Background

Mr. Coyle was a director of Decobake Limited (Company). The Company was wound up by order of the High Court in July 2017 and a liquidator was appointed.

In January 2018, Mr Coyle contacted the Office of Director of Corporate Enforcement (ODCE) as he intended to make a complaint alleging criminal misconduct in relation to the liquidation of the Company. In March 2018, he made a subject access request (SAR) pursuant to section 4 of the Data Protection Act 1988 (1988 Act) requesting access to every document that contained his name, address and PPS number.  The Director of Corporate Enforcement (Director) refused the SAR under section 5 (1) (d) of the 1988 Act as he had received information in confidence from the liquidator, the disclosure of which “would breach confidence and it would be contrary to the public interest”.

Mr Coyle lodged a complaint against this refusal with the Data Protection Commission (Commission). At the request of the Commission, the Director provided a detailed description of the data that had been withheld, together with the reasons for doing so.

After considering the parties’ submissions, on 13 November 2020, the Commission issued its draft decision (Draft Decision) under a cover letter inviting the parties to make further representations in relation to the analysis and findings in it (Accompanying Letter).

In the Draft Decision, the Commission found that the Director was obliged to provide Mr Coyle with access to his personal data contained in publicly available documents; in correspondence between the Director and Mr Coyle; and in legal proceedings.  The Commission accepted that the Director was entitled to withhold Mr Coyle’s personal data contained in liquidator’s reports; complaints; and internal correspondence. The Commission was of the view that it was reasonable for the ODCE to assert that releasing such information “could have a negative impact on the quality of information that liquidators would include in such reports and therefore be likely to be a prejudice to performance by the ODCE of its functions”.

Mr Coyle made no submissions on the Draft Decision. The Director submitted that it was entitled to withhold access to personal data contained in legal pleadings however, it welcomed the other conclusions in the Draft Decision and did not elaborate any further on them.

Ultimately, in its final decision (Final Decision), the Commission departed from the findings in its Draft Decision.  It found that Mr Coyle was entitled to his personal data which was contained in the liquidator’s reports, complaints and internal correspondence.

The Appeal

The Director appealed the decision of the Commission to the Circuit Court (Court). The main issue before the Court was whether the Commission, by significantly departing from the Draft Decision without consulting the parties, failed to observe basic fairness of procedure.

The Commission submitted that it satisfied the parties’ right to be heard during the initial stage of the investigation and in respect of the Draft Decision. The Commission contended that it was not obliged to afford an additional right to be heard if a finding in the Final Decision departed from its Draft Decision.  It also contended that there is no obligation on a decision-maker to disclose its precise reasoning or legal analysis before making a final decision. It further argued that its overarching obligation is to determine complaints in accordance with the law, such that it is not bound by its provisional views in a draft decision.

In response, the Director argued that the Draft Decision invited submissions on its substance.  It did not invite submissions on facts already found in favour of the Director or in the abstract.  The Commission erred in reviewing its Draft Decision on a wholly different basis and without giving the Director a right to comment on its change of mind.

Status of the Draft Decision

The Court began by noting that the Draft Decision is exactly that: a draft.  In the Court’s view, the Commission is not estopped by its preliminary views in the Draft Decision and can revisit any such views or conclusions in the Final Decision.  However, in this case, the Accompanying Letter was influential, for the reasons set out below.

Fair procedures

The real issue in the case, according to the Court, was one of fair procedures.  The Director argued that disclosure of personal data in the liquidator’s reports would be “inimical to its role and duties”.  It also argued that it was unfair for the Commission to accept the Director’s argument on this point in the Draft Decision and to then change its mind in the Final Decision.

The Court noted that whilst the Commission has an expertise which gives rise to “a curial deference to its specialised knowledge by the Court”, it was also an active respondent in the case.  Although this was not suggestive of any inherent bias in the Final Decision, it did mean the Court had to be impartial and not afford one party more deference over the other in terms of their submissions to the Court.

Decision

This was a case about procedural fairness in how the Commission reached its decision. It is the Commission that sets the rules for submissions to be applied following the Draft Decision.  The Court found that the Accompanying Letter was not adequate in protecting the parties right to be heard and its duty to observe fair procedures.

The Court found that the change from the Draft Decision to the Final Decision was a significant one.  In this case it was not obvious to the Court that the Director was given an adequate opportunity to address the issues in the Final Decision, which had significant consequence for it in its public duty role.

The Court partly allowed the appeal on the basis that the Commission had failed to comply with fair procedures in reaching its Final Decision.   The Court ordered the Final Decision to be set aside, except for the determination that the Director was not entitled to withhold personal data relating to Mr Coyle that was

1. publicly available, and
2. in correspondence exchanged between the Director and Mr Coyle, on the basis that he might already have a copy of it.

Take Away

The appeal concerned a SAR under the 1988 Act, which has been superseded by the GDPR and the Data Protection Act 2018.  Nothing turns on this however for the purpose of the key takeaway from this decision of the Court, namely that the Commission must ensure that it upholds both parties’ right to be heard in complaints before it, at all stages, including between the issuing of a draft and final decision.

For parties to a complaint before the Commission, they should ensure that they avail of every opportunity to make representations and submissions. We regularly assist our clients in responding to SAR.  For further information, please contact Adele Hall, Paul Convery or Leo Moore.

Contributed by Sean Cullen, Claire Cashman & Gail Nohilly