The Court of Appeal has dismissed an appeal by the Data Protection Commissioner, upholding a High Court ruling that information from hospice CCTV footage was unlawfully used in disciplinary proceedings against an employee.
The case concerned CCTV outside a staff tea room at Our Lady’s Hospice and Care Services (OLHCS), where graffiti was discovered on 19 November 2015. The Gardaí advised the hospice to review footage from 17 to 19 November to identify people who had entered the room. The judgment says there was no suggestion that Cormac Doolin was involved in the graffiti.
The footage showed Doolin entering the room. Information about his visits, including their times and duration, was then used in an investigation into unauthorised breaks. The investigation panel found, on the balance of probabilities, that he had taken unauthorised breaks on three afternoons. He later received a disciplinary sanction.
Doolin complained to the Data Protection Commissioner, arguing that the footage had been collected for security purposes but was used for staff monitoring and discipline. In 2018, the Commissioner found no breach, reasoning that the footage had been viewed once for the security investigation and was not further processed for the disciplinary purpose. The Circuit Court dismissed Doolin’s appeal, treating the matter as a single security investigation.
The High Court allowed Doolin’s appeal on a point of law. The Commissioner then appealed to the Court of Appeal, which considered whether the footage data had been processed more than once and whether later use was incompatible with the stated security purpose.
The Court of Appeal held that the data included more than Doolin’s image: they also showed when he entered and left the room and how long he stayed. Recording, viewing and later using those details in the panel report each counted as processing. The court also concluded there were two investigations, or one investigation into two different matters, and found no evidence that unauthorised breaks presented a security issue.
The court assessed compatibility itself rather than sending the case back to the High Court. It noted that the hospice’s CCTV policy and signs identified security as the purpose, and that employees had not been told the footage could be used for discipline. It held that Doolin’s data were used for a different and incompatible purpose, making that use unlawful under the Data Protection Acts 1988 and 2003.
The court dismissed the Commissioner’s appeal. It proposed that Doolin receive the costs of the appeal, subject to the Commissioner applying within 14 days for a different costs order. The judgment records that the other two appeal judges agreed.