Court partially allows appeal against Data Protection Commission for failing to afford fair procedural notice.

AN CHÚIRT CHUARDA THE CIRCUIT COURT Record No. 2021/00340 DUBLIN CIRCUIT COUNTY OF CITY OF DUBLIN IN THE MATTER OF SECTION 26 OF THE DATA PROTECTION ACT 1988, AS AMENDED BETWEEN:

THE DIRECTOR OF CORPORATE ENFORCEMENT APPELLANT -AND- THE DATA PROTECTION COMMISSION RESPONDENT -AND- PAUL COYLE NOTICE PARTY Judgment of His Honour Judge John O’Connor delivered on the 1st day of April, 2022

Introduction:

1. In these proceedings, the Appellant, the Director of Corporate Enforcement (the ‘Director’), appeals against the decision of the Respondent, the Data Protection Commission (the ‘Commission’), dated 24 December 2020 (the ‘Decision’), whereby the Commission upheld the notice party’s (Mr. Coyle’s) complaint that the Director had unlawfully withheld access to Mr. Coyle’s personal data contained in liquidator’s reports, complaints, internal correspondence and pleadings.

2. The Decision concerned a complaint by Mr. Coyle, that the Director had refused to provide Mr. Coyle with access to his personal data held by the Director contrary to the Data Protection Acts 1988-2003 (the ‘Acts’).

3. The Commission issued a draft decision to the parties on 13 November 2020 (the ‘Draft

Decision’). In the Draft Decision, the Commission signified its intention to decide that the Director was obliged to grant Mr. Coyle access to his personal data contained in publicly available documentation, contained in the Director’s correspondence with Mr. Coyle and contained in legal pleadings. The Commission also suggested in the Draft Decision that the Director was entitled to withhold access to Mr. Coyle’s personal data contained in liquidator’s reports, complaints and internal correspondence.

4. The Commission invited the parties to make submissions in relation to the Draft Decision.

Mr. Coyle did not make submissions. The Director submits he confined his submissions, following the Draft Decision, to the aspects of the Draft Decision in which he perceived that the Commission were proposing to hold against him.

5. The Commission in the Final Decision came to a different conclusion in part to that contained in the Draft Decision. The Director contends that the Commission did so, without giving the parties fair notice of its proposal or intention to do so and without affording him an opportunity to adduce evidence or make further submissions before the Final Decision was made. The Director submits that this represents a fundamental departure from basic fairness of procedures in the decision-making process.

6. The Commission submits that the Director has not identified any serious and significant error of procedure or substance, which would justify setting aside the findings of the Commission impugned in these proceedings. It further submits that in circumstances where the Director does not challenge a number of the findings of the Commission in the Final Decision, there is no basis on which the Decision as a whole could be set aside.

While the Commission contends that, the Director has failed to establish any basis on which the Decision should be set aside, even in part, it submits that if the court came to a different conclusion, the appropriate course of action then would be for the relevant findings to be set aside, but for the matter to be remitted back to the Commission.

7. Bearing in mind the competing submissions, the court is principally required to consider whether the Commission adopted fair procedures in its conclusions contained in the

Decision. In doing so the court must also consider the scope of an appeal pursuant to the Data Protection Acts.

8. Although the Respondent is referred to as the ‘Commission’ instead of the ‘Commissioner’ in this case, it is done so solely for ease of reading the judgment. It is acknowledged that the parties used the words ‘Commission’ and ‘Commissioner’ interchangeably at various stages in their submissions. It is acknowledged that the appeal is brought under and governed by the Acts. Pursuant to Section 14 of the Data Protection Act 2018 (the “2018 Act”) all functions previously vested in the Data Commissioner are now transferred to the Data Protection Commission as established by the 2018 Act. The Data Protection Act 2018 which became law on 25 May 2018 established the Commission and it is this latter term that is referred to below in the judgment. However, the Court understand this is not an issue for the parties.

9. The Appellant is the Director of Corporate Enforcement but on occasions when referring to submissions it is referred to as the ODCE (Office of the Director of Corporate Enforcement) but more generally as the Director.

The Applicable Law: The Data Protection Act 1988 and Directive 95/46/EC:

10. The statutory scheme comprises three principle elements:

a. Firstly, Mr. Coyle’s right of access to his personal data and the restrictions on that right provided for by the Data Protection Acts.

b. Secondly, those statutory provisions derive from EU law, including Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the Protection of individuals with regard to the processing of personal data and on the free movement of such data (“the Directive”). The Directive is since repealed, however it is common case that the complaint is, by reason of Section 8 of the Data Protection Act 2018, governed by the old acts.

c. Thirdly, the functions and responsibilities of the Director as prescribed by the Companies Act 2014.

11. The long title to the Data Protection Act 1988 provides that it is an “Act to give effect to the Convention for the protection of individuals with regard to automatic processing of personal data done at Strasbourg on the 28th day of January 1981, and for that purpose to regulate in accordance with its provisions the collection, processing, keeping, use and disclosure of certain information relating to individuals that is processed automatically.”

12. The 1988 Act was one of the first national data protection statutes and it implemented the provisions of the Convention, which are set out in full in Schedule 1 to the 1988 Act. The Directive was introduced to achieve harmonisation of the laws of Member States on data protection. Insofar as the 1988 Act had not already implemented the provisions of the Directive, the Directive was transposed into Irish law by the Data Protection (Amendment) Act 2003.

13. The 1988 Act and the 2003 Act remain in force, although some of their provisions were repealed by Section 7 of the Data Protection Act 2018. Section 8(2) of the 2018 Act provides, however, that the 1988 Act shall apply to a complaint made pursuant to Section

10 of the 1988 Act, before the commencement of the 2018 Act, i.e. before 25 May 2018.

Similarly, Article 99(2) of the General Data Protection Regulation provides that it “shall apply from 25 May 2018”. Accordingly, Mr. Coyle’s complaint is governed by the 1988 Act, the Directive and the 2003 Act, rather than by the General Data Protection Regulation and the 2018 Act.

14. The Directive and the 1988 Act, as amended, set out general rules on the lawfulness of the processing of personal data and they identify the rights of persons whose data are processed. The Directive also allows Member States to enact legislative measures to restrict the scope of data protection rights and obligations where “necessary ... to safeguard” a number of objectives prescribed by Article 13 of the Directive.

Definitions under the Acts:

15. The Data Protection Acts impose obligations on persons, known as “data controllers”, who “[control] the contents and use of personal data”. “Personal data” is defined very broadly, to include any information that can be related to a living individual (“a data subject”) and anything done with that information. Any information that may relate to an individual can fall within this definition. Personal data has been held to include a person’s name and address (Case C-28/08EC Commission v. Bavarian Lager Company Limited (UK) [2011] 1 CMLR 1), and his or her income (Joined Cases C-465/00, C-138/01 and C-139/01 Rechnungshof v.Osterreicher Rundfunk [2003] ECR I-4989), for example.

16. A “data controller” is the entity responsible for complying with data protection law.

Section 1(1) of the 1988 Act defines a data controller as “a person who, either alone or with others, controls the contents and use of personal data”. A “data processor” is defined in the same section as “a person who processes personal data on behalf of the data controller but does not include an employee of the data controller who processes such data in the course of his employment”. “Processing of data” is broadly defined in the 1988 Act and it includes obtaining, recording, keeping, collecting, organising, storing, retrieving or disclosing the information in question. Rights of Data Subjects and Restrictions on those Rights:

17. The 1988 Act and the Directive provide that data subjects have certain rights, including a right to establish whether another person keeps any data in relation to the subject (Section 3 of the 1988 Act and Article 10 of the Directive) and a right of access to data held by a data controller (Section 4 of the 1988 Act and Article 12 of the Directive). The Charter of Fundamental Rights of the European Union has since recognised the right to protection of personal data. Article 8(2) of the Charter provides, in the relevant part, that:

“everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.”

18. Accordingly, the right of a data subject to have access to his or her personal data, subject to the exceptions, is a core provision of the data protection regime.

19. The Directive grants Member States an appreciable measure of discretion when implementing its provisions. Article 13 of the Directive provides that Member States may introduce legislation to restrict the scope of the obligations and rights set out therein, when such a restriction is necessary to safeguard:

(a) national security;

(b) defence;

(c) public security;

(d) the prevention, investigation, detection and prosecution of criminal offences, or of breaches of ethics for regulated professions;

(e) an important economic or financial interest of a Member State or of the European Union, including monetary, budgetary and taxation matters;

(f) a monitoring, inspection or regulatory function connected, even occasionally, with the exercise of official authority in cases referred to in (c), (d) and (e);

(g) the protection of the data subject or of the rights and freedoms of others.

20. In that context, Ireland has enacted a number of restrictions on the general right of access to data. Section 4(1)(a)(iii) of the 1988 Act provides for a right of access in the following terms, namely:

“Subject to the provisions of this Act, an individual shall, if he or she so requests a data controller by notice in writing –

...

(iii) have communicated to him or her in intelligible form – (I) The information constituting any personal data of which that individual is the data subject, and (II) Any information known or available to the data controller as to the source of those data unless the communication of that information is contrary to the public interest.”

21. Section 5 of the 1988 Act restricts the access provided for in section 4(1) in a number of ways. Section 5(1)(d) of the 1988 Act empowers the Minister for Justice to restrict access to personal data kept by bodies exercising statutory functions designed to prevent loss to members of the public, where such access would be likely to prejudice the proper performance of those functions. The section provides as follows:

“Section 4 of this Act does not apply to personal data –

...

(d) kept for the purpose of performing such functions conferred by or under any enactment as may be specified by regulations made by the Minister, being functions that, in the opinion of the Minister, are designed to protect members of the public against financial loss occasioned by -

(i) dishonesty, incompetence or malpractice on the part of persons concerned in the provision of banking, insurance, investment or other financial services or in the management of companies or similar organisations, or

(ii) the conduct of persons who have at any time been adjudicated bankrupt, in any case in which the application of that section to the data would be likely to prejudice the proper performance of any of those functions”.

22. Pursuant to the Data Protection Act 1988 (section 5(1)(d)) (Specification) Regulations 2009, the Minister for Justice specified, for the purposes of section 5(1)(d) of the 1988 Act, the functions of the Director pursuant to the Companies Acts. Section 957A of the Companies Act 2014, as inserted by section 224 of the 2018 Act, ensures that the restriction on the right of access has been retained since the enaction of the 2018 Act, though the 2018 Act introduced requirements for the restrictions to be necessary and proportionate.

23. Paragraph 11(1) of Schedule 6 to the Companies Act 2014 provides that all references in legislation to the Companies Act 1963 to 2013 are deemed to refer to equivalent provisions in the Companies Act 2014.

24. The Commission is the supervisory authority in Ireland, which is responsible for the application of data processing law within the State. Section 10(1) of the 1988 Act, as amended, provides as follows:

“(a) The Commissioner may investigate, or cause to be investigated, whether any of the provisions of this Act have been, are being or are likely to be contravened by a data controller or a data processor in relation to an individual either where the individual complains to him of a contravention of any of those provisions or he is otherwise of opinion that there may be such contravention.

(b) Where a complaint is made to the Commissioner under paragraph (a) of this subsection, the Commissioner shall -

(i) Investigate the complaint or cause it to be investigated, unless he is of the opinion that it is frivolous or vexatious, and

(ii) If he or she is unable to arrange, within a reasonable time, for the amicable resolution by the parties concerned of the matter the subject of the complaint, notify the individual concerned in writing of his decision in relation to the complaint and that the individual may, if aggrieved by the decision, appeal against it to the Court under section 26 of this Act within 21 days from the receipt by him or her of the notification.”

Appeal to the Circuit Court and the Test to be Applied:

25. Section 26(1)(d) of the 1988 Act, as amended, provides for an appeal to the Circuit Court against any decision of the Commissioner in relation to such a complaint. In Nowak v.

Data Protection Commissioner [2016] 2 IR 585, (“Nowak”) the Supreme Court (O’Donnell J.) held that the test to be applied and/or reviewed to be applied on any appeal is that promulgated by Keane CJ in Orange v. Director of Telecommunications Regulations [2000] 4 IR 159 at pages 184 to 185 (“The Orange Test”):

“In short, the appeal provided for under this legislation was not intended to take the form of re-examination from the beginning of the merits of the decision appealed from culminating, it may be, in the substitution by the High Court of its adjudication for that of the first defendant. It is accepted that, at the other end of the spectrum, the High Court is not solely confined to the issues which might arise if the decision of the first defendant was being challenged by way of judicial review. In a case of this legislation at least, an applicant will succeed in having the decision appealed from set aside where it establishes to the High Court as a matter of probability that, taking the adjudicative process as a whole, the decision reached was vitiated by a serious and significant error, or a series of such errors. In arriving at a conclusion on that issue, the High Court will necessarily have regard to the degree of expertise and specialised knowledge available to the first defendant.”

26. It is common case between the parties and the court therefore that an appeal under Section 26 of the Acts is not a full re-hearing on the merits and is limited in nature. In doing so in applying the Orange Test, as outlined by O’Donnell J, above the following three principles are applicable to this case.

27. First, the appeal is not intended to take the form of a re-examination, from the beginning, of the merits of the decision, culminating in the substitution by the Court of its adjudication for that of the statutory decision-maker.

28. Secondly, the court is not confined to the issues which could be raised solely by way of judicial review. However, an applicant must establish as a matter of probability that taking the adjudicative process as a whole, the decision reached was vitiated by a serious and significant error or a series of such errors.

29. Thirdly, in its decision, the Court will necessarily have regard to the degree of expertise and specialised knowledge available to the Commission.

30. The Commission further submits that in coming to its judgment, the Decision must be assessed by the court on the basis of the evidence that was before the Commission at the time of the Decision (King v. Minister for Finance & Others [2010] IEHC 307; Governey v.

Financial Services Ombudsman [2013] IEHC 403).

31. In this regard, the Commission therefore submits that as the Director has put further evidence before the court (which it states was not available to the Commission), in respect of an affidavit setting out the expert opinion of an experienced liquidator in relation to certain matters, it would be neither fair nor appropriate for this material to be relied upon by the Director in reviewing the Commission’s Decision.

32. In general, it is not open to the Court to reconsider issues of fact, or mixed questions of law and fact, unless they reach the level of being “vitiated by a serious and significant error or a series of such errors” (Millar v Financial Services Ombudsman [2015] IECA 126 per Kelly J at paragraphs 36-38).

33. In addition, the court should not consider complaints about process or merits in isolation but rather should consider the adjudicative process as a whole (Millar v Financial Services Ombudsman [2015] IECA 126).

The Companies Act 2014:

34. The Director of Corporate Enforcement [the ‘Director’] was established pursuant to Section 7 of the Company Law Enforcement Act 2001, to give effect to the recommendations of the McDowell Report in November 2018. Section 945(1) of the 2014 Act provides that the Office of the Director shall remain in being. The Director is independent in the performance of his functions (Section 946(5) of the 2014 Act). The functions of the Director are prescribed by Section 949(1) of the 2014 Act, and set out below:

(a) to encourage compliance with this Act,

(b) to investigate –

(i) instances of suspected offences under this Act, and

(ii) instances otherwise of suspected non-compliance with this Act or with the duties and obligations to which companies and their officers are subject,

(c) to enforce this Act, including by the prosecution of offences by the way of summary proceedings,

(d) at his or her discretion, to refer cases to the Director of Public Prosecutions where the Director has reasonable grounds for believing that an indictable offence under this Act has been committed,

(e) to exercise, in so far as the Director considers it necessary or appropriate, a supervisory role over the activity of liquidators and receivers in the discharge of their functions under this Act,

(f) for the purpose of ensuring the effective application and enforcement of obligations, standards and procedures to which companies and their offices are subject, to perform such other functions in respect of any matters to which this Act relates as the Minister considers appropriate and may by order confer on the Director,

(g) to act under Chapter 2 as a member of the Supervisory Authority and, if appointed under section 907, act as a director of that body, and

(h) to perform such other functions for a purpose referred to in paragraph (f) as may be assigned to the Director under this Act or any other Act of the Oireachtas.

35. Section 682(2) of the 2014 Act provides that, in the winding up of an insolvent company, the liquidator “shall, within 6 months after the date of his or her appointment, and at all intervals as required by the Director thereafter, provide to the Director a report in the prescribed form”. The Director may then require the liquidator of the insolvent company to answer such questions as the Director may decide to put to him or her “concerning the contents of a report made by the liquidator .., the affairs of the company or the conduct of any director of the company” (Section 682(3)(a) of the 2014 Act) and to “give such other assistance” as the Director may reasonably require “for the purposes of the Director’s appraisal of such a report and the Director’s examination of any fact or allegation contained in it or which comes to the Director’s knowledge by reason of an answer given ... or otherwise through the Director’s performance of functions under the Act” (Section 682(3)(b) of the 2014 Act). The form of a liquidator’s report is prescribed by Order 74, Rule 94 of the Rules of the Superior Courts and Form 54 appended thereto to ensure a measure of consistency in the provision of information by liquidators to the Director so that the Director can perform his functions.

36. Section 683(2) of the 2014 Act provides that all liquidators of insolvent companies are obliged to make an application to have the directors restricted, pursuant to Section 819 of the 2014 Act, unless the Director has relieved the liquidator of the obligation to make such an application, whether generally or in respect of certain of the directors (Section 683(3) of the 2014 Act). The purpose of a restriction order is to protect the public, as Finlay Geoghegan J. explained in Re Colm O’Neill Engineering Services Limited (unreported, High Court, Finlay Geoghegan J., 13 February 2004). Finlay Geoghegan J.

at paragraph 2 of her judgment:

“It is well established that the purpose of the Section is to protect the public against the future supervision and management of companies by persons who past record as directors of insolvent companies have shown them to be a danger to creditors and others.”

37. In Re Silken Construction Limited; Kavanagh v. O’Donoghue [2003] 4 IR 443, Finlay Geoghegan J. directed the liquidator of the company to make discovery of certain parts of his report, in the context of an application for restriction. In doing so, Finlay Geoghegan J.

observed, however, that “a liquidator should, having regard to the statutory framework, be entitled to furnish to the Director without necessarily disclosing same to the directors of the company,” certain of the information contained in his reports (pages 447 to 448).

The Applicable Rules of Statutory Interpretation:

38. The principles to be applied in construing the relevant provisions of the 1988 Act are well settled. The court must have regard to “the ordinary and natural meaning of the words and phrases used, with the text being the primary reference source” (Meagher v. Minister for Social Protection [2015] 2 I.R. 633 at para. 37). Where the words used are clear and unambiguous, they should be so construed (Board of Management of St. Molaga’s National School v. Department of Education [2011] 1 I.R. 362 at page 372) unless such “a construction would be absurd or would fail to reflect the plain intention of the Oireachtas” (Irish Life and Permanent plc v. Dunne [2016] 1 I.R. 92 at para. 36). The natural meaning of a word can vary depending on the context in which it is used (Director of Public Prosecutions v. Brown [2019] 2 I.R. 1).

39. When construing the provisions of the Acts, they must be construed, insofar as possible, in conformity with the parent Directive (Marleasing SA v. La Comercial Internacional de Alimentacion SC (C-106/89).

The Facts:

40. Mr. Coyle was a director of Decobake Limited (“the company”), which was, on 5 May 2000, incorporated as a limited liability company pursuant to the provisions of the Companies Act 1963, as amended. The company was wound up by Order of the High Court on 24 July 2017 and Mr Declan De Lacy was appointed as Official Liquidator of the company.

41. Mr. Coyle contacted the Director’s office in January 2018, to signify his intention to make a complaint alleging criminal misconduct in relation to the liquidation of the company. On

7 March 2018, he made a data access request in the following terms:

“I require access to every document in your offices that contains my address, my name, my PPS number.”

42. On 28 March 2018, the Director wrote to Mr. Coyle, to advise him that he had decided to refuse Mr. Coyle’s request for access to the documents in question. The Director also set out the basis upon which he had decided to withhold access, namely because:

(a) The Director had received information, in confidence, from the liquidator of the company. Disclosure of that information would breach confidence and it would be contrary to the public interest;

(b) The Director highlighted the importance of preserving the confidentiality of the information contained in reports submitted by liquidators to the Director and contended that he was entitled to withhold access to Mr. Coyle’s personal data pursuant to the provisions of Section 4 of the 1988 Act; and

(c) The Director contended that he was entitled to restrict access to Mr. Coyle’s personal data pursuant to Section 5(1)(d) of the 1988 Act, as the Director’s statutory functions had been specified by the purposes of that section.

43. On 1 August 2018, Mr. Coyle lodged a complaint with the Commission regarding the Director’s refusal to provide him with access to the documents in question. On 25 January 2019, the Commission advised Mr. Coyle that the Director “appeared to have a legal basis for refusing [the] access request”. The Director submits that this must have been a reference to the entitlement to restrict access pursuant to section 5(1)(d). However Mr.

Coyle asked the Commission to proceed with its investigation.

44. On 21 February 2019, the Commission requested the Director to provide a detailed description of the data that had been withheld, together with the Director’s reasons for doing so. The Director replied, on 4 March 2019, outlying the basis of his contention that he was entitled to withhold access to the data in question.

45. Having considered the parties’ submissions, the Commission issued its Draft Decision on

13 November 2020 (the ‘Draft Decision’). In the Draft Decision, the Commission decided that the Director was obliged to provide Mr. Coyle with access to his personal data contained in publicly available documents that the Director held and in correspondence exchanged between the Director and Mr. Coyle.

46. However in the Draft Decision the Commission also accepted that the Director’s statutory function in receiving confidential reports from liquidators of insolvent companies was designed to protect members of the public against financial loss occasioned by dishonesty, incompetence or malpractice in the management of companies. The Commission stated the following, at paragraph 29 of the draft decision:

“I am of the view that it is reasonable for the ODCE to assert that if personal data relating to an officer of an insolvent company contained in a liquidator’s report could be required to be released to that officer if the officers [sic] makes a subject access request, then this could have a negative impact on the quality of information that liquidators would include in such reports and therefore be [sic] likely to be a prejudice to performance by the ODCE of its functions in connection with its receipt and use of such reports. As such, I am satisfied that the application of Section 4 in this case could prejudice the performance of the ODCE’s functions under Section

682. Therefore, I am satisfied that the ODCE was entitled to rely upon Section 5(1)(d)(i) of the Acts in withholding your personal data contained in the liquidator’s reports. As I have reached the view that this exemption applied, it is not necessary to consider whether the data could also be withheld on the basis of Section 4(1)(a)(iii)(II) of the Acts.”

47. At paragraph 31of its Draft Decision, the Commission signified its intention to find “that it is in the public interest that the ODCE is able to carry out its statutory functions and that disclosing personal data relating to [Mr. Coyle] in complaints and internal correspondence could impact upon and would be contrary to the public interest.”

48. According to the Director, in the Draft Decision, the Commission provisionally decided that:

a) The Director was not entitled to withhold personal data relating to Mr. Coyle if such personal data was also publicly available;

b) The Director was not entitled to withhold personal data relating to Mr. Coyle contained in correspondence between Mr. Coyle and the Director, on the basis that Mr. Coyle already had a copy of such data;

c) The Director was entitled to withhold personal data relating to Mr. Coyle contained in liquidator’s reports, pursuant to section 5(1)(d) of the 1988 Act, as amended;

d) The Director was entitled, in the public interest, to withhold personal data relating to Mr. Coyle contained in complaints and internal correspondence pursuant to section 4(1)(a)(iii)(II) of the 1988 Act, as amended; and

e) The Director was not entitled to withhold personal data relating to Mr. Coyle contained in legal pleadings pursuant to sections 5(1)(d), 4(1)(a)(iii)(II) or 4(4) or 4(4)(A) of the 1988 Act, as amended.

49. The Commission invited the parties to make further submissions followings the Draft

Decision. Mr. Coyle did not make any further submission. However by letter dated 4 December 2020, the Director submitted to the Commission that the Director was entitled to withhold access to personal data contained in legal pleadings. The Director explained that certain legal pleadings had been provided to him “in confidence by the other party to the proceedings, namely the liquidator” and that the restriction of Mr. Coyle’s access to the personal data contained in those proceedings was “considered necessary and proportionate in order to protect the confidential reporting regime and not negatively impact on the quality of information provided by [liquidators] where such a confidential reporting regime is designed for the purpose of protecting the public against financial loss caused by dishonesty”.

50. The Director submitted that it welcomed the conclusions that the Commission had provisionally reached in the Draft Decision regarding the reporting regime established by section 682 of the Companies Act 2014 and the Director’s entitlement to withhold access to personal data contained in such reports.

51. The Director further submits to the court that it believed the Commission had found in the Director’s favour in relation to this issue, and therefore the Director believed that it was not required to make further submissions or offer any further evidence as to why this

decision was justified. In other words the Director’s perspective is that the Commission had accepted his submissions in relation to these matters and there was therefore no contrary view to be addressed or dealt with.

52. The Commission did not request further submissions before it delivered its final Decision.

The Commission’s Submission in respect of the Change of Findings in the Final

Decision:

53. Firstly in relation to personal data contained in the liquidators’ reports, in the Draft

Decision, the Commission states it had expressed the preliminary view that the Director was entitled to rely upon section 5(1)(d)(i) of the Acts in withholding Mr Coyle’s personal data. However, having considered the matter further, including in light of the Director’s submissions, the Commission concluded that, for the detailed reasons they set out in the Final Decision, the Director was not entitled to withhold access to personal data in the liquidators’ reports on this basis.

54. Secondly, in relation to personal data in complaints and internal correspondence, in the Draft Decision, the Commission acknowledges it expressed the provisional view that the Director was not entitled to withhold such personal data under section 5(1)(d) of the Acts but that the provision of this category of personal data would be contrary to the public interest for the purposes of section 4(1)(a)(iii)(II) of the Acts. In the decision under appeal, the Commission states it remained of the view that the Director was not entitled to withhold such personal data under section 5(1)(d) of the Acts. In respect of section 4(1)(a)(iii)(II), the Commission submits it clarified that the Director was entitled to withhold the source of personal data but not otherwise to withhold other personal data on this basis. In doing so, the Commission further submits that its finding reflected the terms of section 4(1)(a)(iii)(II).

55. The Director accepts the Commission’s provisional view on section 4(1)(a)(iii)(II) of the Acts and did not make detailed submissions on this point. However, the Commission further submits the Director did make submissions on this category more generally, including by arguing that there was a contradiction between the provisional findings in respect of section 4(1)(a)(iii)(II) and section 5(1)(d) in the Draft Decision.

56. Therefore in both instances, in light of the submissions made by the Director, the Commission submits that it was required to consider afresh the proper interpretation of the exemptions relied upon in the context of the third, fourth and fifth categories of personal data at issue in the complaint. In doing so, the Commission acknowledges it departed from the provisional views expressed in the Draft Decision but submits that it did so in limited respects. In addition the Commission states it was perfectly entitled to depart from its view in reaching a final decision on the complaint, as they had given due consideration to the parties’ positions.

The Issues as Submitted by the Director:

57. The Director submitted in written submissions that the issues to be determined by the court are:

(a) Did the Commission observe basic fairness procedures by reaching the decision which the Director submits departed significantly from the Draft Decision it had circulated to the parties, without having been asked by either party to do so, and without giving the parties an opportunity to make submissions in relation to the proposed change?

(b) Did the Commission’s decision-making process and decision respect the Director’s legitimate expectations?

(c) Was the Commission entitled to conclude that legal pleadings cannot be provided to the Director in confidence?

(d) Did the Commission err in its interpretation of the restriction on the general right of access to personal data contained in Section 5(1)(d) of the Data Protection Act 1988, as amended?

(e) Is the Commission entitled to explain its decision by evidence in these proceedings?

58. While not waiving these issues raised, the Director conceded in oral submissions in court that the primary issue to be concerned is one of breach of fair procedures by the Commission in arriving at its decision. In particular, it is asserted that the fact the Commission reversed its decision on significant preliminary views expressed in the Draft

Decision, without reverting to the Director, constitutes a breach of the Director’s right to be heard.

Summary of the Issues from the Commission’s Submissions:

59. The Commission accepts in accordance with the requirements of fair procedures under both Irish and EU law, the parties to a complaint under investigation by the Commission have a right to be heard in respect of the complaint. However, in the process culminating in the Decision, the Commission submits that it ensured the parties’ right to be heard, both during the initial stage of the investigation and in respect of the Draft Decision, which identified the issues arising for determination and the Commission’s provisional views in relation to same. Having done so, the Commission submits that it was not obliged to afford an additional right to be heard in the event that a finding in the Final

Decision departed from its preliminary view in the Draft Decision, as this would be tantamount to a right to be heard on multiple occasions.

The Status of the Draft Decision:

60. One of the contentious issues between the parties therefore is the status of the Draft

Decision. The Commission submits that while it does not dispute that fair procedures require the parties to be informed of the issues for determination in respect of a particular complaint and any relevant factual material relied upon by the decision-maker, there is no obligation on a decision-maker to disclose the precise reasoning or legal analysis it proposes to adopt prior to making a final decision. (National Maternity Hospital v Information Commissioner [2007] 3 I.R. 643 and Eviston v. DPP [2002] 3 IR 260)

61. The Commission further submits that the issues for determination by it (the Commission)

were in fact clearly identified in the Draft Decision. It then stated it did afford the parties a right to be heard in respect of those issues and was thereafter obliged to consider the submissions and representations. However, the Commission submits it could not be regarded as being bound by the provisional views set out in the Draft Decision or as being precluded from departing from the preliminary views in the Draft Decision bearing in mind the Commission’s overarching obligation to determine complaints in accordance with the applicable Irish and EU law.

62. The Director submits that the purpose of delivering a Draft Decision is to enable the parties to make submissions in relation to it and referenced paragraph 2 of the judgment of McGovern J. in Data Protection Commissioner v. Facebook Ireland Limited and Another [2016] IEHC 414, where the learned judge stated:

“The decision was issued in draft form so as to preserve the right of Mr. Schrems and/or [Facebook Ireland Limited] to make further submissions in relation to its terms and the Commissioner will give consideration to such submissions in due course.”

63. It also referenced that in another statutory context, the High Court held in Ryanair Ltd v Commission for Aviation Regulation [2008] IEHC 98, that the purpose of issuing a Draft

Decision was to enable the parties affected by that decision to make submissions in relation to it or to be given an opportunity to inspect the Final Decision.

64. The Director then submitted that the procedure (albeit in a different context) was explained by the Commission in its submissions to Barniville J. in Facebook Ireland Limited v. Data Protection Commission [2021] IEHC 336 as follows, namely to invite the parties “to make submissions on the facts and on the law and to provide such further information as it felt necessary in response to the preliminary views set out” (ibid at paragraph 6) in the Draft Decision. In the same judgment, Barniville J. considered that the purpose of a preliminary decision was to enable the Commission to “set out [its] view pending receipt of further submissions”.

65. The Director submitted that at common law, drafts of a judgment may be provided to enable parties affected by the decision to inspect them for “error and ambiguity”, including an error in the “reasoning process” (In re N (A Child) [2009] 1 WLR 1621 at paragraph 106), or to identify any material omission (ibid), but not to make further submissions in relation to the matters at issue (R (Edwards) v. Environment Agency [2008] 1 WLR 1587).

The Court’s View of the Draft Decision:

66. In the court’s view the description of a ‘Draft Decision’ by the Commission is in reality just that, a draft. It is not a mandatory requirement for the Commission to do so. It involves a preliminary disclosure and opinion by the Commission to the parties involved of the Commission’s understanding of the facts and issues for determination, its philosophy, the relevant law and a draft decision to the parties in respect of a determination of a complaint(s). The voluntary invitation to the parties to make further submissions under such conditions and time limits as the Commission decides is to be assessed in the overall context of the Commission’s duty as the decision-maker to observe fair procedures in the adjudicative process as a whole and which impacts on the Final Decision.

67. The Commission is not estopped by its preliminary views in the Draft Decision to concluding its findings in the Final Decision. It is therefore not confined in its Final

Decision to matters of error or ambiguity and can revisit its “preliminary conclusions” in its Final Decision.

68. However, in this case, it is important to look at both the letter that accompanied the Draft

Decision, and the Draft Decision of November 2020. The letter is from Sandra Skehan, Assistant Commissioner, Determination Assessment Unit, dated the 13th November 2020 and addressed to Mr Phil Flood in the Office of the Director of Corporate Enforcement. It states as follows:

“Dear Mr Flood,

I refer to previous correspondence with the office in relation to Mr Paul Coyle’s complaint against the Office of the Director of Corporate Enforcement (“ODCE”), referenced above.

I now enclose a copy of the Draft Decision of the Commissioner, also being issued on today’s date to Mr Coyle.

The decision is being sent to you in draft form, to afford you a future and final opportunity to identify any factual material contained therein which it considers to be inaccurate and/or incomplete and to make representations to this office in relation to the analysis and findings contained in the draft.

I would ask that you submit your representations, if any, by 04 December 2020.

If further representations are received from Mr Coyle and/or the ODCE it is the Commissioner’s intention to issue a final decision within a period of not more than

10 working days thereafter. In the event that the parties decide not to submit further representations at this point, the Commissioner’s final decision will issue as soon as practicable.

I trust this is in order.”

69. The Draft Decision style is very much in the format of a final decision except that on each page of the document the word “draft” appears.

70. The Commission, as the decision maker, must at all stages of the process afford all parties adequate opportunity to be informed of the issues for determination in respect of a particular complaint throughout the whole adjudicative process. The Draft Decision is a useful tool in this regard. Ultimately, in coming to a final decision, it is one of fairness to be assessed in an objective matter and not according to the subjective submissions of the individual parties involved.

71. On an appeal to the Circuit Court, the court will assess this “fairness” by evaluating the adjudicative process as a whole objectively. This does not negate the curial deference the court affords the Commission and the conditions laid out in the Orange Test.

The Respondent’s Views on the Adjudicative Process as a Whole and Fair Procedures:

72. The Commission submitted that it fully complied with the requirements of fair procedures, including the right to be heard and that, therefore, there was no breach of fair procedures or the Director’s right to be heard.

73. Specifically, it pointed out the following. First, following receipt of the complaint, the Commission states it wrote to the Office of the Director of Corporate Enforcement (ODCE)

informing it of the complaint and the commencement of the investigation and requested a detailed description of the data the ODCE was withholding and a clear statement of the reasons for refusal of access. The ODCE replied setting out its basis for refusal of access and providing an appendix with the categories of personal data held by the ODCE in respect of Mr Coyle.

74. Secondly, prior to its determination of the case, the Commission furnished both parties with a Draft Decision identifying the issues for determination and giving the parties a further opportunity to make any submissions they wished to make in advance of the Commission proceeding to make a final decision on the matter.

75. The Draft Decision identifying the issues arising for determination and the Commission’s preliminary views were clearly described as such and its status as a draft was marked on each page of the Draft Decision. In the covering letter, it is stated that the Draft Decision was being provided to the parties “to afford you a further and final opportunity to identify any factual material contained therein which it considers to be inaccurate and/or incomplete and to make representations to this office in relation to the analysis and findings contained in the draft”.

76. In affording this further and final opportunity to be heard, the parties had the opportunity to make any submissions or representations they wished in respect of the Draft Decision and were not curtailed or circumscribed in any way in this regard. The Commission submitted it was clearly signalled that there would not be a further opportunity to make submissions.

77. In reaching the Final Decision, the Commission states it carefully considered the submissions and representations of the parties and the legal issues arising therefrom.

Having done so, it was acknowledged that Mr Coyle did not make a submission and that the Commission did depart from certain provisional findings in the Draft Decision but it is submitted that the Commission was entitled to do so.

78. Specifically, in relation to personal data contained in the liquidators’ reports, in the Draft

Decision, the Commission submits that it had expressed the preliminary view that the Director was entitled to rely upon Section 5(1)(d)(i) of the Acts in withholding Mr Coyle’s personal data. However, having considered the matter further, including in light of the Director’s submissions, the Commission stated it concluded that, for the detailed reasons set out in the Decision, the Director was not entitled to withhold access to personal data in the liquidators’ reports on this basis under Section 5(1)(d) of the Acts, but that the provision of this category of personal data would be contrary to the public interest for the purposes of Section 4(1)(a)(iii)(II) of the Acts.

79. It acknowledges that the Director accepted the Commission’s provisional view on Section 4(1)(a)(iii)(II) of the Acts and did not make detailed submissions on this point, but that the Director did make submissions on this category more generally, including by arguing that there was a contradiction between the provisional findings in respect of Section 4(1)(a)(iii)(II) and Section 5(1)(d) in the Draft Decision.

80. In both instances, in light of the submissions made, the Commission states it was required to consider afresh the proper interpretation of the exemptions relied upon in the context of the categories of personal data at issue in the complaint. While, in doing so, the Commission acknowledges it departed from provisional views expressed in the Draft

Decision in what it describes as limited respects, it submits that it was perfectly entitled to do so in reaching a final decision on the complaint, having given due consideration to the parties’ positions.

81. The Commission also submits that in accordance with fair procedures, the Commission was obliged to, and did in fact, have regard to the submissions made by the Director in respect of these issues in reaching a final determination of Mr Coyle’s complaint. The fact that some of the Director’s submissions may have been directed to specific categories and not others did not preclude the Commission from having regard to the submissions as a whole in the overall determination of the complaint, particularly where they concerned similar or related issues.

82. In addition, the Commission submits that it was also entitled to have regard to the position of Mr Coyle even though he had not made detailed submissions or submissions on the Draft Decision.

83. The Commission states that the overarching obligation on the Commission was to determine the complaint in accordance with law and to ensure compliance with data protection law. In accordance with its responsibilities under Irish and EU law, including under Article 8(3) of the Charter of Fundamental Rights, the Commission was obliged to - and did in fact - determine the issues in the complaint in accordance with the requirements of Irish and EU law. Moreover, in doing so, the Commission gave detailed reasons for its findings, including in those limited instances where it departed from the preliminary views set out in the Draft Decision.

The Director’s Views on the Adjudicative Process as a Whole and Fair Procedures:

84. The essence of the Director’s complaint is that the Commission did not follow fair procedures in this case. It submits that the Commission did not give the parties a real right of substance to be heard in relation to the final issue. Whilst it acknowledges that the Commission invited the parties to make submissions, that invitation proceeded from the premise that the Commission would (unless the parties persuaded it to do otherwise)

decide Mr. Coyle’s complaint in the manner set out in the Draft Decision. The Director states it therefore made submissions in that context. The Director submits it did not, and could not have made submissions which were directed to an issue that the Draft Decision did not disclose. Similarly, it states it would have been entirely otiose for the Director to address an alternative analysis that had not been offered either by Mr Coyle or the Commission.

85. In summary, the Director states the circulation of a Draft Decision invites submissions as to its substance. It does not invite the parties to reiterate facts which have already found favour (in the Draft Decision) with the decision-maker, or to make submissions in the abstract. By failing to give the Director an opportunity to make submissions regarding all such issues, the Commission deprived the Director of a real right to persuade the Commission and of a substantive right to be heard on a matter of real importance.

Therefore, it submits that where the Commission fell into error was to review its Draft

Decision on a wholly different basis, without any intimation of its intention to do so and without giving the Director an opportunity to address the significant issues raised in the Final Decision.

86. Specifically, the Director submits that this unfairness is demonstrated by the fact the Commission accepted, in its Draft Decision, that the Director was entitled to withhold access to personal data contained in liquidators’ reports pursuant to the provisions of Section 5(1)(d) of the 1988 Act. As the Director agreed with that view, it submits that it believed it was apparently unnecessary for the Director to elaborate on the point, to convince the Commission that it was correct about this issue. It also suggests that “Mr.

Coyle did not cavil with this analysis either”.

The Director’s Legitimate Expectations:

87. While there are detailed written submissions as to whether the Commission’s decision failed to respect the Director’s legitimate expectations as set out in the test outlined by Fennelly J. in Glencar Exploration plc v. Mayo County Council (No. 2) [2002] 1 IR 84, I am satisfied that this issue does not apply in this case. I have already outlined the courts view of the Draft Decision and helpfully the Director conceded in the oral submission that the real issue in this case was one of fair procedures.

The Challenge to the Commissioner’s Substantive Findings:

88. The Director submits that the Commission has made a serious and significant error, in the Commission’s interpretation and application of Section 5(1)(d) of the Acts. This is denied by the Commission. According to the Director, the Commission claims to have changed its mind regarding the Director’s entitlement to withhold access to personal data contained in liquidators’ reports “in light of the submissions received” from the Director but the Director states there was nothing in his submissions that would give credence to that argument.

89. It is important to bear in mind the competing public interests’ arguments in respect of Section 5(1)(d) of the Acts. On the one hand the importance of the Director’s statutory functions which are designed to prevent financial loss to members of the public and that it is necessary to restrict access to personal data kept for the purpose of performing those functions, where access to the data in question would prejudice the proper performance of the Director’s functions. On the other hand the Commission has a duty to ensure any limitations on the right of access must apply only insofar as is strictly necessary.

According to the Commission this requires a data controller to assess and determine in each individual case, and by reference to the specific items of personal data at issue, whether the restriction on the right of access in respect of a data subject’s personal data would be likely to prejudice the proper performance of its functions and whether that restriction is applied only insofar as it is strictly necessary to do so for that purpose. In the Commission’s submission, the Director had not identified or established any serious and significant error in the decision in this regard.

90. In contrast the Director argues that this argument was not raised at what it considers the appropriate time (i.e. in the Draft Decision). More importantly it submits that it generally fails to recognise the Director’s role in the investigation of a directors’ conduct. The Director argues that personal data cannot be disclosed because it would prejudice the performance of his functions, for example, the Director cannot assert an argument, rooted in the concrete particulars of any particular file, without disclosing the nature and extent of the Director’s concerns, or the matters under investigation. It therefore submits that the disclosure of such sensitive data is clearly inimical to the proper performance of the Director’s statutory role and functions. It submits that is unfair for the Commission to accept the Director’s argument on this point in the Draft Decision before changing its mind in the Final Decision and then criticising the Director for not making arguments.

91. The Director maintains that the Commission put forward new arguments and evidence which was never outlined to them cogently before, whereas the Commission argue that is not a correct interpretation and that too much reliance is placed on the Draft Decision. In addition, the exemption was not particularised and that the Director’s own submission following the Draft Decision alerted the Commission to the broadness of the exemption sought. The Commission believed it is not appropriate for the court to take into account the liquidator’s affidavit on this point as it was not raised with the Commission before it made its decision.

The Assessment of the Role of the Commission on Appeal:

92. The Commission is the national independent supervisory authority in Ireland with responsibility for upholding the fundamental right of an individual to have his/her/their personal data protected in accordance with the Acts. This enables on one hand “transparency” by ensuring full information is provided to individuals in an accessible style and manner and on the other hand “accountability” by ensuring that all organisations take demonstrable responsibility using personal data. In this case it conducted an inquiry regarding alleged infringements of data protection legislation by the Director against Mr Coyle and made a decision.

93. The Commission has an expertise which is deservedly recognised by the courts as giving rise to a curial deference to this specialised knowledge in the Final Decision. However, the Commission, as the decision-maker, is also an active (as opposed to a neutral)

Respondent, who is strenuously defending its own decision and the conduct of the inquiry on appeal to the Circuit Court. This is not to suggest there is any inherent bias in the Final

Decision by the Commission or that the Commission is doing anything improper in the appeal. Rather it means that while the Circuit Court on appeal needs to be cognisant of the need to give curial deference to the reasons outlined in the decision, issues of fairness argued on appeal does not attract any more or less deference than any other party appearing in court in respect of its submissions. This is simply stated to emphasise the court’s duty to be impartial in proceedings.

Applying the Law to the Facts:

94. Essentially this case is about fairness of procedures in how the Commission reached its

decision as the adjudicator. I accept it is not a matter for the court to substitute its opinion solely on the grounds that it felt that it could have come to a different conclusion to the Commission in the Final Decision, provided that decision was arrived at fairly. I also accept that it is not generally open to the court to introduce new evidence that was not proffered to the Commission as an adjudicator. This of course assumes that the aggrieved party had an adequate opportunity to do so.

95. Both parties to the appeal acknowledge that all parties need to be heard. The Commission submitted it succeeded in doing so prior to the Draft Decision and provided one last opportunity for the Director to comment on the Draft Decision. The Director submits it should have been given a right to comment on the Commission’s change of mind following the Draft Decision. The Commission has interpreted this as a right to be heard on multiple occasions; in other words, it is argued that the Director should not only be heard in respect of the issues which fall to be determined in the context of the complaint but also that, where having considered the submissions received, the Commission [sic] departs from a preliminary view adopted in a Draft Decision, the Commission must give the parties a further and additional right to be heard.

96. This court does not agree with that interpretation. The change from Draft Decision to Final Decision, the Commission submits, was prompted by a submission made by the Director concerning another finding in the Draft Decision. It was a significant change. The right to be heard needs to be open and clearly understood by the parties from an objective point of view and not the subjective view of the parties. The correct procedure is for the Circuit Court to assess the adjudicative process as a whole in regards to procedures. It is in this court’s view that the weight the Commission applied to reasonableness of the opportunity for the Director to make submissions prior to the Draft

Decision was materially outweighed by the consequences of the significant change identified by the Commission in the Final Decision. It is not obvious to this court that the Director was given adequate opportunity to address this fundamental issue identified by the Commission in the Final Decision, which has significant consequences for the Director in its public duty role.

97. The Commission set the rules for submissions to be applied following the Draft Decision.

In many, if not in the vast majority of cases appearing before the Commission, the procedures outlined in the letter of the 13th November 2020 for further submissions would be adequate. However, in the court’s view, it was not so in this case. One way the Commission might have dealt with the rigidity of their own rule on submissions in this case, as set out in the letter of the 13th November 2020 accompanying the Draft

Decision, would be to reserve to itself a right to allow further submissions at its discretion. This bearing in mind that the Commission has a duty to observe fair procedures where it is involved in the decision-making process.

98. The Director made out a cogent argument on the balance of probabilities as to why it could rely on the exemption of Section 5(1)(d)(i) of the Acts to withhold personal data in the liquidator’s report and why it was entitled to withhold access to personal data contained in complaints and internal correspondence from the public pursuant to Section 4(1)(a)(iii)(ii) of the Acts. This in itself would not be sufficient to overturn the Commission’s finding in the Final Decision. However, combined with the fact that in the court’s opinion the Director was not given sufficient opportunity to address these combined issues and the possibility of their interface before the Commission made its Final Decision means the court should intervene to allow the appeal.

99. The Court appreciates that the Commission also found in the Draft Decision that the ODCE was not entitled to withhold personal data relating to Mr Coyle in legal proceedings.

The Court also notes that in the Draft Decision the Commission held that Director was entitled to withhold access to personal data contained in complaints and internal correspondence but in the Final Decision the Commission held the Director was only entitled to withhold the source of that data. The Court is of the opinion that the Commission should revaluate the practicality of these findings in light of the pleadings and disclosure in this case.

100. The difficulty this court has to grapple with therefore is: What part of the Commission’s Final Decision should be upheld and what part not upheld? On the balance of probabilities, the court is of the view that what should be upheld is what has been agreed and or conceded by the parties.

101. The court will partly allow the appeal on the grounds that the Commission failed to comply with fairness of procedures in arriving at the Final Decision.

102. Therefore, the Court orders that the Decision of the Data Protection Commission dated 24 December 2020 be set aside, save and insofar as the Decision determined that:

a. The ODCE was not entitled to withhold personal data relating to Mr Coyle held by the ODCE on the basis such personal data was also publicly available;

b. The ODCE was not entitled to withhold personal data relating to Mr Coyle in correspondence exchanged with him that was held by the ODCE on the basis that he might already have a copy of it.