[2018] IEHC 117
THE HIGH COURT
(CIRCUIT COURT APPEALS)
[2014 /89 CA]
[CIRCUIT COURT 2013 No. 10413]
IN THE MATTER OF THE DATA PROTECTION ACTS, 1988 AND 2003
IN THE MATTER OF AN APPEAL PURSUANT TO SECTION 26 OF THE DATA PROTECTIONS ACTS 1988 AND 2003
PETER NOWAK
APPELLANT
AND
DATA PROTECTION COMMISSIONER
RESPONDENT
AND
PRICE WATERHOUSE COOPERS
NOTICE PARTY
JUDGMENT of Mr. Justice Coffey delivered on the 26th day of February, 2018
1. This is an appeal on a point of law against an order of the Circuit Court made on 2nd May, 2014 wherein the President of the Circuit Court dismissed the appellant’s appeal pursuant to s. 26 of the Data Protection Acts 1988 and 2003 against a decision of the respondent made on 6th December, 2013. In that decision, it was determined, inter alia, that material contained in memoranda from the notice party (“PwC”) which it produced under cover of its letter dated the 13th September, 2012 in response to a complaint made by the appellant to PwC’s regulatory body, could not be deemed to be personal data relating to the appellant within the meaning and for the purposes of the definition of “personal data” contained in s. 1 of the Data Protection Act 1988.
Factual Summary:
2. In September, 2011 the appellant made a complaint to the Chartered Accountants’ Regulatory Board (“CARB”) against PwC, his former employer and training firm, in respect of allegations of non-compliance with accounting and auditing standards in respect of two audits.
3. By letter dated 13th September, 2012, PwC wrote to CARB and attached to the letter memoranda “addressing the complaints” made by the appellant in respect of the two audits.
4. By letter dated 15th July, 2013 the appellant wrote to PwC in order to request a copy of the memoranda which had been attached to the letter dated 13th July, 2012. By letter dated 17th July, 2013, PwC refused the request on the basis that the documents sought did not contain the personal data of the appellant.
5. The appellant disagreed and by letter dated 22nd July, 2013 made a complaint to the respondent, in which he contended that the memoranda related to “(his) complaint and allegations expressed therein as well as the audit work that (he) carried out as an employee of PwC”.
6. On 22nd July, 2013, and in the exercise of his statutory powers so to do, Tony Delaney, an Assistant Commissioner, attended at the offices of PwC and inspected the material contained in the memoranda. Having read the relevant material attached to the letter of the 13th September, 2012, he was satisfied that the documents in question did not contain any personal data in relation to the appellant and further that the documents did not refer to the appellant in any way. An averment to that effect was made by Mr. Delaney in an affidavit sworn on the 27th February, 2014 which was subsequently produced to the Circuit Court.
7. By letter dated 13th August, 2013 the respondent wrote to the appellant to state that an inspection had been carried out and to inform him of the view of the respondent that there was no personal data concerning the appellant in the relevant memoranda.
8. By email dated 22nd August, 2013 the appellant asked the respondent to provide reasons to explain why she had formed the view expressed in her letter dated 13th August, 2013. By email dated the 5th November, 2015 the respondent indicated that the relevant material did not contain any personal data relating to the appellant and that he was not referred to “in any way” in the relevant documents.
The Decision of the Circuit Court:
9. The President of the Circuit Court stated that in advancing an appeal against a statutory decision-maker, the test that must be satisfied is that laid down by Finnegan P. in Ulster Bank v. McCarren [2006] IEHC 323 (Unreported, High Court, Finnegan P., 1st November, 2006), where it was stated:-
“…To succeed on this appeal the Plaintiff must establish as a matter of probability that, taking the adjudicative process a whole, the decision reached was vitiated by a serious and significant error or a series of such errors. In applying the test the Court will have regard to the degree of expertise and specialist knowledge of the Defendant. The deferential standard is that applied by Keane C. J. in Orange v. The Director of Telecommunications Regulation & Anor and not that in The State (Keegan) v. Stardust Compensation Tribunal.”
10. As the appellant had asserted that no inspection had been carried out, the learned Circuit Court Judge considered the issue and determined as a fact that, as part of the investigation of the appellant’s complaint, Tony Delaney, an Assistant Commissioner, had attended the offices of PwC to inspect the documents. He found that the Assistant Commissioner had taken careful notes of the contents of the documents that formed the basis of the decision and that the documents did not constitute personal data relating to the appellant.
11. He further found as a fact that the investigation by CARB was not personally referable to the appellant’s complainant but was referable to the appellant’s complaint about two audits conducted by his former employer, PwC. On that basis, the learned Circuit Court Judge stated that the respondent’s decision that the material in dispute was not “personal data” was a reasonable one, bearing in mind that the court must take due account of the respondent’s expertise in such matters such that the appellant had not discharged the burden of proof.
12. The appellant has appealed the said decision of the Circuit Court on the grounds that the material does constitute his personal data and that the learned Circuit Court judge erred in determining that the decision of the respondent of the 6th December, 2013 was not vitiated by a serious and significant error or series of such errors.
The Applicable Test:
13. It is evident from the wording of the appellant’s notice of appeal that he accepts that the legal test which applies to an appeal such as this is that set out by Finnegan P. in Ulster Bank v. McCarren.
14. In Nowak v. Data Protection Commissioner [2016] 2 I.R. 585, two members of the Supreme Court indicated by way of obiter dicta that the Orange Communications Limited v. The Director of Telecommunications & Anor (No.2) [2000] 4 IR 159 test from which the Ulster Bank test is derived may well be the subject of further review by the Supreme Court in an appropriate case in the future. O’Donnell J. confirmed that the applicable test in such an appeal was that derived from Orange. However, he noted that no argument had been addressed as to the formulation of the Orange test. Clarke J. (as he then was) indicated that he would prefer to reserve a final decision on the applicability of Orange to an appropriate case. As such, unless and until a review of the Orange test is undertaken by the Supreme Court, the manifest error test propounded by Finnegan P. in Ulster Bank v. McCarren remains the appropriate legal test to apply to an appeal pursuant to s. 26 of the Data Protection Act 1988.
The Directive:
15. The Data Protection Acts 1988 and 2003 were enacted to transpose into Irish Law, Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data.
16. The purpose of the Directive is to be discerned from the recitals in its preamble which emphasise the right to privacy, as shown in recitals (2), (7), (9), (10), (11), and (68).
17. Article 1(1) of the Directive states:-
“In accordance with this Directive, Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy, with respect to the processing of personal data.”
18. “Personal Data” is defined by Article 2(a) of the Directive as follows:-
“‘personal data’ shall mean any information relating to an identified or identifiable natural person (“data subject”); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity.”
The Data Protection Act 1988:
19. The definition of “personal data” in the Directive is mirrored in s. 1 of the Data Protection Act 1988, as amended, which provides:-
“”personal data” means data relating to a living individual who is or can be identified either from the data or from the data in conjunction with other information that is in, or is likely to come into, the possession of the data controller.”
20. In Opinion 4/2007 on the concept of personal data, the Data Protection Working Party set up by Article 29 of the Directive, 01248/07 EN WP 136, stated that the Directive contains a “broad notion of personal data”. The Working Party noted that the definition of “personal data” contained in the Directive is reflective of the fact that it was the intention of the Commission that the definition “should be as general as possible” so as to include “all information concerning an identifiable individual”, (as per p.4). It further noted that the objective of the rules contained in the Directive is to protect individuals and “in particular their right to privacy” and that the scope of the data protection rules “should not be overstretched” or “unduly (restricted)”.
21. Neither the Directive nor the Data Protection Acts 1988 and 2003 address the issue which arises on this appeal, namely, whether records relating to the consideration and investigation of complaints can be personal data in respect of the person making the complaint.
22. This issue was considered in the United Kingdom by the Information Commissioner’s Office wherein a document entitled “Determining what is personal data” accepted that such records could constitute personal data “about the person making the complaint” but stated that this would “depend on the circumstances”.
Decision:
23. It is manifest that the definitions of “personal data” provided by both the Data Protection Act 1988 and the Directive are very broad. Further, insofar as there is any difference in their scope, the Act should be interpreted conformably with the Directive.
24. It is common case that the appellant’s complaint to CARB was in respect of alleged non-compliance by PwC with accounting and auditing standards in respect of two audits. It is further agreed that, at the relevant time, the appellant was employed as a trainee in the firm and took part to whatever extent in the carrying out of the audits in that capacity. It is on this basis only that the appellant asserts that the information sought is “personal data”, to which he is entitled to access under the Act.
25. At the request of the parties to this appeal, I inspected the relevant material and am satisfied that the documents do not contain any data of a personal nature relating to the appellant and do not refer to the appellant in any way. Specifically, there appears to be nothing in the material that relates to the appellant as an identified or identifiable natural person which engages his right to privacy or which could in any meaningful way be amenable to objection, rectification or erasure under the provisions of the Act. The purpose of this statutory appeal, however, is not for this Court to place itself in the shoes of the respondent or to reconsider the matter de novo. Rather this Court is tasked with determining whether an error of law was made by the learned Circuit Court Judge in determining that the decision of the respondent was not vitiated by a serious error or a series of such errors.
26. In light of the foregoing, and in circumstances where I cannot find any error of law in the reasoning and conclusions of the learned Circuit Court Judge, I dismiss the appeal.
