The High Court has dismissed an appeal by Agnieszka Nowak against a Circuit Court decision upholding the Data Protection Commissioner’s finding that her former employer had not contravened data protection law in responding to her 2015 access request.
The appeal was brought on points of law under section 26 of the Data Protection Acts 1988 and 2003. Mr Justice McDermott delivered judgment on 12 July 2018. He found no error of law in the Commissioner’s or Circuit Court’s conclusions and dismissed the appeal.
Ms Nowak’s letter to Intesa Sanpaolo Life Ltd, dated 7 September 2015, sought copies of three categories of personal data, including her personnel file, records of time management and overtime, and emails concerning disciplinary matters. After the company supplied documents on 14 October, she complained to the Commissioner that additional documents had not been provided and that the company had not supplied a description of the data, its processing purposes and possible recipients.
During the Commissioner’s investigation, the company supplied additional personal data that existed and was available in its systems. Ms Nowak later told the Commissioner she had no further issues with the access request, but asked for a formal decision on whether the company had failed to meet its statutory 40-day obligation. The Commissioner decided that the original request was limited to the three specified categories and that the company had complied with it. The Commissioner also found that the request for copies indicated that it did not seek the additional descriptions required by section 4(1)(a)(ii).
The Circuit Court dismissed Ms Nowak’s appeal on 6 February 2018. It considered the word “namely” to qualify the request and rejected the argument that the 40-day period prevented the Commissioner from considering material supplied later.
In the High Court, Ms Nowak also challenged the Circuit Court’s decision to accept a late affidavit and related defence documents. Mr Justice McDermott held that the Circuit Court had power to allow the late filing and had acted within its jurisdiction. A separate challenge concerning service of the Commissioner’s decision by email was abandoned at the hearing.
The judge concluded that the 7 September letter was a focused request, not a general request for all personal data. He held that the employer had supplied the requested documents within 40 days and that it was reasonable to treat the request as limited to the three categories listed. The appeal was dismissed; the judgment did not order the company to provide further documents.