[New search]
[Help]
My Office received a complaint in February 2010 from the legal representative of an individual concerning the alleged failure of Dublin Bus to supply her, in response to an access request, with a copy of CCTV footage of an incident involving her which occurred on one of its buses.
Córas Iompair Éireann Group Investigations Department responded to the access request stating that:
"All documents and records in this office are prepared in contemplation of litigation. These days every incident is a potential claim and our files fall within legal professional privilege. In those circumstances, information in any form, is not disclosed pursuant to a Data Subject Access Request nor is our defence evidence disclosable. In the event of disputes on that point, you can apply to Court for a Discovery Order”
The complainant also informed us that, at the invitation of Dublin Bus, the legal representative of the data subject had attended, on its client's behalf, at CIE Offices to view the footage concerned prior to the submission of the access request to the company.
Investigation
In commencing our investigation of the complaint we asked Dublin Bus to outline the specific circumstances under which the data subject's image was captured by CCTV systems operating in Dublin Bus and to provide an explanation as to why a copy of the CCTV footage was not provided to the data subject in response to her access request. We stated that it was unlikely that CCTV footage of an incident would fall under the legal professional privilege exemption provided for at Section 5(1)(g) of the Data Protection Acts.
Dublin Bus responded by claiming “the CCTV footage was preserved solely for use in the defence of any litigation arising out of the accident and regardless of whether or not litigation is yet in being it is privileged.”
In attempting to progress our investigation we gave Dublin Bus a number of opportunities to re-consider its position on the application of the Section 5(1)(g) exemption. However, it maintained its position and it refused to supply a copy of the footage in response to the access request.
Enforcement
An Enforcement Notice was served on Dublin Bus in January 2011 requiring it to provide the data subject with a copy of the CCTV footage concerned. The Notice stated that the Commissioner was of the opinion that Dublin Bus was in contravention of Section 4(1) of the Acts in failing to comply with an access request made to it in February 2010. Dublin Bus appealed the Enforcement Notice to the Circuit Court. Subsequently, Dublin Bus requested that the Enforcement Notice be withdrawn as the data subject sought discovery in April 2011 in the context of High Court proceedings of all information held by Dublin Bus relating to the incident which had allegedly taken place on the bus. The Commissioner did not accede to this request.
Circuit Court
In its appeal to the Circuit Court in May 2011 and relying heavily on the UK Durant case, Dublin Bus submitted :
- that the Enforcement Notice was an attempt to subvert the jurisdiction of the courts;
- that the CCTV footage did not constitute personal data within the meaning of the Data Protection Acts;
- that the CCTV footage was not held or maintained on a relevant filing system; and
- that the CCTV footage was downloaded solely for the purposes of the defence of anticipated litigation and is, as such, privileged.
Counsel for the Data Protection Commissioner submitted :
- that the Durant case was irrelevant as the UK Data Protection Act 1998 gives the Court discretion as to whether to direct access to such data;
- that by allowing an inspection of the CCTV footage to the data subject's legal representatives, Dublin Bus thereby waived any privilege it claimed;
- that even if any privilege was not waived, Dublin Bus does not come within the exception provided at Section 5(1)(g) in relation to the CCTV footage in this case;
- that there is no provision in the Acts which precludes a data subject from exercising their right to access personal data to which they are entitled because they are litigating before the Court; and
- that there are no exemptions from the right of access where civil legal proceedings are contemplated or ongoing.
On 5 July, 2011 the Circuit Court judgment was delivered (Record No. 1316/2011). It ruled that:
- the CCTV footage concerned is personal data within the meaning of the Data Protection Acts;
- Dublin Bus does not come within the exception relating to privilege under Section 5(1)(g) of the Data Protection Acts from the obligation to comply with a data access request under Section 4;
- there are no exemptions under the Data Protection Acts from the right of access under Section 4 where civil legal proceedings are contemplated or ongoing; and
- the UK Data Protection Act 1998 is distinct from the Irish legislation in that it confers a discretion on the Court as to whether to grant an order for access.
The appeal by Dublin Bus was accordingly dismissed and costs were awarded to the Data Protection Commissioner.
High Court
Dublin Bus appealed the Circuit Court judgment to the High Court. The case was heard in June 2012 (Record No. 123CA/2011). Dublin Bus submitted:
- that the Circuit Court erred in law in holding that, subsequent to the commencement of legal proceedings, the High Court did not have the sole competence to deal with and adjudicate upon all of the matters arising between the parties relating to the accident;
- that the proper forum for adjudicating on matters of Discovery between the parties is the court which has seisin of the proceedings, in this instance, the High Court;
- that any attempt to seek disclosure outside of the High Court is a mistaken and inappropriate attempt to usurp the function of the High Court;
- that the role of the Data Protection Commissioner is protecting the data of the citizens of the state. The Commissioner should have no role in the conduct of litigation;
- that by affording an appellant the right to first appeal to the Circuit Court, and thereafter to the High Court on a point of law, the drafters of the legislation clearly intended that the Courts would have discretion in deciding upon the interpretation of the Acts. Therefore, the purposive effect of the Acts provisions must be considered, and it is on this basis that the dicta of Auld LJ in the Durant case retains very strong persuasive value in terms of the interpretation of the Irish Acts; and
- that the High Court should take cognisance of the dicta of Auld LJ that the purpose of data protection law is not "to assist [a litigant].... to obtain discovery of documents that may assist him in litigation or complaints against third parties."
Counsel for the Data Protection Commissioner submitted:
- that the Circuit Court was correct in its finding;
- that the serious and significant error test (in Ulster Bank v Financial Services Ombudsman [2006] IEHC 323) is of long standing in Irish law and is the appropriate standard to apply to this appeal;
- that a person's fundamental right to access their personal data under the Acts is not conditional upon their establishing a good motive for wanting their personal data and the Commissioner is not required to demand of a requester why they want their personal data;
- that if the drafters of the legislation wished to impose limitations on the right of access to personal data in circumstances where litigation had been instituted they would have done so expressly;
- that there is nothing about making a data access request pursuant to the statutory right of access that amounts to subverting the jurisdiction of the courts, indeed quite the opposite, since the courts expect parties to see if they can obtain information from other sources before taking up the time of the court with a discovery request;
- that any exemption to data protection law should be narrowly construed since it is an exemption from a fundamental right.
On 8 August 2012 Hedigan J delivered judgment. He noted that no attempt had been made in the appellant's notice of appeal to identify any points of law. He stated "From the Courts perspective this is completely unsatisfactory. Simply saying that you are appealing the whole of a judgment does not amount to a valid appeal on a point of law. An appeal on a point of law is just that. The point of law should be identified and the submissions should be directed to that point. When pressed on the matter, the appellant did identify the point of law which it wished to raise on appeal as follows: 'Whether the existence of legal proceedings between a data requester and a data controller precludes a data requester making an access request under the Act.'"
Hedigan J found that the English case law relied upon by Dublin Bus was not relevant. He found that in effect the appellant was "seeking to carve out a new exception in the Acts, to the effect that whenever a data requester has instituted litigation against a data controller he or she is precluded from making a data access request under the Acts." Hedigan J accepted Counsel's submission that "if the drafter of the legislation wished to place such limitations on the right of access to personal data then they would have done so expressly."
Hedigan J concluded: "Thus in my judgment, the existence of proceedings between a data requester and the data controller does not preclude the data requester making an access request under the Act nor justifies the data controller in refusing the request. I am not therefore satisfied that the appellant has raised a point of law giving rise to grounds for overturning the decision of the learned circuit judge. I must therefore dismiss this appeal."
The High Court subsequently made an Order for costs in favour of the Data Protection Commissioner.
The High Court's ruling in this matter is welcome as it provides important legal clarity on the right of access to personal data for individuals involved in matters of litigation while at the same time it defines for data controllers the narrow restriction to the right of access which is contemplated by the exemption in Section 5(1)(g).
BAILII:
Copyright Policy |
Disclaimers |
Privacy Policy |
Feedback |
Donate to BAILII
URL: http://www.bailii.org/ie/cases/IEDPC/2012/[2012]IEDPC5.html
