Fox v Data Protection Commissioner (Unapproved) [2024] IECA 92 (25 April 2024)

THE COURT OF APPEAL

Record Number: 2023/280

High Court Record Number: 2022/80CA

Circuit Court Record Number: 2019/8215

Neutral Citation Number [2024] IECA 92

IN THE MATTER OF THE DATA PROTECTION ACTS 1998 - 2003

AND IN THE MATTER OF AN APPEAL UNDER SECTION 26

OF THE DATA PROTECTION ACTS 1988 - 2003

Noonan J.

Binchy J.

Butler J.

BETWEEN/

DAVID FOX

APPELLANT

-AND-

THE DATA PROTECTION COMMISSIONER

RESPONDENT

JUDGMENT of Mr. Justice Noonan delivered on the 25th day of April, 2024

1. This appeal arises from a data access request made by the appellant over 14 years ago. It is the third appeal by the appellant, who has at all times been self-represented, from a decision of the respondent made in 2019. The multiplicity of appeals provided for under the Data Protection Acts has previously been the subject of comment by this Court - see Doolin v The Data Protection Commissioner [2022] IECA 117 at para. 1 - 2. In our courts system, the vast majority of first instance decisions may be appealed only once. There is no obvious justification for so many appeals in this instance. As this case amply demonstrates, the effect is great delay, enormous cost and a significant drain on court resources. This is not in the interests of the parties or the public. Reform is long overdue.

Background

2. The appellant was employed by the National Gallery of Ireland ("the NGI") as an attendant for over 20 years. His employment was terminated by letter of the 28^th November, 2011.

3. On the 10^th December, 2010, the appellant submitted a data access request to the NGI. The appellant was not satisfied with the response received and made a complaint to the respondent. For reasons set out in the judgment of the High Court (Heslin J. [2023] IEHC 529), the complaint was ultimately reformulated on the 27^th October, 2016 and after a lengthy investigation, the respondent issued a detailed written decision on the 14^th November, 2019. Prior to that, on the 2nd August, 2019, the respondent provided a draft of her decision to the appellant and afforded him the opportunity of making submissions on the draft, which he took.

4. The appellant originally complained of seven separate matters, recorded in the respondent's decision and quoted in para. 8 of the judgment of the High Court:

"Your Complaint

You submitted an updated complaint to this office dated 27 October 2016 against NGI alleging the following:

(1) That NGI processed your personal data, while monitoring your use of your work mobile telephone.

(2) That NGI had held covert files in relation to you.

(3) That NGI had installed covert CCTV to monitor employees.

(4) That NGI failed to provide you with access to your all (sic) personal information in response to an access request you had submitted to it.

(5) That NGI processed your personal data, while monitoring the content of your work email.

(6) That NGI failed to ensure the return of your personal data following the conclusion of a contract with a data processor.

(7) That NGI obtained your biometric data without being transparent about the purpose for which it was obtained."

5. The respondent upheld complaints (1), (2), (6) and (7), but rejected (3), (4), and (5). It is the latter three which are the subject of the appellant's appeals herein. A helpful summary of the respondent's determination regarding these complaints is set out in the High Court judgment:

"Complaint 3

10. With respect to complaint 3, the Commissioner decided that, in circumstances where the NGI was faced with the theft of property from a secure storeroom and this theft raised further security concerns, the NGI had a legitimate interest in processing the Appellant's personal data by installing a covert security camera for the purposes of detecting an offence. The Commissioner further found that, under s. 2 A (1) (d) of the Acts, the NGI had a legal basis for processing the Appellant's personal data by installing a covert CCTV camera. In addition, the Commissioner concluded that there had been no breach of s. 2 D (1) of the Acts, as it would not have been practicable for NGI to provide the Appellant with information relating to the processing of his personal information recorded on a covert CCTV camera.

Complaint 4

11. With respect to complaint 4, the Commissioner found that the NGI did not contravene s. 4 of the Acts, as it provided the Appellant with access to his personal data to the extent possible within the statutory time frame, in that the NGI provided access to a certain amount of the Appellant's personal data and sought clarification from him regarding what he considered to be outstanding, which clarification the Appellant failed to provide.

Complaint 5

12. With respect to complaint 5, the Commissioner found that the NGI had a legal basis, under s. 2 A (1) (d) of the Acts, for processing the Appellant's personal data contained in the email messages in question. The Commissioner also concluded that the processing of the Appellant's personal data was compliant with the fair processing requirements set out under s. 2 D (1) of the Acts."

6. The investigation which resulted in the decision under challenge was undertaken by the respondent pursuant to s. 10(1)(a) of the Data Protection Acts 1988 - 2003 ("the Acts") which provides in relevant part:

"The Commissioner may investigate, or cause to be investigated, whether any of the provisions of this Act have been, are being or are likely to be contravened ... in relation to an individual either where the individual complains to him of a contravention of any of those provisions or he is otherwise of opinion that there may be such a contravention ...".

The Circuit Court

7. Section 26(1) of the Acts provides for an appeal to the Circuit Court in the following terms:

""(1) An appeal may be made to and heard and determined by the Court against—

...

(d) a decision of the Commissioner in relation to a complaint under section 10(1)(a) of this Act".

8. The threshold test applicable to appeals to the Circuit Court was analysed in the judgments of the Circuit Court and High Court, both of which held that the test derived from the judgment of Keane C.J. in Orange v Director of Telecommunications Regulations [2000] 4 IR 159 at pp. 184 - 185. In brief summary, the burden is on the appellant to establish on the balance of probabilities that, taking the adjudicative process as a whole and paying the appropriate deference to the expertise of the decision maker, the decision in question was "vitiated by serious and significant error or a series of such errors". Such an appeal is not therefore a rehearing on the merits.

9. The appellant's originating notice of motion, dated the 9^th December, 2019, by which the matter was brought before the Circuit Court was couched in the following terms:

".... TAKE NOTICE that the grounds of this appeal are that, in making the Decision, the Data Protection Commissioner erred in fact and/or in law:

(1) In determining that my employer was not in violation of Section 2, and in particular, Section 2 (1) (c) (ii), Section 2 (1) (c) (iii), Section 2 (d) of the Data Protection Acts applicable by reason of the said employer's collection of my data using a covert camera disguised as a PIR without having a CCTV policy in place, for reasons that were excessive for the purpose for which it was collected.

(2) In determining that the my (sic) employer was not in violation of Section 2, including Sections 2 (1) (a), (b), (c) (i) (ii) (iii) (iv), (d) and Sections 3, 4 & 5 of the Data Protection Acts applicable by reason of the said employer's covert and unfair collection, processing, keeping, use and covert retention of my data, denying my right to establish the existence of personal data and denying me a right of access and his processing of this data for reasons that were excessive for the purpose for which it was collected.

(3) In determining that my employer was not in violation of Section 2 of the Data Protection Acts; Article 8 of the European Convention of Human Rights; Article 7 & 8 of the European Charter of Fundamental Rights, and Article 40.3 of the Irish Constitution applicable by reason of the said employer's covert and unfair accessing and reading of the content of my private correspondence without prior warning of the nature and extent of the intrusion into my privacy".

10. In substance, what the appellant appears to allege in this notice of motion is that the respondent ought to have found in his favour, and was in error in not doing so. As such, it is difficult to see how this motion does not in effect amount to an appeal on the merits which does not identify a serious and significant error or a series of such errors in the decision of the respondent.

11. Be that as it may, it seems clear from the transcript of the hearing before the Circuit Court that the judge, in debate with the appellant, tried to identify the errors which were said to arise. Having set out the factual background and the applicable legal principles in his written judgment, the Circuit Court judge concluded that the appellant had failed to prove on the balance of probabilities that, taking the adjudicative process as a whole and paying the appropriate deference to the expertise of the decision maker, the decision in question was vitiated by serious and significant error or a series of such errors.

12. It is of some relevance to note that an application for discovery had been made by the appellant to the Circuit Court in respect of four categories of discovery. Category 2 comprised a copy of the NGI's IT policy "Code of conduct for users of computer resources" signed by the appellant. The Circuit Court refused the other three categories of discovery but allowed Category 2, noting in the order that it had already in any event been furnished to the appellant. The order was not appealed.

The High Court

13. The High Court judge noted that the appeal was brought pursuant to s. 36(3) of the Acts which provides:

"(3) (a) Subject to paragraph (b) of this subsection, a decision of the [Circuit]

Court under this section shall be final.

(b) An appeal may be brought to the High Court on a point of law against such a decision; and references in this Act to the determination of an appeal shall be construed as including references to the determination of any such appeal to the High Court and of any appeal from the decision of that Court."

14. As the section makes clear, an appeal to the High Court is limited to a point of law and is thus significantly more confined than the prior appeal to the Circuit Court. The distinction between the two forms of appeal is discussed in some detail in the judgment of the High Court. Whereas the appeal to the Circuit Court is governed by the Orange test, the appeal to the High Court on a point of law is considered in the judgment of this Court in Nowak v Data Protection Commissioner [2022] IECA 95. This Court cited with approval the earlier judgment in Fitzgibbon v The Law Society of Ireland [2015] 1 IR 516 where Clarke J. observed that in appeals on a point of law, a higher degree of deference, so far as the facts are concerned, is paid by the appellate body to the decision of the first instance body in an appeal of on a point of law only, as opposed to an appeal against error.

15. The Court of Appeal also referred to the judgment of the Supreme Court in Attorney General v Davis [2018] 2 IR 357 where McKechnie J. held that a court may intervene to overturn a decision on a point of law in the following circumstances:

"(a) In cases of errors of law as generally understood, to include those mentioned in Fitzgibbon;

(b) In cases involving errors such as would give rise to judicial review, including, illegality, irrationality, defective or absence of reasoning and procedural errors of some significance;

(c) Errors which may arise in the exercise of discretion which are plainly wrong, notwithstanding the latitude inherent in such exercise; and

(d) Certain errors of fact."

16. McKechnie J. went on to identify three categories of error of fact which may lead to intervention by an appellate court, being:

"(1) Findings of primary fact where there is no evidence to support them;

(2) Findings of primary fact which no reasonable decision-making body could make; and

(3) Inferences or conclusions:-

- Which are unsustainable by reason of any one or more of the matters listed above;

- Which could not follow or be deducible from the primary findings as made; or

- Which are based on an incorrect interpretation of documents."

17. The matter came before the High Court on foot of an originating notice of motion of the 5^th May, 2022 and it is I think relevant to set this out in full as it bears close comparison with the motion issued in the Circuit Court.

18. The motion before the High Court is stated to be by way of appeal from the decision of the Circuit Court and goes on to say:

"AND FURTHER TAKE NOTICE that the grounds of the appeals are that, in making the decision, the Circuit Court erred in fact and/or in law.

1. In upholding that the Data Protection Commissioner's decision that my employer was not in violation of s. 2 of the Data Protection Acts 1988 and 2003 and other applicable laws concerning the matter, by reason of the said employer's covert and unconsented secondary processing, unfair collection and retention of my Data of my data (sic) using a covert camera disguised as a motion sensor, for reasons that were excessive and unjustified.

2. In upholding that the Data Protection Commissioner's decision that my employer was not in violation of s. 2 and 4 of the Data Protection Acts 1988 and 2003 by reason of the said employer's collection of my data by unconsented secondary processing, unfair collection and retention of my Data, and denying me my right to establish the existence of personal data and my right to access said personal data.

3. In upholding that the Data Protection Commissioner's decision that my employer was not in violation of s. 2 of the Data Protection Acts 1988 and 2003, Article 8 of the European Convention on Human Rights, Articles 7 and 8 of the European Charter of Fundamental Rights, applicable by reason of the said employer's unconsented and unfair collection of my data and accessing and reading the contents of my private correspondences without prior warn od (sic) the nature and extent of the intrusion into my privacy".

19. It is immediately apparent that, while the language is slightly different, the substance of the complaint set out in this motion is to all intents and purposes identical to the motion brought before the Circuit Court. As the High Court ultimately determined, it does not engage in any way with the judgment of the Circuit Court beyond asserting that that Court was wrong not to overturn the respondent's decision. As the High Court judge ultimately held, and I agree, it does not purport to identify any discrete point of law in respect of which the appeal is brought.

20. It is clear from the judgment of the High Court that from the outset, the judge was concerned at the appellant's failure to identify a point of law and engaged in considerable debate with him to endeavour to identify such a point. At para. 46 of the judgment, the Court sets out a large number of complaints made by the appellant in response to the request to demonstrate a point of law. Indeed, most of these seem focused on a claim by the appellant that the respondent accepted statements made by the NGI "without proof". In its submissions to the respondent, the NGI said that a theft of a quantity of wine had occurred from a secure store on the NGI premises and this had led to the installation of a covert camera for the purpose of detecting possible further criminal activity. The appellant however insisted that there was no proof that the wine had ever in fact been in the store in the first place and accordingly, there was no justification for the installation of a covert camera.

21. Following this process, the judge said:

"47. Arising out of the foregoing, further efforts on the part of the Court were made in order to clarify with the Appellant the point(s) of law which he says arise(s) from the originating motion. The outcome was for the Appellant to confirm that the following represents an accurate summary of what he regards as the points of law in issue:-

· Upholding a primary fact that was not a primary fact;

· The Circuit Court gave too much deference to the decision maker;

· In the Circuit Court, the Appellant relied on the Deeley decision as being the appropriate test, whereas Deeley 'wasn't brought in at all' and the case was wrongly decided on the basis of the Orange test;

· There was a failure to comply with procedures required by the Criminal Justice (Surveillance) Act 2009 and a failure on the part of the Commissioner and the Circuit Court to look at this;

· The NGI failed to give prior notice in relation to monitoring emails."

22. These appeared to the judge to be an invitation to embark on a merits-based reassessment of the decisions of both the respondent and the Circuit Court.

23. In the course of making submissions to the High Court, the appellant was asked to explain how he claimed that both the respondent and the Circuit Court had misinterpreted various provisions of the Acts, in particular s. 4. However, it became clear that although the appellant characterised it as misinterpretation, in fact what he was complaining of was that it had been decided by the respondent that, based on the respondent's findings of fact, no breach of the Acts had been established. An example of this is to be found at paras. 163 - 164 of the respondent's decision concerning Complaint 5, monitoring the appellant's work email:

"163. NGI provided you with prior notice of this type of monitoring in its 'Code of conduct for Users of Computing Resources'. I also note that the monitoring of your email communications was narrow in scope, as NGI only reviewed five emails that had been flagged as security sensitive, and therefore had a legitimate interest to do so as these may have raised security concerns. I consider that in this instance NGI used the least privacy intrusive method available to it as it utilised software that only flags emails that contain weighted security sensitive words, which do not cause a substantial adverse impact to your right to privacy as an individual.

164. On the final part of the test, this office considers that NGI has demonstrated that the potential risk to the security of NGI, and the assets housed there, was of such a serious nature that it validated this manner of the processing of your personal data, especially in circumstances where you were aware that using NGI computer resources to transmit or receive sensitive or confidential information was not permitted as per the NGI Code of Conduct for Users of Computing Resources. Therefore, I consider that NGI's pursuit of its legitimate interest took precedence over your rights and freedoms as a data subject".

24. These two paragraphs contain multiple findings of fact which include:

(1) The appellant had prior notice of the type of monitoring which was carried out;

(2) The monitoring was narrow in scope, being confined to five emails flagged as security sensitive;

(3) NGI had a legitimate interest to monitor these emails;

(4) NGI used the least privacy intrusive method available to carry out this monitoring;

(5) Such monitoring did not cause a substantial adverse impact to the appellant's right to privacy;

(6) The potential security risk was of such a serious nature as to validate the manner of data processing concerned;

(7) The appellant was aware that using NGI computer resources to transmit or receive sensitive or confidential information was not permitted.

25. While it seems clear that the appellant does not agree with these findings, he does not suggest that the respondent was not entitled to make them by virtue of an absence of relevant evidence. Further, these are findings which are within the area of expertise of the respondent and as such, they must be accorded significant deference by a court examining them.

26. In reaching his decision, the primary finding of the High Court judge was that the appellant had failed to identify any point of law in his notice of motion. The consequence of this was that the judge considered that he only had jurisdiction to consider a point of law raised and since none was raised, the appeal fell to be dismissed in limine. In reaching that conclusion, the judge placed significant reliance on the judgment of the High Court in Board of Management of Scoil an Chroí Naofa Íosa & Ors. v Donnelly [2021] 32 ELR 78, in which the Court said:

"58. In this type of statutory appeal, there is no requirement for a statement of grounds. Rather the point of law must simply be introduced in a notice of motion. The Minister was admirably succinct in her identification of same. Nonetheless, given that the jurisdiction of the court exists exclusively in relation to a point of law identified by an appellant under s. 34(2), I only have jurisdiction in relation to the point of law identified in the notice of motion. The four walls of the court's jurisdiction are delineated by the point of law identified. I do not have jurisdiction to extend the statutory appeal to points not encompassed by the point of law identified. No matter how widely I interpret the point of law in this case, I cannot define it to include a failure to give reasons. Averments that include a complaint about a factual situation cannot be the basis for an implicit amendment of the points of law the subject of the appeal."

27. The judge had due regard to the fact that the appellant is a litigant in person in reaching this determination, and in doing so referred to the dicta of Clarke J. in Dowling & Ors v The Minister for Finance & Ors. [2012] IESC 32:

"...while acknowledging that the lay applicants are not legally represented and that the courts generally will, in those circumstances, endeavour to ensure that unrepresented parties are not unfairly prejudiced, it nonetheless remains the case that parties cannot expect to benefit by being unrepresented to the extent of being permitted to conduct their proceedings in a way that would not be allowed to a represented party." (at para. 4.7)

28. With regard to the five issues that the appellant raised in argument which are identified at para. 47 of the High Court judgment, the judge was of the view that he could not interpret the notice of motion as giving rise to these points. Despite that finding, however, the judge went on to consider the merits of the arguments that had been raised in submissions by the appellant. With regard to the appellant's claim that the Circuit Court judge erroneously applied the Orange test when it should have been that described in Deely v Information Commissioner [2001] 3 IR 439, this was, in the view of the judge, simply a misunderstanding of the law on the part of the appellant. But in any event, as the Deely test sets the bar higher than that in Orange, as the judge described it, there was no prejudice in applying the Orange test even were it wrong, which it was not.

29. A significant complaint made by the appellant throughout the course of this litigation and again before this Court was that the respondent upheld a primary fact which the appellant claimed was not a primary fact. The appellant's contention in this regard was based on his claim that there was no "evidence" to support this finding. As already noted, this meant, according to the appellant, that there was no justification for the installation of the covert camera. The judge pointed to the appellant's own affidavit in which he agreed that wine had been stolen from the premises but his contention in this respect evolved into a claim that while he accepted wine was stolen, there was no evidence to show it was stolen from the secure lock-up. The judge dealt with this submission at para. 105:

"105. In addition, the Commissioner also had before her evidence of theft of wine from a storeroom, which evidence she referred to at para. 77 of the decision in the following terms:-

'NGI informed this office that NGI was faced with a theft of a number of cases of wine, from a secure storeroom, between September 2009 and December 2009. NGI installed covert cameras in the storeroom strictly for the investigation of that offence and to prevent a similar offence occurring. NGI advised this office that any possible breach of security in NGI is considered very serious, in view of the need to protect the State's National Art Collection which is housed therein. NGI states that this processing was legitimised under section 2A(1)(d) and section 8(b) of the Acts.'

106. For the avoidance of doubt, in the present appeal, the Appellant has not put a scintilla of evidence before this Court to suggest that the NGI did not inform the Commissioner of the theft in question."

30. The judge also made the point that this submission had not previously been made by the appellant when he was given the opportunity to make submissions on the draft decision. The judge held further that the appellant had not raised this point either with the respondent or the Circuit Court, nor was it articulated in the originating motion.

31. The judge then turned to an argument advanced by the appellant based on Art. 7(f) of the Data Protection Directive, transposed into Irish law by s. 2A of the Acts. Article 7(f) provides in relevant part:

"Member States shall provide that personal data may be processed only if:

...

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection under Article 1(1)."

32. The fundamental submission of the appellant appeared to be that in the absence of his consent, his rights must always be taken to override those of any data controller. The High Court held that a plain reading of the section could not support such a contention, a conclusion with which I agree. S. 2A/Article 7(f) provides that personal data may be processed if such processing is necessary for the purposes of the legitimate interests of the data controller but this may in turn be overridden by the interests, or fundamental freedoms, of the data subject. It does not mean that the rights of a data subject, if asserted, will always override the interests of the data controller but requires the respective rights and interests to be balanced in each individual case. The appellant does not complain that a balancing exercise did not take place, but rather objects to the outcome of that exercise.

33. In reaching a conclusion that the respondent had fairly balanced the competing interests of NGI with those of the appellant, the respondent in her decision referred to the opinion of Advocate General Bobek in Case C - 13/16 Rigas Satiksme:

"(b) Balancing of interests

66. The second condition relates to balancing between two sets of competing interests, namely the interests and rights of the data subject (18) and the interests of the controller or of third parties. The balancing requirement clearly results both from Article 7(f) and from the legislative history of the Directive. As to the text of the latter, Article 7(f) requires that the legitimate interests of the data subject him or herself be balanced against the legitimate interests of the controller or of a third party. The legislative history confirms that the balancing of interests was already provided for, in slightly different ways, in the Commission's initial proposal (19) and also in its amended proposal after the first reading of the European Parliament."

This passage was taken account of by the respondent in reaching her conclusions concerning the balancing of rights as between the appellant and NGI.

34. The judge also referred to paras. 105 to 107 of the respondent's decision where she had regard to the decision of the European Court of Human Rights in Kopke v Germany [2010] ECHR 1725 which, while not binding on the respondent, provided a useful analysis of a similar factual scenario. The case concerned covert video surveillance of a supermarket employee following detection of irregularities regarding the accounts of one department of the supermarket. Covert cameras were placed in that area where the complainant worked for a two week period. The national court held that there had not been any other equally effective means of protecting the employer's property rights which would have interfered to a lesser extent with the complainant's right to privacy and the ECtHR agreed. It held that there was nothing to indicate that a fair balance had not been achieved between the respective parties' rights.

35. The judge held that the appellant's view as to meaning and effect of Art. 7(f) was entirely mistaken and the respondent had appropriately carried out the balancing exercise identified by the foregoing authorities.

36. The judge then considered the appellant's submissions concerning the Criminal Surveillance Act, 2009. The appellant asserted that under this Act, before An Garda Síochána can initiate covert surveillance, judicial approval must be sought and in this case, it was not. The judge found this Act to be of no relevance and the appellant's contention that the NGI had greater powers than the Gardaí to be entirely misplaced.

37. As regards Complaint 4, the appellant's original access request was set out at para. 113 of the respondent's decision:

"I hereby request, under the Freedom of Information and Data Protection Acts, that all files with (sic) the Gallery holds relating to me and my personal data, whether hardcopy or electronic and including minutes taken at meetings, be made available to me for my inspection".

38. Given that the appellant was employed by NGI for over 20 years, this was clearly a very wide-ranging request. As the respondent's decision shows, NGI did provide documents to the appellant pursuant to his request, but the appellant claimed that NGI failed to provide certain documents in specific categories. It was common case that in response to the appellant's request, NGI had sought further clarification from the appellant as to the nature of the documents he was seeking, and he declined to provide it. In this respect, the respondent in her decision made reference to s. 4(3) of the Acts which provides:

"an individual making an access request shall supply the Data Controller concerned with such information as he may reasonably require in order to locate any relevant personal information".

39. The respondent found that the appellant failed to comply with his obligation under this subsection by refusing to respond to the request for clarification and accordingly, that NGI had responded to the appellant's access request to the extent possible. The High Court judge referred to this as a finding of fact made by the respondent, which was not subsequently challenged by the appellant. The judge was thus satisfied that the appellant's submissions on this issue were not stateable, as well as not having been argued before the respondent or the Circuit Court or identified in the originating motion.

40. In the context of Complaint 5, the appellant placed reliance on the decision of the ECtHR in Barbulescu v Romania [2017] ECHR 742. The appellant complained that both the respondent and the Circuit Court failed to consider and apply this decision. Although the respondent is not bound by judgments of the ECtHR, it is clear from the decision that this was in fact considered in the passages of the decision referred to by the judge:

"161. In assessing whether NGI struck a fair balance between your right to privacy and NGI's right to safeguard its legitimate interest, I have had regard to the judgment of the Grand Chamber of the European Court of Human Rights in the case of Barbulescu v. Romania [2017]. This case relates to the monitoring of an employee's instant messages by his employers. Mr. Barbulescu was a Romanian engineer who was asked by his employer to set up an instant messaging account for work purposes. Mr. Barbulescu also used the instant messaging service to contact his fiancée and brother. Mr. Barbulescu's employer monitored his messaging actively and, ultimately, dismissed him on the grounds of using company resources for personal purposes. Mr. Barbulescu felt that this was in breach of his privacy rights and exhausted his claim in the Romanian courts and European Court of Human Rights when the case eventually came before the Grand Chamber.

162. The Grand Chamber found that when balancing the rights to privacy of the employee and the legitimate interests of the employer to monitor communications in the workplace the following factors need to be taken into consideration:-

(i) was there prior notice of the monitoring?

(ii) the scope of the monitoring and its necessity i.e., monitoring the amount of personal communication as opposed to the content of personal correspondence;

(iii) did the employer have a legitimate interest in monitoring the communications?

(iv) were there less privacy intrusive methods available to the (sic) same result?

(v) consideration of the consequences and impact of the monitoring".

41. The succeeding paragraphs 163 and 164 have already been referred to above and the judge held that the respondent plainly considered Barbulescu and conducted a careful assessment and balancing of the respective rights of the parties. The judge was satisfied that the appellant had demonstrated no error in this assessment and his contention, plainly misconceived, was that it was unlawful for the NGI to have looked at the contents of any emails sent by/to him without seeking and obtaining his explicit permission.

42. The High Court further noted in this regard the contents of the IT Code of Conduct signed by the appellant on the 11^th June, 2003, paragraph 1 of which states:

"1. While everyday network traffic or information stored on NGI equipment is not normally monitored, it may be necessary to monitor if there is reason to suspect that this Code of Conduct is being breached, or for purposes of systems administration, backup or problem-solving. You must therefore be aware that such monitoring may occur".

43. In response, the appellant complained that while he may have signed the document, he was not provided with a copy of it. But here again, the judge observed that this was not an issue ever raised by the appellant in his submission on the draft decision, nor was it raised in the appellant's motion to the Circuit Court or the High Court. Finally, the judge noted the appellant's complaint about the Circuit Court showing excessive deference to the respondent and displaying apparent bias, but the judge held that these were no more than bare assertions not underpinned by any evidence. Manifestly, the rejection of the appellant's arguments cannot of itself be construed as evidence of bias on the part of the Circuit Court judge. The High Court judge took the opportunity to read the DAR transcript of the entire Circuit Court hearing and was satisfied that it disclosed nothing which could be characterised as bias on the part of the judge.

The Appeal

44. In his notice of appeal, the appellant refers to Appeal 1, 2 and 3 which correspond to complaints 3, 4 and 5, i.e., covert camera, access request and email monitoring. Under Appeal 4, he alleges that the respondent and the High Court failed to have regard to his rights pursuant to Article 7 (f) of the Directive.

45. Appeal 1 repeats the earlier complaint that the court allowed unproven statements to stand as primary fact and "the word of NGI employees was taken as fact without proof". There is a further a complaint that the High Court failed to "examine the installation of a covert camera" and failed to properly apply the legal principles to such installation. On the access request, there is a complaint that the High Court failed to recognise that the transfer of the appellant's data within NGI was a breach of his rights.

46. How the latter relates to a complaint about a failure to provide access to his data on request is unclear and, despite the fact that data were furnished to him by NGI, he characterises this as a refusal of his data access request. Under Appeal 3, the appellant complains that the High Court "failed to examine" the installation of a covert email gateway and misapplied the legal test for monitoring and surveillance of correspondence in the workplace as laid down in Barbulescu.

47. What is particularly striking about the appellant's notice of appeal is that it makes no reference to the first, and fundamental, determination of the High Court that it had no jurisdiction to entertain the appellant's appeal because his notice of motion identified no point of law. The respondent accordingly makes the point that this is the essential finding of the High Court that led to the dismissal of the appeal to that Court, and as it is not the subject of appeal to this Court, this appeal must also fail. The respondent submits that the balance of the arguments advanced by the appellant are therefore moot and should not be considered further by this Court. The point is further made that despite this issue being clearly flagged in the respondent's notice delivered in answer to the notice of appeal (which it was), the appellant's written submissions make no reference whatever to this issue.

48. Conscious of the difficulty that this posed for the appellant, particularly as a litigant in person, this Court was at some pains from the outset of the appeal hearing to point out to the appellant that he had not addressed the respondent's objection in any way and the Court was anxious to know what his response was. Unfortunately, during his oral submissions, the appellant declined to engage with this issue in any way, notwithstanding repeated invitations by this Court to do so.

49. Indeed, it was only in the course of his reply to the respondent's oral submissions that the appellant made any attempt to deal with this issue. In substance, his response was that he did not understand at any stage during the proceedings that he could have applied to amend his notice of motion to plead one or more points of law and nobody had advised him of this fact. He also appeared confused as regards the concept of an originating notice of motion in the High Court and seemed to think that this was the document which had initiated his appeal in the Circuit Court. While this might be regarded as some form of explanation, it obviously does not address, less still answer, the respondent's submission, which appears to be well-founded.

50. The High Court found, correctly in my view, that the appellant identified no point of law in his originating notice of motion before the High Court. The High Court judge took the, perhaps narrow, view that this deprived him of the jurisdiction to hear the appeal, such jurisdiction being statutory in origin. Indeed, in the absence of any countervailing argument, it seems to me that the judge was obliged to follow the earlier determination of the High Court in Donnelly.

51. It is undoubtedly correct to say that the appeal on a point of law provided for by the Acts must necessarily be circumscribed by what is pleaded in the originating notice of motion. Like any pleading, however, such notice of motion must be susceptible to amendment in an appropriate case. Such an amendment would in the normal way be made by the party bringing the motion. That is not to say that the court does not retain jurisdiction, where appropriate, to amend such pleading of its own motion in order to determine the real issues in controversy between the parties. It is perhaps somewhat analogous to the position that obtains where an application is made to strike out proceedings for failing to disclose any cause of action. It is well settled that the court will be slow to do so where an amendment to the pleadings could save the claim, although it is usually for the plaintiff to seek such amendment.

52. I do not for a moment suggest that it is the function of the court to proactively assist unrepresented parties to make their case to best advantage. That would be tantamount to the judge stepping into the arena which, in our adversarial system, is generally impermissible. As is often said, unrepresented parties are subject to the same rules as those who are represented and the court must of necessity be careful when assisting litigants in person by explaining matters to them not to overstep the mark in a way that could result in prejudice to the opposing party. The judgment of the High Court in this case provides a good example of the judge seeking to help the appellant by teasing out in considerable detail the case he was actually seeking to make.

53. Nonetheless, it remains true to say that if amendment of a notice of motion bringing an appeal on a point of law is possible, and it is again at least possible that the court could make an amendment of its own motion, it would seem to follow that the court's jurisdiction cannot be exclusively confined to what an appellant identifies as the point of law in their notice of motion. If amendment remains at least a possibility, it becomes I think difficult to say that the jurisdiction of the High Court is limited.

54. However, in the normal way, parties should be confined to their pleaded case and whether this is viewed as a question of jurisdiction or simply convention probably does not matter a great deal in this instance. Counsel for the respondent helpfully drew the Court's attention to the judgment of the Supreme Court in Cadden v Vesey (Unreported, Supreme Court, 16^th December 2016) where McKechnie J., speaking for the Court observed:

"34. It has long been the jurisprudence of this Court that its appellate jurisdiction is by and large determined by the ambit of the Notice of Appeal. Whilst it has power to look at matters not fully within such a Notice, it will do so only on compelling reasons being established. Therefore, whilst some latitude should perhaps be given to a lay person in a self representation situation, nonetheless such must be consistent with the rights of the other parties to the application. In this case nothing has been advocated to suggest that the ambit of the appeal should not follow the normal procedure."

55. However, whichever way one views the question of jurisdiction in an appeal on a point of law, it seems to me that the respondent's point is well taken and whether the High Court dismissed the appeal simply on jurisdiction grounds, as distinct from pleading grounds, the end result is the same and the appeal must fail. It should be pointed out however that this is not in fact a case which could have been saved by simple amendment, as hereafter appears, and it would be difficult, if not impossible, to reframe any of the grounds pleaded by the appellant, or even those raised in submissions, as points of law. This is because of the difficulty that the appellant's complaints are in substance concerned with the respondent's treatment of the evidence and the conclusions reached, i.e. an appeal on the merits.

56. The respondent urges us to stop there on the basis that any further consideration of the matter becomes moot and again, there is force in that argument. However, the authorities show that even in such circumstances, the court retains the discretion to consider the substantive arguments where there are good grounds for doing so. Having regard to the fact that this is the (possible) culmination of this litigation after such a protracted period and, having regard to the fact that the appellant represents himself, I think it would be perhaps regrettable if the appellant were to be left with the impression that he had lost this appeal on a technicality, when there might have been real merit in his case. Accordingly, as the High Court did, I propose to briefly consider the points raised by the appellant in this appeal.

Complaint (3) (covert camera)

57. As already noted, the essential complaint made by the appellant is that there was no justification for installing a covert camera in the secure lock-up because there was no "proof" that a theft of wine had occurred from the lock-up. This in turn is based on the assertion by the appellant at his first ground of appeal that "the word of NGI employees was taken as fact without proof."

58. It emerged during the course of the appeal hearing that this assertion is based on a fundamental misunderstanding by the appellant of what proof in law is. The appellant appears to think that a written or oral statement of a fact does not prove that fact as a "primary fact". He appears to believe that some form of independent verification of that statement is required before it can be accepted as evidence. Of course, in this he is mistaken. As the High Court judge held at para. 105 of his judgment (quoted at para. 29 above), the respondent had such evidence available to her. What's more, the judge held that the appellant's own evidence was consistent with this and, significantly, he never raised this issue with the respondent when making submissions on the draft report.

59. It is therefore clear that the appellant's appeal on this issue has at all times from the outset been based on a basic misunderstanding of the law.

60. It is relevant in this context to set out what s. 2A, in relevant part, provides:

"2A (1) Personal data shall not be processed by a data controller unless section 2 of his Act (as amended by the Act of 2003) is complied with by the data controller and at least one of the following conditions is met: -

(a) the data subject has given his or her consent to the processing ...

(d) the processing is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the fundamental rights and freedoms or legitimate interests of the data subjects".

61. It is thus clear that the Acts expressly provide for the processing of data without the subject's consent in certain limited circumstances. Where those arise, the appropriate balance must be struck by the data controller between its interests (or those of the third arty to whom the data is legitimately disclosed) and those of the data subject in the manner already described. The respondent found, and was entitled to find, that this balance was achieved in the circumstances pertaining here, a finding which was upheld by the Circuit Court and the High Court. The appellant appears to think that such processing could never occur without his consent when that is manifestly not the case, as the section itself makes clear.

62. The appellant complains further in this regard that NGI had erroneously relied on the provisions of s. 8 of the Acts to justify the installation of the covert camera and this was wrongly upheld by the respondent. Section 8 provides:

"Any restrictions in this Act on the processing of personal data do not apply if the processing is -

(a) in the opinion of a member of the Garda Síochána not below the rank of Chief Superintendent or an office of the permanent Defence Forces who holds an army rank not below that of Colonel and is designated by the Minister for Defence under this paragraph, required for the purpose of safeguarding the security of the State,

(b) required for the purpose of preventing, detecting or investigating offences, apprehending or prosecuting offenders or assessing or collecting any tax, duty or other monies owed or payable to the State, a local authority or a health board, in any case in which the application of those restrictions would be likely to prejudice any of the matters aforesaid."

63. It is clear from a reading of this section that it has no application to the facts of the case and in so far as the NGI place reliance on it as well as s. 4, that was mistaken. However, the respondent did not in fact determine that NGI was entitled to rely on s. 8 but that it was entitled to rely on ss. 2A and 2D. This is, accordingly, a red herring.

Complaint (4) (data access request)

64. As can be seen from the appellant's original complaint (4), it was to the effect that NGI failed to provide him with access to all his personal data in response to a request. That however has morphed into a completely different complaint in this appeal where the appellant now appears to suggest that NGI wrongfully processed his data by virtue of an alleged covert transfer of same between the NGI Human Resources Manager and Head of Administration.

65. This was accordingly not a matter that was ever before the respondent under this heading. Further, the appellant fails to engage in any way with the finding of the respondent that the appellant had a statutory obligation to clarify his request when asked to do so, and he failed to comply with that statutory obligation. In any event, this was the subject matter of the appellant's complaint (2) concerning NGI holding covert files in relation to him, and that complaint was in fact upheld by the respondent.

Complaint (5) (email monitoring)

66. In his notice of appeal on this point, the appellant essentially complains that the High Court failed to hold in his favour, particularly having regard to the decision in Barbulescu. I have already dealt with this. The Circuit Court and the High Court both upheld the respondent's determination on this point that the processing of the appellant's data was compliant with the Acts for the reasons already set out.

67. Here again, the appellant's submissions strayed far from anything that might reasonably be encompassed in the notice of appeal and extended to a claim that the respondent had no power to decide the appellant's guilt or innocence in relation to an indictable offence. This appears to be a reference to an alleged security breach by the appellant in the context of a small number of emails which ultimately led to his dismissal. As the respondent correctly points out, this issue, even if it could be regarded as remotely relevant to this appeal, was not one canvassed by the appellant before either the Circuit Court or the High Court and accordingly cannot be considered by this Court. In any event there is simply no basis for saying that the respondent purported to decide the appellant's guilt or innocence in relation to any criminal offence nor any matter relating to his dismissal. Whilst the facts the respondent had to consider might be relevant under all of these headings, her consideration of them was confined to issues of relevance to the appellant's complaint under the Data Protection Acts.

68. It is in any event clear that the respondent's remit obliged her to consider whether the processing of the appellant's emails was justified by the legitimate interest identified in s. 2A(1)(d) and the respondent did so with due regard to the test identified in Rigas Satiksme. In so far as the appellant complains of breaches of the ECHR, as the respondent points out, she has no jurisdiction to consider any such alleged breaches and her remit is confined to a consideration of any alleged breach of the provisions of the Acts.

Miscellaneous points

69. Under the heading "Appeal 4" in his notice of appeal, the appellant complains that the respondent and the High Court failed to have regard to a breach of his rights under s. 7(f) of the Directive. Article 7(f) is transposed into national law by s. 2A(1)(d) of the Acts which have already been fully considered. There is accordingly no substance in this complaint.

70. A substantial portion of the appellant's written submissions are devoted to a claim of apparent bias on the part of the Circuit Court judge. Complaints of bias by litigants in person are, unfortunately, not uncommon. They usually arise from a perceived sense of grievance against a judge who has not held in favour of the personal litigant's arguments. Personal litigants frequently lack the objectivity to see the weaknesses of their own cases, something of which legal representatives are usually careful to advise their clients. Such complaints are often made because the litigant might not have been given free rein to conduct the proceedings in any way they see fit. A requirement by the court to comply with procedural rules and confine argument to matters that are relevant and admissible is sometimes seen by the litigant as bias.

71. As I have said already, the rules are the same for all parties, whether represented or not. The court is entitled and obliged to manage its business in accordance with well-settled rules of practice and the efficient conduct of litigation. The court's case management powers include confining parties to time and word limits on submissions. This can be perceived by litigants in person, unfamiliar with the courts' processes, as unfairly limiting their access to justice. It is of course nothing of the kind.

72. Before the High Court, the appellant alleged that the Circuit Court judge had been biased against him. However, the High Court judge held that this was no more than a bare assertion but nonetheless, carefully considered the transcript of the entire Circuit Court proceedings to satisfy himself that there was no substance in this complaint. On the contrary, the High Court held that the interventions of the Circuit Court judge, about which the appellant apparently complained, were designed to assist rather than hinder him in endeavouring to identify the real issues in dispute.

73. However, in the present appeal, the appellant has gone considerably further in his complaints concerning bias on the part of the Circuit Court judge. His complaint, now made for the first time, very regrettably includes wild speculation amounting to scurrilous claims concerning the Circuit Court judge. It goes without saying that these scandalous accusations ought never have been made and reflect very poorly on the appellant. I do not propose to consider them further.

74. Finally, in his notice of appeal, the appellant seeks a reference to the CJEU, the detail of which is stated to be "Clarify Art 7 95/46/EC". As is evident from the foregoing, there is no need for such reference to enable this Court to conclude its judgment.

Conclusion

75. I would dismiss this appeal. The decision of the respondent in this case was comprehensive, careful and made within jurisdiction. Despite three appeals, the appellant has failed to demonstrate a single infirmity in that decision. It is impossible to avoid the conclusion that the appellant has sought to pursue appeal after appeal on the merits of the respondent's decision, without any regard to what the legislation actually provides for. As the High Court correctly held, the appellant signally failed to even identify a point of law in his originating motion. Undeterred by this finding, he again appealed to this Court and elected to simply ignore that finding by refusing to engage with it, even after repeated invitations from this Court.

76. It is difficult to conclude otherwise than this was a deliberate choice by the appellant, who is clearly an intelligent person. These appeals purport to be advanced on the basis of an erroneous understanding of the most basic legal principles. They are an abuse of process. The consequences of this relentless pursuit of spurious appeals are serious for both parties and in particular the appellant himself, who will likely be faced with a potentially ruinous order for the costs of all this unnecessary litigation. And, as often occurs, in the event that the appellant is unable to discharge those costs, it is ultimately the taxpayer who must do so. As I observed at the outset, this is in nobody's interest.

77. As the respondent has been entirely successful, my provisional view is that the respondent is entitled to the costs of this appeal. If the appellant wishes to contend otherwise, he will have 14 days from the date of delivery of this judgment to deliver a written submission not exceeding 1,000 words and the respondent will have a similar period to a reply likewise. In default of receipt of such submissions, an order in the terms proposed will be made.

78. As this judgment is delivered electronically, Binchy and Butler JJ. have authorised me to record their agreement with it.

Result: Appeal Dismissed

	[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback]
	Irish Court of Appeal
You are here: BAILII >> Databases >> Irish Court of Appeal >> Fox v Data Protection Commissioner (Unapproved) [2024] IECA 92 (25 April 2024) URL: http://www.bailii.org/ie/cases/IECA/2024/2024IECA92.html Cite as: [2024] IECA 92

Irish Court of Appeal