The Circuit Court dismissed a prison officer’s appeal over the use of hospital CCTV footage in an internal investigation and disciplinary proceedings, while clarifying that further use of the footage must remain tied to the security breach that led to its collection.
Judge John O’Connor delivered the judgment on 19 April 2023 in two appeals against decisions made by the Data Protection Commission (DPC) on 17 January 2022. The appeals concerned footage collected at Mayo University Hospital, then provided for viewing to the Irish Prison Service (IPS) after a prisoner escaped from custody there on 8 September 2018.
The officer argued that the hospital and IPS had breached data protection law. Among other points, he said the prisoner had been apprehended before the footage was viewed and that using it in disciplinary proceedings was a separate, incompatible purpose. The DPC had rejected his complaints, finding lawful bases for the hospital’s disclosure and the IPS’s processing, and concluding that the uses were compatible with the original security purpose.
The court accepted that the hospital collected the footage for security purposes and that the officer knew CCTV was in use. It also accepted that the hospital had been led to believe the prisoner was still at large when access was requested, although the prisoner had been apprehended by the time the footage was released. Judge O’Connor said the short interval did not remove the need to investigate a serious incident and concluded that the hospital’s disclosure remained for a security purpose.
The court separately considered the IPS’s later use of the footage in disciplinary proceedings. It said the DPC had not carried out the compatibility analysis required by the Court of Appeal’s decision in Doolin. The judge considered whether the disciplinary use was linked to the security incident, the officer’s reasonable expectations and the purpose for which the footage had been collected.
The court concluded that the officer could reasonably expect CCTV to be used to investigate a security breach at the hospital. But it drew a limit: use was compatible with the original purpose only if confined to dealing with the security issue arising during the prisoner’s escape. Use for another purpose would not be compatible.
Despite finding that clarification was needed because the DPC had omitted the compatibility analysis, the court said it was unnecessary to annul or modify the DPC’s decision and dismissed the appeal under section 150(6) of the Data Protection Act 2018. It invited the parties to propose wording for an order reflecting the decision and said it would hear submissions on costs. The judgment does not state the final wording of that order or the costs outcome.