The Court of Appeal dismissed Gerardine Scanlan’s appeal against High Court orders refusing to join Danske Bank and the Data Protection Commissioner (DPC) to proceedings brought by Grant Thornton. It also affirmed orders striking out parts of her defence and most of her counterclaim.
The appeal concerned orders made by the High Court on 27 July 2017 after hearing three interlocutory motions: Grant Thornton sought to strike out parts of the defence and counterclaim and to dismiss them for failure to comply with an earlier order; Scanlan sought a range of reliefs, including the joinder of the Bank and the DPC. The Court of Appeal confined its consideration to the 2017 orders. It said a separate challenge to an order made on 27 November 2015 was out of time.
The underlying action followed Grant Thornton’s delivery, after a data access request, of a disc containing information about Scanlan as well as confidential personal data relating to other people and proprietary information belonging to the firm. Grant Thornton sued for the return of that information and an injunction against its use or disclosure, along with damages. Scanlan accepted that she had sent some of the material to third parties, while maintaining she had a legal obligation to do so. An interim order made in December 2015 restrained her from using the information and required its return and deletion; that order was not appealed.
Scanlan argued that the Bank had been the data controller and should be joined. The Court of Appeal agreed with the High Court that no cause of action or relief against the Bank was set out in the proceedings. Any claim that the Bank was responsible for the data went to Scanlan’s defence, the court said, and did not require the Bank to be a party. Allegations that the Bank and Grant Thornton had concealed facts in earlier debt proceedings did not arise on the pleadings in this action. The court also accepted that joinder could amount to an unarticulated collateral challenge to the earlier judgment against Scanlan.
Scanlan argued that the DPC had failed to enforce data protection law. The court noted that the DPC had opened an inquiry into the alleged breach and that it remained ongoing. The present case was a private law action, separate from the regulator’s investigation; no cause of action or relief against the DPC had been pleaded. The court refused to require the DPC to join as a party or make submissions as an amicus curiae.
The court also dismissed Scanlan’s allegation of objective bias against the High Court judge, finding it unsupported by evidence on appeal. The appeal was dismissed and the High Court order affirmed.