In a recent High Court Case, Martin V The Data Protection Commissioner 2015/165 JR, Mr Justice Robert Haughton dismissed judicial review proceedings and outlined that the Data Protection Commissioner (“the Commissioner”) was not empowered under the Data Protection Acts, 1988 and 2003 to hold an oral hearing to investigate complaints.
In this case, Mr Martin claimed that a member of his credit union showed his confidential financial statements to his father which indicated that his loans were in trouble. Following this Mr Martin made a complaint to the Commissioner. When the Commissioner informed Mr Martin that it would not be possible for them to form a definitive opinion as his complaint concerned an allegation of a verbal disclosure with no physical transfer of documentation, Mr Martin then requested the Commissioner to conduct an oral hearing to fully investigate his complaint. The Commission refused to conduct an oral hearing and Mr Martin brought Judicial Review proceedings to review this refusal.
Mr Justice Haughton ruled that neither the EU data protection directive of 1995, nor the Data Protection Acts of 1988 and 2003 give the Commissioner the power to hold sworn oral hearings. Mr Justice Haughton outlined in his ruling that the Oireachtas had made very detailed provisions for oral hearings in other legislative frameworks and cited the Central Bank Act, the Medical Practitioners Act and the Pharmacy Act as examples legislation which make such provision.
Will the EU GDPR (“GDPR”) change the way in which complaints to the Commissioner are handled?
There are currently no proposals for a new complaints process which would allow for oral hearings and/or oral submissions.
In relation to the GDPR, comprehensive guidance is being drafted by the Commissioner’s Office, together will local legislation to assist in the implementation of the GDPR.