The High Court has rejected a judicial review challenge brought by HSE fire prevention officer Eamon McShane over the Data Protection Commission’s handling of a complaint concerning his work-issued mobile phone.
McShane complained to the DPC in December 2021 after discovering that personal email accounts and a cryptocurrency account had been accessed. About €1,400 in cryptocurrency was taken. He believed the HSE phone was the source of the compromise following the major cyberattack on the health service in May 2021.
The HSE said personal use of the device had not been authorised under its ICT policy. In May 2022, the DPC concluded that there was no basis for treating the HSE as controller of personal data which McShane himself had stored or processed on the phone without the HSE’s knowledge or agreement.
McShane sought to have that decision quashed. His High Court case distinguished between personal data generated through legitimate work use of the phone and non-work personal data.
Mr Justice Barry O’Donnell held, however, that the complaint actually presented to the DPC had focused on the latter category. The correspondence referred specifically to Gmail, Yahoo, Fitbit and Binance accounts. McShane had not asked the DPC to investigate more broadly whether other work-related personal data on the device had also been compromised.
The judge said it would be unfair to require the DPC to speculate about additional complaints not actually put before it. On the case it was asked to decide, the commission had carried out an appropriate and proportionate examination.
The court also accepted that the DPC’s communication of its May 2022 decision had been somewhat vague about its statutory status and appeal route. That was enough to prevent the case being dismissed merely because McShane had not used the statutory appeal procedure, but it did not make the underlying decision unlawful.
Judicial review was refused. Final orders, including costs, were left for agreement or later determination.