High Court dismisses appeal where limited data request was fulfilled within statutory time limits.

[2018] IEHC 443

THE HIGH COURT

[2018 No. 54 C.A.]

County of Dublin

IN THE MATTER OF THE DATA PROTECTION ACTS, 1988 AND 2003

AND IN THE MATTER OF AN APPEAL PURSUANT TO SECTION 26 OF THE DATA PROTECTION ACTS, 1988 AND 2003

BETWEEN

AGNIESZKA NOWAK

APPELLANT

AND

THE DATA PROTECTION COMMISSIONER

RESPONDENT

JUDGMENT of Mr. Justice McDermott delivered on the 12th day of July, 2018.

1. This is an appeal from an order of the Circuit Court (Goarke P.) made 6th February, 2018 dismissing an appeal against a decision

made by the respondent on 9th December, 2016 pursuant to s. 26(3) of the Data Protection Acts, 1988 and 2003 (the Acts). An

appeal against the respondent’s decision under s. 10 of the Acts may be brought to the Circuit Court and thereafter to the High Court

on a point of law. Section 26 provides:-

“26.—(1) An appeal may be made to and heard and determined by the Court against—

…

(d) a decision of the Commissioner in relation to a complaint under section 10(1)(a) of this Act,

and such an appeal shall be brought within 21 days from the service on the person concerned of the relevant notice or,

as the case may be, the receipt by such person of the notification of the relevant refusal or decision …

(3)(a) Subject to paragraph (b) of this subsection, a decision of the Court under this section shall be final.

(b) An appeal may be brought to the High Court on a point of law against such a decision; and references in this

Act to the determination of an appeal shall be construed as including

references to the determination of any such appeal to the High Court and of any appeal from the decision of that

Court.”

2. Section 10(1) of the Acts provides that:-

“(a) The Commissioner may investigate, or cause to be investigated, whether any of the provisions of this Act have

been, are being or are likely to be contravened in relation to an individual either where the individual complains to

him of a contravention of any of those provisions or he is otherwise of opinion that there may be such a

contravention.

(b) Where a complaint is made to the Commissioner under paragraph (a) of this subsection, the Commissioner shall—

(i) investigate the complaint or cause it to be investigated, unless he is of opinion that it is frivolous or

vexatious, and

(ii) If he or she is unable to arrange, within a reasonable time, for the amicable resolution by the parties

concerned of the matter the subject of the complaint, notify in writing the individual who made the

complaint of his or her decision in relation to it the individual may, if aggrieved by the decision, appeal

against it to the Court under section 26 of this Act within 21 days from the receipt by him or her of the

notification.”

3. The appellant submitted a request under s. 4 of the Acts to her former employer, Intesa Sanpaolo Life Ltd. (ISPL), by letter dated

7th September, 2015 in which she sought:-

“A copy of all documents (emails, memos, minutes, letters, etc.), held by the Intesa Sanpaolo Life Ltd. on computer or in

manual which constitute “personal data”, within the meaning of that term as set out in the Data Protection Acts 1988 and

2003 namely:-

(1) entire copy of the personal file;

(2) TMS records since January 2011 including the overtime worked;

(3) emails between you and senior management of the Company regarding disciplinary matters which took place in

2011/2012 and recently;

… please bear in mind that if I am not satisfied with the response to my request I will, with no further notice to the

Company, make a complaint to the Data Protection Commissioner. … Finally, although the respondent has statutory 40

days to comply with the request I trust and will appreciate if the Company replies soonest.”

4. Section 4 of the Acts provides:-

“4-(1)(a) Subject to the provisions of this Act, an individual shall, if he or she so requests a data controller by notice in

writing-

(i) be informed by the data controller whether the data processed by or on behalf of the data controller include

personal data relating to the individual,

(ii) if it does, be supplied by the data controller with a description of –

(I) the categories of data being processed by or on behalf of the data controller,

(II) the personal data constituting the data of which that individual is the data subject,

(III) the purpose or purposes of the processing, and

(IV) the recipients or categories of recipients to whom the data are or may be disclosed,

(iii) have communicated to him or her in intelligible form –

(I) the information constituting any personal data of which that individual is the data subject and

(II) any information known or available to the data controller as to the source of those data unless the

communication of the information is contrary to the public interest, and

(iv) where the processing by automatic means of the data of which the individual is the data subject has

constituted or is likely to constitute the sole basis for any decision significantly affecting him or her, be informed

free of charge by the data controller of the logic involved in the processing, as soon as may be and in any event

not more than 40 days after compliance by the individual with the provisions of this section and, where any of the

information is expressed in terms that are not intelligible to the average person without explanation, the information

shall be accompanied by an explanation of those terms.

(b) A request under paragraph (a) of this subsection that does not relate to all of its subparagraphs shall, in the absence

of any indication to the contrary, be treated as relating to all of them.

…

(7) A notification of a refusal of a request made by an individual under and in compliance with the preceding provisions of

this section shall be in writing and shall include a statement of the reasons for the refusal and an indication that the

individual may complain to the Commissioner about the refusal.”

The appellant’s employer supplied her with documentation pursuant to her request under cover of letter dated 14th October, 2015.

5. The appellant made a complaint to the Data Protection Commissioner on 20th October, 2015 that her former employer had failed to

provide her personal data “such as”:-

“(a) Completed performance and development form 2014.

(b) Confidential mediation agreement between myself and Lorraine McIntyre.

(c) Follow-up email (dated 9th December, 2011 13:10) to the email from Dave Sheehan to Ruth O’Sullivan, John Spollen.

(d) Email from A. Nowak to John Spollen and Lorraine McIntyre cc Ruth O’Sullivan dated 6th February, 2012 10:40 and

follow-up email dated 6th February, 2012 11:01.

(e) Email Re: absence from Ruth O’Sullivan to Tommaso Sillan, Dave Sheehan dated 11th November, 2009 12:03.

(f) Email Re: absence/force majeure leave from A. Nowak to Ruth O’Sullivan dated 17th November, 2009 8:31 and follow-

up emails in this relation.

(g) Email from Ruth O’Sullivan to A. Nowak dated 25th January, 2012 11:06 Re: Break allowance.

(h) A great deal of other communication Re: matter which arose in April 2015 between Ruth O’Sullivan and John Spollen,

Dave Sheehan.”

The appellant made complaints about entries made into her email box by her employer and the clearance of its contents and an

alleged breach of the provisions of s. 4(7) by a failure to inform her that she had a right to make a complaint to the Office of the Data

Protection Commissioner if unsatisfied with the response to her request. In addition, she complained that there had been a failure to

comply with the obligation to notify her of any refusal in writing which ought to have included a statement of the reasons for the

refusal and an indication that she could take her complaint further. The appellant also complained that the employer failed to supply

“the description of personal data” and “to express the purpose of its holding and categories of recipients to whom the data are or

maybe disclosed”.

6. By letter dated 28th October, 2015 the Data Protection Commissioner advised the appellant that if there was any outstanding data

that she considered contained personal data relating to her, she should write to her employer setting out in writing in the form of an

itemised list what she considered to have been omitted from her personal data disclosure. It was advised that if she considered that

her request was not responded to in a satisfactory manner she could then contact the office again with a copy of the list of

outstanding items and a copy of any response received. The letter noted that it was not evident that her access request had been

refused and indicated that the complaint in respect of refusal or notification of refusal might not arise. Furthermore, it was pointed

out that it was not clear from the correspondence that she had made any specific request under s. 4 for a description of the data.

7. In reply by letter dated 11th November, 2015 the appellant indicated that she did not intend to communicate further with her

former employer on the matter and she exercised her rights under the Acts to make a complaint to the Data Protection Commissioner

as she was dissatisfied with the response to the request. She submitted that the Commissioner had an obligation to investigate her

complaint or cause it to be investigated unless it was considered to be frivolous or vexatious under section 10(1)(b)(i). Judicial review

was threatened in the event that investigation of her complaint was not commenced within fourteen days.

8. By letter dated 3rd December, 2015 the Commissioner informed the appellant that her complaint would be investigated using full

legal powers if necessary to resolve the matter. The letter informed her that the investigation would focus on the personal data which

she had alleged her former employer failed to supply as outlined in her letter of 20th October, 2015 quoted above and in respect of

the allegation that her former employer had failed to supply a description of personal data and express the purpose for holding that

data and the categories of recipients to whom the data are or may be disclosed under s. 4(1)(a)(ii) of the Acts. The issues

concerning allegations that the employer had unlawfully accessed her email account, cleared its contents and had contravened its

obligations under s. 4(7) of the Acts in failing to inform her of her right to submit a complaint to the Commissioner if dissatisfied with

the employer’s response to her access request were not ultimately pursued by the appellant. The letter also stated that the first step

in the investigation was to give the former employer about whom the complaint was made an opportunity to respond. Thereafter the

Commissioner would attempt to reach an amicable resolution to the matter under investigation. If that were not possible the

complainant might ask the Commissioner to make a formal decision under s. 10 as to whether a contravention had occurred.

9. The appellant’s employer having received a letter from the Data Protection Commissioner wrote to the appellant on 16th December

indicating that its letter of 14th October constituted a complete and comprehensive response to her data subject access request of

7th September.

10. The appellant wrote to the Commissioner on 18th December stating that this response was entirely unsatisfactory and requested

an on-site inspection by an authorised officer of the Commissioner as she alleged that her former employer was “deliberately and

unlawfully” withholding documents containing her personal data as set out in her complaint. She also requested reasons as to why the

Commissioner did not intend to investigate her complaint that her mailbox had been entered and cleared of its contents as set out in

her letter of 20th October. Legal proceedings were again threatened.

11. In the course of the investigation by the Commissioner, the appellant’s former employer submitted that it had made a substantive

response to the appellant’s request and pointed out that the copy of the access request provided to the Commissioner was not the

same as the access request letter dated 7th September, 2015 submitted to the employer. In particular, the employer informed the

Commissioner that in the third category of personal data requested the appellant sought “emails between you and senior management

of the Company regarding disciplinary matters which took place in 2011/2012 and recently”. The employer pointed out that in the

version of the access request provided to the Commissioner by the appellant the word “disciplinary” had been omitted. The

Commissioner was thereby led to understand incorrectly that a wider request had been made than the one actually made and

responded to by the employer. The Commissioner in its decision was satisfied that the two documents differed as claimed by the

employer though no issue ultimately turned on this point.

12. The employer also maintained that the access request made by the appellant was clearly limited to three categories of documents

as set out in the letter of 7th September. In respect of the additional personal data which was the subject of the complaint the

employer made the following observations as recorded by the Commissioner:-

“a [Completed Performance and Development Form 2014] – This was not requested by you and was not contained in your

personal file, TMS records or in the relevant emails;

b [Confidential Mediation Agreement] – As this was confidential it was never contained in your personal file, TMS records

or in the relevant emails;

c [Email dated 9th December, 2011 13:10] – This was furnished to you;

d [Emails dated 6th February, 2012 10:40 and follow up email dated 6th February, 2012 11:01] – These emails were not

amongst the categories of documents sought save where emails were contained on your personal file, which these emails

were not;

e [Email dated 11th November, 2009 12:03] – The only documents sought by you which predated 2011 were documents

contained on your personal file, which these emails were not;

f [Email dated 17th November, 2009 8:31 and follow up emails] – The only documents sought by you which predated 2011

were documents contained on your personal file, which these emails were not;

g [Email dated 25th January, 2012 11:06] – You did not request copies of emails to or from yourself. These emails did not

form part of your personal file or the emails that related to either of the disciplinary matters in 2011/2012 and 2015;

h “A great deal of other communications Re: matter which arose in April 2015 between Ruth O’Sullivan and John Spollen,

Dave Sheehan” – ISPL stated that the “matter” in question is not specified but it was assumed that you are referring to

your absence from work around that time. ISPL further stated that you had been supplied with any personal data relating

to this matter which fell within the scope of your request and that specifically stated that “it is simply a matter of fact

that there is no great deal of other communication containing personal data that can be copied to her”.

13. ISPL also denied that it had breached section 4(1)(a)(ii). It maintained that the data access request was clearly limited to a

request for copy documents or personal data under s. 4(1)(a)(iii) and in those circumstances no request was made or could be

deemed to have been made under section 4(1)(a)(ii).

14. The Commissioner advised ISPL having considered the additional personal data sought by the appellant that it should provide her

with the additional personal data sought pursuant to s. 4(1)(a)(ii) of the Acts. Thereafter under cover of letter dated 27th January,

2016 a copy of which was furnished to the Commissioner the employer enclosed the additional personal data to the extent that it

existed and was available from the company’s system and records. It also set out two schedules containing details of (i) the personal

data then enclosed and (ii) the personal data which had previously been provided to the appellant. This outlined the category of the

document, the personal data involved, the purpose for the processing of the data and the categories of recipients to whom the data

might be disclosed. The employer also informed the Commissioner by letter dated 27th January, 2016 that it considered that it had

honoured the original data access request as it had provided all personal data held by it under the headings set out in the request

which were specific and did not constitute an open ended request. It also indicated that it had no difficulty in providing the additional

personal data which it had now done.

15. ISPL submitted to the Commissioner that it provided the data requested under s. 4(1)(a)(iii) because the letter expressly

requested “copies” of material. Although the employer accepted that under s. 4(1)(b) of the Acts a data request was to be treated

as having been made under all of the subparagraphs of s. 4(1)(a) in the absence of any indication to the contrary, in this instance

there was a clear indication to the contrary in the form of an expressed request for copies of specified material. It was for that

reason that the employer did not consider that the details described in s. 4(1)(a)(ii) were required in response to the data access

request. The employer in those circumstances indicated that if they had misunderstood the request concerning the documentation

required and which had been enclosed with its letter of 27th January it would be more than willing to expand the search for her

personal data beyond that undertaken to date.

16. By letter dated 2nd February, 2016 the respondent’s investigations officer Mr. Ormond wrote to the appellant noting that she had

been furnished by letter dated 27th January with what appeared to be a comprehensive response to the matters raised in her

complaint. He requested confirmation that she considered that her access request had now been dealt with satisfactorily. If this were

not the case she was requested to revert with specific details of any matters which remained to be resolved to her satisfaction. In

respect of the complaint concerning access to her email account he noted that a copy of ISPL’s IT security policy had been furnished

to her and Mr. Ormond also requested confirmation that the issue raised in that regard had been satisfactorily explained in the

documents furnished. If not, he requested that she specify any further issues arising in relation to her complaint.

17. The appellant replied by email dated 8th April, 2016 stating:-

“I have no further issues regarding this data access request. Now, I request the decision of the DPC according to s. 10 of

the Acts to be issued (just to have a formal record of same) to the effect that ISPL breached the law by failing to comply

with its statutory obligation to provide data within 40 days.”

By reply dated 12th April Mr. Ormond informed the appellant that her request for a decision by the Commissioner on her complaint

under s. 10 would now be processed.

18. By letter dated 12th April ISPL was informed of the appellant’s request for a formal decision which stated:-

“I note from your letter to this office of 27th January, 2016 that you felt that the Company honoured the original data

request made by Ms. Nowak. However, this office would maintain that the obligation is on a data controller, such as

Intesa Sanpaolo Life Ltd. to supply a copy of all personal data in response to an access request made under s. 4 of the

Acts regardless of whether an individual has also specified what information they are seeking. In this regard, if you wish

to make any further comments in relation to this complaint please do so within the next seven days.”

19. A detailed submission was then made by A&L Goodbody on behalf of ISPL by letter dated 18th April. It was submitted on behalf of

the Company that it had replied to the request for personal data which was specific in its terms on 14th October, 2015 in respect of

the three categories listed by the appellant. It stated:-

“Quite recently and correctly ISPL interpreted the September SAR as being in respect of the three categories of personal

data that she had listed. By including the word “namely” in her request, Ms. Nowak intentionally limited the scope of her

request to those categories of documents alone. If ISPL was to have provided “all personal data” in response to this

request (as you seem to be suggesting that it should have done), it would have yielded an enormous volume of

documentation that was of no particular interest to Ms. Nowak given the quite focused nature of her request. As we

outline below following a subsequent subject access request received by Ms. Nowak in February 2016 ISPL did in fact

produce large volumes of emails to the extent that they constituted her personal data and Ms. Nowak complained that

she did not wish to receive these documents. It is therefore clear that Ms. Nowak herself has repudiated any suggestion

that the September SAR constituted a request for “all personal data” rather than the three categories specifically listed.

ISPL does not dispute that Ms. Nowak is entitled to receive “all personal data” relating to her of which ISPL is the data

controller when a request under s. 4 of that nature is made. However, ISPL did not agree that the September SAR could

reasonably have been interpreted as having been a request for all “personal data”.

3. It is notable that Ms. Nowak did not indicate to ISPL that she was dissatisfied with the 14th October, 2015

response. Instead she issued a complaint directly to your office. Whilst we accept that Ms. Nowak is entitled to

adopt this course of action we would submit that this was not necessary or appropriate, as ISPL’s conduct

demonstrated that it was (and indeed remains) willing to promptly respond to any s. 4 requests that Ms. Nowak

makes.

4. When Ms. Nowak identified certain additional documentation which she believed to be outstanding (through

correspondence with your office) this was provided without delay by ISPL to the extent that it was data controller

of such data. In this regard, we note the office stated in an email dated 21st January, 2016 from Mr. Ormond that:-

“the list appears to this office as being a valid identification of outstanding personal data not previously

supplied …”.

It is the case therefore that the office adopted the same, interpretative approach as ISPL did with the September

SAR that is, when it received a closed list of personal data categories it interpreted the request to be a request for

those categories alone and not “all personal data”. We believe that the request made via your office is properly

classified as a new s.4 request from Ms. Nowak and notwithstanding this statutorily permitted 40 day period, ISPL

furnish these documents with (in) the 7 day period stipulated by your office …”

20. In the same submission the solicitors furnished the respondent with the further request dated 17th February, 2016 which though

not stated to be a s. 4 subject access request was treated as such by the Company. In that e-mail Ms. Nowak referred to a huge

volume of emails containing or constituting personal data that had not been provided to her. She explicitly referred to payslips and

P60s and requested this information from the beginning of 2009. The Company interpreted this as a request for all personal data

relating to Ms. Nowak from 1st January, 2009 until 20th August, 2015 when her employment ceased. It conducted an extensive

search of its systems in order to furnish this documentation to the appellant. It stated that this was an extremely onerous and

difficult task which involved reviewing approximately 40,000 emails. It sought further information which was not forthcoming. The

Company supplied Ms. Nowak with a copy of all personal data held in relation to her between those dates on 24th March, 2016. When

this was provided Ms. Nowak replied that it was “entirely unnecessary” and a “waste of time”. This was offered in support of the

proposition that the original request was of a much more limited nature than subsequently claimed by her. The Company insisted that

it had acted in good faith and done its upmost to satisfy Ms. Nowak’s request.

21. By email dated 24th November, 2016 Ms. Nowak requested that a decision on her complaint be issued and that it be posted to c/o

5 St. Mary’s Court, Church Road, East Wall, Dublin 3. Following the issuing of the decision the appellant confirmed by email that she

had received it on 20th December, 2016 and indicated that the matter would be appealed to the Circuit Court. The Commissioner’s

decision had been attached in an email of 25th November, 2016 and a copy of same was also posted to the appellant.

The Commissioner’s Decision

22. The respondent’s decision is confined to two issues raised by the appellant arising from her request of 7th September, 2015

namely that while ISPL had provided certain personal data to her in correspondence dated 14th October, 2015, it failed to provide her

with other personal data consisting of seven specified documents and one further category of personal data. Secondly, ISPL had

breached s. 4(1)(a)(ii) of the Acts by failing to supply the appellant with a description of her personal data, the purpose of retaining

her data and the purpose for which her data was retained and the categories of recipients to whom such data is or may be disclosed.

It was noted that the appellant by email dated 8th April, 2016 requested a formal decision to be made by the Commissioner under s.

10 of the Acts “to the effect that ISPL breached the law by failing to comply with its statutory obligation to provide data within 40

days”. Other matters raised had been dealt with in separate correspondence.

Compliance with the 40 day Period

23. This matter was addressed by the respondent at paras. 20 to 26 of the decision. The respondent noted that the three categories

of data sought were specified by the appellant in her letter of 7th September. It was also noted that in later correspondence with the

respondent an additional seven documents and one category of data were said to have been excluded from the material provided by

ISPL. It was noted that this complaint was not made directly to the Company “as might be expected”. ISPL’s position that the access

request was limited to the three categories specified and that the additional personal data did not form any of those categories was

also noted. The Commissioner interpreted the appellant’s email of 8th April, 2016 which confirmed that she had “no further issues with

this access request” as an acceptance that the access request had been complied with in full following the provision by ISPL to her

of the additional personal data. It is then stated:-

“25. The central issue for consideration is whether your Access Request was responded to in full by ISPL when it supplied

you with the three categories of data specified in the Access Request. In so considering this, I have had regard to the

obligation upon a data subject in s. 4(3) of the Acts which states that:-

“An individual making an access request shall supply the data controller concerned with such information as he may

reasonably require in order to locate any relevant personal data or information.” (emphasis added).

This office’s interpretation and application of s. 4(1)(a) together with s. 4(3) (in particular the words “any relevant

personal data or information”) is as follows. While a data subject has a statutory right to a copy of any personal data

which is held about him or her by an organisation, where a data subject explicitly limits their access request to certain

personal data, it is legitimate and appropriate for a data controller to provide solely the personal data which has been

specified rather than all of the personal data which that data controller holds in relation to that data subject. In this

regard I would also point to this office’s guidance notes for individuals on making access requests which are found on the

website of this office and which demonstrate this interpretation of the right of access. These guidance notes advise an

individual making an access request that in relation to the content of his/her access request, they should “… fill in as

much information as possible to assist the organisation to locate the data that you are interested in accessing” (emphasis

added).

26. Having regard to the fact that you specified three categories of documents and used the term “namely” to indicate

those specific categories of data which you are seeking in your Access Request, I consider it reasonable that ISPL

interpreted your Access Request as being limited solely to the personal data constituting those three specific categories.

Further, I note ISPL’s position that the Additional Personal Data did not constitute any of the three specific categories of

personal data set out in the Access Request. Accordingly, I find that the ISPL’s non-provision of the Additional Personal

Data, in its substantive response dated 14th October, 2015 to your Access Request, did not constitute a contravention

of section 4(1)(a).”

Alleged Breach of Section 4(1)(a)(ii)

24. The respondent then considered the second issue for consideration namely the complaint that ISPL breached s. 4(1)(a)(ii) by

failing in its substantive response of 14th October, 2015 to provide the appellant with a description of the categories of data being

processed by or on behalf of ISPL, the personal data constituting the data of which she was the subject and the purpose or purposes

of its processing and the recipients or category of recipients to whom the data is or may be disclosed. Having set out the relevant

terms of s. 4(1)(a)(ii) and s. 4(1)(b) the respondent noted:-

“30. The key phase in this provision is “in the absence of any indication to the contrary” which indicates that where an

individual makes a request under s. 4(1)(a) in general terms and does not make any further specification as to what is

required, that the data controller must, by default, comply with the provisions of s. 4(1)(a)(i) to (iv) and provide the

individual with the information specified in these subparagraphs. However conversely, it is clearly the legislative intention

that where an access request denotes a request for specific information (rather than a general request under s. 4(1)(a)),

that these default information requirements in the subparagraphs of s. 4(1)(a) are lifted. Of further relevance is s. 4(9) of

the Acts which states that the requirement in s. 4(1)(a)(iii) shall be compiled with by supplying the data subject with a

copy of the information concerned in permanent form (unless certain derogations apply).

31. In your Access Request you stated “I hereby make a request for a copy of all documents”. I consider that your

request for a “copy” is a clear indication that you were requesting your information in permanent or intelligible form

under s. 4(1)(a)(iii) (which is to be interpreted by reference to section 4(9)). As this was a clear indication of a request

pursuant to a specific subparagraph rather than an Access Request in general terms under s. 4(1)(a), I consider that it

was reasonable for ISPL to interpret the Access Request as being limited solely to copies of the three categories of

personal data specified in the Access Request and to therefore assume that you were not seeking the descriptions

relating to the data pursuant to section 4(1)(a)(ii). Accordingly, I find that ISPL was not in contravention of the Acts by

failing to provide you with the description relating to the data pursuant to s. 4(1)(a)(ii) as such an obligation did not

arise in these circumstances.”

25. The respondent was therefore satisfied that ISPL had not contravened s. 4 of the Acts in relation to its response dated 14th

October to the Access Request dated 7th September, 2015.

26. The appellant duly exercised her right to appeal to the Circuit Court.

Circuit Court Appeal

27. The appellant’s appeal to the Circuit Court was determined on 6th February, 2018, (Goarke P.). In an ex tempore judgment (

recorded by the respondent’s solicitor), the learned president stated:-

“Ultimately, the decision of the [respondent] was handed down on 9 December 2016. That decision did not just deal with

the 40 day issue but it dealt with all issues raised in the appeal. The [respondent] could have taken that the email of April

meant that issues except the 40 day issue were not to be determined. The [respondent] did not do so and the decision

dealt with all issues in considerable detail.

Ms. Nowak says that the Commissioner was biased against her and I am paraphrasing here, her complaint is that the

decision is irrational and illogical and wrong. A large, although not total part of Ms. Nowak’s complaint is that information is

furnished outside the 40 days and the decision was vitiated on account of the consideration by the [respondent] of

information not furnished within the 40 day limit. The argument of the applicant is fundamentally erroneous.

The argument of the employer and accepted by the [respondent] is that the effect of the word ‘namely’ qualifies the

access request. This is an entirely correct view on the part of the [respondent].

In an effort to satisfy Ms. Nowak, [ the respondent] managed to obtain considerable cooperation from the employer.

There were various other matters but that is the fundamental argument raised by Ms. Nowak (the 40 days) and that is an

erroneous view on her part. There is nothing in the statutory provisions which prohibits [ the respondent] from considering

material provided in excess of the 40 day limit.

The 40 day limit is a mandatory provision on the employer…the Data Controller in relation to the documents sought.

Failure to comply may give rise to a criminal prosecution. It does not prohibit the [respondent] in considering such

documents in her decision and the argument just does not stand up.

As I have already stated in my initial view, the conclusion regarding the word namely is an entirely reasonable one.

The fundamental argument which Ms. Nowak brings to court fails. The decision given by the [respondent] on 9 December

2016 is an extensive and clear decision in relatively simple and straightforward terms. It is reasoned, rational, lucid and

entirely reasonable.

In those circumstances, I do not find that any of the arguments made by Ms. Nowak are substantiated. I dismiss her

application accordingly.”

The High Court Appeal

28. The appeal to this Court is on a point of law from a decision of the Circuit Court pursuant to s. 26(3)(b) of the Acts. The

principles applicable to such an appeal have been set out in a number of decisions of the Supreme Court. In Fitzgibbon v. Law Society

of Ireland [2015] 1 I.R. 516 at p. 559 – 560, Clarke J. stated:-

“In one sense it may be said that two types of points of law can legitimately be raised in an appeal which is limited to

points of law alone. First, there may be an error of law in the determination of the first instance body. Second, it may be

the case that the way in which the first instance body has reached its conclusions on the facts involves an error which

itself amounts to an error in law. There may have been no evidence to support a finding or inferences may have been

drawn on the facts which no reasonable decision-maker could have drawn. It follows that a higher degree of deference,

so far as the facts are concerned, is paid by the appellate body to the decision of the first instance body in an appeal on

a point of law only, as opposed to an appeal against error. In the latter case the court is entitled to form its own view on

the proper inferences to be drawn (although not on primary facts).”

29. It is also clear that the point of law on an appeal under s. 26(3)(b) should be identified and submissions directed to the point in

issue.

30. The appellant set out five points said to be points of law arising from the decision of the learned President. These are set out in

the notice of appeal. They are:-

(i) Did the learned Circuit Court Judge err in law in upholding the decision of the Data Protection Commissioner dated 9th

December, 2016?

(ii) Did the learned Circuit Court Judge err in law in accepting that the data access request of 7th September, 2015 was

not general in nature and was limited to three categories of personal data?

(iii) Was the replying affidavit of the Data Protection Commissioner invalid in circumstances where it was delivered in

breach of the direction of the court out of time?

(iv) Did the learned Circuit Court Judge consequently have jurisdiction to hear counsel for the Commissioner of the appeal?

(v) Was the service of the Commissioner’s decision dated 9th December, 2016 by email effective?

31. These suggested points of law were elaborated upon in a submission delivered shortly before the hearing of this case on 12th

June, 2018. Though extensive written submissions were made in relation to the fifth point concerning the service of the

Commissioner’s decision of 9th December by email, it should be noted that the learned President did not accept the respondent’s

submission that the service of the notice of appeal was out of time. However, for some reason, an appeal on this matter was pursued

by the appellant even to the point of submissions notwithstanding the fact that she had been successful before the Circuit Court on

the point. However, the point was abandoned during the hearing.

32. In respect of points (iii) and (iv), the appellant submitted that the respondent was in breach of a direction by the learned

President that the replying affidavit and Points of Defence be delivered within a four week timeframe specified when the matter

appeared for mention before the court on 27th March, 2017. The affidavit was delivered on 14th June, 2017. It was, therefore,

submitted that the Circuit Court should not have heard any submissions by the respondent. In reply, the respondent submits that the

learned President considered the application concerning the late delivery of the affidavit and the points of defence. It was submitted

on behalf of the respondent that notwithstanding the delay for which an apology was given to the court, the late delivery of the

papers could not possibly prejudice the appellant in any way as they were filed and served approximately eight months prior to the

Circuit Court hearing date. The case had not been reached on an earlier date. None of the factual contents of the affidavit were

disputed at the hearing and the appellant delivered a further affidavit sworn on 5th July, 2017, on the eve of the first hearing date

allocated without any objection from the respondent. It is submitted on behalf of the respondent that the learned President had a

discretion notwithstanding the failure to comply with the direction as to time to permit and/or deem sufficient the late delivery of the

documents and proceed with the hearing in the absence of any injustice done.

33. I am satisfied that the Circuit Court had jurisdiction to enlarge the time for doing any act or to declare any step taken or act done

outside the time limited by the Rules or the Court to be sufficient upon such terms as the court may direct under O.67 r. 6 of the

Rules of the Circuit Court as amended. I am also satisfied that the learned President acted entirely within his jurisdiction in permitting

the respondent to defend the appeal notwithstanding the failure to comply with the direction which had been given. I do not consider

that any point of law arises for the consideration of this Court having regard to the well-established discretion vested in the learned

trial judge.

Issues (i) and (ii)

34. The remaining two questions posed in grounds (i) and (ii) are closely related. The first question posed is very widely drawn. It

does not raise a specific question of law and simply poses the question whether the learned President erred in law in upholding the

decision of the respondent of 9th December, 2016. It does not take issue with the legal principles applied by the learned President in

reaching his determination which were agreed at the hearing to be those set out in Orange v. the Director of Telecommunications

Regulations and another (No. 2) [2000] 4 I.R. 159, Ulster Bank Investment Funds Ltd. v. Financial Services Ombudsman (unreported

High Court 1st November, 2006) and Nowak v. Data Protection Commissioner [2016] IESC 18. The principles to be applied are that

the burden of proof lies with the appellant in any appeal to the Circuit Court to establish her case on the balance of probabilities. The

complaints made against the Commissioner’s decision should be considered in the context of the adjudicative process as a whole. The

onus lies upon the appellant to show that the decision reached by the statutory body was vitiated by a serious and significant error

or a series of such errors. In applying the test, the court should take account of the fact that the decision maker has a degree of

expertise and specialist knowledge within the statutory framework of the Acts. There is no suggestion that the learned President

deviated in any way from the principles applicable to an appeal of this kind to the Circuit Court. No issue of law arises in that regard.

35. In legal submissions to this Court the appellant sought to expand the issues that had arisen in respect of her complaint before the

Commissioner and ultimately before the Circuit Court to embrace many issues which, if permitted would amount to a complete hearing

de novo of the circuit appeal rather than the limited appeal contemplated by s. 26(3) on a point of law. In doing so she also ignored

the investigation carried out by the Commissioner and the Commissioner’s correspondence with her and the employer in respect of

outstanding issues which led ultimately to the expression on her part that she was totally satisfied that the issues the subject matter

of her complaint of 20th October had been resolved apart from the fact that she wished to have a formal decision as to whether the

documents released by the employer had been released within the applicable statutory period of 40 days.

36. The essence of the issue raised by the appellant in this case is whether her initial request of 7th September was appropriately

addressed by the employer in accordance with its legal obligations under s. 4 of the Act. It is clear that the employer always

maintained that it was willing to furnish all personal data which was the subject of a request under the Act. It is also clear that the

appellant sought copy documents of three categories of personal data from her employer in her letter of 7th September, 2015. It was

not a general request made to the data controller. The appellant clearly knew what she wished to obtain and selected three

categories from a wider category of documentation. When she used the word “namely” she was clearly identifying the documents and

could equally have said “that is to say” or “specifically” which have the same meaning. Once it is accepted as a matter of fact that

she limited the categories of documents that were required it was open to the data controller to furnish those documents in

compliance with that specific request. That was a reasonable and rational interpretation of the letter of 7th September. The

respondent found that to be so when considering the complaint. I do not consider that the correspondence between the respondent

and the former employer indicates a view taken by the respondent that the letter of 7th September embraced a wider request for all

personal data. The respondent was simply pointing out to the employer that the additional documents set out in the letter of

complaint of 20th October, 2015 would be regarded as personal data. The employer had no difficulty with that proposition and was

prepared and did supply the documents immediately. Indeed, one of the documents had already been supplied. It is notable that the

appellant took no steps to engage with her former employer in respect of the outstanding documentation prior to her complaint of

20th October. The Commissioner who has a mandate to seek a friendly resolution of these matters requested that she do so.

However, the appellant chose not to do so and simply advanced her complaint with the Commissioner. Nevertheless, the Commissioner

wrote to the employer in respect of these outstanding documents who was satisfied to furnish them. It is abundantly clear that the

employer at all material times would have complied with a more general request had it been in the general terms now suggested by

the appellant. The court is satisfied that this was never a case about a data controller seeking to deprive the appellant of her

statutory rights to personal data. Though I am satisfied that the employer’s interpretation of the letter is entirely correct, the worst

that could be said is that the employer may have misinterpreted the letter as a more limited request than that which was intended by

the appellant. I am satisfied that had the appellant simply written to the employer seeking the additional material as suggested by the

respondent she would have received a wholly positive response. When the Commissioner wrote for the same information or

documentation it was furnished to him and to the appellant without difficulty. Indeed, the appellant later expressed satisfaction that

all issues had been resolved with her former employer in respect of the documentation sought.

37. It is clear to me therefore that the documentation supplied by the former employer on 14th October was supplied within the 40

day statutory period. I am satisfied that the learned President was correct in dealing with the request of 7th September as one which

was not general in nature but limited to the three categories specified therein. Furthermore, I am satisfied that his conclusion that

the Commissioner did not err in accepting that the data access request was so limited was correct. I do not consider that it is

reasonable having made a specific request limited to three categories of documents to complain to the Commissioner about a failure

to comply with that request on the basis that documents which were not specifically requested have not been furnished. At the very

least I would have expected a letter to be written before making such a complaint to the data controller pointing out that certain

documentation had not been included and requesting a more general disclosure if that was what was genuinely sought.

38. A request under s. 4(1)(a) for personal data which does not relate to all of the subparagraphs of s. 4 shall, in accordance with s.

4(1)(b) “in the absence of any indication to the contrary, be treated as relating to all of them”. I am satisfied that insofar as the

letter of 7th September was a limited request, it was not a request of the wide ranging nature envisaged by s. 4(1)(a) in respect of

each of its subparagraphs. Thus there was an “indication to the contrary” under s. 4(1)(b). It is clearly open to an applicant to make

a focused request for data under the terms of the Act. That was done. There was no error of law by the Commissioner or the learned

President in reaching their respective determinations. I am also satisfied that it was therefore in the circumstances of this case

reasonable to conclude that the information sought on 7th September, 2015 was furnished within the 40 days statutory period. I am

not satisfied, insofar as it may be relevant, that it was reasonable for the appellant to raise the absence of the further specified

documents as a ground of complaint to the respondent without either including them in her initial narrowly focussed request or

seeking them directly from her former employer when she was well aware that her initial request was limited and specific.

39. The appeal is dismissed.