click here to read the full judgment
O'Brien v The Data Protection Commission and Ors (Approved)
Smart Summary
Factual and Procedural Background
This is an appeal under Section 150 of the Data Protection Act 2018 from a decision of the Data Protection Commission ("Respondent") dated 4 November 2022, which dismissed a complaint by the Appellant concerning a data subject access request made to Company A. The request (13 June 2018) sought personal data and information about recipients of disclosures relating to a dossier prepared by Company A for an unidentified client. Company A supplied limited data by letter dated 13 September 2018 and withheld material relying on Section 60(3)(a)(iv) of the 2018 Act, legal professional privilege (Section 162), and Article 15(4) GDPR (rights and freedoms of others).
The Appellant had previously litigated against Company A seeking discovery of documents identifying Company A's client; the High Court (Judge MacEochaidh) and the Court of Appeal refused to order disclosure of the client's identity. The Appellant lodged a complaint with the Respondent on 2 July 2020; the Respondent upheld Company A's refusal. The appeal to the High Court (Judge Lankford) raised three principal issues identified at hearing.
Legal Issues Presented
- Whether Section 60(3)(a)(iv) of the Data Protection Act 2018 is compatible with Article 23 GDPR (challenge to its lawfulness and suggestion to refer to the CJEU).
- Whether the Respondent properly dealt with documents claimed to attract legal professional privilege and whether Section 151 procedures should have been invoked.
- Whether Company A applied a blanket refusal and whether refusal to provide a copy of personal data revealing a client's identity was justified under Article 15(4) GDPR as affecting the rights and freedoms of others (notably confidentiality).
Arguments of the Parties
Appellant's Arguments
- Section 60(3)(a)(iv) is incompatible with Article 23 GDPR: policy objective unclear, disproportionate, and failing Article 23(2) requirements (missing specification of categories, purposes and scope).
- Section 60 is vague, incoherent and effectively duplicates or extends legal professional privilege (an "extended litigation privilege"); it should apply only where access would make litigation impossible.
- The Respondent and Company A may not rely on confidentiality to refuse access; such reliance undermines Article 15 GDPR and the Appellant alleged a blanket refusal.
- If doubt exists as to compatibility, the Court should refer the question to the CJEU under Article 267 TFEU.
Respondent's Arguments
- The right of access is not absolute; Article 23 GDPR contemplates proportionate restrictions and Section 60(3)(a)(iv) gives effect to Article 23(1)(j) (enforcement of civil law claims).
- Section 60(3)(a)(iv) is capable of interpretation compatible with Article 23 GDPR; Article 23(2) requirements are qualified by relevance ("at least where relevant").
- Section 162 addresses privilege specifically; Section 60 addresses a broader range of litigation-related contexts and permits necessary operational flexibility.
- The Respondent was entitled not to invoke Section 151 given the factual context and the Appellant's express disavowal of seeking privileged material.
Company A's Arguments
- Company A asserted that protecting its client's identity was necessary to its defence in ongoing litigation and that restrictions under Section 60(3)(a)(iv) were necessary and proportionate.
- Company A claimed legal professional privilege over certain documents and maintained a duty of confidentiality regarding its client.
Table of Precedents Cited
| Precedent |
Rule or Principle Cited For |
Application by the Court |
| Orange Limited v Director of Telecommunications (No.2) [2000] 4 IR 159 |
Standard for statutory appeals: not a full rehearing; applicant must show serious and significant error in adjudicative process; deference to specialist bodies' expertise. |
The Court applied this test and afforded deference to the Respondent on mixed questions of fact and law, intervening only if serious errors were shown. |
| Nowak v Data Protection Commissioner [2016] 2 IR 585 |
Approval of the Orange test as applicable to Data Protection Act appeals. |
Reinforced deference to the Respondent's determinations in this appeal context. |
| Miller v Financial Services Ombudsman [2015] IECA 126 |
Distinguishes deference on factual/mixed issues from questions of law; court should not be deferential on pure questions of law. |
The Court noted deference applies but reserved scrutiny for pure legal issues. |
| EMI Records (Ireland) Ltd and Ors v Data Protection Commissioner [2012] IEHC 264 |
Limits of curial deference: respect for tribunal expertise does not permit breaches of jurisdiction or bypassing fair procedures. |
Cited to emphasise boundaries of deference to the Respondent's factual assessments and procedures. |
| Marleasing SA v La Commercial Internacional de Alimentacion SA Case C-106/89 |
Doctrine of indirect effect/interpretation: domestic law must be interpreted, as far as possible, in light of EU law to achieve the directive's result. |
Used to support interpretive approach to Section 60 to give effect to Article 23 GDPR where possible. |
| DPP v Quirke [2023] IESC 5 |
Application of Marleasing principle in recent Irish jurisprudence. |
Cited as recent authority endorsing interpretation of domestic law to conform with EU obligations. |
| A, B & C v Minister for Foreign Affairs and Trade [2023] IESC 10 |
Statutory interpretation: language, context and purpose guide construction of statutes. |
Applied the tripartite approach to interpret Section 60 in context and purpose of the Act. |
| Friends of the Irish Environment Clg v The Minister for Agriculture Food and the Marine, Ireland and the Attorney General [2022] IEHC 64 |
Three approaches to statutory/European legislation interpretation: literal, schematic, teleological. |
Referenced to support schematic and teleological interpretive approaches to Article 23(2) GDPR and Section 60. |
| Volker und Markus Schecke GbR and Hartmut Eifert v Land Hessen Joined Cases C-92/09 and C-93/09 |
Recognition that data protection rights are not absolute and must be balanced against their societal function. |
Supported the proposition that Article 15 rights are subject to proportionality balancing. |
| UI v Österreichische Post AG Case C-154/21 |
Article 15(1)(c) – right to information on recipients is not absolute; proportionality applies. |
Cited to confirm that Article 15 rights can be qualified and balanced against other rights. |
| R v (The Open Rights Group and Another) v The Secretary of State for the Home Department and Another [2021] EWCA Civ 800 |
Interpretation and scope of Article 23(2) GDPR; held that Article 23(2) requires specific legislative provisions and that a broad, general exemption (the Immigration Exemption) was incompatible. |
Distinguished from the present case: Court found Section 60(3)(a)(iv) contained sufficient targeted requirements (necessity and proportionality) unlike the Immigration Exemption. |
| La Quadrature du Net and Others v Premier Ministre and Ministère de la Culture Case C-470-21 |
Article 23(1) restrictions must satisfy proportionality; legislative measures must respect CJEU guidance. |
Referenced to support requirement that derogations apply only as strictly necessary. |
| Dublin Bus v Data Protection Commissioner [2012] IEHC 339 |
Separation between rights of a data requester under data protection law and litigant's rights in court proceedings. |
Cited by Appellant; Court accepted the principle but noted proceedings are relevant background to assessing necessity and proportionality under Section 60. |
| Fernandez Martinez v Spain (application no. 56030/07) |
European Court of Human Rights authority on confidentiality/privacy considerations. |
Referenced by the Respondent to show confidentiality falls within "rights and freedoms of others" for Article 15(4) balancing. |
| Facebook Ireland and Schrems Case C-311/18 |
Reaffirmation that data protection rights require proportionality and balancing with other rights. |
Quoted in support of the balancing approach to data protection rights in context. |
Court's Reasoning and Analysis
The Court applied the statutory-appeal standard (Orange/Nowak): deference to the Respondent on mixed fact-law determinations, with closer scrutiny of pure legal questions. The Court read Section 60 in light of Article 23 GDPR (Marleasing/Quirke), applying ordinary interpretive principles (language, context, purpose) and schematic/teleological approaches.
On compatibility, the Court held Section 60(3)(a)(iv) contains the express necessity and proportionality threshold, specifies the rights susceptible to restriction (Articles 12–22, 34 and corresponding Article 5 provisions), and defines the processing purposes (litigation/claims). The Court concluded Article 23(2) GDPR's requirements are qualified by relevance ("at least where relevant") and that Section 60 meets the relevant elements for the litigation-related derogation; it is sufficiently specific and capable of interpretation compatible with Article 23.
The Court distinguished the broad Immigration Exemption considered in Open Rights (which lacked proportionality and specificity) from Section 60(3)(a)(iv), which is narrower and contains the necessity/proportionality test. The Court accepted that Section 60 and Section 162 cover different and overlapping protective interests: Section 162 addresses legal professional privilege narrowly; Section 60 permits broader balancing (including confidentiality, fair trial and privacy interests) in the enforcement/defence of civil claims.
On privilege procedures, the Respondent reasonably declined to invoke Section 151 given the Appellant's assertion that privileged material was not sought and no reasonable grounds to suspect privilege was misclaimed. On Article 15(4), the Court agreed with the Respondent that confidentiality of Company A's client engages "rights and freedoms of others" and may justify withholding a copy of personal data where furnishing it would adversely affect that right; the Respondent's finding that Company A's refusal was not a blanket refusal and was justified was not shown to be erroneous.
Holding and Implications
CORE RULING: The appeal is dismissed.
Implications: The Court upheld the Respondent's decision that Company A was entitled to rely on Section 60(3)(a)(iv) and Article 15(4) GDPR to refuse disclosure of material that would reveal its client's identity, and that Section 162 privilege issues were appropriately handled. The practical effect is that the Respondent's decision stands and Company A's withholding of the contested identity-related data is justified. No new broad legal precedent altering the statutory framework was created by the judgment; the decision applied existing interpretive and proportionality principles to uphold compatibility of Section 60 with Article 23 GDPR.
Costs: The Court directed that the Appellant bear the costs of the Respondent and Company A; the Attorney General shall bear his own costs. There is a one-month stay on the costs order to permit argument on costs if any party so notifies the Registrar.
Click here to read the full judgment