The Court of Appeal has dismissed an appeal by a former employee against decisions upholding the Data Protection Commissioner’s conclusion that her former employer had not breached data protection law in responding to her 2015 access request.
The judgment, delivered by Ms Justice Faherty on 13 April 2022, concerned a request made by Agnieszka Nowak to Intesa Sanpaolo Life Limited (ISPL) on 7 September 2015. She sought copies of documents relating to her personnel file, time-management records and emails about disciplinary matters.
ISPL supplied documents on 14 October 2015, within the statutory 40-day period. Ms Nowak then complained to the Commissioner that several items were missing and raised separate concerns about access to and clearance of her work email account. After the Commissioner’s office intervened, ISPL supplied additional material on 27 January 2016. Ms Nowak later told the office she had no further issues with the access request, but sought a formal decision that ISPL had failed to meet the 40-day deadline.
The Commissioner’s decision of 9 December 2016 found no breach. It concluded that the request was focused on three categories, in part because it used the word “namely”, and that the additional material was outside those categories. The Commissioner also found that ISPL was not required to provide a separate description of the data and its processing in the circumstances.
The Circuit Court dismissed Ms Nowak’s appeal. The High Court later dismissed her appeal on a point of law, finding that the request was limited and that the documents supplied in October were provided within the deadline.
In the Court of Appeal, Ms Nowak argued that her request was general, that the later-supplied documents should count toward the 40-day period, and that the Commissioner had misinterpreted the relevant provisions. The court held that the request could reasonably be read as focused on the three listed categories. It also found that the wording provided a sufficient indication that the request did not seek all the information covered by the statutory default provisions.
The court rejected her other arguments, including complaints about the investigation and the handling of her work-email concerns. It concluded that she had not identified a point of law warranting intervention and dismissed the appeal. The court proposed that the respondent receive its costs, subject to either party seeking a different order within 21 days of receiving the electronic judgment.