The High Court has made interim orders restraining a former contracted systems administrator from using or sharing confidential information that the Health Service Executive (HSE) said included patient data. The orders also restrict him from leaving the jurisdiction until he delivers up records and devices containing the information and hands his passport to An Garda Síochána.
In an ex tempore judgment delivered on 5 June 2020, Mr Justice O’Connor said the HSE had established a probability that the defendant had gained access to sensitive private data through his former role maintaining an automated dispensing cabinet system used in various hospitals. The judge said the HSE had presented evidence that the defendant threatened to facilitate dissemination of patient details and private records, which he had referred to in a tweet as “stolen”.
The judgment records that the defendant’s employment was terminated on 19 May 2020 by the contractor engaged by the HSE. The HSE said a screenshot of a gateway to its servers had appeared in a tweet linked to the defendant. It also relied on communications that, according to its counsel, indicated he intended to leave Ireland and give access to data from abroad. The defendant did not attend the hearing or have legal representation, despite being served with the motion and supporting material.
The court granted an interlocutory injunction barring the defendant and anyone to whom he had communicated the confidential information from disseminating, publishing, communicating or using it. A separate injunction prevents the defendant and anyone who received the information from him from deleting or destroying it. He was ordered to deliver relevant documents, records and devices to the HSE’s solicitors or submit devices for forensic analysis.
The departure restriction is tied to compliance with the delivery-up order. The defendant must also deliver his passport to An Garda Síochána, which is to retain it until further order. The HSE’s solicitors may notify relevant authorities about the orders. The court noted an undertaking by the solicitors to provide the order and application affidavits to the Data Protection Commissioner, Minister for Health and Attorney General if requested.
The judge said the orders were for the proper administration of justice and not punishment, and were to last for the shortest possible time. The defendant may apply to vary any or all of them on 48 clear hours’ email notice, supported by affidavit, and may present a defence at the plenary hearing. The court directed that the statement of claim be delivered by email by 5pm on 15 June 2020. Costs of the applications to date were reserved for a later sitting. The published judgment redacts details of the information and accounts covered by the orders.