The High Court has granted Eamon McShane leave to seek judicial review of the Data Protection Commission’s decision to close his complaint about personal data on his work-issued phone.
Mr Justice Bolger said Mr McShane had established an arguable case, with a reasonable prospect of success, that the Commission had focused on his non-work-related data and had not handled or examined his complaint about work-related data. The court’s decision was at the leave stage; it did not determine whether the complaint was well-founded or whether the Health Service Executive was a data controller.
Mr McShane complained to the Commission on 15 December 2021. The judgment says he alleged that personal data held by his employer, the HSE, had been accessed without authority or consent, and that online accounts had been accessed. The Commission decided on 23 May 2022 to close its file, concluding that the HSE could not be considered a controller of personal data stored on the work phone without its knowledge or agreement.
Mr McShane argued that the complaint also covered work-related personal data processed by the HSE in connection with his employment. The Commission submitted that the complaint concerned only non-work-related data. It also argued that he could have used a statutory appeal and was precluded from seeking judicial review after failing to do so.
The judge noted that statutory appeals are generally the default route, but that an exception may apply where an appeal cannot adequately address the complaint. He said there was an arguable case that the Commission had not investigated the work-related aspect at all, rather than merely analysing it incorrectly. He also was not satisfied at this stage that Mr McShane had raised specious legal points to sidestep the statutory appeal time limits.
The court found an arguable case that the HSE could have been a data controller in relation to the work-related data and that the Commission’s review may have been too narrow. These were grounds sufficient to allow the judicial review to proceed, not final findings on the parties’ dispute.
The judge said the case would be mentioned before him at 10.30am on 1 November 2023 to finalise the orders to be made. The judgment does not set out the final orders.