The Court of Appeal has dismissed David Fox’s third appeal over a 2019 decision by the Data Protection Commissioner, leaving in place the rejection of his complaints about covert CCTV, access to personal data and monitoring of work emails.
The judgment, delivered on 25 April 2024, concerned an appeal from the High Court. That court had dismissed Fox’s appeal against a Circuit Court decision, finding that his High Court notice of motion did not identify a point of law, as required for that appeal. The Court of Appeal said that finding was correct and that Fox had not addressed it in his notice of appeal or answered the Commissioner’s objection during most of the hearing.
The Court of Appeal considered Fox’s substantive arguments as well. It found that his challenge to the covert camera rested on a misunderstanding of what can constitute evidence: the Commissioner had received information from the National Gallery of Ireland (NGI) that wine had been stolen from a secure storeroom. The court said the Commissioner was entitled to find that the balance between the NGI’s interests and Fox’s rights had been met, and that the Data Protection Acts allowed processing without consent in specified circumstances.
The court also said the Commissioner had not relied on section 8 of the Acts to justify the camera. The relevant finding rested on sections 2A and 2D; the court described reliance on section 8 as a red herring.
On the access complaint, the court said Fox’s appeal arguments had shifted to an alleged transfer of his data within the NGI, a matter that was not before the Commissioner under that complaint. It noted that the Commissioner had found Fox did not clarify which documents he sought when asked, and that the NGI had responded to the access request to the extent possible.
On work email monitoring, the court said the Commissioner had considered the European Court of Human Rights decision in Barbulescu v Romania and had assessed the competing privacy and security interests. The Commissioner’s decision recorded that five emails flagged as security-sensitive were reviewed, and that the NGI’s IT code gave prior notice that monitoring might occur. The Court of Appeal said the Commissioner’s remit was limited to the Data Protection Acts and did not extend to deciding Fox’s guilt or innocence of any offence.
The appeal was dismissed. The court’s provisional view was that the Commissioner should receive the costs of the appeal. Fox was given 14 days from delivery of the judgment to make written submissions, limited to 1,000 words, on costs; the Commissioner was allowed a similar period to reply. The judgment did not make a final costs order in the text provided.