High Court allows appeal finding CCTV footage used for discipline was further processing in breach of Data Protection Act 1988.

[2020] IEHC 90 THE HIGH COURT [RECORD NO. 2019/211 CA] IN THE MATTER OF THE DATA PROTECTION ACTS, 1988 AND 2003 AND IN THE MATTER OF AN APPEAL UNDER SECTION 26 OF THE DATA PROTECTION ACTS, 1988 AND 2003 BETWEEN CORMAC DOOLIN APPELLANT AND THE DATA PROTECTION COMMISSIONER RESPONDENT AND OUR LADY’S HOSPICE AND CARE SERVICES NOTICE PARTY JUDGMENT OF MS. JUSTICE HYLAND DELIVERED 21st FEBRUARY 2020

Introduction

1. This case raises a discrete question: whether CCTV footage viewed by the Appellant’s employer, Our Lady’s Hospice and Care Services (“OLHCS”) was further processed by OLHCS in breach of the Data Protection Act 1988 as amended (the “1988 Act”). In short, the Appellant, an employee with OLHCS at the time of the alleged breach, makes the case that the CCTV was viewed for a permissible use i.e. to prevent crime and promote staff security and public safety, but that information derived from same was unlawfully further processed for the purpose of disciplinary action against him qua employee of OLHCS.

Background

2. On 19th November 2015, OLHCS found a threatening graffiti message in a staff room located in one of the buildings known as the Anna Gaynor house forming part of the Hospice campus in Harold’s Cross in the following terms: “Kill all whites, ISIS is my life”.

This was reported to An Garda Siochana who advised OLHCS to review the CCTV footage to identify the persons who had accessed, inter alia, the staff room (also described as the tea room or break room) in the Anna Gaynor house for the period between 17th and 19th November 2015. The Appellant was one of a number of staff members identified on the CCTV footage accessing the staff room. Both parties agree that the CCTV footage was only viewed once by Mr. Paul Gahan, Human Resources Manager and Mr. Tommy Beatty, Capital Projects Manager on 20th November 2015 for the purpose of investigating the graffiti incident. The Appellant’s case is that the subsequent use of the information from that footage was a breach of s.2(1)(c)(ii) of the 1988 Act.

3. Section 2(1)(c)(ii) provides that personal data kept by a data controller (having been obtained only for one or more specified purposes) shall not be further processed in a manner incompatible with those purposes.

Chronology of Events

4. On 26th November 2015, OLHCS wrote to the Appellant stating that it had commenced a formal investigation under its Disciplinary Policy into the following:

• An offensive graffiti message which was found in the Anna Gaynor staff room.

• The use of unauthorised breaks.

5. The Appellant was asked to attend a meeting on 1st December to progress the investigation. Terms of reference, disciplinary policy and hours of work policy were enclosed with the letter. A document entitled “Terms of reference” was exhibited to the Affidavit of Cormac Doolin filed 20th August 2018 (Exhibit CD4). It refers to the graffiti message and the viewing of the CCTV footage, and to staff members accessing the room at unauthorised times. It notes OLHCS is conducting a fair, speedy and thorough investigation into the matter. At paragraph 8 it states that if the outcome of the investigation is that there is a reasonable belief that any employee is guilty of the alleged gross misconduct, a disciplinary hearing may be convened.

6. On 26th November 2015 an email was sent from Paul Gahan of HR asking a Deirdre Congdon to send out invites for investigation, inter alia, to the Appellant, with the two terms of reference and to draft the letter in a way that refers to the two investigations. A further letter was sent on 27th November 2015 in very similar terms to the letter of 26th November referred to above identifying that formal investigations were taking place into:

• An offensive graffiti message which was found in the Anna Gaynor staff room.

• Staff members accessing the room at unauthorised times.

(Despite the reformulation of the terms of investigation in the second terms of reference, in fact the conclusion of the Panel Report of 15th February 2016 discussed below was that the Appellant had taken unauthorised breaks as opposed to a finding on access at unauthorised times i.e. it reverted to the original formulation in the letter of 26th November).

7. On 27th November 2015, a meeting was held between the persons conducting the investigation and Mr. Ken White, building services manager. The notes of that meeting were presumably obtained under a freedom of information request or in some other way as the Appellant did not attend that meeting. That meeting refers to Mr. White receiving two terms of reference as well as the disciplinary policy and hours of work policy. As identified above only one terms of reference was exhibited. Mr. White was questioned almost exclusively about break times for the Appellant and others and their reason for being in the tea room where the graffiti incident took place.

8. On 1st December 2015, an investigation meeting took place with Mr. Doolin, Mr. Gahan and Mr. Beatty. Mr. Gahan stated the role of the investigation panel was to establish the facts pertaining to the incident of 19th November and the access to the Anna Gaynor Tea Room at unauthorised times. The Appellant was questioned about his access to the room and reference was made to the CCTV footage. Because OLHCS asserted that the disciplinary proceedings continued solely on the basis of admissions by the Appellant rather than information derived from the CCTV footage it is necessary to set out the relevant extracts from the note of interview in this respect (Exhibit JVOD1). “TB: The Gardai asked us to look at the CCTV for the days previous to identify if there was a pattern. It came to light that you had accessed the room for 55 minutes on the day in question, the day previous 46 minutes and 50 minutes on the Tuesday.

Why were you in the room?

CB: If work got on top of us we would take a break?

TB: Did you get your lunch break on those days?

CD: Yes I can’t remember exactly but I would remember if I did not get my lunch.

PG: Would there be a reason for you to be up there?

CD: On occasion we would go up.

PG: Your manager confirmed there were no tickets raised for that area on the days in question so why were you there?

CD: For me personally, things got on top of me.

PG: Do you want to see the CCTV footage.

CD: Not at this present time no.

PG: So you took a break, is that fair to say?

CD: Sometimes.

PG: Just that week?

CD: For myself, yes.

PG: Is that a regular occurrence?

CD: If work was on top of me I might go off on my own and get some water.

PG: Do you think that is an appropriate way to deal with things getting on top of you?

CG: No I should have said it to my manger if I needed a break.

PG: Is there anything else you want to tell us?

CD: No I’m ok.”

9. On 15th January 2016, the Investigation Panel Report (the “Panel Report”) was produced by Mr. Gahan and Mr. Beatty. That report refers to the CCTV footage showing staff members accessing the room at unauthorised times. It states that if the outcome of the investigation is that there is a reasonable belief that any employee is guilty of the alleged gross misconduct, a disciplinary hearing may be convened. Under the heading “Findings”, it is stated that in the course of the investigation the panel considered, inter alia, CCTV footage on 17th, 18th and 19th November 2015 and the interview and record of meeting with the Appellant. Under the heading “With respect to the access to the staff area upstairs in Anna Gaynor House”, it states:

“The panel reviewed CCTV footage and Fob Access in line with OLH&CS Policy on Closed Circuit Television in order to establish the facts in relation to a crime (Offensive Graffiti) in consultation with Gardaí. The panel is satisfied that Mr Doolin accessed the staff area upstairs in Anna Gaynor on three consecutive afternoons (17th, 18th and 19th November) at times shown in the table below.

Name Date Time Accessed Time Left Time Duration

Cormac Doolin 17th November 15.11 16.04 53 Minutes 2015

Cormac Doolin 18th November 15.35 16.21 46 Minutes 2015

(Cut-off) 19th November (Cut-off) (Cut-off) 1 hour & (cutoff)

(Cut-off)

10. Findings were also made in respect of times of unauthorised access, working hours, work tickets in the staff area upstairs in Anna Gaynor, other rooms in the staff area upstairs in Anna Gaynor. Then under the heading “Outcome”, the finding is as follows:

“Following a comprehensive consideration of the information obtained during this investigation the panel have established on the balance of probabilities that unauthorised breaks were taken by Mr. Cormac Doolin on the afternoons of Tuesday 17th, Wednesday 18th and Thursday 19th November 2015”.

11. Under “Recommendations” the Panel recommended:

• “Training is carried out with Mr Doolin in relation to Our Lady’s Hospice & Care Services Hours of Work Policy.

• Access through fobs for the staff area upstairs in Anna Gaynor is removed from Mr Doolin and fobs are only issued by the Building Services Manger on a needs basis in line with work tickets raised.

• Mr Doolin is invited to a Disciplinary Hearing under Our Lady’s Hospice & Care Services Disciplinary Procedure.

This report will be sent to Senior Management who will consider this report and may make further recommendations as necessary. The Occupational Health Services of Our Lady’s Hospice & Care Services remains available to Mr Cormac Doolin.”

12. The following observations may be made about the Panel Report. The Report is solely in respect of the investigation relating to staff members accessing the room at unauthorised times. It clearly relies inter alia directly on the CCTV footage, identifying as it does the precise times of entry and exit. Accordingly, it wholly undermines the claim of OLHCS that the investigation into unauthorised access was solely made on the basis of admissions.

Finally, there is no reference at all to unauthorised access to the staff room being a security issue contrary to the averments of Mr. O’Dwyer of the DPC discussed below.

13. By letter of 2nd February 2016 the Appellant is invited to a disciplinary hearing under the formal disciplinary procedure. The letter states: “The matters to be considered at the meeting are included in the final outcome report from the investigation (which you received on 15th January 2016) Please find attached a copy of the disciplinary policy”.

14. No further documentation is exhibited and the outcome of the disciplinary hearing is not apparent from the affidavits, although from submissions made at the hearing it appears that the Appellant was given a minor sanction.

Legal Framework Appeal on a point of law

15. This is an appeal on a point of law from the Circuit Court under s.26(3)(b) of the 1988 Act. As such, the scope of the review is as identified in cases such as Deely v. Information Commissioner [2001] 3 IR 439, to the effect that a court is confined in its remit on appeals on a point of law as follows:

(a) It cannot set aside findings of primary fact unless there is no evidence to support such findings;

(b) It ought not to set aside inferences drawn from such facts unless such inferences were ones which no reasonable decision-making body should draw.

(c) It can however reverse such inferences if the same were based on interpretation of documents and should do so if incorrect;

(d) If the conclusion reached by such bodies shows that they have taken an erroneous view of the law, then that also is a ground for setting aside the resulting decision.

16. Insofar as appeals against decisions of the DPC to the Circuit Court are concerned, they have been specifically considered by the Supreme Court in Nowak v. DPC [2016] 2 I.R.

585, where O’Donnell J. reached the conclusion that the applicable standard to apply is that in Orange Ltd. v. Director of Telecoms (No. 2) [2000] 4 I.R. 159.

Purpose Limitation Principle

17. Section 2(1)(c) of the 1988 Act provides in relevant part as follows: 2(1) The data controller shall, as respects personal data kept by him or her, comply with the following provisions:

“(c) The data -

(i) shall have been obtained only for one or more specified, explicit and legitimate purposes,

(ii) shall not be further processed in a manner incompatible with that purpose or those purposes”.

18. This section transposes Article 6(1)(b) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, (“Directive 95/46”)

which provides, inter alia:

“1. Member States shall provide that personal data must be: …

(b) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes. Further processing of data for historical, statistical or scientific purposes shall not be considered as incompatible provided that Member States provide appropriate safeguards”.

19. Article 6(2) places the obligation for compliance on the controller, providing that “It shall be for the controller to ensure that paragraph 1 is complied with”.

20. The protection provided by Article 6(1)(b) is known as “purpose limitation” in the data protection world. The concept of purpose limitation is explained by the Working Party 29 group (“WP29”), a group of experts from the Member States (now re-named under the GDPR as the European Data Protection Board) that from time to time issue opinions on aspects of Directive 95/46, and now on the GDPR.

21. Opinion 3/2013 on purpose limitation 00569/13/EN WP 203 (the “Opinion”) was adopted on 2nd April 2013. Because I am told by both counsel in this case, Mr. Walsh BL for the Appellant and Mr. Fennelly BL for the Respondent, that there is no case law of the CJEU or the Irish courts interpreting Article 6(1), I will quote from this Opinion in extenso. I am conscious this Opinion is simply an interpretation by a body (albeit a body with considerable expertise in data protection) of the provisions of Directive 95/46 and such opinions are not afforded any particular status in the Directive. Nonetheless, because it is of assistance in understanding the scheme of Article 6(1), it is useful to set out in full certain passages.

“III.2.1. General framework for compatibility assessment The notion of 'further' processing

It is helpful to first clarify what constitutes 'further processing'. As explained earlier, it follows from Article 6(1)(b) and recital 28 of the Directive that the purposes of processing must be specified prior to, and in any event, not later than, the time when the collection of personal data occurs.

When setting out the requirement of compatibility, the Directive does not specifically refer to processing for the 'originally specified purposes' and processing for 'purposes defined subsequently'. Rather, it differentiates between the very first processing operation, which is collection, and all other subsequent processing operations (including for instance the very first typical processing operation following collection - the storage of data).

In other words: any processing following collection, whether for the purposes initially specified or for any additional purposes, must be considered 'further processing' and must thus meet the requirement of compatibility.

The notion of incompatibility

Rather than imposing a requirement of compatibility, the legislator chose a double negation: it prohibited incompatibility. By providing that any further processing is authorised as long as it is not incompatible (and if the requirements of lawfulness are simultaneously also fulfilled), it would appear that the legislators intended to give some flexibility with regard to further use. Such further use may fit closely with the initial purpose or be different. The fact that the further processing is for a different purpose does not necessarily mean that it is automatically incompatible:

this needs to be assessed on a case-by-case basis, as will be shown below.

In some situations, this additional flexibility may be needed to allow for a change of scope or focus in situations where the expectations of society - or of the data subjects themselves - have changed about what additional use the data may be put to. It is also possible that when initially specifying the purpose, neither the controller nor the data subject thought additional purposes would be necessary, although it subsequently transpired that the data could indeed be very useful for other things. In some of these (and similar) situations, a change of purpose may be permissible, and further processing may be considered not incompatible, provided that the compatibility test is satisfied” (page 21).

22. The Opinion goes on to identify four key factors to be considered during the compatibility assessment:

- The relationship between the purposes for which the data has been collected and the purposes of further processing. The Opinion explains that the greater the distance between the purposes of collection and the purposes of further processing, the more problematic this would be for the compatibility assessment.

- The context in which the data have been collected and the reasonable expectations of the data subjects as to their further use. Here the Opinion explains that the issue here is what a reasonable person in the data subject’s situation would expect his or her data to be used for based on the context of the collection. Generally, the more unexpected or surprising the further use is, the more likely it is that it would be considered incompatible. Further the balance of power between the data subject and data controller should be considered and in particular, an investigation should be made as to whether the data subjects were obliged to provide the data under law. The more specific and restrictive the context of collection, the more limitations there are likely to be on further use.

- The nature of the data and the impact of further processing on the data subjects.

Relevant impact may involve the way in which data are further processed. The more negative or uncertain the impact of further processing, the unlikely it is to be considered as compatible use. The availability of alternative methods to achieve the objectives pursued by the controller, with less negative impact for the data subject, would be a relevant consideration.

- The safeguards applied by the controller to ensure fair processing and to prevent any undue impact on the data subjects. Appropriate additional measures could serve as compensation for the change of purpose, including additional steps taken for the benefit of the data subjects, such as increased transparency with the possibility to object or provide specific consent.

23. In summary, further processing for a different purpose is not automatically incompatible but must be assessed on a case by case basis.

Complaint by Appellant

24. At some stage following the disciplinary procedure, the Appellant decided to make a complaint to the DPC about the use of his data. Somewhat surprisingly, the original complaint made by the Appellant on 17th June 2016 does not appear to be exhibited. An email of 12th October 2017 is exhibited whereby the Appellant complains of the delay in dealing with his complaint. By letter of 18th October 2017 Mr. O’Dwyer, deputy commissioner of the DPC responds, acknowledging that progress has been slow but identifies that queries have been put to OLHCS.

25. On 28th November 2017, the DPC wrote to the Appellant summarising the response of OLHCS. The DPC summarised the Appellant’s complaint as being that OLHCS “used the CCTV footage for disciplinary proceedings related to unauthorised breaks”. OLHCS stated that the investigation panel did not view the CCTV after interviewing staff members. It further stated that the footage showed staff entering the room, that there was no workrelated reason for them to be there, that in interviews they were asked their reason for being in the room and some of them admitted to taking an unofficial additional break.

Disciplinary action was taken on the basis of that admission. Accordingly, OLHCS stated that the Appellant’s personal information was not processed by it by using CCTV as part of the disciplinary matter.

26. By email of 10th December 2017, the Appellant picked the DPC up on a mischaracterisation of his complaint, stating: “I have previously stated to your office and OLHCS Ltd. that, it was not CCTV footage that was used to sanction me, it was data retrieved, processed and used in an incorrect/unfair manner, from CCTV footage, that lead to my illegal sanction”.

27. I should say at this point that it was alleged that the Appellant had not made it clear in the proceedings that this was his position. I do not accept that contention. At paragraph 5 of his first affidavit sworn on 20th August 2018, he refers to “the grounding for such meeting (being 1 December 2015 meeting) having come from the unlawful further processing of the CCTV footage”. At paragraph 7 of the same affidavit he refers to the DPC erring in concluding that the “subsequent use of information gathered/processed for a security purpose … could thereafter legitimately be used for a reason unrelated to either security or safety…”. These paragraphs make clear the nature of his complaint.

Decision of the DPC

28. No reply to the email of 10 December 2017 is exhibited but on 27th July 2018 the DPC writes to the Appellant formally issuing a decision. The DPC notes that in its response to the Office, “OLHCS confirmed that the purpose for the use of CCTV by the Hospice at the time of graffiti incident was for “Health & Safety/Security”. OLHCS provided a copy of the relevant CCTV Policy, signature dated 30 June 2015, in which it stated that the use of CCTV in OLHCS was to prevent crime and to promote staff security and public safety”

(paragraph 4).

29. At paragraph 5, the submissions of OLHCS were summarised, with OLHCS asserting that “CCTV footage was not used for the purpose of the disciplinary hearing, and that the only purpose for the use of the CCTV was for the investigation into a criminal matter with the involvement of the Gardai. It advised that disciplinary action was taken on foot of the staff admitting that they had been taking unsanctioned breaks”.

30. The DPC first asked whether OLHCS had a lawful basis as set out under s.2A of the Act for processing the Appellant’s personal data. It concluded that OLHCS “had a legitimate justification to access and view CCTV footage in order to make enquiries as to who had carved the offensive and threatening material into the table in the staffroom. It was a serious security issue which potentially gave rise to a threat to staff and it had to be investigated. This included the necessity to view the CCTV footage as part of the investigation” (paragraph 18)…. This Office is satisfied that the processing of your personal data was in pursuit of security purposes and to prevent what your employer deemed to be possible terrorist activity. This is in line with its CCTV policy in place at the time of the incident, which states that the purposes of the CCTV system is to “prevent crime and promote staff security and public safety” (paragraph 22). The DPC concluded that OLHCS had a lawful basis under the legitimate interest provision set out in s.2A(d) of the Acts for the very limited processing of the Appellant’s personal data.

31. The DPC then went on to consider whether the requirements of s.2(1)(c)(ii) had been met, being that personal data must not be processed for purposes other than the purpose for which it was originally collected. It found that: “In this case, I am satisfied that your images captured on CCTV were processed in connection with the investigation of a security incident when they were initially viewed by the investigation team for that purpose alone. The information gathered from that viewing may subsequently have been used for another purpose i.e.

disciplinary proceedings against you but this in my view does not constitute a different purpose, because the CCTV images were not further processed for that second purpose. If the images were further processed for that second purpose, for example by downloading and use in the disciplinary proceedings against you, it might constitute further processing for a different purpose but that did not happen in your case and no further processing of your images occurred for the second purpose. Accordingly, I find that the limited viewing of your personal images took place exclusively for the security purpose for which the images were originally collected and that no contravention of s.2(1)(c)(ii) occurred” (paragraph 26).

32. It is clear from the Decision that the exclusive basis upon which it was found that no further processing had occurred was that the CCTV images had not been viewed in the disciplinary proceedings against the Appellant. The Decision did not engage with what the Appellant had clearly stated in his email of 10 December 2017, i.e. that it was not CCTV footage that was used to sanction him but rather data retrieved and processed from the CCTV footage.

The Proceedings

33. Following on from that Decision, the Appellant issued the within proceedings by originating Notice of Motion on 18th October 2018 on the following sole ground of appeal:

In making the Decision, the DPC erred in fact and/or in law: (1) In determining that the Appellant’s employer was not in violation of section 2, and in particular section 2(1)(c) of the Data Protection Acts applicable by reason of the said employer’s use of the Appellant’s data for reasons unrelated to the purpose for which such data was originally processed and/or in breach of the CCTV policy in being;”

34. The proceedings were grounded on an affidavit of the Appellant sworn 20th August 2018.

There was later an amendment to the relief sought to advance a claim of breach of fair procedures. The Appellant has made clear that he does not wish to advance that argument and so I do not consider it further. A supplemental Affidavit was sworn by the Appellant on 12th October 2018 and exhibits case studies published by the DPC in its Annual Reports.

35. Points of defence were filed on 8th November 2018 by the DPC as well as a replying affidavit sworn by Mr. O’Dwyer on 7th November 2018. In this Affidavit, Mr. O’Dwyer asserted that insofar as the CCTV footage formed the basis for the investigation meeting of 1st December 2015, it was on foot of its processing for security purposes to include those relating to the investigation of the graffiti incident (paragraph 8). He went on to observe that the disciplinary action against the Appellant took place on the basis of his own admissions in the investigation meeting, not on the basis of the CCTV footage (paragraph 9). He concluded at paragraph 12 that there was no further processing of the CCTV footage beyond that necessary for the security purposes relating to and arising from the investigation of the graffiti incident and that the disciplinary action relating to taking of breaks was based on admissions of the Appellant.

36. A further supplemental Affidavit of the Appellant was sworn on 6th December 2018. An Affidavit of the Appellant (application to amend) was sworn on 20th December 2018. A second replying Affidavit was sworn by Mr. O’Dwyer on 11th January 2019 and a replying Affidavit was sworn by him on 11th January 2019 in relation to the application to amend.

37. Only one intervention in these proceedings was made by OLHCS and that was by an affidavit sworn by Mr. Pierce of OLHCS on 8th March 2019 to address, inter alia, the purpose for which the CCTV footage was processed. At paragraphs 3,3 4 and 5 he made the following averments:

3. “We were advised to review the CCTV for the locus on a number of days (“the Data”) to ascertain who had been in the break-room at the pertinent time and may have effected the graffiti. For this purpose alone the CCTV for the 17th, 18th and 19th of November 2015 was reviewed by Mr Paul Gahan, Human Resources Manager, and Mr Tommy Beatty, the newly appointed Capital Projects Manger and previous Building Services Manager (in charge of Building Security and CCTV). In the course of this review the Appellant was seen on the CCTV entering and exiting the break room at the times set out. I say and believe that Mr Beatty, who in his former role was very familiar with the Appellant’s work schedule, had a strong suspicion that the Appellant was not authorised to be in the break room at the given times.

4. I say and believe that Mr Ken White, the newly appointed Building Services Manager, them ascertained from the OLHCS ticketing system (a system controlling and logging access to areas for maintenance purposes) that the Appellant had no authorisation to be in the break room at the given times for unknown reasons. The Appellant was called to an investigatory meeting on the 1st of December 2015, in the course of which the reason he gave for being in the break room without authorisation, at the given times, was to take unauthorised breaks. As a result of this admission sanctions were imposed on the Appellant.

5. I say that the Data was processed/reviewed on one occasion only, as set out above, and not again thereafter, and the averment at paragraph 5 of the Grounding Affidavit of the Appellant dated 20th August 2018, that there was “unlawful further processing of the CCTV footage” is inaccurate and untrue”.

38. Thus Mr. Pierce is reflecting the consistent position of the DPC, that the disciplinary process and sanctions were based on admissions and not the CCTV data or the use of it.

39. On 21st March 2019, the defence of the proceedings by the DPC took an unexpected turn.

Mr. O’Dwyer swore a third affidavit on 21st March 2019 at which stage he identified a new basis for the further processing by OLHCS not identified by OLHCS either in the summary given by the DPC of the submissions made to it by OLHCS, in the Affidavit of Mr. Pierce, in the Panel Report or in any of the material exhibited to this appeal. It may be found at paragraph 5, where he states:

“On the basis of the evidence before the Court, I say that it is clear beyond doubt that the processing of the CCTV footage by OLHCS was for security purposes, arising directly from and relating to the investigation of the graffiti incident. It is clear that, in the particular circumstances of this case, the taking of unauthorised breaks at an unauthorised location, the site of the graffiti incident, was a serious and bona fide security issue and that the investigation by OLHCS and the disciplinary action which resulted therefrom, arose directly out of and was directly connected to this security issue, albeit that the sanction applied in the context of the disciplinary action relied on admissions made by the Appellant himself”.

40. A further supplemental Affidavit was sworn by the Appellant on 27th March 2019. A reply to this was sworn by Mr. O’Dwyer on 11th April 2019 in which he repeats the new claim made in his third affidavit above at paragraph 10 as follows:

“In summary, there is no dispute that the Appellant was in the Anna Gaynor room without authorisation and in contravention of the Hospice’s ticketing system at a point in time that was relevant to the Hospice’s investigation into the graffiti incident. Indeed, on his own account, this would have constituted Mr. Doolin as a “suspect” for the purpose of that investigation. In the context of this investigation, a minor sanction was imposed on Mr Doolin on foot of his admission (now accepted)

that he had taken unauthorised breaks in an unauthorised location in contravention of the ticketing system. It is clear that, in the circumstances, the contravention of the ticketing system and the taking of an unauthorised break were valid security concerns on the part of the Hospice”.

Evidential Basis for Decision of Circuit Court

41. This approach set out at paragraph 5 of Mr. O’Dwyer’s third affidavit and paragraph 10 of his fourth affidavit was reflected in the case made before the Circuit Court and this Court, where the primary defence of the DPC is now that the further use of the information gleaned from the CCTV in the disciplinary proceedings was in fact use for the original purpose i.e. security purposes since unauthorised entry into the break room was a security concern.

42. This marks a significant departure from the approach adopted in the Decision, where the sole justification for rejecting the s.2(1)(c)(ii) argument was that, although there may have been use of the material for a different purpose i.e. disciplinary proceedings against the Appellant, this was not in fact a different purpose because the CCTV images were not further processed for that second purpose, for example because they were not downloaded and used in the disciplinary process. I find below that that conclusion is erroneous as a matter of law due to an incorrect interpretation of processing. However, its importance in this context is that it demonstrates the surprising shift in the approach of the DPC during the life of these proceedings. The DPC has gone from finding no breach because there was no further processing of the CCTV footage to asserting in these proceedings no breach because any further processing was done for the purpose for which the material was collected i.e. security.

43. This approach is quite different to the defence adopted by the DPC in the proceedings to the effect that there was no further processing in the context of the disciplinary proceeding since that process was founded exclusively on admissions made by the Appellant – again reasoning that had not been identified in its original Decision as the basis for the rejection of the s.2(1)(c)(ii).

44. What is remarkable about this new argument, i.e. that the use of the material derived from the CCTV footage in the disciplinary proceedings was for security purposes, is that there was no evidence at all to support this argument from OLHCS (as discussed further below). Notwithstanding this, it became the sole basis for the rejection by the Circuit Court of the Appellant’s appeal.

45. At page 94 of the transcript of the decision of the Circuit Court the trial judge recites in full paragraph 5 of the third affidavit of Mr. O’Dwyer quoted above, and observes “Clearly, it was a security issue, Mr. Doolin being in an unauthorised place taking unauthorised breaks. In effect, he admitted a breach of security, i.e. by taking the unauthorised breaks. The disciplinary action was taken on his admissions.” (lines 23 to 27). At page 95, the trial judge held:

“I accept that in the circumstances Mr. Fennelly’s submission that the disciplinary action by his employer against Mr. Doolin was taken for security purposes. In fact I also accept, as has been argued, that there was one investigation, i.e. the graffiti incident, not two investigations, as argued by Mr. Doolin’s counsel. In all the circumstances, taking into account the facts in this case, I’m satisfied that Mr.

Doolin has not established that he’s satisfied the test for having this decision of the Data Protection Commissioner overturned” (lines 2 to 8).

46. This conclusion was not surprising given that the trial judge relied heavily on the averments of Mr. O’Dwyer at paragraph 5 and 6 of his third affidavit (see page 276 lines

6 to 21) and does not appear to have examined the underlying documents including the Panel Report, the submissions of OLHCS as recorded in the DPC Decision, or considered the absence any averment relating to security in the Affidavit of Mr. Pierce of 8th March 2019. A consideration of this material discloses that, as far as I can ascertain, at no point in time did OLHCS ever justify the further processing of the material gleaned from the CCTV footage in the disciplinary proceedings on the basis of security concerns. Rather, it

(a) made the point that the CCTV footage itself was only viewed for security purposes and

(b) that the disciplinary proceedings did not employ material derived from the footage but were based exclusively on admissions made by the Appellant at the interview of 1 December 2015. The idea that the use of the information obtained from the CCTV footage in the context of the disciplinary proceedings was for security purposes rather than for disciplinary purposes does not find a basis in any of the material before me. There is simply no evidence at all to this effect. Perhaps most significantly, as noted in my review of the exhibited material above, the Panel Report makes no reference whatsoever to unauthorised access to the tea room or unauthorised breaks being a security issue.

47. Indeed, the very fact that OLHCS asserted that the material was not used as a basis for the disciplinary process and that the process was based on admissions makes it clear that OLHCS were not justifying use of the derived material in the disciplinary process on security grounds.

48. The Panel Report, dealing as it does only with the unauthorised breaks issue, reflects the fact that OLHCS always approached the matter on the basis that the viewing of the CCTV gave rise to two different matters: a security investigation and a disciplinary process. This is reflected in the letters of 26th and 27th November and the internal email of 27th November, as well as the Panel Decision itself. The question as to whether there were one or two investigations was the cause of much controversy between the parties, with the DPC placing significant emphasis on the fact that the Appellant had said in an email of 10 December 2017 to the DPC that there was a single investigation (CD4 to the grounding Affidavit of the Appellant) but had then asserted in the course of the proceedings that there were two investigations. This controversy seemed to me somewhat pointless. In deciding whether there were one or two investigations, what is clearly most relevant is the actions taken by OLHCS at the relevant time, rather than how the Appellant characterised them some considerable time later when engaging in correspondence with the DPC. The Appellant has no particular knowledge of the OLHCS processes, being at a remove from them and therefore his characterisation of same is unlikely to be particularly relevant.

49. The most obvious way to accurately identify what OLHCS did in this respect is to look at the contemporaneous documentation, in particular the letters of 26th and 27th November 2015 and the internal email exchange of 27th November described above. On balance, those documents indicate that there were two investigations and not one. However, the real question is not whether there were one or two investigations but whether information from the CCTV footage was used in the disciplinary process and for what purpose. As noted above, the Panel Report of 15th February 2016 makes it clear that the data was used in the investigation into the unauthorised breaks and that the unauthorised breaks were not treated as raising any security issues.

50. Moreover, the evidence indicates that the use of the information from the CCTV footage in the context of the disciplinary hearing was used for an entirely different purpose to that for which it was collected. The purpose for which the material was collected was stated on the sign beside the CCTV cameras - “Images are recorded for the purposes of health and safety and crime prevention” (see exhibit CD 3, page 113 of book of pleadings). This was reflected in the relevant CCTV Policy of OLHCS at the time, dated 30th June 2015, in which it stated that the use of CCTV in OLHCS was to prevent crime and to promote staff security and public safety. That Policy was amended on 8th August 2016, after the graffiti incident, and now has the following addition at paragraph 1 – “…The purpose of the system is to prevent crime and promote staff security and public safety. If, in the event of viewing CCTV for the specified purpose, a disciplinary action is observed, the CCTV can be used for the purpose of a disciplinary investigation. However, CCTV will not be viewed solely for the purpose of monitoring staff”.

51. Had CCTV material been intended to be used for disciplinary purposes as well as the other purpose identified, that would require to be identified (as indeed was subsequently done in the policy amendment). If, at the time of collection, the policy was as it is now, none of the above difficulties would have arisen. This is not intended in any way as a criticism of OLHCS but rather to demonstrate that the draconian consequences of upholding the Appellant’s claim as urged upon me by counsel for the DPC are unlikely. It was asserted that such a finding would seriously hamper investigations of the kind carried out here. I do not accept that. Where a processor wishes to use CCTV data for identified purposes, if those purposes are clearly identified before the material is collected (assuming of course that they are otherwise permissible purposes having regard to the Act) then the use of such material is likely to be uncontroversial.

52. In summary the CCTV footage was collected for the express and exclusive purpose of security and was used (permissibly) for that purpose but was also used for a distinct and separate purpose, i.e. disciplinary proceedings into unauthorised breaks by an employee.

53. In the premises, it seems to me that there was no evidence upon which the Circuit Court could safely conclude that the further processing in the context of the disciplinary hearing was for security purposes, since the sole basis for this finding i.e. the averments of Mr.

O’Dwyer in his third affidavit, were not themselves grounded on any material put forward by OLHCS.

54. I am therefore overturning the decision of the Circuit Court on the basis that there was no evidence for the conclusion that the disciplinary action, in which information derived from the CCTV footage was used, was carried out for security purposes.

Relevance of Appellant’s admissions

55. Although it formed no part of the DPC’s conclusions in the Decision (addressed below), for the sake of completeness, I should address the argument of OLHCS, latterly adopted by the DPC, that there was no further processing and the disciplinary proceedings were based entirely on admissions of the Appellant. I have quoted above what OLHCS characterise as the admissions of the Appellant made during the meeting of 1st December 2015. On the basis of those statements alone, it is difficult to conclude that OLHCS would have been in a position to reach the conclusions reached in the report of 15th February 2016. The Appellant’s statements are vague, lacking in detail and inconclusive in respect of unauthorised breaks. In any case, it is manifest from the Panel Report of 15th February 2015 that the disciplinary proceedings were not based exclusively on the Appellant’s admissions. The Panel expressly refer to their consideration of the CCTV footage and identify the precise entry and exit dates and times of unauthorised access to the staff area in the Anna Gaynor house by the Appellant, which is expressly stated to come from the CCTV footage and fob access. Indeed, no reference is made to any admissions in the Report at all. Given the state of the evidence on this, it makes Mr. O’Dwyer’s averment at paragraph 5 of his third affidavit to the effect that the “sanction applied in the context of the disciplinary action relied on admissions made by the Appellant himself” very difficult to understand.

Breach of s.26(1)(c)(ii)

56. Given my conclusion that the Circuit Court decision should be quashed, I am required to decide if the decision of the DPC of 27 July 2018 that there was no breach of s.26(1)(c)(ii) should be overturned, having regard to the principles identified above in Deeley.

57. The sole basis for the DPC’s decision in that regard was that there had been no further processing of the CCTV footage because that footage was not viewed again. As noted above, the Appellant’s complaint was in respect of that data retrieved and processed from the CCTV footage, and not use of the CCTV footage itself.

58. In the DPC decision, the Commissioner states that the Appellant’s images on CCTV were processed in connection with the investigation of a security incident when they were initially viewed by the investigation team. The letter goes on as follows:

“The information gathered from that viewing may subsequently have been used for another purpose i.e. disciplinary proceedings against you, but this in my view does not constitute a different purpose, because the CCTV images were not further processed for that second purpose. If the images were further processed for that second purpose, for example by downloading and use in the disciplinary proceedings against you, it might constitute further processing for a different purpose but that did not happen in your case and no further processing of your images occurred for the second purpose.”

59. It is difficult to reconcile that statement with the express terms of the Panel Report. The Panel Report describes the review of the CCTV footage as being “in order to establish the facts in relation to a crime (Offensive Graffiti) in consultation with the Gardai”, goes on to identify the precise dates and times the Appellant accessed the staff room by way of a table and concludes that the Appellant accessed the staff area in Anna Gaynor on 3 consecutive afternoons at times shown in the table in the Report. The Report explicitly states that they considered, inter alia, the CCTV footage. The information used by the Panel to arrive at their conclusion that the Applicant had taken unauthorised breaks derived inter alia from both the CCTV footage and fob access records. Accordingly, it is indisputable that the information contained in the CCTV footage was used for the disciplinary proceedings, which use constituted a different purpose from the one for which the data was originally collected. The fact that it was not downloaded for use does not mean no further processing took place.

60. In my view, applying the test in the DPC letter, this constitutes “further processing for the second purpose” having regard to the wide definition of processing. One aspect of the statutory definition of processing found at Section 1 of the Act is particularly apposite, being “processing of or in relation to information or data, means performing any operation or set of operations on the information or data, whether or not by automatic means, including – (c) retrieving, consulting or using the information or data”.

61. Here, the operation in question that was performed on the CCTV footage was its use by the investigation team to conclude that the Appellant accessed the staff area in Anna Gaynor on three consecutive afternoons (17th, 18th and 19th November) at 15.11 and

15.35 and left at 16.04 and 16.21 (the times for 19th November appear to be obscured on the copy of the Panel Report). That information was further used when the Panel Report was passed on to a Panel convened for the disciplinary hearing as identified in the letter of 2nd February 2016, being Audrey Brabazon and Kingsley Long (Exhibit CD4 to the Affidavit of Cormac Doolin sworn 20th August 2018).

62. Accordingly, I conclude that as a matter of law, having regard to the definition of processing in the Act, and contrary to the conclusion reached by the DPC, the CCTV images were further processed.

Conclusion

63. For the reasons set out in the Decision, I:

(a) allow the appeal against the decision of the Circuit Court on the basis that there was no evidence for the conclusion that the use of the CCTV footage or material derived from it in the disciplinary hearing was for security purposes;

(b) conclude that the DPC made an error of law in holding that no further processing took place as this conclusion was founded upon an incorrect interpretation of “processing” having regard to the terms of s.2(1)(c)(ii).

64. Having regard to the above, I uphold the appeal and set aside the conclusions of the DPC in the Decision to the effect that no contravention of s.2(1)(c)(ii) occurred.

65. I am conscious that s.26 simply provides for an appeal to the High Court on a point of law but does not prescribe what should happen in the event of a successful appeal. I therefore propose to hear the parties on the form of Order, including whether the matter should be remitted to the DPC.

[Note: At a costs hearing on 25 February 2020, the parties indicated that no remittal should be made to the DPC and an Order was made in the terms of paragraph 63 above].