McCabe v AA Ireland Ltd [2024] IECC 6

The plaintiff was on sick leave from his employment with the defendant in August 2022.  On the last day of his sick leave, he was cutting overhanging branches at a relative’s home.  He noticed the defendant’s operations manager recording him on his mobile phone (Recording). The plaintiff protested angrily to the Recording and claimed he was being wrongfully recorded out of work.   The following day, the plaintiff was suspended from his job pending an investigation.  Following a disciplinary hearing in September 2022, the plaintiff was summarily dismissed. The plaintiff’s reaction to being recorded was given as part of the reason for his dismissal.  The dismissal was upheld on appeal.

The plaintiff instituted Circuit Court (Court) proceedings alleging that the defendant was not entitled to use, disclose or process his confidential information without prior consent for an unlawful purpose.  He alleged that the information was recorded, used, and processed in breach of the GDPR and Data Protection Act 2018 (DPA).  The plaintiff also alleged that the publication of confidential and sensitive information violated his constitutional right to privacy under the ECHR.  Negligence, breach of duty and breach of confidence were also alleged against the defendant in the manner it used the plaintiff’s personal data.  The plaintiff claimed damages, including non-material damages for wrongful invasion and breach of his right to privacy.

The plaintiff also sought an order under section 117 of the DPA directing the defendant to comply with his subject access request and furnish him with a copy of his personal data, including a copy of the Recording.  The plaintiff also sought an order, if necessary, that the defendant accounts to him for the loss, erasure or destruction of the recording.

Judgment

The Court referred to the Circuit Court decision of Kaminski v Ballymaguire Foods Limited [2023] IECC 5, which set out the legislative provisions of the GDPR and the DPA, which were of particular relevance to this case (see previous our article on the Kaminski decision here).  Those provisions included the principles relating to the processing of personal data under Article 5(1) of the GDPR and the lawfulness of processing of personal data under Article 6 of the GPDR.  The Court also referred to Article 82, which provides for the right to compensation for material or non-material damage suffered by a data subject because of an infringement of the GDPR.

The Court accepted that the Recording was not relied on by the defendant in the disciplinary process leading to the plaintiff’s dismissal or in the Workplace Relations Commission proceedings.  However, it found that there was a sufficient causal connection between the act of the Recording and the plaintiff’s dismissal. Therefore, the Court directed the defendant to account to the plaintiff for the loss, erasure or destruction of the Recording and provide sworn testimony of its current status.

The Court expressed concern about the appropriate provision of information to the plaintiff, as the data subject, regarding the destruction or availability of the Recording because it may have assisted his WRC appeal or related litigation.  The Court noted that the plaintiff enjoyed a right to data collected by his employer, which is closely connected to his role.  For this infringement, the Court made an award of compensation for the damage suffered by the plaintiff under section 117(4)(b) of the DPA in the sum of €5,500 together with costs.

The Court declined to make any findings on the plaintiff’s claim of breach of privacy, negligence, breach of duty, and breach of confidence.

Conclusion

The decision follows the decision in Kaminiski to the effect that compensation for non-material damages in data protection claims will be modest.  Section 117(3) of the DPA was amended under the Courts and Civil Law (Miscellaneous Provisions) Act 2023, conferring jurisdiction on the District Court to hear and determine data protection actions.  That provision came into force in January 2024, so cases such as McCabe should be brought before the District Court rather than the Circuit Court.  This will be of particular interest to data controllers in defending such claims as the costs will generally be lower.

The decision is of note because the Court directed the defendant to account to the plaintiff for the Recording, showing the wide-ranging powers of the Court to grant relief under section 117(4) of the DPA.  It is a reminder to data controllers about the importance of a data subject’s right of access under the legislation.

To discuss any of the matters raised in this article, please contact Paul Convery, Rachel Hayes or Adele Hall.

Contributed by Jack Stokes and Gail Nohily