In a recent Circuit Court case involving an appeal by Dublin Bus against a decision of the Data Protection Commissioner (DPC), the Court upheld the DPC's decision that a data subject was entitled to CCTV footage of her accident.
The data subject was travelling with Dublin Bus in October 2008, when she allegedly fell down the steps of the bus while going upstairs. An application was made to PIAB in October 2009, as required before the institution of personal injury proceedings. Following a request by her solicitor, Dublin Bus arranged for her solicitor to view the CCTV footage.
The data subject subsequently applied for access to the CCTV footage in February 2010 under the Data Protection Acts 1988 and 2003 (DPA), but her request was denied by CIÉ Group Investigation Department on the basis that all documents and records in that office are prepared in contemplation of litigation and fall within legal professional privilege.
The data subject's solicitor then made a complaint to the DPC, and the DPC investigated the matter. The response of Dublin Bus to the DPC was that an application had been made to PIAB and the CCTV footage was preserved / downloaded solely for the purpose of the defence of any litigation arising from the incident which had taken place on its bus, and accordingly was privileged.
Following his investigation, the DPC issued an Enforcement Notice requiring Dublin Bus to comply with the data subject's access request in relation to the CCTV footage. Dublin Bus appealed to the Circuit Court against the DPC's decision.
The Court Proceedings
The Court considered a number of issues, including:
- Whether CCTV footage constitutes 'personal data' – It was not disputed by Dublin Bus that CCTV footage constitutes 'personal data'. Judge Linnane noted that Kelleher's book on Privacy & Data Protection Law in Ireland confirms this. She quoted para 8.50 of Kelleher's book which states that: "Only if a controller cannot identify an individual caught on CCTV and it is not likely that he will come into possession of information that would enable him to make that identification can it be said that data derived from the CCTV is not personal data".
- Whether a data subject can use the DPA to obtain access to documents for the purposes of litigation – Counsel for Dublin Bus argued that the data subject was trying to usurp the function of the Court by obtaining documents for the purpose of her litigation through the DPA instead of through discovery.
Counsel for the DPC argued there is no provision in the DPA that precludes a data subject from exercising their right to access personal data because they are litigating before the Court.
- Whether the English case of Durant v Financial Services Authority  EWCA Civ 174 provides (persuasive) authority for data controllers to refuse to comply with a subject access request where the applicant is contemplating or has begun legal proceedings - Counsel for the DPC argued that the Durant case, relied upon by Dublin Bus, was irrelevant as the UK Data Protection Act 1998, unlike the Irish DPA, applies a test of reasonableness and gives the Court a statutory discretion as to whether to direct access to such data.
- Whether the access request for CCTV footage fell within the privilege exception in section 5 (1) (g) of the DPA – Section 5 (1) provides for certain exceptions to a data subject's right of access. Section 5 (1) (g) provides that the right of access does not apply to personal data in respect of which a claim of privilege could be maintained in proceedings in a court in relation to communications between a client and his professional legal advisers or between those advisers.
Counsel for the DPC argued that by allowing an inspection of the CCTV footage to the data subject's solicitor, Dublin Bus had waived any privilege it claimed, and in addition even if it was not waived, it did not come within the exception to the right of access provided at section 5 (1) (g) of the DPA.
Dismissing the appeal, the Court held that it was clear that Dublin Bus did not come within the privilege exception provided for in section 5 (1) (g) of the DPA.
Judge Linnane found that the UK Data Protection Act 1998 is distinct from the Irish DPA in that the former confers a discretion on the Court as to whether to grant an order for access. The judge also referred to guidance issued by the UK Information Commissioner which clarifies that his Office does not accept the Durant case as authority for the proposition that controllers should refuse to comply with a subject access request where the applicant is contemplating or has begun legal proceedings. The guidance states that failure to comply with an access request in such circumstances would amount to a breach of the data subject's right of access.
Furthermore, the judge found that Dublin Bus could not broaden the grounds of its appeal before the Circuit Court, as it was claiming that the decision of the DPC was wrong. It was therefore confined to the grounds it advanced to the DPC during his investigation, and before the DPC made his decision resulting in the Enforcement Notice.
This case is useful as there is a paucity of judgments concerning Irish data protection law. The use of CCTV systems has expanded greatly in recent years, and the judgment helpfully clarifies the scope of "personal data" in relation to CCTV images. It also highlights that the Irish Courts have no discretion under the DPA to refuse data subjects access to their personal data. Access may only be refused if one of the limited exceptions contained in sections 4 or 5 of the DPA apply.