Court orders compensation and data disclosure for employee wrongfully recorded and dismissed by employer.

Record No: 05096/ 2022

Neutral Citation: [2024] IECC 6

AN CHÚIRT CHUARDA

THE CIRCUIT COURT

DUBLIN CIRCUIT CIVIL COURT COUNTY OF THE CITY OF DUBLIN

IN THE MATTER OF

PHILIP MCCABE

Plaintiff

and

AA IRELAND LTD

Defendant

Judgment of Her Honour Judge Jennifer O’Brien delivered this 5th day of July 2024

Background:

1. This case comes before the Court by way of equity civil bill issued on 19 December 2022.

The plaintiff is a mechanic and resides at an address in Dublin. The defendant is a limited company having its address in Dublin 2. The plaintiff contends that at all material times the defendants, its servants and or agents were controller and/or processor of data within the meaning ascribed to that term by Regulation (EU) 2016/ 679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and the Free Movement of Such Data (“General Data Protection Regulation”, “GDPR”) and the Data Protection Act of 2018 (“2018 Act”).

2. It is claimed that the defendant was the holder of confidential and sensitive information in relation to the plaintiff and was under a statutory and constitutional duty to maintain the confidentiality of the said confidential and sensitive information and each part of same. The plaintiff was an employee of the defendant and consequently it was claimed that the defendant owed him a duty of care.

3. The plaintiff was absent from work on sick leave in August 2022. On the last day of his sick leave on Monday 29 August 2022 the plaintiff was assisting his mother-in-law in cutting an overhanging branch at her home at Lower Ballymount Road, Walkinstown, County Dublin. At approximately 2:30pm the plaintiff became aware of a vehicle on the opposite side of the road and observed one of the occupants recording the plaintiff with his mobile phone. On approaching, the plaintiff became aware that the occupants were senior management of the defendant and the defendant’s operations manager, Adam Staunton was recording him. The plaintiff became angry and annoyed claiming that he was being wrongfully recorded outside of the workplace and without his knowledge and consent. The following day the plaintiff was requested to attend a meeting with Adam Staunton when he was suspended with pay pending an investigation. It was submitted that no investigation took place. During the course of the meeting the plaintiff queried why he was being videoed and he was advised not to fixate on video evidence and further informed “video evidence wouldn't be required in a case like this as there were three very credible witnesses to the event.”

4. On 6th September 2022, the plaintiff attended a disciplinary hearing, and the defendant advised the plaintiff on 12th September 2022 that he was summarily dismissed with immediate effect. The decision was upheld following an appeal. It's claimed that at no stage was the alleged unlawful recording and violation of the plaintiff's personal data rights considered by the defendant, either during the course of the disciplinary process or at all.

The defendant’s conditions of employment guide for employees provide that any breach of their data protection policy will result in an investigation under AA Ireland disciplinary and grievance policy and may result in disciplinary action. No investigation or action was taken against the defendant’s operations manager who recorded the plaintiff, whereas the plaintiff was summarily dismissed as a result of the incident. It is submitted that the defendants, its servants and or agents were not entitled to use or disclose or process the plaintiff’s confidential information or any part thereof without the prior consent or any consent of the plaintiff for an unlawful purpose. It is claimed that the said information was recorded, used, and processed in breach of the provisions of GDPR, and the Data Protection Act 2018 and the regulations enacted there under. Further and or alternatively the processing, disclosure and or publication of the confidential and sensitive information constituted a violation of the rights enjoyed by the plaintiff pursuant to the provisions of Bunreacht na hÉireann and the European Convention on Human Rights including the plaintiff's right to privacy pursuant to Article 40.3 of Bunreacht na hÉireann and Article 8 of the European Convention on Human Rights. It is also claimed that the defendants, it's servants or agents were negligent and or in breach of duty including statutory duty and or in breach of confidence in the manner in which they used the plaintiff’s personal data. As follows:

a) Unlawfully used the plaintiff’s personal data for surveillance and tracing the plaintiff’s private movements;

b) Acted in violation of Article 5 and 6(1) of GDPR and Section 71 of the 2018 Act in unlawfully processing the plaintiff’s personal data without the plaintiff’s consent;

c) Acted in breach of Article 5 (1) (a) of GDPR and Section 71 (1) (a) of the 2018 Act in failing to process the footage in a fair and transparent manner;

d) Acted in breach of Article 5 (1) (b) of GDPR and Section 71 (1)(b) of the 2018 Act in collecting the plaintiff’s personal data for an illegitimate purpose;

e) Acted in breach of Article 5 (1) (c) and Recital 39 of GDPR and Section 71 (1) (c) of the 2018 Act, namely the principle of data minimization in wrongfully, unnecessarily, and disproportionately recording the plaintiff when there were three witnesses to the event;

f) Failed to notify the Data Protection Commission (DPC) of the breach in violation of Article 33(1) of GDPR and Section 86 of the 2018 Act;

g) In failing to notify the DPC, failed in its duty to allow the DPC to verify whether or not the breach led to a high risk of the rights and freedoms of the plaintiff;

h) Failed to notify the plaintiff of the breach in violation of Article 34, Recital (86) and

(87) of GDPR and Section 87 of the 2018 Act as soon as they became aware of the unlawful data breach, or at all;

And various other heads of claim as set out in the in the equity civil bill.

5. By letter dated 15 November 2022 the defendant denied processing or possession of the covert video recorded on 29 August 2022. The plaintiff maintains that the said video recording was processed by the defendant, and its servants and or agents and if same is not in the defendant’s possession, same has been deleted or destroyed and consequently the defendants, its servants and or agents were negligent or in breach of duty (including statutory duty) and or in breach of confidence in that they:

a) Acted in violation of Article 5 and 6(1) of GDPR and Section 71 of the 2018 Act in unlawfully processing the plaintiff’s personal data and thereby causing unlawful destruction, erasure or loss of the video footage of the plaintiff;

b) Failed to demonstrate compliance with the principle of accountability in breach of Article 5 (1) and Article 5 (2) of GDPR and various other headings as set out in the equity civil bill.

6. It is also claimed that the plaintiff suffered significant distress, stress and anxiety as a result of the loss of control of his personal data, violation of his movements while not working and outside the workplace, being wrongfully required to defend and explain his private movements to the defendant, a complete loss of trust and confidence in the defendant, it's servants and or agents to exercise their duty of care to defend and protect his privacy and the defendant’s misuse and unlawful recording of the plaintiff to his financial detriment in placing a blemish and reputational damage on his working career. The plaintiff’s claim is for damages including non-material damages, damages for wrongful invasion and breaches of the right of privacy enjoyed by the plaintiff pursuant to the provisions of Bunreacht na hÉireann and the European Convention on Human Rights.

7. The plaintiff also issued a motion and sought an order pursuant to Section 117 of the 2018 Act directing the defendant to comply with the plaintiff’s subject access request delivered to the defendant on 15 September 2022 and furnish the plaintiff with a copy of his personal data as set out in this data subject access request. An order was also sought pursuant to Section 117 directing the defendant to furnish a copy of the video (mobile phone recording)

of the plaintiff taken by the defendant, its servants and or agents on 29 August 2022. If necessary, an order was sought that the defendant account to the plaintiff for the loss, erasure, or destruction of the video (mobile phone recording) of the plaintiff taken by the defendant, its servants and or agents on 29 August 2022. That motion was adjourned to the hearing of the action and was moved by counsel on behalf of the plaintiff. The affidavits and pleadings were read into Court and oral evidence was given to the Court by Mr. Philip McCabe.

8. Mr. Adam Staunton swore an affidavit on 11 May 2023 in which he avers “I confirm that I do not hold a video recording of the plaintiff in any capacity whatsoever. I do not have access to any such video. I confirm that I have never shown anyone with the defendant a video of the plaintiff. I also confirm that I did not transfer any video of the plaintiff to the defendant or to anyone else.” The affidavit does not include any details as to whether the video was deleted or destroyed and there is no sworn testimony as to the current status of the video. The defence contains a statement that the video was deleted but this is not supported by any evidence on oath. A full defence was filed on behalf of the defendant such that it was admitted that the plaintiff was observed during the course of his sick leave assisting his mother-in-law cutting overhanging branches from her home at Lower Ballymount Road, Walkinstown. When the plaintiff was approached by members of the defendant staff, it is alleged that he engaged in threatening and abusive behaviour towards these individuals. In those circumstances, a decision was made to suspend the plaintiff on pay whilst a full investigation was carried out. The matter was subsequently investigated, and a disciplinary hearing was convened. On 12 September 2022 it is submitted that the plaintiff was notified and advised that he was being summarily dismissed with immediate effect.

9. The plaintiff appealed this decision, and the appeal hearing was convened on 29th September 2022. A decision was issued on 6 October 2022 to oppose the disciplinary hearing outcome. It is common case that the video recording did not feature in the disciplinary process culminating in the plaintiff’s dismissal. The Court notes that the matter has also been settled in the context of the proceedings before the WRC and that the video evidence was not used in that process. The defendant denies that there was a breach of the defendant’s Conditions of Employment guide for employees. It is further denied that there was a breach of the defendant’s data protection policy and denied that an investigation into the defendant’s operations manager was required by the defendant under its disciplinary policies in circumstances where there was no breach of the defendant’s data protection policy. It's denied that the defendants, its servants, or agents used or disclosed or processed the plaintiff’s confidential information or any part thereof without the prior or any consent of the plaintiff for an unlawful purpose. It is further denied that the defendant recorded, used, and processed in breach of the provisions of the GDPR, and the Data Protection Act 2018 and the regulations enacted thereunder the plaintiff’s confidential information. It is further denied that the processing, disclosure, or publication of the confidential and sensitive information constituted a violation of the rights enjoyed by the plaintiff pursuant to the provisions of Bunreacht na hÉireann and the European Convention of Human Rights.

It was also denied that the defendant, its servants, and or agents were negligent and in breach of duty including breach of statutory duty and or in breach of confidence in the manner alleged or at all. In essence the defendant denies processing the video recording at all or being in possession of same at any time.

10. Counsel on behalf of the defendant submits that the recording was not taken on the defendant’s instruction and that the video has been deleted. While this is pleaded, there is no affidavit furnished by the defendants to the effect that the recording has been deleted.

The plaintiff’s application for interim relief was adjourned to hearing of the action. It is submitted on behalf of the plaintiff that it was necessary to bring an application for injunctive relief. Counsel for the plaintiff submits that recovery from the knee injury was an issue and there is reference in the dismissal documentation to the plaintiff being angry on account of being videoed and this may have caused him to react in an overly aggressive manner. The defendants deny either processing or being in possession of the video and state that it was created without their instructions. In any event the defendant relies on the fact that the video was not used for the purpose of the disciplinary meetings or decisions.

11. The Court heard evidence from the plaintiff such that he could clearly see Adam Staunton using his phone to make a video of the plaintiff on the date in question. The plaintiff said that he went over to Mr. Staunton and one of his colleague’s cars to ask whether he was recording. The plaintiff identified the three individuals in the car as Adam Staunton, Kieran Harrod and Gavin Smith who was in the back of the car. The plaintiff described that in a meeting at work the following day he was told he was going to be suspended with immediate effect. Ultimately, the plaintiff lost his job, and he said in evidence that he’s very cynical and distrustful on account of what occurred. In the course of the plaintiff’s meeting with the defendant, the video evidence was not relied on. Under cross-examination the plaintiff denied that it was a legitimate step for an employer to create a video in circumstances where someone was working while on sick leave. The plaintiff responded and said that he never said he couldn’t cut a hedge in the course of his sick leave. He reiterated that he believed he was being illegally recorded by an officer of the defendant company. He stated that his entire management structure was in the car, and he agreed that he had been informed that for this reason the video would not be used. The plaintiff said he did not believe that the video on Mr. Staunton’s phone had not been shown to other officers at the defendant’s business. He said he did not accept that the company never had it. It was put to the plaintiff that the company never possessed the video and that it had been made by Mr. Staunton who was not acting in the course of his employment, that the video had never been used and never been processed by the defendant and there was an exception, such that in certain circumstances an employer could pursue the making of such a video where legitimate interests were being pursued. The plaintiff said the reasons given for his suspension were said to be on account of his actions.

12. Having heard this matter, it would seem the reasons were twofold. That is firstly on account of the plaintiff’s ability to engage in physical work at a time when he was on sick leave, albeit this took place on the last day of sick leave and secondly on account of the manner in which the plaintiff responded to the act of being videoed while in his private life. The Court accepts that the plaintiff had no choice other than to bring the motion for the purpose of requesting a copy of his personal data as set out in the data subject access request. In this regard the Court notes that there was a delay in provision of a response to the data subject’s access request and further that even at the date of trial the defendant had not produced any sworn testimony to the effect that the offending video recording had been deleted by Mr. Staunton. While the defence and document states that the video was deleted, this is unsatisfactory in circumstances where Mr. Staunton’s sworn affidavit does not address this fact. The Court further notes that the plaintiff continued to receive data from the defendant following the issue of the motion.

13. Counsel for the plaintiff referred to Article 82, Section 117, and Article 4 of the GDPR, stating that the video comprised personal data in the sense that the plaintiff is identifiable.

It was submitted that processing includes “recording”, and it was submitted would also include the event of making the recording, in the first instance. With reference to the contract of employment, there is a requirement for lawful consent to use of data and that section of the plaintiff’s contract with the defendant it was submitted could not be intended to include or cover a circumstance of surveillance of the plaintiff by the defendant. It was submitted that creation of a video recording was quite an intrusion on the plaintiff outside his workplace and while he was not at work. The defence would be required to show that the data was adequate or relevant, however it was submitted that the recording in this instance was excessive. References is made to page 20 of the book of pleadings and to the proposition that “video evidence wouldn't be required as there were three very credible witnesses.” Counsel submitted that there was no legitimate reason for creation of the recording and that it was clearly excessive in the circumstances. Reference is made to Section 5 (1) (a) of the GDPR and the equivalent provision in the 2018 Act. Reference is also made to the loss of control of data on part of the plaintiff. Counsel referred to the

decision in GP, 11 April 2024 of the European Court of Justice which involved a reference from a German case where GP’s data was used for marketing purposes. In that case the Court considered the right to compensation for damage caused by data processing that infringes the Regulation. The Court considered the concept of “nonmaterial damage” and the impact of the seriousness of the damage suffered, together with the liability of the controller. The Court also considered a possible exemption in the event of default of a person acting under his or her authority within the meaning of Article 29 so referred in particular to paragraph 27(2) of the decision which raises the question:

“Is liability for compensation under Article 82(3) of the GDPR excluded by the fact that the infringement is attributed to human error in the individual case on the part of a person acting under the authority of the processor or controller within the meaning of Article 29 of the GDPR?”

14. Reference is also made to paragraph 42 of the decision which provides:

“In that regard, it should be noted that Recital 85 of the GDPR expressly mentions “loss of control” among the damage that may be caused by a personal data breach. In addition, the Court has held that the loss of control over such data, even for a short period of time, may constitute a “non-material damage”, within the meaning of Article 82 (1) of that Regulation, giving rise to a right to compensation, provided that the data subject can show that he or she has actually suffered such damage, however slight, (see to that effect, judgment of 25 January 2024 in MediaMarktSaturn, C-687/21, EU:C: 2024: 72 paragraph 66 and the caselaw cited).

15. Counsel also referred to paragraph 46 which provides “The Court has already held that it is apparent from a combined analysis of Article 82(2) and (3) that that Article provides for a fault -based regime, in which the controller is presumed to have participated in the processing constituting the breach of the GDPR in question, so that the burden of proof lies not with the person who has suffered damage but with the controller.”

16. Reference is also made to paragraph 49 of the decision which states as follows:

“An employee of the controller is indeed an actual person acting under the authority of that controller. Thus, it is for that controller to ensure that his or her instructions are correctly applied by his or her employees. Accordingly, the controller cannot avoid liability under Article 82 (3) of the GDPR simply by relying on negligence or failure on the part of a person acting under his or her authority.”

17. Reference is also made to paragraph 51 “In that regard, it must be pointed out by the circumstances of the exemption provided for in Article 82 (3) of the GDPR must be strictly limited to those in which the controller is able to demonstrate that the damage is not attributable to him or her. Therefore, in the event of a personal data breach committed by a person acting under his or her authority, that controller may benefit from that exemption only if he or she proves that there is no causal link between any breach of the data protection obligation incumbent on him or her under Articles 5, 24 and 32 of that Regulation and the damage suffered by that of the data subject.”

18. Paragraph 52 provides “Therefore, in order for the controller to be exempted from liability under Article 82 (3) of the GDPR, it cannot be sufficient for him or her to demonstrate that he or she had given instructions to persons acting under its authority, within the meaning of Article 29 of that Regulation, and that one of those persons failed in his or her obligation to follow those instructions, with the result that that person contributed to the occurrence of the damage in question.”

19. The plaintiff submits that the employees’ actions in this case were closely connected to his responsibilities and were aligned with the interests of his employer. Honesty of the plaintiff was in issue. It is claimed that the defendant should be liable for Mr. Staunton’s actions in the particular circumstances of this case. Counsel pointed to the harm suffered by the plaintiff, highlighting that he lost his job as a result of this process. It is claimed that there is a causal link between the loss suffered by the plaintiff and the actions of the defendant.

For instance, the plaintiff’s reaction to being recorded is proffered as part of the reason for the plaintiff losing his position of employment. As such, the circumstances could not fairly be described as having no causal connection with the processing of his personal data in this instance.

20. Counsel for the plaintiff submits that recording is processing and excessive recording where the subject is identifiable amounts to personal data. The surveillance carried out by Mr.

Staunton is closely connected to his duties as a manager and it is submitted that there is a causal connection between recording this video and the dismissal of the plaintiff from his employment. Counsel argues that whether or not the video was used, the burden of proof is on the defendant. It was submitted that the motion issued by the plaintiff was necessary for the purpose of obtaining data from the defendant, that the defendant is entitled to all of the relief sought in the motion, albeit that the recording can no longer be provided. Counsel submitted that the plaintiff is entitled to the declaration sought.

21. On behalf of the defendant in regard to the interlocutory relief sought it was submitted that this matter was heard by Judge O'Connor and that he was satisfied that the defendant was not in possession of the data. It is submitted that he has dealt with that. It was submitted that it is for this Court to determine whether the motion should have been brought. As such the only relief available in this case is one of damages that arises if there was a breach in circumstances where the information is no longer available. It is submitted that Judge O'Connor has already made orders in this regard.

22. Counsel raises the question as to whether this recording is covered by the GDPR Regulation and the 2018 Act. Obviously, the recording and the data relates to the plaintiff. The issue which arises is as to whether the data was processed by the defendant. It was submitted that the data did not go beyond Mr. Staunton’s phone and as such there was no processing on the part of the defendant. It is required that “an operation is performed on personal data.” “Recording” here is the personal data. The question arises as to whether the defendant processes the information by collecting it, recording, organizing and same etcetera. The question is whether the information has been processed. It is submitted that the data was never used by the defendant, nor was it used in the disciplinary proceedings and as such it was never processed and therefore the application to this Court must fail.

23. Reference was made to Article 82 (3), and it was submitted that Mr. Staunton took the video but not on behalf of the defendant and that the video was not used by the company as it was never handed over. It is submitted that Article 82 applies, and the controller is exempt from liability under that provision. Reference was made to two cases in which the Court considered whether the defendant can be vicariously liable for an employee. Counsel referred the Court to the decision of the High Court in Elmontem v Nethercross Limited & Others [2014] IEHC 91 and also to the decision in O'Keefe and Hickey [2008] IESC 72.

This case considers the close connection between what the person was doing and the alleged breach.

24. It is submitted that in this case we have someone out on a break and the information was not used in the course of employment. Reference was made to the UK Supreme Court case of WM Morrison Supermarkets PLC v Various Claimants [2020] UKSC 12, such that the employer is vicariously liable for breaches by an employee. This case was primarily concerned with the circumstances in which an employer is vicariously liable for the conduct of its employees and provides the Court with an opportunity to address misunderstandings which have arisen. “The data controller must take reasonable steps to ensure the reliability of any employees of his who have access to personal data.” It was submitted that in the instant case the defendant was never in control of the information and never released it in the manner that it was released in the Morrison decision.

25. Counsel for the defence further submitted that if there was a breach of the Article 4 exception then Article 6 provides a basis for the lawful processing at Article 6 (1) (F) as the legitimate interests pursued by the controller in this case arise if the Court finds that the defendant did process the information. It is submitted that there is an exception for the legitimate interest of the defendants that where someone was out on sick leave and had been cutting a hedge, it was in the employer’s interest to collect data in relation to the actions of the employees. The Article 6 (1) (F) exception applies.

26. It is further submitted that there is also an exception in Section 60 of the Data Protection Act 2018 where there is an exception as to where the information can be held to defend a prospective claim. It was argued that the plaintiff must fail. If the Court does see fit to grant damages to the plaintiff reference is made to the decision of Judge O’Connor in Kaminski v Ballymaguire Foods Limited [2023] IECC 5. That case concerns an employee who became emotionally upset on account of a video that was circulated of him in his workplace and the Court made certain findings with regard to the circumstance of non-material damage. In the instant case the plaintiff brought WRC proceedings and his dismissal has already been dealt with. The defendant submits that the plaintiff claims that he has a mistrust of people in authority, however the Court must have regard to an injury which is nonmaterial and genuine. Mere breach of the provisions is not sufficient. The plaintiff cannot claim damages on foot of mere upset and the damage must be genuine not speculative. In this regard reference is made to the personal injury guidelines which provide that the sum of €500 might be appropriate in such cases. It is submitted that there's no automatic right to compensation unless damage suffered reaches a certain degree of seriousness. It was submitted that the unfair dismissal has already been decided and settled by the plaintiff. This case essentially relates to a technical breach of GDPR, and it is argued that the plaintiff is not able to prove any damages. As such, it is argued that no compensation flows in the circumstances.

27. On behalf of the plaintiff, counsel submitted that it was not just damages that were sought but also a declaration that the plaintiff’s rights have been infringed, albeit injunctive relief may not be appropriate on account of the deletion of the footage. It was submitted that processing of the defendant’s personal data had taken place as a recording had been made.

It was argued that it would be strange to absent the act of creating the recording from the concept of processing of data. It was submitted that simply being recorded can impact on a person's rights of privacy and data protection rights. In the act of making the recording Mr.

Staunton was acting in a manner closely connected with his duties as a manager. It was submitted that it would be artificial to disconnect his duties from his activities and actions in this case. The plaintiff was found to be working on a sick day and the issue was brought up immediately with him on his return to work the following day. It was submitted that the two events cannot be separated. There was a close connection between the actions of Mr.

Staunton and the interests of his employer. Reference was also made to the supermarkets case in this regard. Insofar as the defendant is relying on the exception at Article 6 (1) (F)

of the GDPR, it was argued that the both the plaintiff’s constitutional rights and his GDPR rights are engaged and that he was recorded in public, and the exception relates to any such recording being limited to what is necessary. The data that was provided in this case was provided a long time after it was originally requested. Counsel for the plaintiff also sought to rely on the decision of the Court in Kaminski v Ballymaguire Foods Limited [2023] IECC 5 regarding damages being awarded for non-material damage and while the settlement at the WRC disposes of the plaintiff’s claim with regard to unfair dismissal, that forum does not have jurisdiction to deal with the issues arising on the processing of the plaintiff’s data.

28. It is submitted the data processing led to the plaintiff’s dismissal whether unfair or not and he's entitled to pursue his claim under this legislation, which is a separate matter and does not involve being compensated twice. It was submitted that the plaintiff is not alleging mere infringement and that there is substance to his claim and in any event nonmaterial damage can give rise to damages.

29. Counsel for the defendant confirmed that the cases that have been cited all relate to situations where the employer disseminated data and we simply do not have that in the instant case. It was submitted that there cannot be a finding that the defendant processed the data wrongly.

Decision:

30. The Court has had an opportunity to consider this matter and having read the pleadings, heard the evidence of the plaintiff and what was offered by each counsel, the Court refers to the decision of Judge John O'Connor in Kaminski v Ballymaguire Foods Limited [2023] IECC 5 delivered on 11 July 2023 where he sets out the relevant legislation and terms of the provisions that are to my mind of particular relevance to this case. The Court refers to Article 5 (1) which provides:

“Article 5.1: Principles relating to processing of personal data:

Personal data shall be:

(a) Processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”).

Article 6: Lawfulness of Processing:

Processing shall be lawful only if and to the extent that at least one of the following applies (I'm including here only the provisions which I believe are relevant to the instant case):

(a) The data subject has given consent to the processing of his or her personal data for one or more specific purposes;

(f)Processing is necessary for the purposes of the legitimate interest pursued by the controller or by a third party, except where such interests are overridden by the interests or

fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”

31. Reference is also made to Article 82: Right to Compensation and Liability:

1. Any person who has suffered material or non-material damage as a result of an infringement of this regulation shall have the right to receive compensation from the controller or processor for the damaged suffered.

2. Any controller involved in processing shall be liable for damage caused by processing which infringes this Regulation. A processor shall be liable for the damage caused by processing only where it has not complied with obligations of this Regulation specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller.

3. A controller or processor shall be exempt from liability under paragraph two if it proves that it is not in any way responsible for the event giving rise to the damage.

32. Reference is also made to Section 71 of the Data Protection Act and in particular to Section 71(5)(b) the processing is necessary in proportion to the purpose for which the data are being processed.

33. Reference is also made to Subsection 7 which provides “a controller shall ensure, in relation to personal data for which it is responsible, that an appropriate time is established for:

(a) The erasure of the data, or

(b) The carrying out of periodic reviews of the need for the retention of the data.”

34. Reference is also made to Subsection 9 which provides:

“A processor, or any person acting under the authority of the controller or of the processor who has access to personal data, shall not process the data unless the processor or person is-

(a) Authorised to do so by the controller, or

(b) Required to do so by the law of the European Union or the law of the State.

and then only to the extent so authorised or required, as the case may be.

35. Reference is also made to Subsection 10 which provides:

(10) The controller shall ensure that it is in a position to demonstrate that the processing of personal data for which it is responsible is in compliance with Subsections 1, 2 and 8 of this section.”

36. Turning to the motion issued on behalf of the plaintiff the Court is concerned that the video in this instance was created by the plaintiff’s manager and while the video was not directly relied on for the purpose of the subsequent dismissal of the plaintiff, there is clearly a causal link between the actions of Mr. Staunton in this regard and the ultimate dismissal of the plaintiff from his position of employment. One of the grounds for the plaintiff’s dismissal included his reaction to the act of Mr. Staunton recording him on the day in question. This activity on the part of Mr. Staunton is closely related to his duties and as such in the opinion of the Court it was incumbent on the defendant to account to the plaintiff for the erasure or destruction of the video (mobile phone recording) of the plaintiff that was taken by the defendant’s servant. It is notable that there is no sworn testimony available to this Court as to the current status of the recording which is most unsatisfactory from the position of the plaintiff. As such the Court grants an order directing the defendant to account to the plaintiff for the loss, erasure, or destruction of the video and to provide sworn testimony as to the current status of same.

37. It is the opinion of this Court that given the seriousness of the steps taken by the defendant against the plaintiff following the creation of this video recording, and given the reasons cited for the plaintiff’s ultimate dismissal (that is his angry reaction to being videorecorded), it was in the interests of fairness and transparency that a copy of the video was made available to the plaintiff or that the plaintiff was reliably informed of the destruction of same. This may have assisted the plaintiff in defending the actions taken by his former employer. The Court does not consider that the defence of legitimate interest has a bearing on the matter in circumstances where the defendant denies reliance on or use of the videorecording in reaching its determinations. Such a defence would only arise where use of the data was admitted or proved. Albeit the Court is satisfied that there is a connection between Mr Staunton’s role and his control of the data. Here the Court’s concern arises around the question of appropriate provision of information to the data subject regarding the destruction of the data or availability of the data to the data subject, as it may have assisted his WRC case or related litigation. Furthermore, the plaintiff enjoys a right to data collected by his employer or the employer’s agent, where same is closely connected to his role as employee. The Court makes no comment with regard to privacy rights and the alleged infringement of same however that does not exclude the possibility that Constitutional provisions and ECHR provisions may have application in a case such as this.

38. As such the Court makes the following orders:

1. A declaration that the defendant, its servants and or agents breached the plaintiff’s personal data rights;

2. An order directing the defendant to account to the plaintiff for the loss, erasure, or destruction of the video/ mobile phone recording of the plaintiff taken by the defendant, its servants and or agents on 29 August 2022.

3. Compensation for damage suffered by the Plaintiff pursuant to Section 117 (4)(b) of the 2018 Act as a result of the infringement in the sum of €5,500.

4. The Court makes no finding with regard to the question of breaches of privacy pursuant to the provisions of Bunreacht na hÉireann and the European Convention on Human Rights.

5. The Court makes no finding of negligence, breach of duty whether statutory otherwise and or breach of confidence.

6. An order for costs in favour of the plaintiff, to include reserved and discovery costs, including the costs of the motion, to be taxed in default of agreement.

Appearances Jamie Quane BL for the plaintiff instructed by John McCabe Solicitors Conor Kearney BL for the defendant instructed by Arthur Cox LLP