Supreme Court dismisses appeal where plaintiff failed to prove negligence, loss, or publication in data protection claims.

THE SUPREME COURT

Appeal No. 435/2012

Clarke C. J.

Dunne J.

Baker J.

BETWEEN/

PETER MURPHY

APPELLANT

-AND-

GARY CALLINAN, JULIE CARROLL, AND ARB UNDERWRITING LIMITED, THE COMMISSIONER OF AN

GARDA SÍOCHÁNA

IRELAND AND THE ATTORNEY GENERAL

RESPONDENTS

JUDGMENT of Ms. Justice Baker delivered on the 30th day of November, 2018

1. This is an appeal from the dismissal of these plenary proceedings by MacMenamin J. on 9 May 2012 on the application

for non-suit brought by the defendants at the conclusion of the plaintiff’s evidence.

2. The plaintiff, a litigant in person, runs a motor trading business. He commenced the action by plenary summons dated 24

October 2006, after his motor insurance policy with ARB Underwriting Ltd. (“ARB”), the third named defendant, was

cancelled as he was considered to have falsely stated on the policy application form that he had never been convicted of any

motoring offence or of any criminal non-motoring offence. The information on foot of which the policy was cancelled came

to the attention of ARB from the first defendant, a member of An Garda Síochána who, at all material times, acted in his

professional capacity.

3. The proceedings were issued against six defendants, four of whom, the first, fourth, fifth, and sixth will be collectively

referred to as the “State defendants”. The second named defendant was, at all material times, acting as an employee of

ARB, and she and the third defendant will be collectively referred to as “ARB” as the claim against her relates to her actions

in the course of her employment.

Background

4. The plaintiff never contested the cancellation of the motor insurance policy and accepted the returned premia. After the

cancellation, he exercised his right of access pursuant to the then operative data protection legislation, the Data Protection

Act 1988, as amended by the Data Protection (Amendment) Act 2003 transposing Directive 95/46/EC on the Protection of

Individuals with Regard to the Processing of Personal Data (“the 1988 Act”) and thereafter requested that the State

defendants and ARB erase/rectify data showing criminal convictions for fraud.

5. The plaintiff’s claim before MacMenamin J., as well as the related judicial review proceedings, have at their core a

contention as to the accuracy of the records of the previous convictions of the plaintiff held by the State defendants and

ARB and an assertion that the State should no longer keep record of stale or old convictions.

6. The Plaintiff’s pleaded claims against the State defendants are, in essence, twofold:

(i) A claim in injurious falsehood that, in breach of section 20(1) of the Defamation Act 1961 (the “1961 Act”),

the first defendant knew, or ought to have known, that the information held by An Garda Síochána concerning

his past convictions was false and inaccurate and that communication of that data would damage the Plaintiff’s

vehicle dealership business and was unlawful.

(ii) A claim in negligence, breach of duty, and breach of Constitutional rights as a result of the communication of

incorrect data to the second and third defendants.

7. The plaintiff’s claim against ARB is for damages for breach of statutory duty under the 1988 Act on account of its

pleaded failure to rectify identified errors in the data it holds concerning him.

8. It is important to observe that the complaints concern events in 2006 and requests under the 1988 Act made between

June and September of that year, and the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27

April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement

of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation) (“GDPR”) and changes made by the

Data Protection Act 2018 are not engaged.

9. MacMenamin J. dismissed the plaintiff’s claim in the light of the evidence and applied the principles identified by the

Supreme Court in Hetherington v. Ultra Tyre Services Ltd. [1993] 2 IR 535, and O’Toole v. Healy [1993] 2 IR 544,

although he noted that a court was not, as a result of the approach identified in those authorities, precluded from engaging in

some degree in an analysis or scrutiny of the evidence.

10. No error is identified in that approach taken by the trial judge.

The judicial review proceedings

11. The appellant issued separate proceedings by way of judicial review on 23 January 2007 (the “Judicial Review

proceedings”) involving the same parties and, essentially, the same facts as those upon which he relies in these plenary

proceedings.

12. The Judicial Review proceedings were heard and determined in the High Court and an ex tempore judgment was

delivered by Charleton J. on 25 July 2008. He made the factual determination that both answers given by the plaintiff on the

proposal form were wrong “whether as a result of being filled in quickly or by an agent”.

13. The applicant’s appeal of that decision was dismissed by the Supreme Court and an ex tempore judgment was given by

Fennelly J. on 12 June 2009 with which the other judges agreed.

The plenary proceedings and the findings of the High Court

14. The plaintiff continued to pursue this plenary action after the determination by the Supreme Court of the Judicial

Review proceedings and ARB made an application for dismissal on the grounds of res judicata. Having taken the view that

“as a matter of justice” the plaintiff “should be given the opportunity of completing his evidence […] being cross-examined

[…] and calling his son”, MacMenamin J. fairly postponed the consideration of the application until the plaintiff finished his

oral evidence. Only two witnesses gave evidence, the plaintiff and his son, and the matter then proceeded as an application

for a non-suit by the State defendants before any evidence was called by the defendants and where they had indicated that

they would go into evidence if the application was refused.

15. The grounds of that application by the State defendants were that the plaintiff had not made out a prima facie case

and/or that the plaintiff’s claim (or part thereof) was res judicata and/or an abuse of process.

16. ARB’s application that the matters were res judicata was then revisited and re-submitted.

17. In his written judgment dismissing the plaintiff’s claim against the second and third defendants for damages,

MacMenamin J. found, inter alia:

(a) That the plenary action and the earlier judicial review proceedings cannot be dissociated from each other

as the issue in the judicial review was the integrity of the conviction records;

(b) That the plaintiff was in fact convicted of an offence pursuant to s. 18 of the Theft and Fraud Offences

Act 2001 in the District Court for possession of a stolen chequebook. On appeal, the Circuit Court found

the facts proved and, without proceeding to a conviction, dismissed the charge under the Probation Act and

that this order of the Circuit Court on appeal was not equivalent to a finding of not guilty;

(c) That the plaintiff did have recorded criminal convictions for matters other than traffic road offences,

and “a couple” of convictions under the Road Traffic Acts from the early 1990s;

(d) That the plaintiff had failed to make out any loss.

18. At p. 17 of his ruling, the conclusion of MacMenamin J. was that the matter was res judicata in its strict sense, as the

matters in issue had already been determined in a way that met the test set out in the authorities, that courts had “exercised

their judicial mind on the issue”, the words used by Shaw L.J. in Bradshaw v McMullan [1920] 2 IR 412. In the alternative,

he concluded that the plaintiff should not be permitted to proceed with this action on the grounds that to do so would be an

abuse of court process.

19. In regard to the claim against the State defendants for injurious falsehood, MacMenamin J. did not rely on a finding of

res judicata and made other findings against the plaintiff which were dispositive, inter alia:

(a) The proofs had not been met and no evidence was adduced either by interrogatories or by direct

evidence of an unlawful publication;

(b) That the evidence adduced on the conviction order under s 18 of the Theft and Fraud Offences Act

2001 and the road traffic offences establishes the truth of the relevant statements.

20. In dismissing the plaintiff’s claim against the State defendants for negligence, breach of duty, and breach of

constitutional rights, MacMenamin J. found, inter alia:

a) That the claims “overlap in every respect those which were made in the judicial review proceedings”;

b) That the plaintiff “simply has not addressed the question as to whether it is open to him to by-pass the

Commissioner, and simply pursue an action for negligence or breach of constitutional rights” and this

amounted to “contributory negligence” on his part;

c) That the plaintiff failed to make out any negligence or loss and that “any loss which he sustained was as

a result of his own actions”.

21. The conclusion of MacMenamin J. in regard to the claim against ARB was that the plaintiff had not made a prima facie

case with regard to his claim for negligence or injurious falsehood and that the complaints regarding data breach “should,

appropriately, in the first instance, have been dealt with by the Data Commissioner”.

The grounds of appeal

22. The grounds of appeal are argued as deriving from what the appellant describes as “incompetent record keeping” of the

Garda Commissioner, and the appeal against the defendants generally is that they ought to be held accountable by a

competent court for their breaches of his rights as data subject.

23. The appellant pleads ten grounds of appeal which I propose quoting in full:

“(1) The State defendants breach of the An Garda Síochána Act 2005 triggered the initiation of the action. They

were not held accountable for the breach.

(2) In the face of admission and evidence produced by the State defendants of nine wrongful convictions on the

Court Outcomes record kept on the plaintiff for a period of circa 34 years, a total of fourteen entries erased,

numerous alterations and ongoing wrongful entries on the Court Outcomes record kept of the plaintiff, in

defiance of the plaintiff’s constitutional right to his good name the court failed to remedy the matters or hold the

State defendants accountable.

(3) The fourth named defendant’s incompetent record keeping in relation to the Plaintiff is itself evidence of

negligence.

(4) The fourth named defendant’s incompetent method of processing the Court Outcomes database is itself

evidence of negligence.

(5) The court enunciated on the issue raised by “PM9” of my Book of Exhibits in my favour during the hearing

and determined the issue against me in the written judgment.

(6) Incontrovertible evidence was offered to the court that the matter is not res judicata.

(7) The remedies given by the Data Protection Acts are in addition to not to the exclusion of any remedies in tort

sec. 7 DPA 1988.

(8) In the circumstance of the case herein, it is not necessary to allege or prove special damage in the tort of

injurious falsehood. Section 20(1) of the Defamation Act 1961.

(9) Despite evidence adduced of both sets of defendants abusing the process of the court throughout the

proceedings they were not held accountable.

(10) The determination of the High Court undermines the integrity of the domestic jurisprudence in that it is open

to the lawbreakers and tortfeasors to pursue the victim of their lawlessness for their legal costs.”

24. They can be usefully considered under the following headings:

(i) As against the State defendants, that the failure to erase or correct its records regarding the criminal

convictions of the appellant amounted to a breach of his constitutional right to a good name, and is negligent.

(Grounds 1 to 5 inclusive and Ground 9);

(ii) That the remedies under the 1988 Act in regard to a data breach do not exclude the remedies for which s. 7

of the Act of 1988 provides (Ground 7);

(iii) That the trial judge misdirected himself in law in failing to have regard to the fact that the plaintiff’s claim for

damages for injurious falsehood did not require proof of special damage on account of the provisions of s. 20 of

the 1961 Act; (Ground 8);

(iv) That the trial judge misdirected himself in coming to a determination that some of the matters raised in the

plenary proceedings were res judicata. (Ground 6).

Abuse of process: Ground 7

25. The appellant identifies inaccuracies in the databases held by An Garda Síochána, and also points to the fact that some

of the records held by An Garda Síochána are of such antiquity as to amount to stale convictions for the purposes of the

Criminal Justice (Spent Convictions and Certain disclosures) Act 2016.

26. A number of corrections were made to the appellant’s personal data held by the Garda Commissioner, some of which

arose from the fact that another person of the same name with the same day and month of birth, but a different year, is

recorded as having convictions which were wrongly attributed to him. Those errors were rectified following his complaints

in 1999 as a result of which twenty-two entries which appeared in a printout he received from An Garda Síochána in 1999

were reduced, altered, and corrected so the relevant data in July 2001 showed nine entries only. The plaintiff subsequently

sought corrections and erasures in correspondence with An Garda Síochána in 2001 and 2006 and the relevant database in

2006, when the proceedings commenced, showed two classes of records, thirteen entries in all of which eight were what he

described as “old” and five “recent”. He had, in the meantime, made a complaint that the alternation of the old Punt records

to Euro amounted to an unlawful alteration of the record and in breach of his rights, gave the impression that the records

“endows the offences with a modern character”, and obscures the fact that they relate to incidents from the mid-1990s.

27. For the reasons that will be apparent, I do not propose examining each of the various incidents and complaints regarding

the databases of which the plaintiff complains. These complaints were the subject matter of the judicial review proceedings

in which Mr. Murphy sought an order of mandamus directed to the Garda Commissioner and ARB to correct or erase some

of his personal data, and the grounding affidavit in which he exhibited his data subject request and responses ran to several

pages.

28. The Supreme Court endorsed the approach of Charleton J. in regard to the primacy of the statutory remedy both on

account of the scheme of the 1988 Act, which conferred certain powers on the then Data Protection Commissioner and

provided for an appeal to the High Court against a determination, but also because, as Charleton J. had held, the right to

seek erasure or correction is one derived from the data protection legislation and without which no general right in law exists.

Fennelly J. agreed with that proposition and the conclusion of Charleton J. that “the Act in my view creates a remedy within

itself”.

29. The judicial review proceedings were not dealing with the relief in damages sought by the plaintiff in the plenary action,

but only with the claim of the plaintiff for an order of mandamus, and I will return later to the question as to whether the

conclusions of the Judicial Review proceedings can amount to an operative res judicata in the claim for damages. But I will

first deal with the question of whether the plenary action is an abuse of process.

30. MacMenamin J. noted that the plaintiff had given no satisfactory account in the course of the hearing before him, or in

cross-examination, when it was put to him, as to why he did not pursue his complaint with the Data Protection

Commissioner, even after the Supreme Court delivered its judgment in 2012. He records that the plaintiff’s answer, when

probed, was that he had “wanted to bring this action on so that somebody would be looking at the records and deciding

what is right and wrong”. MacMenamin J. noted, at para. 72 of his ruling, that the task of engaging with the records is

vested in the Data Protection Commissioner and that to permit the plaintiff to pursue a remedy other than through that

means would be to “countenance an abuse of process”.

31. The appellant argues that the plenary action was wrongly characterised as an abuse of process and that the courts retain

the jurisdiction to award damages for breach of duty arising from a data breach. He relies on s. 7 of the 1988 Act, which

provides as follows:

“For the purposes of the law of torts and to the extent that that law does not so provide, a person, being a data

controller or a data processor, shall, so far as regards the collection by him of personal data or information

intended for inclusion in such data or his dealing with such data, owe a duty of care to the data subject

concerned:

Provided that, for the purposes only of this section, a data controller shall be deemed to have complied with

the provisions of section 2 (1) (b) of this Act if and so long as the personal data concerned accurately

record data or other information received or obtained by him from the data subject or a third party and

include (and, if the data are disclosed, the disclosure is accompanied by)-

(a) an indication that the information constituting the data was received or obtained as aforesaid,

(b) if appropriate, an indication that the data subject has informed the data controller that he regards the

information as inaccurate or not kept up to date, and

(c) any statement with which, pursuant to this Act, the data are supplemented.”

32. In simple terms, that section imposes a duty of care on a processor or controller of data, and creates a presumption that

that duty of care has been complied with by a data controller who accurately records data or other information received or

obtained by him or her from the data subject or a third party in the circumstances outlined.

33. The plaintiff’s claim in negligence is pleaded broadly against the State defendants, and more narrowly against the ARB

defendants, but essentially, it is founded in an assertion that the relevant parties had an obligation to process and protect the

plaintiff’s data in a fair manner and, in particular in the light of his allegations, to keep it accurate, complete, and up to date.

That general proposition is one that indeed finds reflection in the policies and provisions of the data protection legislation

generally, albeit the provisions of the Data Protection Act 2018 create a more complex scheme of protection.

34. Section 7 of the 1988 Act has the effect that the court is entitled to award damages for breach of duty to a data subject

arising from the negligent processing of police data. Accordingly, in my view, MacMenamin J. was not correct insofar as he

held that the claim in damages is not well founded as it seeks to bypass a statutory scheme and that the claim is an abuse of

process.

35. Section 7 preserves the judicial remedy for breach of the duty of care by the data controller. A claim for damages for

breach of the duty of care is not an abuse of process merely on account of the fact that there exists a statutory scheme by

which correction, erasure or other alternation of data may be achieved. Thus, it seems to me that the appellant must succeed

on ground 7 of his notice of appeal. But the matter does not end there.

The claim in negligence: Grounds 1 to 5 incl., and ground 9

36. The claim for damages is grounded in tort, and the 1988 Act does not create a new cause of action or strict liability.

37. Feeney J. considered the matter in some detail in his judgement in Collins v. FBD Insurance Plc. [2013] IEHC 137,

where he allowed an appeal from an order of the Circuit Court which had awarded the plaintiff damages pursuant to s. 7 of

the 1988 Act. The question for determination by the High Court was whether the plaintiff was entitled to damages pursuant

to s. 7 of the 1988 Act and, if so, the quantum of such damages.

38. That judgment was not opened to us in the appeal but seems to me to correctly state the legal principles and I propose to

therefore consider it in some detail. In Collins v. FBD Insurance Plc., the claim also concerned a dispute between the

plaintiff and the insurers who provided him with motor insurance. The plaintiff had complained to the Data Protection

Commissioner in regard to certain breaches of his data rights. The plaintiff, in the course of the High Court appeal,

acknowledged that he had suffered no out-of-pocket expenses or special damages arising from the breaches of the data

protection legislation which had been subject to a determination by the Data Protection Commissioner. The claim therefore

was one for general damages. At para. 4.4 of his judgment, Feeney J. concluded as follows:

“Section 7 is limited and goes no further than providing for a duty of care that is a duty of care within the

law of torts. To obtain a compensation for a breach of duty of care, it is necessary for a claimant to

establish that there has been a breach, that there has been damage and that the breach caused such damage.

The tort of negligence, unlike the tort of trespass to person, requires proof of damage. Such requirement is

demonstrated in the judgment of Clark J. in Larkin v. Dublin City Council [2008] 1 I.R. 391…. A person

seeking compensation arising from a breach of statutory duty under an Act must establish that the loss or

damage that such person has suffered flowed from the breach, unless the statutory duty involved is one of

strict liability. Here, the statute does not provide for strict liability and for me to interpret s. 7 of the Data

Protection Acts as enabling a claimant to benefit from an award of damages for non-pecuniary loss, would

be for me to expand the scope of s. 7 beyond that provided for in the Act or required by the Directive. The

Directive in issue in this case requires for there to be compensation for damage suffered and s. 7 does not

extend beyond that obligation. Section 7 provides an obligation of duty of care and allows for a remedy

under the law of torts and the law of torts generally provides for compensation to be based upon certain

criteria which includes the proof of damage.”

39. A plaintiff claiming breach of a duty of care in the management or processing of data is not relieved of the obligation to

show that there has been a breach and to establish a causative connection between the breach and a loss. The 1988 Act

does not create a new tort, and a breach of the rights of a data subject is not actionable in itself without proof of negligence

or breach of a duty of care, or proof of loss.

40. As stated by Feeney J. in Collins v. FBD Insurance Plc., at para. 3.6:

“It is also the case that s. 7 in the Irish legislation does not, on the face of it, provide for compensation for strict

liability or for the automatic payment of compensation but limits compensation to the existence of a duty of care

within the law of torts. It is consistent with the general principles of the Irish law of torts that a person seeking

compensation arising from a breach of statutory duty must establish that the loss or damage which they have

sustained flowed from that breach unless the statutory duty involved is one of strict liability. The Directive does

not provide for strict liability or the automatic payment of compensation nor does s. 7 of the Irish legislation so

provide, either by its express terms or by reference to a duty of care within the law of torts”.

41. I agree with that statement of the legal effect of the provisions of s. 7 of the 1988 Act.

42. MacMenamin J., in paras. 47 et seq. of his judgment, considered that the plaintiff had not adduced any evidence that the

data was processed or obtained in an unfair manner by ARB or its servants or agents. He asked the rhetorical question

“where was the unfairness?”, and noted that the plaintiff had not adduced even prima facie evidence that any unfairness

occurred in the processing of his personal data by ARB. It is essential, in that context, to bear in mind that the plaintiff

makes no complaint that the cancellation of his policy was wrongful, and his complaint relates solely to the accuracy of the

records.

The new data protection regime followed the coming into force on May 25 2018 of the GDPR. The Data Protection Act

2018 implementing GDPR permits an individual to seek compensation from the court for breaches of data subject rights

even in the absence of any material damage or financial loss. But s. 7 of the 1988 Act, on which the plaintiff relies, whilst it

did expressly create a duty of care on a data controller in regard to personal data, did not make the breach of data subject

rights actionable without proof of negligence or a causative connection to an alleged material damage or other loss.

43. Further, MacMenamin J. correctly determined a data subject must engage fairly with a data controller, and the plaintiff

offered no explanation as to why he did not respond to the open offer from ARB made in open court to correct any errors

he could identify. MacMenamin J. was correct to find that the failure to avail of the statutory remedy did amount to

contributory negligence.

44. For these reasons, I consider that MacMenamin J. was perfectly correct in his ruling that the claim of the plaintiff had to

fail on account of the fact that he adduced no evidence of negligence or of loss.

Res judicata: Ground 6

45. As the Judicial Review proceedings did not concern the right of a data subject to seek damages in the general law of tort

and did not consider the provisions of s. 7 of the 1988 Act, the argument that the claim in the plenary proceedings must fail

by reason of it being res judicata is wrong at law. The appellant, to that extent, succeeds in ground 6.

The claim for damages for injurious falsehood: Ground 8

46. The key to the conclusion to which MacMenamin J. came in relation to the plaintiff’s claim in injurious falsehood was

that the plaintiff had adduced no evidence regarding any publication of the allegedly incorrect data and, as I have observed,

the only oral evidence heard was evidence from the plaintiff himself and conversations between him and the first defendant.

While the plaintiff is correct that as a matter of law it was not necessary for him to establish any special loss where the claim

is one of injurious falsehood, MacMenamin J. determined the claim and that that had to fail for absence of evidence of

publication.

47. I see no error in the approach of MacMenamin J. who, as he was required to, accepted the plaintiff’s case at its highest

and tested the claim in particular against the uncontroverted finding that the plaintiff had failed to adduce evidence of

publication. The plaintiff is a litigant in person and may well have considered that the affidavit evidence in the Judicial

Review proceedings or that the replies for particulars or other pleadings amount to evidence of publication. The stark fact is

that they are not, and the plaintiff’s evidence at the plenary hearing failed to establish an essential proof of the tort of which

he claimed. MacMenamin J. was correct in the approach he took.

Bias

48. In the course of his oral submission to this Court, the plaintiff appellant made an assertion that two of the judges who sat

on the Supreme Court panel in the Judicial Review proceedings were objectively biased for the reasons identified there by

him. The plaintiff appellant alleged that two members of the Supreme Court had relevant links to him, and that one member

of that Court had acted for him in the past. He did not identify how the nature of his alleged prior interactions with the

relevant judges were of such a nature as to give rise to a perception of bias, and it seems from his oral submissions that the

links of which he complained were purely professional.

49. The allegations of alleged bias were not raised before the Supreme Court which determined the Judicial Review

proceedings in 2012, and the appellant offers no explanation as to why he permitted the Supreme Court to engage upon the

hearing of the appeal without any complaint from him, and it seems to me to be simply too late for him to now pursue the

argument. In Goode Concrete v. CRCH Plc. [2015] IESC 70, the Supreme Court emphasised the desirability that an

application regarding alleged bias be made to the relevant court alleged to be guilty of such bias. Furthermore, I am unclear

as to the purpose of the argument of alleged bias.

50. Quite apart from that consideration, the decision of the Supreme Court in the Judicial Review proceedings is final and

this Court may not now engage upon any consideration of that decision which would fail to respect its final and conclusive

nature.

Other matters raised in the appeal

51. In the course of the hearing before this Court, the appellant drew our attention to correspondence with An Garda

Síochána in 2017 and 2018 regarding recent data protection access request to it on account of what he identified as incorrect

entries. These matters and complaints post-date the proceedings now under appeal, and cannot fall for consideration here.

52. That approach must also be taken to the argument made by the plaintiff appellant that some of the recorded convictions

ought to be treated as spent under the Criminal Justice (Spent Convictions and Certain disclosures) Act 2016 which was not

in existence at the time the present proceedings were commenced or concluded.

Conclusion

53. The appellant has a strongly held and well-articulated complaint regarding the storage and processing of certain personal

data by the defendants. He complains that the State defendants wrongly retained and continued to retain incorrect data

concerning his previous criminal convictions and on account of the failure to treat some of the very old records as “spent”.

54. MacMenamin J. determined inter alia that the action was an abuse of process and the issue of res judicata arose, and

for the reason stated, I do not consider that he was correct in this.

55. However, he was correct in his primary determination that the plaintiff had not established a prima facie case on the

evidence. In regard to the claim in negligence and for breach of the duty of care under s.7 of the 1988 Act, because the

appellant had not shown any negligence or unfairness in the processing of his personal data, nor had he established any loss.

In the claim for injurious falsehood, because the appellant had failed to establish the essential element of publication.

56. MacMenamin J. was accordingly correct to accede to the application by the defendants for a non-suit.

57. Therefore, I conclude that the appeal must fail, albeit that the appellant must succeed in grounds 6 and 7 of his notice of

appeal.