Reform needed to deal with ‘multiplicity’ of appeals in data protection cases, court says

Comments made when dismissing the third appeal brought by former National Gallery of Ireland attendant

Reform is “long overdue” of the law that allows those unhappy with decisions of the Data Protection Commissioner (DPC) to bring “a multiplicity of appeals”, the Court of Appeal (CoA) has said.

The court made the comments when dismissing the third appeal brought by former National Gallery of Ireland (NGI) attendant David Fox over part of a decision of the DPC rejecting his complaints in relation to access to his data held by his then employer.

Mr Fox worked for the NGI for 20 years before his employment was terminated in November 2011.

In 2014, Mr Fox was awarded €25,000 by an Employment Appeals Tribunal for unfair dismissal. The tribunal found the NGI was defective in the procedures used or adopted to terminate his employment.

READ MORE

It found compensation was the appropriate remedy because it considered that he himself “contributed significantly to his dismissal”.

The tribunal had heard the dismissal arose after NGI decided Mr Fox compromised the security of the national collection by a gross breach of protocols and a lack of common sense.

The NGI said he had done so by aiding a former colleague, working for an outside agency, in preparing a submission for the Rights Commissioner service. The preparation was done by internal email and, NGI claimed, disclosed sensitive security information.

Mr Fox, who was an active trade union representative, said he was asked by the former colleague, who worked on night security and had been dismissed due to an incident at the NGI, for assistance in preparing for a submission to the Rights Commissioner.

Mr Fox said the former colleague’s submission was atrocious and needed to be corrected and tidied up but he did not accept that there was any breach of security or that the emails contained any sensitive information.

Before his own dismissal, Mr Fox had submitted a data request on his personal information to NGI. He was not happy with the response and made a complaint to the DPC.

By 2016 that complaint was reformulated and in 2019 the DPC found in his favour on a number of points but was against him on others.

He brought a Circuit Court appeal in relation to the findings not in his favour.

These included that, in circumstances where the NGI was faced with the theft of property from a secure storeroom and this theft raised further security concerns, that it had a legitimate interest in processing Mr Fox’s personal data by installing a covert security camera to detect an offence.

The DPC also found NGI had a legal basis for processing the data in the emails.

The Circuit Court found against him and he appealed to the High Court.

The High Court rejected his appeal, saying he had failed to identify any point of law that showed an error by the decision maker and that is the only basis on which the higher courts can deal with such appeals.

He brought a further appeal to the CoA which, on Thursday, also dismissed it.

Mr Justice Seamus Noonan, on behalf of the three-judge CoA, said he failed to address a single infirmity in the DPC decision, despite three appeals in which he failed to identify a point of law.

“The consequences of this relentless pursuit of spurious appeals are serious for both parties and in particular the appellant himself, who will likely be faced with a potentially ruinous order for the costs of all this unnecessary litigation”, he said.

If he is unable to pay those costs, then the taxpayer must do so, he said.

The “multiplicity of appeals provided for under the Data Protection Acts” was previously the subject of comment by the CoA, he said.

There was no obvious justification for so many appeals in this instance and, as this case amply demonstrated, the effect is great delay, enormous cost and a significant drain on court resources, which is not in the interests of the parties or the public.

“Reform is long overdue,” he said.