Fox v The Data Protection Commissioner (Approved) [2023] IEHC 529 (25 September 2023)

THE HIGH COURT

[2023] IEHC 529

HIGH COURT RECORD NO. 2022 80 CA

CIRCUIT COURT RECORD NO. 2019 / 8215

IN THE MATTER OF THE DATA PROTECTION ACTS 1988–2003

AND IN THE MATTER OF AN APPEAL UNDER SECTION 26 OF THE DATA PROTECTION ACTS 1988-2003

BETWEEN

DAVID FOX

APPELLANT

AND

THE DATA PROTECTION COMMISSIONER

RESPONDENT

Judgment of Mr. Justice Mark Heslin delivered on the 25th day of September 2023

Introduction

1. This case comes before the court by way of an appeal, on a point of law, against a 25 April 2022 decision of the Circuit Court (His Honour Judge O’Connor) dismissing an appeal against a decision of the Respondent (otherwise “the Commissioner”) dated 14 November 2019 (“the decision”).

2. The decision by the Commissioner was made pursuant to s. 10 of the Data Protection Acts 1988–2003 (“the Acts”), para. 10 (1) (a) of which, under the heading “Enforcement of data protection” begins as follows:-

“The Commissioner may investigate, or cause to be investigated, whether any of the provisions of this Act have been, are being or are likely to be contravened…in relation to an individual either where the individual complains to him of a contravention of any of those provisions or he is otherwise of opinion that there may be such a contravention. . .”.

Background

3. The Appellant was employed by the National Gallery of Ireland (“the NGI”) as an attendant from 1991. His contract of employment was terminated by the NGI by letter dated 28 November 2011, arising from allegations that he sent emails to a third party which contained information of a security sensitive nature. The Appellant takes issue with this description of the emails.

4. The Appellant submitted a complaint to the Commissioner dated 10 December 2010. The Commissioner formed the view that the complaint was “frivolous or vexatious” within the meaning of those terms as used in s. 10 (1)(b)(i) of the Acts.

5. The Appellant contested this determination by way of a statutory appeal which was brought under s. 26 of the Acts. The Commissioner’s position was upheld by decisions in the Circuit Court and High Court and a further appeal was made to the Court of Appeal.

6. Prior to determination of the matter by the Court of Appeal, the Supreme Court delivered a decision in Nowak v. Data Protection Commissioner [2016] IESC 18 on 28 April 2016. In essence, the Supreme Court decided that a statutory appeal lies against an opinion formed by the Commissioner that a complaint ought not to be investigated on the basis of a view formed by the Commissioner that the complaint was “frivolous or vexatious”.

7. In the wake of the Supreme Court’s judgment, the Commissioner conceded the appeal to the Court of Appeal and, pursuant to terms agreed between the Commissioner and the Appellant, a re-constituted complaint was submitted, dated 27 October 2016.

8. On internal p. 2 of the Decision, the relevant complaint by the Appellant to the Commissioner is summarised in the following terms:-

“Your Complaint

You submitted an updated complaint to this office dated 27 October 2016 against NGI alleging the following:

(1) That NGI processed your personal data, while monitoring your use of your work mobile telephone.

(2) That NGI had held covert files in relation to you.

(3) That NGI had installed covert CCTV to monitor employees.

(4) That NGI failed to provide you with access to your all (sic) personal information in response to an access request you had submitted to it.

(5) That NGI processed your personal data, while monitoring the content of your work email.

(6) That NGI failed to ensure the return of your personal data following the conclusion of a contract with a data processor.

(7) That NGI obtained your biometric data without being transparent about the purpose for which it was obtained.

For the purpose of making this decision, the investigation conducted by this office has had regard to all of the materials submitted by both parties since 2010”.

9. It has never been suggested that the foregoing is not an accurate summary of the Appellant’s complaint. In circumstances where the Commissioner decided four of the seven issues in favour of the Appellant, only complaints 3, 4 and 5 are of relevance for present purposes.

Complaint 3

10. With respect to complaint 3, the Commissioner decided that, in circumstances where the NGI was faced with the theft of property from a secure storeroom and this theft raised further security concerns, the NGI had a legitimate interest in processing the Appellant’s personal data by installing a covert security camera for the purposes of detecting an offence. The Commissioner further found that, under s. 2 A (1) (d) of the Acts, the NGI had a legal basis for processing the Appellant’s personal data by installing a covert CCTV camera. In addition, the Commissioner concluded that there had been no breach of s. 2 D (1) of the Acts, as it would not have been practicable for NGI to provide the Appellant with information relating to the processing of his personal information recorded on a covert CCTV camera.

Complaint 4

11. With respect to complaint 4, the Commissioner found that the NGI did not contravene s. 4 of the Acts, as it provided the Appellant with access to his personal data to the extent possible within the statutory time frame, in that the NGI provided access to a certain amount of the Appellant’s personal data and sought clarification from him regarding what he considered to be outstanding, which clarification the Appellant failed to provide.

Complaint 5

12. With respect to complaint 5, the Commissioner found that the NGI had a legal basis, under s. 2 A (1) (d) of the Acts, for processing the Appellant’s personal data contained in the email messages in question. The Commissioner also concluded that the processing of the Appellant’s personal data was compliant with the fair processing requirements set out under s. 2 D (1) of the Acts.

13. On any view, the Commissioner’s decision (which runs to 44 pages) comprises a careful setting out of the analysis conducted with respect to each complaint, the decisions arrived at and the reasons for same. Later in this judgment I will make reference to certain paragraphs from the decision (wherein complaint 3 is addressed at paras. 75–91; complaint 4 is addressed at paras. 113–128 and complaint 5 is addressed by the Commissioner at paras. 132–151).

Draft decision

14. Whilst the decision issued on 14 November 2019, it is noteworthy that some three and a half months earlier, under cover of correspondence dated 02 August 2019, the Commissioner provided a copy of its draft decision to both the Appellant and the NGI. As the Commissioner’s letter made clear:-“The decision is being sent to both parties in draft form to afford a further and final opportunity to make representations to this office in relation to the analysis and findings contained in the draft…”.

Representations

15. Under cover of a letter dated 13 August 2019, the Appellant submitted representations in respect of the draft decision. These submissions comprised of one page concerning complaint 3; two pages concerning complaint 4; and one and a half pages concerning complaint 5.

Appeal to Circuit Court (s. 26(1))

16. The Commissioner’s decisions with respect to complaints 3, 4 and 5 formed the basis of a statutory appeal to the Circuit Court by the Appellant. It is not in dispute that the appeal to the Circuit Court was governed by s. 26 (1) of the Acts which provides:-

“(1) An appeal may be made to and heard and determined by the Court against—

. . . .

(d) a decision of the Commissioner in relation to a complaint under section 10 (1) (a) of this Act”.

Motion (Circuit Court appeal)

17. The said appeal was brought by way of originating notice of motion, dated 9 December 2019, in which the Appellant pleaded the following:-

“…. TAKE NOTICE that the grounds of this appeal are that, in making the Decision, the Data Protection Commissioner erred in fact and/or in law:

(1) In determining that my employer was not in violation of Section 2, and in particular, Section 2 (1) (c) (ii), Section 2 (1) (c) (iii), Section 2 (d) of the Data Protection Acts applicable by reason of the said employer’s collection of my data using a covert camera disguised as a PIR without having a CCTV policy in place, for reasons that were excessive for the purpose for which it was collected.

(2) In determining that the my (sic) employer was not in violation of Section 2, including Sections 2 (1) (a), (b), (c) (i) (ii) (iii) (iv), (d) and Sections 3, 4 & 5 of the Data Protection Acts applicable by reason of the said employer’s covert and unfair collection, processing, keeping, use and covert retention of my data, denying my right to establish the existence of personal data and denying me a right of access and his processing of this data for reasons that were excessive for the purpose for which it was collected.

(3) In determining that my employer was not in violation of Section 2 of the Data Protection Acts; Article 8 of the European Convention of Human Rights; Article 7 & 8 of the European Charter of Fundamental Rights, and Article 40.3 of the Irish Constitution applicable by reason of the said employer’s covert and unfair accessing and reading of the content of my private correspondence without prior warning of the nature and extent of the intrusion into my privacy”.

Discovery sought

18. The Appellant sought four categories of discovery in the context of his appeal to the Circuit Court. These can be summarised as follows:-

Category 1 - Documents demonstrating that the Appellant’s actions “posed a serious threat to the security of” the NGI or that the Appellant “had in any way endangered the national art collection”;

Category 2 - A copy of the NGI’s IT policy “Code of conduct for users of computer resources” signed by the Appellant;

Category 3 - Records provided to the Investigator by the NGI “that a theft was under investigation between September and December 2009”

Category 4 - Documents relating to contact between the NGI and “An Garda Siochana in regarding the installation of covert CCTV” and “evidence provided by the NGI relating to the identity of the said Garda and any evidence of this report such as the Garda’s notebook or PULSE numbers”.

Commissioner’s response to discovery request

19. The Commissioner’s attitude to this discovery request was set out, at length, in a 7–page letter, dated 2 July 2021 which was sent to the Appellant by Messrs. Philip Lee, solicitors for the Commissioner. In brief, the Commissioner’s attitude to each of the four categories was as follows:-

Category 1 - “ . . . . the documents sought in Category 1 are not identified or referenced in the decision. Nor does the decision contain any statement by the DPC to the effect that you posed a serious threat to the security of the Gallery or that you had endangered The National Art Collection” and:-“The material now sought by reference to Category 1 cannot on any sensible assessment be considered relevant and necessary to the fair disposal” of the issues “not least when you were party to the emails referred to above, and where, in the context of your submissions on the draft decision, you did not say (for example) that the emails did not contain material of the nature described by the Gallery, or that the Gallery’s interpretation or reading of those emails was wrong”.

Category 2 - “Nowhere in the affidavit grounding your appeal (sworn by you on 9 December 2019) is it suggested that the IT policy referred to in the Decision is “untrue” or is not one and the same as the IT policy you had signed. In fact, at paras. 38 to 40 of the Affidavit, grounding your appeal, you appear to accept that you had in fact signed a copy of the IT policy in 2003. The issue you raise in the appeal, therefore, is a different one, i.e., whether or not you were made aware of the section of the policy relating to the monitoring of the emails. You say that you were not notified of the monitoring of emails and that notification given to you was therefore deficient. The letter went on to assert that discovery of this category was not relevant to the grounds of appeal; that speculation as to the legitimacy of a document is not a valid ground for discovery, going on to say: “Without prejudice to all of the foregoing, and in a bid to move things on, we are enclosing a copy of the IT policy as signed by you on 11 June 2003 and referred to in the decision. This document is being furnished on a voluntary basis and for the sake of completeness, strictly without prejudice to the Commission’s position that its disclosure is neither relevant nor necessary. For completeness, we also note that you are already in possession of this document and that you provided this firm with a copy of same on the day of a listing of the appeal before the court on 23 November 2020. (We understand you had received the document from the Employment Appeals Tribunal)”.;

Category 3 - “Your grounds of appeal do not raise any issue to the effect that, contrary to what was put by NGI to the DPC, no theft was under investigation by NGI between September and December 2009. To the contrary, the affidavit sworn by you to ground your appeal appears to acknowledge that an ‘alleged’ theft was indeed under investigation (see paras. 6 and 7 thereof). Accordingly, it is clear beyond question that no issue arises in the appeal in respect of which the discovery sought at Category 3 could be said to be relevant and/or necessary. Indeed, we note that no reason is cited in support of your request for discovery of documents under Category 3….”.

Category 4 - “The identity of the Garda referred to in the Decision is not relevant to the Decision. The DPC investigated and considered whether NGI processed your personal data for the purpose of preventing, detecting or investigating offences. It was satisfied, on the basis of the material provided by the NGI, that the NGI had indeed contacted An Garda Siochana on 27 February 2010 informing them of the installation of the camera and the purposes of the installation….No reason other than ‘discovery of these documents is in the interest of natural justice and is necessary for disposing of this matter’ has been given for the request for discovery in respect of this item. ‘Addressing your concerns’ to the Garda in question is not a valid reason for requesting discovery. Speculation as to whether the DPC contacted the Garda is most definitely not a ground for discovery and we would refute very strongly any implication/allegation to the effect that no such contact was made, particularly in circumstances where, as stated above, this specific point has been sworn to on affidavit on behalf of the DPC…..” going on to state: “….in simple terms, even on your own account, no issue arises in the appeal on the question as to whether or not NGI contacted the Garda in question. It is clear that discovery is sought so that you may address unspecified ‘concerns’ to that Garda. That is not a matter with which the court can or will concern itself in the context of the within appeal”.

Code of conduct for users of computing resources

20. Before leaving the letter sent by the Commissioner’s solicitors to the Appellant on 2 July 2021 (from which the foregoing quotes have been taken), it is appropriate to note that the said letter enclosed a 12–page NGI “Code of conduct for users of computing resources”. Page 12 of 12 bears the Appellant’s name; his position (“senior attendant”) the date (“11/6/03”) and his signature under the words:- “I have read the Code of conduct for users of computing resources and agree to comply with its contents”.

No appeal against Circuit Court’s order refusing discovery

21. It is clear that the Appellant was dissatisfied with the Commissioner’s attitude to his discovery request. In these circumstances, the Appellant’s motion (issued on 4 November 2020) came for hearing before the Circuit Court (His Honour Judge O’Connor) on 8 July 2021. The Circuit Court’s order (perfected on 16 July 2021) makes clear that the court considered the Appellant’s motion; his grounding affidavit sworn on 4 November 2020; an affidavit sworn by the Appellant on 28 June 2021; an affidavit sworn by Ms. Sandra Skehan on behalf of the Respondent, on 5 July 2021; the exhibits referred to in the said affidavits; and the court considered the submissions made by the Appellant and by counsel for the Respondent respectively. The operative part of the said order was to grant discovery of category 2 (the court noting that category 2 had already been furnished to the Appellant) and to refuse categories 1, 3 and 4. The Appellant has never appealed the aforesaid order with respect to discovery.

Circuit Court hearing

22. In the wake of an exchange of affidavits and written submissions, the Circuit Court appeal was heard over the course of 1 February and 23 February 2022 (approximately a half day each). In the present appeal, exhibit “KD1” to the affidavit sworn on 5 October 2022 by Ms. Karen Donnelly, solicitor for the Commissioner, comprises transcripts of the DAR recordings in relation to the Circuit Court appeal hearing. The transcript in respect of 1 February 2022 runs to some 35 pages, whereas the transcript for 23 February 2022 runs to 46 pages and I have carefully considered the entire of same.

Judgment of Circuit Court

23. His Honour Judge O’Connor delivered a written judgment (running to 14 pages) dated 25 April 2022 which I have also carefully considered. Having set out the background, including relevant statutory provisions, the learned judge referred to the Appellant’s complaint; the findings by the Commissioner; and the three complaints with which the Circuit Court appeal was concerned. The learned judge addressed each of the three in sequence; referred to submissions by the Appellant; analysed relevant provisions and definitions in the Acts; and identified the test to be applied (referring, in particular, to the Supreme Court’s decision in Nowak v. Data Protection Commissioner [2016] 2 IR 585 which held that the appropriate test was that outlined by Keane C.J. in Orange v. Director of Telecommunications Regulations [2000] 4 IR 159 at p. 184-185).

24. Noting that the appeal under s. 26 of the Acts was not a full re-hearing on the merits and was limited in nature, the learned judge outlined principles derived from the “Orange test”, further noting that, in coming to its judgment, the Circuit Court was required to assess the decision on the basis of the evidence that was before the Commissioner at the time of the decision (King v. Minister for Finance & Ors [2010] IEHC 307; Governey v. Financial Services Ombudsman [2013] IEHC 403; Millar v. Financial Services Ombudsman [2015] IECA 126), also noting that the court should not consider complaints about process or merits in isolation but, rather, should consider the adjudicative process as a whole (Millar v. Financial Services Ombudsman [2015] IECA 126). The learned Circuit Court judge also observed, further noting that (per the same authority) the burden of proof rested on the Appellant and the standard of proof was the balance of probabilities. The Circuit Court duly came to the following decision:-

“27. The Court is satisfied that the Decision of the Commissioner was carried out fairly and is both logical and appropriate bearing in mind the law and the adjudicative process as a whole. Specifically for the purposes of this appeal by Mr. Fox, the Court is satisfied that he has not discharged the burden that is on him as an Appellant, namely to prove on the balance of probabilities that taking the adjudicative process as a whole and paying the appropriate deference to the expertise of the decision maker, the decision in question was vitiated by serious and significant error or a series of such errors.

28. Accordingly, the Appeal is dismissed.”

This appeal (s.26(3) “on a point of law”)

25. It is against the foregoing judgment that the present appeal is made. Whereas the appeal to the Circuit Court was governed by s. 26(1) of the Acts, it is common case that the present appeal is governed by s. 26(3) which provides for an appeal, on a point of law, from the decision of the Circuit Court, as follows:-

“(3) (a) Subject to paragraph (b) of this subsection, a decision of the Court

under this section shall be final.

(b) An appeal may be brought to the High Court on a point of law against such a decision; and references in this Act to the determination of an appeal shall be construed as including references to the determination of any such appeal to the High Court and of any appeal from the decision of that Court.”

26. Before turning to look at Mr. Fox’s appeal to this Court, it is useful to refer to certain relevant principles.

The ‘Orange’ test

27. With respect to the appeal to the Circuit Court, the relevant test was that identified in Orange Ltd v. Director of Telecoms (No. 2) [2000] 4 IR 159. As the learned Circuit Court judge correctly observed (at para. 22 of his decision) the foregoing was made clear in the judgment of O’Donnell J. (as he then was) in the Supreme Court’s 2016 decision in Nowak. As the headnote in the reported decision in Nowak provides:-

“Per O’Donnell J.: That under s. 26 of the Data Protection Act 1988, the Circuit Court was not required to provide a full appeal on the merits but should set aside a decision was wrong in law or vitiated by a serious error or series of errors. The precise formulation of this standard, however, could be argued in an appropriate case. Orange Limited v. Director of Telecoms (No. 2) [2000] 4 IR 159 approved.”

28. As the current Chief Justice put it succinctly at para. 30 (p. 607 of the reported judgment):-

“In my view, the standard in Orange Limited v. Director of Telecoms (No. 2) is the appropriate standard to apply here.”

29. At para. 2 of the judgment by the learned Circuit judge, he quoted as follows from pp. 184-185 of the decision in Orange Ltd:-

“In short, the appeal provided for under this legislation was not intended to take the form of a re-examination from the beginning of the merits of the decision appealed from culminating, it may be, in the substitution by the High Court of its adjudication for that of the Director. It is accepted that, at the other end of the spectrum, the High Court is not solely confined to the issues which might arise if the decision of the Director was being challenged by way of judicial review. In the case of this legislation at least, an applicant will succeed in having the decision appealed from set aside where it establishes to the High Court as a matter of probability that, taking the adjudicative process as a whole, the decision reached was vitiated by a serious and significant error or a series of such errors. In arriving at a conclusion on that issue, the High Court will necessarily have regard to the degree of expertise and specialised knowledge available to the Director.” (per Keane C.J.)

30. Whilst O’Donnell J. indicated that what might be called the “internal workings” of the Orange Ltd test may be for further consideration in an appropriate case, it was made very clear that the Orange test applies to the statutory appeal from the Commissioner to the Circuit Court pursuant to s. 26(1)(d). If further clarity were needed, Coffey J., in Nowak v. Data Protection Commissioner & Anor [2018] IEHC 117, stated the following:-

“In Nowak v. Data Protection Commissioner [2016] 2 I.R. 585, two members of the Supreme Court indicated by way of obiter dicta that the Orange Communications Limited v. The Director of Telecommunications & Anor (No.2) [2000] 4 IR 159 test from which the Ulster Bank test is derived may well be the subject of further review by the Supreme Court in an appropriate case in the future. O'Donnell J. confirmed that the applicable test in such an appeal was that derived from Orange. However, he noted that no argument had been addressed as to the formulation of the Orange test. Clarke J. (as he then was) indicated that he would prefer to reserve a final decision on the applicability of Orange to an appropriate case. As such, unless and until a review of the Orange test is undertaken by the Supreme Court, the manifest error test propounded by Finnegan P. in Ulster Bank v. McCarren remains the appropriate legal test to apply to an appeal pursuant to s. 26 of the Data Protection Act 1988.”

31. The reference by Coffey J. to the Ulster Bank test was to the judgment of Finnegan P. Ulster Bank v. McCarren [2006] IEHC 323, wherein the learned judge stated:-

“To succeed on this appeal the Plaintiff must establish as a matter of probability that, taking the adjudicative process as a whole, the decision reached was vitiated by a serious and significant error or a series of such errors. In applying the test the Court will have regard to the degree of expertise and specialist knowledge of the Defendant. The deferential standard is that applied by Keane C.J. in Orange v The Director of Telecommunications Regulation & Anor and not that in The State (Keegan) v Stardust Compensation Tribunal.”

The test governing this ‘point of law’ appeal

32. By contrast, a materially different test applies in relation to a point of law appeal to this Court. In this regard, it is appropriate to quote as follows from the Court of Appeals’ 13 April 2022 decision in Nowak V. Data Protection Commissioner [2022] IECA 95:-

“An appeal on a point of law to the High Court

54. The test for an appeal on a point of law to the High Court is that set out in Fitzgibbon v. The Law Society of Ireland [2015] 1 IR 516. There, Clarke J. stated, at para. 128:

“In one sense it may be said that the two types of points of law can legitimately be raised in an appeal which is limited on points of law alone. First, there may be an error of law in the determination of the first instance body. Second, it may be the case that the way in which the first instance body has reached its conclusions on the facts involves an error which amounts to an error in law. There may have been no evidence to support a finding or inferences may have been drawn from the facts which no reasonable decision-maker could have drawn. It follows that a higher degree of deference, so far as the facts are concerned, is paid by the appellate body to the decision of the first instance body in an appeal on a point of law only, as opposed to an appeal against error. In the latter case the court is entitled to form its own view on the proper inference to be drawn (although not on primary facts)” (at p. 559–560).

The foregoing extract was cited by McDermott J. at para. 28 of the judgment under appeal here.

55. In Attorney General v. Davis [2018] 2 IR 357 (cited by Ms. Nowak in her submissions), the Supreme Court again considered the jurisdiction of a court in an appeal on a point of law, and in particular whether an appeal on a point of law may include an appeal against an error of fact. McKechnie J. held, at para. 53, that a court may intervene to overturn on a point of law in the following circumstances:

• In cases of errors of law as generally understood, to include those mentioned in Fitzgibbon;

• In cases involving errors such as would give rise to judicial review, including, illegality, irrationality, defective or absence of reasoning and procedural errors of some significance;

• Errors which may arise in the exercise of discretion which are plainly wrong, notwithstanding the latitude inherent in such exercise; and

• Certain errors of fact.

56. Drawing on Fitzgibbon and his own judgment in Deely v. Information Commissioner [2001] 3 IR 439, at para. 54 the learned judge identified three categories of errors of fact which may lead to intervention. These are:

• Findings of primary fact where there is no evidence to support them;

• Findings of primary fact which no reasonable decision-making body could make; and

• Inferences or conclusions:-

— Which are unsustainable by reason of any one or more of the matters listed above;

— Which could not follow or be deducible from the primary findings as made; or

— Which are based on an incorrect interpretation of documents.”

33. Being a point of law appeal, it is the foregoing test which governs this Court’s approach in the present case and it does not appear controversial to say that, in light of the test, the ‘bar’ facing the Appellant is set high. Furthermore, the onus of proof rests on the Appellant (see Millar v. Financial Services Authority [2015] IECA 126, para. 19) with the standard of proof being the balance of probabilities.

34. Also of relevance is the principle that an Appellant in the position of Mr. Fox cannot advance in the present appeal issues which were not canvased before the Commissioner and, thereafter, in the statutory appeal to the Circuit Court. On this issue, McDermott J. stated, at para. 35 in his 12 July 2018 judgment in Nowak v. The Data Protection Commissioner [2018] IEHC 433:-

“35. In legal submissions to this Court the Appellant sought to expand the issues that had arisen in respect of her complaint before the Commissioner and ultimately before the Circuit Court to embrace many issues which, if permitted would amount to a complete hearing de novo of the circuit appeal rather than the limited appeal contemplated by s. 26(3) on a point of law…”

35. What emerges from the foregoing is that the jurisdiction of this Court extends only to hearing a limited appeal (i.e. consistent with the principles outlined by the Court of Appeal in its 2022 Nowak decision with reference to the judgments in Fitzgibbon; Davis; and Deeley).

Not a re-hearing by this court

36. As will presently become clear, it does not seem to me that the Appellant has sufficiently appreciated the nature of this Court’s role in a point of law appeal. Regardless of how sincerely the Appellant might wish for this Court to engage in a complete re-hearing of the three complaints which were not upheld in the decision by the Commissioner, this is entirely impermissible. Why this is so can be put succinctly. The will of the Irish people, as expressed in legislation enacted by the Oireachtas, is that a suitably qualified expert (in the form of the Commissioner) not this Court or, for that matter, the Circuit Court, should investigate and decide alleged contraventions of the Acts. This reality is, of course, reflected in, inter alia, s. 10 of the Acts which I quoted earlier. The relevant approach which this Court must take has also been decided by the Irish people and, earlier, I quoted relevant authority in relation to the applicable test in this s. 26 (3) appeal.

Jurisdiction in relation to the point of law identified

37. Before looking closely at the appeal to this Court, it seems useful to refer to a further principle of relevance, namely, that this Court only enjoys jurisdiction in relation to the point or points of law identified by the Appellant in his originating motion. In Board of Management of Scoil an Chroí Naofa Íosa & Ors v. Donnelly [2021] 32 ELR 78 (“Donnelly”) this Court dealt with an appeal, on a point of law, from a decision of the Employment Appeals Tribunal (“the Tribunal”) governed by s. 34 of the Maternity Protection Act 1994 which provided:-

“34 . . ..

(2) A party to proceedings before the Tribunal under this Part may appeal to the High Court from a determination of the Tribunal on a point of law”.

38. As can be seen from the above, this section is virtually identical to s. 26 (3) (b) of the Acts, insofar as it creates and governs an appeal to this Court. Bearing this in mind, para. 58 of the decision of Hyland J. in Donnelly seems to me to be particularly relevant:-

“58. In this type of statutory appeal, there is no requirement for a statement of grounds. Rather the point of law must simply be introduced in a notice of motion. The Minister was admirably succinct in her identification of same. Nonetheless, given that the jurisdiction of the court exists exclusively in relation to a point of law identified by an Appellant under s. 34(2), I only have jurisdiction in relation to the point of law identified in the notice of motion. The four walls of the court's jurisdiction are delineated by the point of law identified. I do not have jurisdiction to extend the statutory appeal to points not encompassed by the point of law identified. No matter how widely I interpret the point of law in this case, I cannot define it to include a failure to give reasons. Averments that include a complaint about a factual situation cannot be the basis for an implicit amendment of the points of law the subject of the appeal” (emphasis added)

The originating motion

39. The Appellant’s originating notice of motion is dated 5 May 2022. It gives notice of an application to this Court: “….by way of appeal against the decision of the Circuit Court of 25^th April 2022, from an appeal against the decision of the Data Protection Commissioner pursuant to the Data Protection Acts 1988 and 2003, dated 14^th November 2019”.

40. The motion proceeds to give notice that the Appellant seeks: “orders allowing within the appeal (sic) setting aside the cited decisions made by the Circuit Court and the Data Protection Commissioner and an order for costs in my favour”.

41. The following is a verbatim setting out of the balance of the Appellant’s originating motion:-

“AND FURTHER TAKE NOTICE that the grounds of the appeals are that, in making the decision, the Circuit Court erred in fact and/or in law.

1. In upholding that the Data Protection Commissioner’s decision that my employer was not in violation of s. 2 of the Data Protection Acts 1988 and 2003 and other applicable laws concerning the matter, by reason of the said employer’s covert and unconsented secondary processing, unfair collection and retention of my Data of my data (sic) using a covert camera disguised as a motion sensor, for reasons that were excessive and unjustified.

2. In upholding that the Data Protection Commissioner’s decision that my employer was not in violation of s. 2 and 4 of the Data Protection Acts 1988 and 2003 by reason of the said employer’s collection of my data by unconsented secondary processing, unfair collection and retention of my Data, and denying me my right to establish the existence of personal data and my right to access said personal data.

3. In upholding that the Data Protection Commissioner’s decision that my employer was not in violation of s. 2 of the Data Protection Acts 1988 and 2003, Article 8 of the European Convention on Human Rights, Articles 7 and 8 of the European Charter of Fundamental Rights, applicable by reason of the said employer’s unconsented and unfair collection of my data and accessing and reading the contents of my private correspondences without prior warn od (sic) the nature and extent of the intrusion into my privacy”.

42. It does not seem unfair to say that, on a plain reading of the originating notice of motion, the Appellant simply asserts that the Circuit Court’s error was in upholding the Commissioner’s decision on complaints 1, 2 and 3 (which in the manner explained earlier, correspond to complaints 3, 4 and 5 as originally made). In the manner I will presently expand upon, it does not seem to me that a point of law is identified in the said motion.

The hearing before this court

43. At the outset of the hearing, I invited Mr. Fox (who represented himself) and Mr. Quinn BL (representing the Respondent) to agree an allocation of time. This was done and, during the course of a full-day, the Appellant had somewhat in excess of two hours for submissions. As I did at the conclusion, I want to express my thanks to both Mr. Fox and Mr. Quinn for the clarity of their submissions during proceedings which were conducted by both sides in a very professional manner.

Affidavits delivered without consent

44. Whilst issue had been taken in the Respondent’s submissions with the delivery, by the Appellant, of affidavits sworn by him on 24 and 28 March 2023, respectively (some six months after a hearing date for the case had been given, and without any consent having been sought by the Appellant for the delivery of further affidavits) this did not feature heavily during the hearing. Rather, in light of the Appellant being a litigant in person, counsel for the Respondent made clear that his client did not have a difficulty with the Appellant referring to the contents of those affidavits, insofar as he wished. Nor was objection made to the court considering their contents de bene esse, as I have done.

Request to identify point of law

45. Prior to the Appellant getting into the detail of his oral submissions, I asked him to assist me by identifying the point, or points, of law which he says are raised in his originating notice of motion.

46. As I explained to the Appellant, this question was asked in order that the court could understand what it was called upon to determine in the present appeal. I further explained to the Appellant that this would be of considerable assistance as it would allow the court to understand what point, or points, of law the Appellant’s submissions were directed towards. The Appellant’s response was to make the following assertions:-

· The Commissioner’s investigation was in error;

· The Commissioner accepted statements without proof;

· Insofar as wine was taken from private stores, there is no proof that the wine ever entered the store;

· The NGI put in a camera without any proof;

· The NGI said that they called in the Gardai, but the Appellant has seen no evidence of that;

· Evidence has been withheld from the Appellant;

· In order for a camera to have been installed, a senior member of An Garda Siochana should have applied to the Courts;

· The storeroom in question was an area used by staff, for example to change clothing, and the Appellant does not understand the reason for the camera being installed;

· The NGI put a camera into a locker room, approximately 5 metres long by 5 metres wide, but there was no proof shown by the NGI in relation to the camera;

· The wine was allegedly stored on Friday 29 December 2009 after a staff party; a member of staff, who was left to “tidy up”, said he stored the wine there, but the NGI cannot give any evidence that this happened;

· If the wine was never in the store, it was unjustified to put in a camera, whether wine was stolen or not;

· The Appellant asked to speak to the investigating Garda but was not given access;

· There was no sign of a “break in” and this tells the Appellant, who was a senior member of security staff in the NGI, that there was a key used;

· The applicant asks, rhetorically: “how is it justified or taken as a primary fact, when nobody can prove, or disprove, that the wine was taken?”

· The Appellant’s data protection and privacy rights were violated by the presence of a covert camera;

· Just because the Appellant walks across the threshold of the NGI does not mean that he becomes their property;

· The Appellant has an entitlement to privacy in work and his privacy rights were breached;

· The Commissioner has taken the word of the person last in possession of the wine;

· That is not a primary fact; it is no more than a rumour;

· The error lies in a biased decision by the Commissioner to take the word of the NGI without adequate investigation;

· There was no proof that wine was stolen, and it was not a primary fact that there was wine there, or that it was stolen;

· The Commissioner has wrongly given a right “above” the Appellant to the NGI as data controller.

47. Arising out of the foregoing, further efforts on the part of the Court were made in order to clarify with the Appellant the point(s) of law which he says arise(s) from the originating motion. The outcome was for the Appellant to confirm that the following represents an accurate summary of what he regards as the points of law in issue:-

· Upholding a primary fact that was not a primary fact;

· The Circuit Court gave too much deference to the decision maker;

· In the Circuit Court, the Appellant relied on the Deeley decision as being the appropriate test, whereas Deeley “wasn’t brought in at all” and the case was wrongly decided on the basis of the Orange test;

· There was a failure to comply with procedures required by the Criminal Justice (Surveillance) Act 2009 and a failure on the part of the Commissioner and the Circuit Court to look at this;

· The NGI failed to give prior notice in relation to monitoring emails.

48. It is the foregoing points which, according to the Appellant, arise from his originating motion and fall to be determined. With the greatest of respect, I do not see that these are points made out in the said motion. Furthermore, the points raised by the Appellant seem to me to amount to a critique of the decision and an invitation to this Court to embark on a merits–based reassessment of same. These are issues which I will return to later in this decision.

The Appellant’s submissions

49. In oral submissions, Mr. Fox gave a narrative of relevant history, from his perspective, going back to 2010.

50. This included his reference to an Equality Tribunal claim which, he submitted, included letters of complaint against him by an employee, which letters were not on the Appellant’s file. The Appellant submits that, as a consequence, he sent access requests and got his union involved, but they received no satisfactory answer.

51. He submitted that it was only during 2016/2017 that the Commissioner informed him that the NGI had advised the Commissioner that certain of his data was held in the office of the NGI administrator, as opposed to HR.

52. The Appellant submits that substantial amounts of his personal data was being held covertly by the NGI. He submitted that he made a “Freedom of Information” request which was, according to him, necessarily broad in scope. He referred to the refusal of this request. With reference to the judgment of Hedigan J. in Dublin Bus v. The Data Protection Commissioner [2012] IEHC 339, the Appellant submitted that the refusal of a data access request by the NGI, by reason of an impending legal case, was impermissible.

53. The Appellant asked, rhetorically, why was the data not handed over in circumstances where it was in the administrator’s office?

54. The Appellant submitted that, for his data to be taken from HR to the administrator’s office, into secondary processing, was something to which he gave no consent.

55. He submitted that Article 7 (f) of Directive 96/46/EC provides, in effect, that the Appellant’s rights “overrule all others” with respect to his data.

56. The Appellant submitted that the Commissioner misinterpreted s. 4 of the Data Protection Acts, having regard to Article 7 (f) of the said Directive. Section 4 is entitled “Right of access” and begins as follows:-

“4.—(1) (a) Subject to the provisions of this Act, an individual shall, if he so requests a data controller by notice in writing—

(i) be informed by the data controller whether the data kept by him include personal data relating to the individual,

(ii) if it does, be supplied by the data controller with a description of -

(I) the categories of data being processed by or on behalf of the Data Controller,

(II) the personal data constituting the data of which that individual is the data subject,

(III) the purpose or purposes of the processing, and

(IV) the recipients or categories of recipients to whom the data are or may be disclosed,

(iii) have communicated to him or her in intelligible form -

(I) the information constituting any personal data of which that individual is the data subject, and

(II) any information known or available to the data controller as to the source of those data, unless the communication of that information is contrary to the public interest…...”

57. I asked the Appellant to explain the way in which he contends s. 4 was misinterpreted. In response, Mr. Fox submitted that the Commissioner and the Circuit Court misinterpreted s. 4 (1) (a) because:

- he was not given the information referred to in s.s. (1) (a) (i);

- he was given none of what is referred to in s. 4 (1) (a) (ii);

- rather than communication to him being “in intelligible form” (per s. 4 (1) (a) (iii)) he received communication which was “cryptic” and “nonsensical”; and

- there was no public interest of the type referred to in s. 4 (1) (a) (iii) (II).

58. The Appellant also submitted that “what I was told was section 4 was actually Section 5” of the Acts.

Section 5

59. Section 5, entitled “Restriction of rights of access” beings in the following terms:-

“(1) Section 4 of this Act does not apply to personal data—

(a) kept for the purpose of preventing, detecting or investigating offences, apprehending or prosecuting offenders or assessing or collecting any tax, duty or other moneys owed or payable to the State, a local authority or a health board, in any case in which the application of that section to the data would be likely to prejudice any of the matters aforesaid . . .”

60. The Appellant submitted that: “To say it was Section 4, when it’s actually Section 5 is a misinterpretation”, also submitting that the NGI is an “ordinary citizen” and Garda powers have not been conferred on the NGI.

61. In response to additional questions from me as to what the Appellant contended to be the misinterpretation of s. 4, he submitted that the misinterpretation was the fact that he was refused access which, he contends, he was entitled to under s. 4 (1) (a).

62. As part of his narrative account, the applicant referred to a fire breaking-out in bins adjacent to a “large gas mains”, as a result of which an NGI employee was relieved of his duties. According to the Appellant, this individual showed him his complaint. In circumstances where this individual’s first language was not English, the Appellant submits that he agreed to review and re–work the complaint. The Appellant submits that, at this time, and without the Appellant’s knowledge, the NGI was monitoring his emails.

63. He went on to submit that there was “nothing about this” in the NGI’s IT policy which was introduced in 2003, a copy of which the Appellant acknowledges that he signed.

64. The Appellant referred to a copy of this policy. It comprises Exhibit “DF 15” to the Appellant’s affidavit sworn on 24 March 2023. The “cover sheet” in the Appellant’s books (book 2, of 2) describes this exhibit as follows:-“DF 15 - NGI I.T. policy as signed by the Appellant June 2003”. This appears to be an identical copy of the “Code of conduct for users of computing resources” which I referred to earlier in this judgment. The contents are identical and p. 12 (of 12) bears the name, position and signature of the Appellant and is dated 11/6/03. With reference to the first page of the said IT policy, the Appellant emphasised that what he wrote to his former colleague did not include obscenities or the like.

65. To better understand this submission, it is appropriate, at this juncture, to set out verbatim the first page of the code which provides:-

“Code of conduct for users of computing resources

This document should be read in conjunction with the Notes on the Code of Conduct and other policies which are attached.

Under the code of conduct, you are not permitted to:

1. engage in activities which waste resources (people, networks, computers) or which unfairly monopolise resources to the exclusion of others;

2. engage in activities which are likely to cause a serious disruption or denial of service to other users;

3. interfere with computer or network settings that have been authorised for your use;

4. use computer or network resources to access, distribute or publish material that is obscene, libellous, threatening or defamatory or in violation of any right of any third party;

5. use computer or network resources for any activities which contravene the laws of the State, or the destination country in the case of data being transmitted abroad;

6. infringe copyright or the proprietary rights of software (see Software Licensing & Copyright);

7. use computer or network resources for commercial activities which are not part of your work in the NGI;

8. use computer resources to transmit or receive sensitive and/or confidential information;

9. share usernames, transfer them to other users, or divulge your passwords to other users. Assigned Group usernames and accounts are to be used only for the Gallery-related activities for which they are assigned;

10. use internal network passwords on the Internet;

11. access or interfere with data, displays or storage media belonging to another user, except with their permission;

12. undertake any actions that are likely to bring the NGI into disrepute”.

(emphasis added)

66. The submission by the Appellant would clearly appear to relate to para. 4 of the code of conduct. However, it is plain that para. 4 is not the only applicable restriction and, in the manner presently explained, the provisions of para. 8 are also of relevance.

67. The Appellant also laid emphasis on para. 1 on internal p. 2 of the said IT policy, in particular, the words “while everyday network traffic or information stored on NGI equipment is not normally monitored…”. However, it is appropriate to note that the said paragraph reads, in full:-

“Notes on the Code of Conduct:

1. While everyday network traffic or information stored on NGI equipment is not normally monitored, it may be necessary to monitor if there is reason to suspect that this Code of Conduct is being breached, or for purposes of systems administration, backup or problem-solving. You must therefore be aware that such monitoring may occur” (emphasis added)

68. The Appellant submitted that, in light of the words “while everyday network traffic or information…is not normally monitored” he was entitled to believe that no monitoring would occur. A related submission was to the effect that, before the NGI could legitimately monitor any emails sent or received by him, his consent was required.

69. Insofar as key words played a role in email monitoring, the Appellant submitted that a particular assistant registrar did not start working with the NGI until mid–2004 and, he contended, would not, therefore, have had any input into key words in 2003.

70. He further submitted that there was no reference to key words and nothing in the code of conduct to indicate who would carry out email monitoring, all of which he characterises as a breach of his rights.

71. He further submitted that there was no reason for the NGI to find his emails other than if they were “trawling”.

72. The Appellant submitted that the NGI was not only searching for profane words. The Appellant made specific reference to paras. 163 and 164 of the decision which state:-

“163. NGI provided you with prior notice of this type of monitoring in its “Code of conduct for Users of Computing Resources”. I also note that the monitoring of your email communications was narrow in scope, as NGI only reviewed five emails that had been flagged as security sensitive, and therefore had a legitimate interest to do so as these may have raised security concerns. I consider that in this instance NGI used the least privacy intrusive method available to it as it utilised software that only flags emails that contain weighted security sensitive words, which do not cause a substantial adverse impact to your right to privacy as an individual.

164. On the final part of the test, this office considers that NGI has demonstrated that the potential risk to the security of NGI, and the assets housed there, was of such a serious nature that it validated this manner of the processing of your personal data, especially in circumstances where you were aware that using NGI computer resources to transmit or receive sensitive or confidential information was not permitted as per the NGI Code of Conduct for Users of Computing Resources. Therefore, I consider that NGI’s pursuit of its legitimate interest took precedence over your rights and freedoms as a data subject”.

73. It is common case that reference in para. 164 to “the assets housed there” is to the State’s national collection of paintings and art, housed at the NGI. With reference to the foregoing paragraphs in the Commissioner’s decision, the Appellant made submissions to the following effect:-

· The NGI looked at more than five emails (the Appellant suggesting that ten were examined);

· The Appellant takes issue with the finding in para. 163 that his emails were “flagged as security sensitive” contending that unless there was “active trawling” of his emails by the NGI, the relevant emails could not have been found;

· The Appellant asserts that a mistake arose in circumstances where “the Commissioner accepted the word of the NGI” and he further argues that the Circuit Court shared that mistake;

· The Appellant further submitted that: “The NGI may have given a false book to the Commissioner”.

74. In relation to the last of these submissions, the Appellant contends that the NGI may have submitted to the Commissioner a book which may have been given to new employees which, on advice from Unions, the Appellant and co–workers did not sign, and which was never accepted by the Appellant.

75. With reference to the foregoing, the Appellant submitted that he has notes of investigations which he received, from the WRC, under “FOI” (but did not give to the Commissioner as it did not form part of the investigation) in which it is confirmed that the Appellant “did not accept the new book”.

76. The Appellant also made submissions with respect to para. 135 of the decision. For the sake of clarity, that paragraph reads as follows:-

“135. NGI advised this office that on 05 and 06 October 2010, the IT Manager received three and two alerts respectively from the mail gateway regarding emails and a number of attached documents from your NGI mailbox. The emails concerned were sent from you to a former employee of a security company engaged by NGI. NGI stated that on becoming aware of these emails, and at the request of NGI’s Senior Management, on 05 October 2010, the IT manager backed up a copy of your NGI mailbox and that the five emails concerned were then the subject of an “internal HR investigation” which ultimately resulted in the termination of your employment following disciplinary proceedings. NGI provided this office with a copy of its IT policy, which was rolled out in 2003. In this policy dated 03 April 2003, which states under the heading “Electronic Mail Policy” “All incoming and outgoing e-mail attachments are blocked automatically by Mailsweeper software. You are required to request the release of blocked e - mail by contacting the IT unit by e–mail”. NGI also provided this office with a signed and dated copy of the “National Gallery of Ireland Code of Conduct for Users of Computing Resources” which states “I have read the Code of Conduct for Users of Computing Resources and agree to comply with its contents.” Signed by you and dated 11 June 2003. NGI stated that this processing was legitimised under s. 2 A (1) (d) of the Acts”.

Section 2A

77. At this juncture, it seems appropriate to set out what s. 2 A (concerning “processing of personal data”) provides:-

“2 A (1) Personal data shall not be processed by a data controller unless Section 2 of this Act (as amended by the Act of 2003) is complied with by the data controller and at least one of the following conditions is met:

(a) the data subject has given his or her consent to the processing….

(d) the processing is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the fundamental rights and freedoms or legitimate interests of the data subject”.

78. With reference to para. 135 of the Decision, the Appellant submitted to this Court that an “open email including contents was sent to two parties”, namely, to the head of security and to the head of IT and “surely that has to be a breach of data protection”.

79. Echoing the submission made with respect to para. 163, the Appellant also submitted, with respect to para. 135, that “it was a misjudgement by the Commissioner to say there were five emails when there were at least ten” or words to that effect.

80. The Appellant characterised the attitude to email monitoring by the NGI as “cavalier” and submitted that this was not taken into account by either the Commissioner, or by the Circuit Court.

81. With reference to para. 164 of the decision, the Appellant submitted that he was denied fair procedures by reason of not being furnished with the documentation which he requested, by way of discovery from the Commissioner.

82. On this issue, he referred to correspondence requesting the documentation and to his motion for discovery which was refused by the Circuit Court. Whilst acknowledging, as a fact, that he did not appeal the Circuit Court’s order refusing discovery, he submitted to this Court that “you can’t answer what you don’t know, and this was a denial of fair procedures and a fundamental error” or words to that effect.

83. On the topic of emails, the Appellant submitted that if any employer wishes to look at the contents of an email, they are required to raise that issue with the employee and to ask for permission.

Discussion and decision

84. The entirety of the Appellant’s 26 October 2016 complaint to the Commissioner comprised an exhibit in the present appeal. The original complaint ran to 62 pages. It is common case that the Commissioner’s investigation file ran to in excess of 600 pages. It was not in dispute that the Commissioner carried out a very comprehensive investigation. As I noted earlier, in the present case the Commissioner took the perhaps unusual step (as it is not required by legislation) of issuing her decision in draft form, specifically so that both sides could make such submissions as they might wish. In so doing, the Commissioner was plainly conscious that a lengthy and detailed investigation had taken place, and her draft represented a very obvious attempt to organise the issues in a logical manner and to elicit any and all additional information either side wished to proffer.

85. It is uncontroversial to say that this afforded the Appellant an ideal opportunity to raise any further concerns issues or evidence which he had not previously raised with the Commissioner. Having summarised the Appellant’s submissions to this court, it can fairly be said that the Appellant (i) contends that there were significant errors in the decision of the Commission as well as (ii) errors of law in the Circuit Court’s determination of his appeal, for reasons not articulated in the submissions he made, on 2 August 2019, in response to the Commissioner’s draft decision.

86. Earlier in this judgment, I referred to the decision of Hyland J. in Board of Management v. Donnelly [2021] 32 ELR 78; [2020] IEHC 550. Guided by the principles outlined at para. 58 of the learned judge’s decision, this Court’s jurisdiction is confined to the point (or points) of law identified in the Appellant’s originating motion. In my view, the Appellant has failed to identify any point of law in his motion.

87. It is fair to say that what the Appellant pleads is that the Circuit Court erred in fact and/or in law “in upholding” the Commissioner’s decision in respect of his three complaints. Rather than identifying any point of law, the foregoing seems to me to be a plea that the Commissioner’s decision was wrong on its merits, and the Circuit Court was wrong not to so find. The Appellant’s submissions to this court fortify me in the view that a merits-based challenge to the decision is what the Appellant is seeking, impermissibly, to make in the present appeal. Relying on Donnelly, this Court only has jurisdiction to consider the point of law raised. None is raised. Thus, the appeal falls to be dismissed in limine.

88. Without prejudice to the foregoing, and lest I be entirely wrong in that view, I propose to analyse the appeal further by first referring to a passage from the decision by Hedigan J. in Dublin Bus v. Data Protection Commissioner [2012] IEHC 339, to which the Respondent’s counsel very helpfully drew the court’s attention. At para. 5.3, the learned judge stated:-

“In this case the Appellant has not, as required by Section 26 (3) (b), set out the point of law on which it wishes to appeal. The Appellant's notice of appeal simply states:-

‘The Appellant, Bus Atha Cliath/Dublin Bus hereby appeals to the High Court sitting in Dublin at the first opportunity after the expiration of 10 days from the date of service hereof from the whole of the Judgment of the Circuit Court given herein on the 5^th day of July 2011 in Circuit Court Number 22 before Judge Jacqueline Linnane’.

No attempt has been made in the notice of appeal to identify any points of law. From the Court’s perspective this is completely unsatisfactory. Simply saying that you are appealing the whole of a judgment does not amount to a valid appeal on a point law. An appeal on a point of law is just that. The point of law should be identified, and the submissions should be directed to that point. When pressed on the matter, the Appellant did identify the point of law which it wished to raise on appeal as follows:-

‘Whether the existence of legal proceedings between a data requester and a data controller precludes a data requester making an access request under the Act’

Notwithstanding the unsatisfactory notice of appeal, I indicated to the parties that I would deal with this appeal. However, the parties were to strictly confine themselves to this narrow legal point. I also directed the parties to provide updated written submissions which also address just this net issue within seven days from the date of hearing. Both parties have provided amended submissions”.

89. It seems to me that a number of comments can fairly be made with respect to the foregoing:-

(i) it does not appear from the decision in Dublin Bus that the question of the court’s jurisdiction being confined to the point or points of law identified in the originating motion, was addressed;

(ii) by contrast, it was plainly addressed in Donnelly (per the principles set out by Hyland J. at para. 58);

(iii) the Appellant’s notice of appeal in the present case identifies no point of law. Rather, and similar to the position in Dublin Bus, it gives notice of an appeal: “to the High Court sitting in Dublin at the first opportunity after the expiration of 10 days from the date of service hereof from the whole of the Judgment of the Circuit Court given herein on the 25 day of 04, 2022….” (emphasis added)

(iv) unlike the position in Dublin Bus, it does not seem to me that, in response to this court’s questions, the Appellant identified the point of law he wished to raise. Rather, a plethora of points were suggested and, even when ‘netted down’ to approximately half a dozen, it does not seem to me that they are, truly, points of law, as opposed to expressions of unhappiness with the merits of the decision;

(v) the submissions made with reference to what were contended to be points of law were extremely wide-ranging and (as well as included additional complaints not raised before the Commissioner or in the Circuit Court) share one common feature, namely, they relate to the merits of the decision by the Commissioner.

90. Notwithstanding the foregoing observations, and lest it be wrong not to do so, I propose to consider each of the points which, as a result of a ‘teasing–out’ exercise by this Court at the outset of the Appellant’s oral submissions, the Appellant confirmed to be his case, on appeal. Lest it not already be obvious, I do so out of an abundance of caution and in order that a litigant in person can better understand the reasons for this court’s decision. However, it seems to me that, per the principles articulated clearly by Hyland J in Donnelly, this is unnecessary, given the failure of the Appellant to identify any point of law in his originating motion, as a consequence of which this court simply lacks jurisdiction.

91. I also wish to make clear that I can see no reason why the principles outlined by Hyland J. at para. 58 of Donnelly should apply only to those who have chosen to instruct legal professionals (as opposed to litigants in person, such as the Appellant). Why I take this view stems from observations at para. 4.7 of the Supreme Court’s decision in Dowling & Ors v The Minister for Finance & Ors [2012] IESC 32, wherein Clarke J. (as he then was) stated:-

“…while acknowledging that the lay applicants are not legally represented and that the courts generally will, in those circumstances, endeavour to ensure that unrepresented parties are not unfairly prejudiced, it nonetheless remains the case that parties cannot expect to benefit by being unrepresented to the extent of being permitted to conduct their proceedings in a way that would not be allowed to a represented party.” (emphasis added)

92. It seems to me that, to permit an unrepresented party not to identify in their motion the point of law, in respect of which they wish to appeal on a point of law, creates an obvious prejudice for the Respondent to such an appeal.

93. It does not seem to me to be at all fair if a Respondent, in such circumstances, is to be expected to try and divine the point of law in issue (or whether there is any point of law raised) by trawling through, for example, multiple affidavits wherein a wide range of complaints are made (and, in the present case, no less than two dozen complaints are articulated to varying degrees in a series of affidavits).

94. Nor can it be fair to a Respondent to be forced into the position where (as in this case) it is not until oral submissions by the Appellant during a trial, that there was any attempt by the Appellant to ‘net down’ multiple complaints (into, in the present case, no less than five which the Appellant contended to be the points of law arising from his motion - although, in my view, none of these are at all obvious from the contents his originating notice of motion or, for that matter, his notice of appeal, nor did the Appellant confine himself to those five points when making submissions).

95. On this theme of fairness, the former Chief Justice observed, at para. 9.2 in Dowling, that “parties who represent themselves can suffer from significant disadvantages”, going on to state, however, that: “While the courts will endeavour to explain relevant procedures, the courts cannot bend the rules in any way that would materially and adversely affect the interests of other parties.”

96. It seems to me that the present case illustrates the foregoing perfectly. There was, without doubt, a ‘bending of the rules’ in respect of the ‘late–in–the–day’ service, by the Appellant, in March 2023, of affidavits in respect of which he neither sought, nor obtained, consent to deliver (the court having been given to understand, in October 2022, that all affidavits had been exchanged, and a trial date was assigned on that basis). To afford a certain amount of flexibility in respect of such an issue, so long as it does not prejudice a just outcome, seems to me to be consistent with the principles articulated in Dowling.

97. By contrast, however, the interests of the Respondent would be materially and adversely affected if this Court were to relieve the Appellant from the requirement to identify, in his notice of motion, the point of law at issue. Were this not so, a Respondent would be entirely ‘in the dark’ as to what case they were facing. Irrespective of how I approach the words used in the Appellant’s motion, I cannot interpret them as giving rise to the five points which, on his feet, he ultimately confirmed to be the points of law in issue.

98. Whilst the Appellant confirmed that his case comprised the five points referred to earlier, he did not confine himself to these during subsequent submissions (highlighting the unfairness I have referred to.) I propose to address all of the principal arguments made but, as I say, satisfied that the appeal fails (as a result of this court applying the principles identified in Donnelly).

‘Incorrect’ test

99. The Appellant contends that the learned Circuit Court judge erroneously applied the test in Orange Ltd [2000] 4 IR 159, contending that the appropriate test was that set out in Deely [2001] 3 IR 439. For the reasons already explained in this judgment, he is incorrect in this.

100. The approach set out in Deely (and in Davis [2018] 2 IR 357; and Fitzgibbon [2015] 1 IR 516) comprises the test in respect of a point of law appeal to this Court. A different test applied in respect of the statutory appeal to the Circuit Court, namely that in Orange (again, see para. 30 of the Supreme Court’s decision in Nowak 2 IR 585 at 607; [2016] IESC 18).

101. In circumstances where the test in a point of law appeal sets the ‘bar’ higher, there is no conceivable way in which the Appellant might have been disadvantaged (by having to ‘clear’ the lower bar in the Circuit Court, even if the Orange test had not been the correct one, which it was). It also seems to me that, given the fact that the jurisprudence is clear on the distinction between the two tests, this was not truly a point of law. Nor can this point be divined from the contents of the Appellant’s originating motion, or notice of appeal.

Primary fact

102. The Appellant contends that the Commissioner (and, in turn, the learned Circuit Court judge), upheld a primary fact which, according to the Appellant, was not a primary fact. It is clear from his submissions that his contention is that there was no evidence to support a finding that there had been a theft of wine at the NGI.

103. The Appellant has entirely failed to substantiate this contention. On the contrary, the Appellant has sworn on affidavit that there was evidence of theft. Paragraph 7 of the Appellant’s affidavit, sworn on 9 December 2019 begins in the following terms:-

“7. Sometime in early January 2010, the staff of the NGI development office sought this wine to be used for a Gallery Function and I believe that all who were asked denied any knowledge of the wine’s whereabouts. The maintenance team told me said (sic) that the wine had not been in the lockup on their return to work after the party, which I think could have been Monday 21^st December 2009. Therefore it appears obvious to me that the wine was taken between the early hours of Saturday 19^th December 2009 and 8am on the 21st December 2009…” (emphasis added)

104. Furthermore, in his submissions to the Circuit Court, the Appellant explicitly accepted that there was a theft, the following being an extract from the transcript of the DAR (23 February 2022, p. 39, lines 11-15):-

“MR. FOX: Okay. Basically what I’m saying here, and the counsel here made a point of same that there was a theft here and I had previously accepted that there was a theft, and he is correct in that. My issue there is not that there was a theft or whether there wasn’t a theft, my issue is was the theft taken from where they put the camera. Because I don’t believe it ever got into the National Gallery.” (emphasis added)

105. In addition, the Commissioner also had before her evidence of theft of wine from a storeroom, which evidence she referred to at para. 77 of the decision in the following terms:-

“NGI informed this office that NGI was faced with a theft of a number of cases of wine, from a secure storeroom, between September 2009 and December 2009. NGI installed covert cameras in the storeroom strictly for the investigation of that offence and to prevent a similar offence occurring. NGI advised this office that any possible breach of security in NGI is considered very serious, in view of the need to protect the State’s National Art Collection which is housed therein. NGI states that this processing was legitimised under section 2A(1)(d) and section 8(b) of the Acts.”

106. For the avoidance of doubt, in the present appeal, the Appellant has not put a scintilla of evidence before this Court to suggest that the NGI did not inform the Commissioner of the theft in question.

107. It is worth recalling, at this point, the principles referred to by Clarke J. (as he then was) in Fitzgibbon [2015] 1 IR 516 (at para. 128). Observing that two types of points of law can be raised in an appeal of this kind, he indicated that the second type may be conclusions on facts where there was no evidence to support same. Similarly, in Deely [2001] 3 IR 439 (at para. 54), McKechnie J. made clear that, in a point of law appeal, this Court could intervene in respect of findings of primary fact where there was no evidence to support them.

108. In the present case, the Appellant has known, at all material times, that there was evidence to support the primary fact in question. Indeed, his own evidence is entirely consistent with this. The foregoing was, of course, the position before the statutory appeal to the Circuit Court. That being so, I fail to see how this can truly be considered to be a point of law in the present appeal. Rather, it seems to me that this is simply an expression of the Appellant’s unhappiness with the outcome of the decision and a desire, albeit an impermissible one, to have a rehearing on the merits.

109. It will be recalled that the Appellant made written submissions on 13 August 2019 in response to the Commissioner’s draft decision. In respect of his complaint 3 (covert CCTV), he certainly did not assert in those submissions that no theft had taken place. Nor did he assert that the NGI had not informed the Commissioner of theft. Rather, his submission stated, in relevant part:-

“If a theft of goods has taken place the matter should have been handed over to the Gardaí. The NGI management and staff have no remit to investigate crime. The installation of the covert camera would not prove if anyone had stolen anything from the store, it could only see what was happening in the present and this could have been achieved with a less intrusive overt camera, to which there was no objection.

The Commissioner appears to consider the complaint as being with regard to the processing of data, which is not the case, as the complaint is regarding the NGI’s lack of regard for the law, transparency and privacy rights and the nature of the device installed.

I ask that the Commissioner will re-examine her findings in this matter and reconsider her decision.”

110. It is clear from the foregoing that the Appellant did not raise, either with the Commissioner or with the Circuit Court, the issue he seeks to raise now. Nor is it a point which is articulated in the originating motion. For these reasons, I do not accept that this amounts to a point of law. Put otherwise, the question raised boils down to the following: In circumstances where the NGI informed the Commissioner of the theft and I acknowledged that a theft took place, whether there was no evidence of theft? Even if I am wrong in the view that this is not truly a point in law, it is a point entirely devoid of merit, which was not raised in the Circuit Court and is not identified in the Appellant’s motion.

Sections 4 and 5 of the Acts

111. Paras. 75-112, inclusive, of the decision, address complaint 3 (covert CCTV). Insofar as the Appellant submits to this Court that there was a misinterpretation of ss. 4 and 5 of the Acts on the part of the Commissioner, it is perfectly clear from a reading of the decision that the Commissioner did not rely on ss. 4 or 5. Rather, her decision in respect of complaint 3 was made with reference to ss. 2(A), 2(D) and (as explained at para. 78) s. 8.

Article 7(f) argument

112. Among the submissions made by the Appellant is that, by virtue of Article 7(f) of the Data Protection Directive, his rights override the rights of any data controller. Building on this submission, he contends that the Commissioner, and subsequently the Circuit Court, erred by failing to recognise this. Under the heading “Criteria for Making Data Processing Legitimate”, Article 7(f) provides, in relevant part:-

“Member States shall provide that personal data may be processed only if:

…

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject which require protection under Article 1 (1).”

113. A plain reading of Article 7(f) does not support the interpretation contended for by the Appellant. As is clear from the decision with respect to covert CCTV and email monitoring, the Commissioner took the view that the processing in question was justified in light of a legitimate interest. In so doing, she relied on s. 2(A) of the Acts which transposes Article 7(f) of Directive 95/46/EC (and earlier in this judgment I quoted s. 2(A)(d) which reflects the wording used in Article 7(f)).

114. Rather than being as the Appellant suggests, Article 7(f) makes clear that processing of data is lawful, so long as it is necessary for the purposes of the legitimate interests of the data controller except where this is overridden by the data subject’s rights. It was very obviously for the Commissioner to consider whether the rights and freedoms of the Appellant, as the data subject, did or did not override the legitimate interests of the NGI, as data controller. That required a balancing exercise to be conducted by the Commissioner (i.e. to decide if the NGI’s legitimate interests were or were not overridden by the Appellant’s rights). It is perfectly clear that a very careful balancing exercise was carried out. This can be seen from paras. 96, of the decision, under the heading “Balancing of Interests” ,in particular, from paras. 93-108, inclusive, of the decision. For the sake of clarity, it is appropriate to quote certain of these paragraphs, as follows:-

“96. In considering whether NGI had a legitimate basis for the processing of your personal data as outlined above, I have had regard to the judgment of the CJEU and preceding opinion of the Advocate General of the Court (AG Bobek) in the Rigas Regional Security Police case.”

115. At this juncture, it is appropriate to refer to para. 66 of Advocate General Bobek’s 26 January 2017 Opinion in Rigas Satiksme, Case C-13/16, which stated:-

“(b) Balancing of interests

66. The second condition relates to balancing between two sets of competing interests, namely the interests and rights of the data subject (18) and the interests of the controller or of third parties. The balancing requirement clearly results both from Article 7(f) and from the legislative history of the Directive. As to the text of the latter, Article 7(f) requires that the legitimate interests of the data subject him or herself be balanced against the legitimate interests of the controller or of a third party. The legislative history confirms that the balancing of interests was already provided for, in slightly different ways, in the Commission’s initial proposal (19) and also in its amended proposal after the first reading of the European Parliament.”

116. It is clear from the 4 May 2017 judgment of the CJEU, in the same case (C-13/16), that the Court endorsed the Advocate General’s views in respect of the balancing exercise.

117. Returning to the decision, the Commissioner stated the following at paras. 105-107 of the decision:-

“105. As advised by AG Bobek in his Opinion, in order to carry out the balancing between the rights and freedoms of the data subject and the legitimate interest being pursued by the data controller, there are a number of factors that should be considered. These include, but are not limited to, the nature and sensitivity of the data in question, the degree of publicity of the data, and the gravity of the offence.

106. In considering the final part of the legitimate interest test, I have also had regard for the ECHR decision in the case of Kopke v. Germany [2010]. While this ECHR case law is not binding on the DPC, it provides useful analysis of matters very similar to those at issue in this decision. This case concerned the covert video surveillance of a supermarket employee in circumstances where the supermarket had been noticing irregularities regarding the accounts of the drinks department of that supermarket. The covert cameras covered a specific area of the supermarket where the complainant worked and were in place for a limited period of two weeks. The domestic courts considered that there had not been any other equally effective means to protect the employer’s property rights, which would have interfered, to a lesser extent with the applicant’s right to respect for her private life, a finding that the ECHR was in agreement with. The ECHR went on to state that the stock taking carried out in the drinks department could not clearly link the losses discovered to a particular employee and that surveillance by supervisors or colleagues or open video surveillance did not have the same prospects of success in discovering the source of the theft. The ECHR concluded that there was nothing to indicate that a fair balance had not been achieved between the applicant’s right to respect for her private life under Article 8 and both her employer’s interest in the protection of its property and the public interest in the proper administration of justice.

107. On the final part of the test, this office considers that NGI has demonstrated that its legitimate interest in detecting and investigating a theft by an NGI employee and exonerating innocent employees took precedence over your rights and freedoms as a data subject.”

118. It was in light of, inter alia, the foregoing analysis that the Commissioner came to the view, expressed at para. 108 of the decision, namely, that the NGI had a legitimate basis for processing the Appellant’s personal data by installing a covert CCTV camera, having regard to s. 2(A)(1)(d) of the Acts which, in the manner explained, reflects Article 7(f) of the Directive.

119. In short, the Appellant is entirely mistaken as to the meaning and effect of Article 7(f). Furthermore, insofar as he suggests that the balancing exercise which gives effect to the final clause in Article 7(f) was not carried out, this is plainly not so.

120. Once again, the foregoing issue does not seem to me to be a point of law, so much as unhappiness with the outcome of the decision. For the avoidance of doubt, the Appellant has identified no error in respect of the balancing exercise which was, in fact, conducted by the Commissioner. Nor does it appear to me that, in his appeal to the Circuit Court, the Appellant alleged any error with respect to the balancing exercise.

121. In short, it is the result of the exercise with which the Appellant takes issue. He has certainly not established any misinterpretation of the Acts or parent Directive. Nor is this point expressed in the Appellant’s his originating motion.

Criminal Surveillance Act 2009

122. At paras. 39 and 40 of the Appellant’s written submissions, he asserts that: “Under the Criminal Surveillance Act 2009 certain steps must be taken before An Garda Síochána can initiate a covert surveillance. A primary step is that a senior ranking officer must seek Judicial Approval before carrying out such a surveillance. I do not believe that the Garda involved in this matter was a senior ranking officer, nor was Judicial Approval obtained” going on to submit, inter alia, that: “The Commissioner appears to be of the opinion that any member of the public occupying a premises has more powers to install covert surveillance equipment than the State agencies normally tasked with carrying out such surveillance.” The Appellant proceeds to refer to his request for the PULSE report/Garda’s notes and characterises the refusal of these and his failure to obtain same on discovery as “a significant error”.

123. In circumstances where no appeal was ever made in respect of the Circuit Court’s order (8 July 2021, perfected on 16 July 2021) refusing discovery, I reject the proposition that a failure to provide this documentation to the Appellant can amount to what he appears to characterise, variously as (i) a significant error; (ii) a breach of fair procedures; and (iii) a point of law in respect of this appeal.

124. It must also be kept in mind that what the Commissioner was required to decide was whether there had been a breach of the Acts. Her jurisdiction did not extend to a consideration of compliance with other legislation. Unsurprisingly, therefore, questions in respect of the 2009 Act were never decided in the decision. Thus, they played no part in the statutory appeal to the Circuit Court and, in my view, cannot conceivably constitute a point of law in the present appeal.

125. For the sake of completeness, s. 2 of the 2009 Act, which deals with its application, begins as follows:-

“2. (1) This Act applies to surveillance carried out by members of the Garda Síochána, designate officers of the Ombudsmen Commission, members of the Defence Forces and officers of the Revenue Commissioners.”

126. It is perfectly clear from the foregoing that the 2009 Act does not apply to the activities of the NGI. Thus, it cannot have been an error for the Commissioner not to have decided questions with respect to the 2009 Act. On the contrary, had she purported to do so (and she certainly did not), she would have had no jurisdiction to determine such questions.

127. In short, and regardless of how sincerely the Appellant may believe otherwise, the 2009 Act plays no part in the jurisdiction of the Commissioner, the Circuit Court, or this Court. In my view, this was not a point of law, nor is it identified in the originating motion.

Documents - collateral attack

128. On the question of documents, it is appropriate to note that, when the Appellant made submissions to the Commissioner on 13 August 2019, in response to the draft decision, he did not assert that the absence of any documentation prevented him from fully engaging with the Commissioner. That being so, it does not seem to me that the question of documents featured or could feature, in the statutory appeal to court (other than in the context of the discovery process which reached a final conclusion in the form of the July 2021 order, which the Appellant chose not to appeal). For these reasons, I am satisfied that any issue concerning the absence of documents is simply not a point of law, nor is it identified in the Appellant’s motion.

129. Rather than truly being a point of law, the Appellant’s submissions to this Court with respect to documentation, appear to be a collateral attack on a final order of the Circuit Court, which refused discovery, no appeal against that order ever having been brought.

6 December 2010 access request

130. Complaint 4, as made by the Appellant to the Commissioner, related to the Appellant’s 6 December 2010 access request. A theme in his submissions to this Court is that the Commissioner erred in finding that the NGI did not breach s. 4 of the Acts and that the Circuit Court erred insofar as it did not set aside the Commissioner’s decision. Rather than being a point of law, the foregoing seems to me to be a challenge to the merits of the decision.

131. Without prejudice to the foregoing, it is appropriate to quote para. 113 of the decision wherein the access request is described as follows:-

“113. In your complaint, you alleged that NGI had failed to comply with an access request submitted to it by you on 06 December 2010. You asserted that NGI refused you access to two categories of data. These were firstly correspondence in relation to various matters either sent by you or sent to you, which NGI refused on the grounds that the work in retrieval and compilation would be inordinate. Secondly, it included any correspondence relating to your High Court proceedings against NGI. You stated that, as you had requested to inspect these files rather than receive a copy, their retrieval and compilation would not have been inordinate. You further stated that the High Court case referred to was unprosecuted since 2004 and was therefore, un–prosecutable. You stated that NGI would have been aware of this at the time of your access request and was merely using it as an excuse to withhold files. You stated that the withholding of these two categories of data added further proof that NGI were keeping cover files relating to you. You provided this office with a copy of your access request to NGI dated 06 December 2010 which states:

‘I hereby request, under the Freedom of Information and Data Protection Acts, that all files with the Gallery holds relating to me and my personal data, whether hardcopy or electronic and including minutes taken at meetings, be made available to me for my inspection’”.

132. It is uncontroversial to say that the foregoing request is made in the widest of terms. It is a request to inspect each and every piece of data, of whatever nature, going back approximately two decades (taking into account when the Appellant began working in the NGI).

133. Paras. 31 and 32 of the Appellant’s affidavit, sworn on 9 December 2019 (to ground his appeal to the Circuit Court) stated the following:-

“31. Considering the amount of monitoring carried out that I am aware of, such as the retention of data, phone monitoring, covert email monitoring, covert cameras, it wouldn’t take a great leap of imagination to suspect that the Head of Administration’s files on me might have included Private Investigator’s reports and phone tapping reports, but I can’t prove it, but I suspect it. It was the files that the Head of Administration refused to show me that I wanted to see. I could not be specific as I wasn’t sure what they were, and the files were hidden and covert.

32. The complaints made against me by those I supervised were not upheld by the Equalities Tribunal, nor were they upheld in the subsequent appeal to the Labour Court”.

134. On any analysis, the foregoing averments include speculation which is not underpinned by any evidence. Furthermore, with respect to the Appellant’s references to the “Head of Administration” and “complaints” made against him, it seems uncontroversial to say that it was within the power of the Appellant, at all material times, to say that he wished to see documents relating to complaints against him and/or documents held by the Head of Administration. The foregoing would certainly appear to comprise identified sub–sets of the Appellant’s 06 December 2010 data access request (which was for all data, in whatever format). This observation seems appropriate in light of the obligations which rested on the Appellant pursuant to s. 4(3) and which formed part of the Commissioner’s consideration in the manner presently explained.

135. The analysis and findings by the Commissioner can be seen from paras. 129 to 131, inclusive and it is appropriate to set these out verbatim:-

“129. Through the investigation of your complaint, this office established that you submitted an access request to NGI via email dated 06 December 2010. In your request, you specifically requested access to inspect your personal data. NGI advised you that your personal data was available for your inspection by way of letter dated 10 January 2011. This office established that the provision of this cohort of your personal data in response to your access request was inside the statutory 40-day period as set out in the Acts.

130. Further, I now have regard to the obligation upon a data subject in Section 4 (3) of the Acts which states:

‘an individual making an access request shall supply the Data Controller concerned with such information as he may reasonably require in order to locate any relevant personal information’.

This office’s interpretation and application of s. 4 (3) is as follows. While a data subject has a statutory right of a copy of any personal data, which is held about him or her by an organisation, the Acts also place certain obligations on a data subject, when exercising their right of access, to enable a data controller to locate their personal information. In circumstances where NGI had requested that you provide information in order to enable it to identify and locate any outstanding personal data, in circumstances where you had been an employee of NGI over 22 years, and you failed to do so, I find that NGI responded to your access request to the extent possible.

131. On the basis of the above, I find that NGI did not contravene s. 4 of the Acts as it provided you with access to your personal data to the extent possible within the statutory timeframe, in that it provided access to a certain amount of your personal data and sought clarification from you regarding what you considered to be outstanding, which you failed to provide”. (emphasis added)

136. It cannot be disputed that the Acts contain an explicit provision, in the form of s. 4 (3), which entitled the NGI to act as it did, namely, to ask the Appellant for additional information. The Commissioner found as a fact that the Appellant failed to respond to the NGI’s request. No evidence was put to this Court to suggest that the foregoing facts were infirm. Nor did the Appellant contend in his appeal to the Circuit Court that he had, in fact, replied to the NGI’s request for information to enable the data controller to identify and locate any outstanding personal data. Neither did the Appellant submit, in response to the Commissioner’s draft decision, that he had in fact provided the information requested of him pursuant to s. 4(3).

137. Whilst the Appellant submits that a data access request was made but not addressed properly, he singularly fails to address his obligations pursuant to s. 4 (3). In my view, this is not a point of law. The fundamental question posed by the Appellant can fairly be put as follows: did the Commissioner err by not relieving the Appellant of the obligation to supply information which, pursuant to s. 4 (3), he “shall supply” to the NGI?

138. This question is not even statable in my view, as well as not having been argued before the Commissioner, or on appeal to the Circuit Court. Nor is it identified in the originating motion.

Involvement in legal proceedings

139. Earlier in this judgment, I quoted para. 5.3 of Hedigan J.’s decision in Dublin Bus v. Data Commissioner [2012] IEHC 339. The matter came before the court as an appeal on a point of law, pursuant to s. 26 (3) (b) of the Acts, from a decision of the Circuit Court. This Court held that the existence of legal proceedings between a data subject and a data controller did not preclude the former making an access request under the Acts nor justified the latter in refusing such a request.

140. With reliance on Dublin Bus, the Appellant submits to this Court that the NGI’s involvement in legal proceedings was not a valid basis for data access refusal. Crucially, however, the Commissioner did not purport to rely on the existence of legal proceedings as a basis for refusal. On the contrary, and as noted earlier, the Appellant’s failure to comply with the requirements of s. 4 (3) was relied on.

141. On a plain reading of s. 4, it does not provide an unqualified right of access to an individual in the Appellant’s position. This is made clear in the very first words of s. 4 (1) which begin:-“Subject to the provisions of this Act…”. In other words, s. 4 is not an ‘a la carte’ menu, where the Appellant is free to insist on rights pursuant to s. 4 (1) whilst simultaneously ignoring obligations pursuant to s. 4 (3).

Barbulescu v. Romania

142. Among the submissions made to this Court is that the Commissioner failed to consider and apply the decision in Barbulescu v. Romania [2017] ECHR 742 (and that the Circuit Court similarly erred). The Appellant’s complaint (no. 5) in respect of email monitoring was dealt with by the Commissioner at paras. 132 to 171, inclusive of the Decision. The Commissioner did not have the jurisdiction to consider ECHR breaches. Leaving that aside, it is appropriate to quote para. 161 to 164, inclusive, of the decision:-

“161. In assessing whether NGI struck a fair balance between your right to privacy and NGI’s right to safeguard its legitimate interest, I have had regard to the judgment of the Grand Chamber of the European Court of Human Rights in the case of Barbulescu v. Romania [2017]. This case relates to the monitoring of an employee’s instant messages by his employers. Mr. Barbulescu was a Romanian engineer who was asked by his employer to set up an instant messaging account for work purposes. Mr. Barbulescu also used the instant messaging service to contact his fiancée and brother. Mr. Barbulescu’s employer monitored his messaging actively and, ultimately, dismissed him on the grounds of using company resources for personal purposes. Mr. Barbulescu felt that this was in breach of his privacy rights and exhausted his claim in the Romanian courts and European Court of Human Rights when the case eventually came before the Grand Chamber.

162. The Grand Chamber found that when balancing the rights to privacy of the employee and the legitimate interests of the employer to monitor communications in the workplace the following factors need to be taken into consideration:-

(i) was there prior notice of the monitoring?

(ii) the scope of the monitoring and its necessity i.e., monitoring the amount of personal communication as opposed to the content of personal correspondence;

(iii) did the employer have a legitimate interest in monitoring the communications?

(iv) were there less privacy intrusive methods available to the (sic) same result?

(v) consideration of the consequences and impact of the monitoring”.

143. Although it involves repetition, it is appropriate to continue by quoting paras 163 and 164 as follows:-

“163. NGI provided you with prior notice of this type of monitoring in its “Code of conduct for users of computing resources”. I also note that the monitoring of your email communications was narrow in scope, as NGI only reviewed five emails that had been flagged as security sensitive, and therefore had a legitimate interest to do so as these may have raised security concerns. I consider that in this instance NGI used the least privacy intrusive method available to it as it utilised software that only flags emails that contain weighted security sensitive words, which does not cause a substantial adverse impact to your right to privacy as an individual.

164. On the final part of the test, this office considers that NGI has demonstrated that the potential risk to the security of NGI, and the assets housed there, was of such a serious nature that it validated this manner of the processing of your personal data, especially in circumstances where you were aware that using NGI computer resources to transmit or receive sensitive or confidential information was not permitted as per the NGI Code of Conduct for users of computer resources. Therefore, I consider that NGI’s pursuit of its legitimate interest took precedence over your rights and freedoms as a data subject”.

144. Barbulescu was concerned with the scope of rights pursuant to Article 8 of the European Convention on Human Rights. As mentioned earlier, the Commissioner is not tasked with such determinations, but plainly considered Barbulescu in the context of a carefully conducted balancing exercise with respect to, on the one hand, the legitimate interests of the NGI, and, on the other hand, the Appellant’s rights, freedoms and interests (per s. 2 A (1) (d)).

145. The outcome of this careful assessment by the Commissioner was her decision that the NGI had a legal basis for processing the data contained in the relevant email messages, pursuant to s. 2 A (1) (d) of the Acts. Yet again, it is this outcome that the Appellant takes issue with, having singularly failed to identify any error.

146. It should also be said that the Appellant is entirely mistaken in his submission that Barbulescu is authority for the proposition that it was unlawful for the NGI to have looked at the contents of any emails sent by/to him without seeking and obtaining his explicit permission.

Key words

147. With regard to the Appellant’s submissions that a certain employee did not join the NGI until 2004 and, therefore, he contends, could not have had input into the drawing up of key words, it is entirely unclear what point this is directed at. What is perfectly clear, however, is that no evidence on this issue has been put to the court, other than assertions. The alleged error has not been identified. Nor was this something which featured in the Appellant’s submissions to the Commissioner in response to the draft decision, or during the Circuit Court appeal. By contrast, the significance which key words play in the context of the email security within the NGI is made clear in the following section from the decision:-

“(Complaint 5) Email monitoring

132. In your complaint, you alleged that NGI covertly monitored personal emails sent and received by you using NGI IT facilities using the programme “Mail Sweeper”, without your prior knowledge or consent.

133. This office requested that NGI outline the legal basis for processing your personal data as outlined in your complaint.

134. NGI informed this office, by way of background, that all incoming and outgoing emails to the NGI domain are routed through a mail gateway system. This is used to block potentially hazardous file attachments, spam filtering, profanity scanning and security scanning. NGI advised this office that the part of the system that deals with the analysis of content is ‘Mailsweeper” which allows for the content of emails to be scanned for a number of specified keywords including security related words. If the content of an email contains certain keywords, which are contained in a lexicon or expression list, the email can automatically be quarantined, deleted, delivered and/or flagged. NGI advised that keywords can either be set to be detected or weighted, meaning that the keyword is given a value and once the total value of a content scan is greater than 10 then the message is fluffed for rerouting dependent on the filtering classification. NGI advised this office that security is a major concern for NGI as custodian of the National Collection, and as email is an unsecured way of communicating, emails are scanned for security related keywords. The words on the expression lists were generated by the NGI IT department following instruction from NGI’s Head of Security and NGI’s Registrar and the specified words are stored on expression lists, which can be updated and expanded over time with the facility to give weighting to certain words so that they can be flagged for potential security alerts. NGI informed this office that the alleged system is an automated process. When an outgoing or incoming email is scanned for content and if words on the expression lists are detected and weighted, the email will still issue to the intended recipient. However, the content scanner will also send an email to NGI Head of Security and to the IT department. This email is a standard email, which includes a HTML file listing the words, which have been detected, and a copy of the email. NGI Head of Security is the main contact for dealing with the alerts and the IT manager is available as backup. The IT manager looks at the detected words first and then reviews the relevant emails if necessary. NGI had previously advised this office on 26 April 2011 that in this instance the keywords that prompted the Mailsweeper system to identify the emails as a potential security risk were Security, Security Room and Rapier, which as (sic) the name of the security firm in which the recipient of the email was working. NGI provided this office with documentation in which it was alleged that you had sent confidential information in relation to NGI’s security operations to a third party”.

148. Even though para. 135 may have been quoted earlier in this judgment, it is appropriate to set it out here for the sake of clarity:-

“135. NGI advised this office that on 05 and 06 October 2010, the IT Manager received three and two alerts respectively from the mail gateway regarding emails and a number of attached documents from your NGI mailbox. The emails concerned were sent from you to a former employee of a security company engaged by NGI. NGI stated that on becoming aware of these emails, and at the request of NGI’s Senior Management, on 05 October 2010, the IT manager backed up a copy of your NGI mailbox and that the five emails concerned were then the subject of an “internal HR investigation” which ultimately resulted in the termination of your employment following disciplinary proceedings. NGI provided this office with a copy of its IT policy, which was rolled out in 2003. In this policy dated 03 April 2003, which states under the heading “Electronic Mail Policy” “All incoming and outgoing e-mail attachments are blocked automatically by mailsweeper software. You are required to request the release of blocked e - mail by contacting the IT unit by e - mail”. NGI also provided this office with a signed and dated copy of the “National Gallery of Ireland Code of Conduct for users of computing resources” which states “I have read the Code of Conduct for users of computing resources and agree to comply with its contents” signed by you and dated 11 June 2003. NGI stated that this processing was legitimised under s. 2 A (1) (d) of the Acts”.

149. The Commissioner’s careful analysis proceeds from para. 136 to 164 inclusive and this is followed by her finding, at para. 165, that the NGI had a legal basis for processing the Appellant’s data contained in email messages, under s. 2 A (1) (d).

Signed Code of Conduct

150. What the Commissioner stated (at para. 135) in respect of the IT Code of Conduct reflects precisely the contents of same, as signed by the Appellant on 11 June 2003.

151. Towards the end of the hearing before me, the Appellant asserted that, whilst he signed the IT policy, he did not sign it in June 2003 (he contends that he signed it in April of that year). Nothing turns on the foregoing but it seems fair to say that his oral submission is impossible to square with the fact that, as noted earlier, the Appellant has exhibited the self–same IT policy, bearing his signature and the 11 June 2003 date, which exhibit he has described as: “DF 15 NGI IT Policy as signed by the Appellant June 2003” (emphasis added).

152. Whilst it involves repetition, it is appropriate to recall the contents of para. 1 on the second page of this Code, which states:-

“1. While everyday network traffic or information stored on NGI equipment is not normally monitored, it may be necessary to monitor if there is reason to suspect that this Code of Conduct is being breached, or for purposes of systems administration, backup or problem-solving. You must therefore be aware that such monitoring may occur”. (emphasis added)

153. It will also be recalled that p. 1 of the Code of Conduct made explicit that users were not permitted, inter alia, to: “8. Use computer resources to transmit or receive sensitive and/or confidential information”.

154. In short, as and from June 2003, the Appellant was squarely on notice of the fact that monitoring of emails might take place. With respect to his submission to this Court to the effect that the only way the NGI could have identified the emails in question was if they were actively monitoring all of his emails or trawling through same, this is nothing more than a bare assertion, devoid of any evidence. It also seems to me to comprise another attempt by the Appellant to try and re–run the hearing which took place before the Commissioner. No error has been made out. Furthermore, even if the Appellant had established, by means of evidence that, say, ten (as opposed to five) of his emails had been “flagged” (and he has certainly not proffered evidence to establish this), it would fall very well short of an error of law sufficient to satisfy the test outlined by the Court of Appeal in Nowak [2022] IECA 95, wherein the court, from paras. 54 to 56 referred to Fitzgibbon, Davis and Deely.

Lack of a copy

155. Late in his submissions, the Appellant asserted that he did not have a copy of the IT policy/ Code of conduct at the time of the Commissioner’s decision. Whether or not this is so, the following can fairly be said:-

(i) the Appellant acknowledges that he saw, and signed, this policy in 2003 under the statement “I have read the Code of Conduct for users of computing resources and agreed to comply with its contents”;

(ii) whether he was given a copy of the policy at that time and, if so, what he did with it, was not addressed in evidence before this Court;

(iii) the Appellant did not raise this as an issue with the Commissioner when making submissions on the draft decision;

(iv) the Appellant was provided with a copy, under cover of a letter dated 2 July 2021, which was sent to him by the Commissioner’s solicitors by way of voluntary discovery (the letter and copy policy comprises exhibit “SS - D 1” to the affidavit of Ms. Sandra Skehan sworn on 5 July 2021);

(v) the issue was not raised either in the Appellant’s motion to the Circuit Court;

(vi) the issue was not referred to in the Appellant’s originating motion with respect to the appeal to this Court.

“Unfriendly dog”

156. In the wake of counsel for the Respondent highlighting the numerous issues which the Appellant seeks to raise anew in this appeal, which he failed to raise in submissions to the Commissioner in response to her draft decision, the Appellant responded by saying: “You can only kick a dog so many times until it decides it’s not your friend”. The thrust of his submission was to suggest that raising issues with the Commissioner would have been futile, also submitting, inter alia, that: “If I’d have tackled what they were saying, we’d have been another four or five years down the road”.

157. What I took from these submissions is that the Appellant regarded the process and the time it had taken as being so unsatisfactory that he felt it would be pointless to make further submissions.

158. Irrespective of whether this view was sincerely held, there was no evidence before this Court to justify any criticisms of the process before the Commissioner (or the Circuit Court). Thus, the Appellant’s expressed views are not underpinned by fact.

159. Furthermore, a choice not to make submissions in advance of the decision does not, by any means, entitle one to ‘keep in reserve’ issues which could, and should, have been raised at that point.

160. The Appellant developed his submissions on the foregoing theme by suggesting that the process had taken some three years and: “This was presented as the last kick; this was the knockout punch that they thought I would have no answers to, but I have answers”. The gravamen of the Appellant’s submissions to this court was that, upon receiving the Commissioner’s draft, he regarded the decision as a fait accompli and, for this reason, he did not furnish additional information to the Commissioner.

161. Underpinning this submission is the proposition that the Commissioner’s invitation to both sides to make submissions with respect to the draft decision was no more than a ‘sham’ process, the outcome of which was predetermined. This suggestion is as unfair to the Commissioner as it is utterly devoid of an evidential basis. This is all the more so, given the obvious care, professionalism and scrupulous fairness with which the Commissioner approached the task entrusted to her by the Oireachtas. Submissions along these lines must be deprecated. Nor does the foregoing comprise a point of law disclosed in the notice of motion. It is nothing more than a baseless, and therefore wholly inappropriate, allegation of pre-judgment, unsupported by evidence.

S.8 of the Acts

162. Insofar as the Appellant submits to this Court that the Commissioner erred by misapplying or misinterpreting s. 8 of the Acts, the following can be said:-

(i) This was not raised by the Appellant in submissions to the Commissioner in respect of the draft decision;

(ii) This was not pleaded in the Appellant’s 9 December 2019 motion in respect of his appeal to the Circuit Court;

(iii) This was not raised in the Appellant’s originating motion in respect of the present appeal; and

(iv) The Commissioner did not decide the Appellant’s complaint on the basis of s. 8 of the Acts.

163. A plain reading of the decision reveals that, whilst the NGI referred to s. 8 (see, for example, para. 77 of the decision wherein, under the heading “Complaint (3) Covert CCTV”, the decision records, inter alia, “NGI stated that this processing was legitimised under section 2A(1)(d) and section 8(b) of the Acts”), the Commissioner ultimately decided the matter on the basis of s. 2A(1)(d) of the Acts (see para. 108).

164. In short, s. 8 cannot feature in this appeal, in circumstances where the Commissioner made no findings in respect of s. 8 and, thus, s. 8 cannot have featured in the Circuit Court’s decision against which the Appellant seeks relief from this Court.

Excessive deference/apparent bias

165. Whilst the Appellant submitted that the Circuit Court showed excessive deference to the Commissioner and displayed apparent bias, these are no more than bare assertions.

166. They are not assertions which featured in the Appellant’s oral submissions. Neither were developed in any way or underpinned by a shred of evidence, bearing in mind that, as a general proposition, an appellate body is required to show appropriate deference to the first-instance decision maker as the finder of fact.

167. What the Appellant means by excessive deference has not been explained. No facts or legal principles have been furnished which even articulate an alleged error. An Appellant in this position needs to do far more than merely assert a wrong, but the Appellant has done no more than this.

168. Lest the Appellant has not abandoned the suggestion that the Circuit Court displayed apparent bias, I am entirely satisfied that he has advanced no evidence whatsoever to support the allegation (see Orange Communications Ltd v. Director of Telecommunications Regulation (No. 2) [2000] 4 IR 159).

169. I took the opportunity to read, with care, the DAR transcript of the entire Circuit Court proceedings and a reading of same offers no support for any allegation of bias. What emerges from a reading of the transcript is that counsel for the Respondent made submissions in the normal way and the learned Circuit Court judge encouraged the Appellant to do likewise (i.e. to make submissions with respect to the key points in his appeal, as opposed to reading long passages from written submissions).

170. Given the time constraints, of which all parties were aware, and the fact that the learned Circuit Court judge had access to all the written material, as he confirmed more than once, what emerges is a commitment on the part of the Circuit Court to try and assist the Appellant, who represented himself, as regards conducting his case efficiently and appropriately. There is simply no question of the learned Circuit Court judge’s approach being inconsistent with relevant authorities [see, for example, Tracey v. Burton & Ors [2016] IESC 16 (Supreme, MacMenamin J., p. 45); Ross v. Bank of Scotland Plc & Anor [2020] IECA 34 (Court of Appeal, Whelan J., p. 63)].

In summary

171. To draw this judgment to a conclusion, this Court has no jurisdiction to consider a point of law not identified in the Appellant’s originating notice of motion. None was identified and the appeal must fail.

172. Lest I be wrong to determine the matter on the foregoing basis, I am satisfied that the plethora of points which the Appellant has sought to raise in this appeal comprise a combination of (i) an attempt to re-run, on the merits, the process which took place before the Commissioner; and (ii) an invitation to this Court to reach a different decision, based on bare assertions unsupported by evidence, with respect to issues that were not raised before the Commissioner or before the Circuit Court; and which include a collateral attack on the Circuit Court’s discovery order.

173. On 24 March 2020 the following statement issued in respect of the delivery of judgments electronically: “The parties will be invited to communicate electronically with the Court on issues arising (if any) out of the judgment such as the precise form of order which requires to be made or questions concerning costs. If there are such issues and the parties do not agree in this regard concise written submissions should be filed electronically with the Office of the Court within 14 days of delivery subject to any other direction given in the judgment. Unless the interests of justice require an oral hearing to resolve such matters then any issues thereby arising will be dealt with remotely and any ruling which the Court is required to make will also be published on the website and will include a synopsis of the relevant submissions made, where appropriate.”

174. On the question of costs, and for the benefit of the Appellant who is not legally represented, the general rule is that "costs follow the event", meaning that the successful party is entitled to an order for costs against the unsuccessful party. As the Supreme Court (McKechnie J.) made clear in Godsil v Ireland [2015] IESC 103, (at para. 23):

"23. The general rule is that costs follow the event unless the court otherwise orders: O. 99, r. 1(3) and (4) of the Rules of the Superior Courts (“RSC”). This applies to both the original action and to appeals to this Court (Grimes v. Punchestown Developments Co. Ltd & Anor [2002] 4 IR 515 (“Grimes”) and S.P.U.C. v. Coogan & Ors (No.2) [1990] 1 I.R. 273). Although acknowledged as being discretionary, a court which is minded to dis-apply this rule can only do so on a reasoned basis, clearly explained, and one rationally connected to the facts of the case to include the conduct of the participants: in effect, the discretion so vested is not at large but must be exercised judicially (Dunne v. The Minister for the Environment, Heritage and Local Government & Ors [2008] 2 IR 775 at 783-784) (“Dunne”). The “overarching test” in this regard, as described by Laffoy J. in Fyffes plc v. DCC plc & Ors [2009] 2 IR 417 (“Fyffes”) at p. 679, is justice related. It is only when justice demands, should the general rule be departed from. On all occasions when such is asserted the onus is on the party who so claims."

175. Later in the same judgment, McKechnie J stated (at para.52):

"Costs Follow the Event:

52. The overriding start point on any question of contested costs is that the general principle applies that namely, costs follow the event. All of the other rules, practises and approaches are supplementary to this principle and are designed to further its application or to meet situations where such application is difficult, complex or indeed even impossible.”

176. In Veolia Water UK plc-v-Fingal County Council [2006] IEHC 240, Clarke J (as he then was) stated (at 2.5):

"...the overriding starting position should remain that costs should follow the event. Parties who are required to bring a case to court in order to secure their rights are, prima facie, entitled to the reasonable costs of maintaining the proceedings. Parties who successfully defend proceedings are, again prima facie, entitled to the costs to which they have been put in defending what, at the end of the day, the court has found to be unmeritorious proceedings. Similarly it seems to me that the courts generally (and the Commercial Court in particular) should be prepared to deal with the costs of contested interlocutory applications on the basis of an analysis of whether there were proper grounds for bringing, on the one hand, or resisting, on the other hand, the relevant application."

177. The Respondent has been entirely successful, the “event” being this Court’s decision that the Appellant’s ‘point of law’ appeal case falls to be dismissed. The general rule now has statutory expression in the form of s.169 (1) of the Legal Services Regulation Act, 2015 ("the 2015 Act") which states:-

“169 (1) A party who is entirely successful in civil proceedings is entitled to an award of costs against a party who is not successful in those proceedings, unless the court orders otherwise, having regard to the particular nature and circumstances of the case, and the conduct of the proceedings by the parties, including—

(a) conduct before and during the proceedings

(b) whether it was reasonable for a party to raise, pursue or contest one or more issues in the proceedings,

(c) the manner in which the parties conducted all or any part of their cases,

(d) whether a successful party exaggerated his or her claim,

(e) whether a party made a payment into court and the date of that payment,

(f) whether a party made an offer to settle the matter the subject of the proceedings, and if so, the date, terms and circumstances of that offer, and

(g) where the parties were invited by the court to settle the claim (whether by mediation or otherwise) and the court considers that one or more than one of the parties was or were unreasonable in refusing to engage in the settlement discussions or in mediation.”

178. In short, the entirely successful party (in this case the Respondent) enjoys a presumptive statutory right to their costs, and I have not identified anything in the nature and circumstances of the case or the conduct of the parties which would justify a departure from the normal rule/s.169. Therefore, my preliminary, but strongly-held, view is that the appropriate approach to costs in the present case is to follow the normal rule and to make an order for the Respondent’s costs against the Appellant.

179. The parties should correspond with each other, forthwith, regarding the appropriate form of order, including as to costs, to be made. In default of agreement between the parties on any issue, short written submissions should be filed in the Central Office within 14 days of the beginning of Michaelmas Term (i.e. no later than 5pm on 16 October).

	[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback]
	High Court of Ireland Decisions
You are here: BAILII >> Databases >> High Court of Ireland Decisions >> Fox v The Data Protection Commissioner (Approved) [2023] IEHC 529 (25 September 2023) URL: http://www.bailii.org/ie/cases/IEHC/2023/2023IEHC529.html Cite as: [2023] IEHC 529

High Court of Ireland Decisions