In the Matter for Mount Carmel Medical Group (South Dublin) Ltd (In Liquidation)  IEHC 450 the Irish High Court considered the issue of who is a data controller under data protection law in respect of data held by a company in liquidation.
The liquidators of Mount Carmel Hospital (Liquidators) sought a declaration that the statutory role of the data controller was transferred to St. James Hospital (SJH) along with the transfer of the patient's records to SJH, and that the Liquidators could have access to the patient data insofar as necessary for the purposes of the liquidation. These terms were set out in a draft contract between the parties.
In refusing the application, Keane J made the following three key points:
- that "to declare that a person is not a data controller, as that term is defined under s. 1 of the DPA, in respect of the personal data relating to any data subject, is to make a binding determination that the data subject concerned has no data protection rights as against that person. Both s. 1 of the DPA and Article 2 of Directive 95/46 make it clear that the role of data controller in respect of any given personal data is not a singular one; it is perfectly possible for different persons to control the same personal data jointly".
- The Court has no discretion either to artificially delimit the number of persons against whom data protection rights can be asserted or to nominate only certain persons within the data controller definition for that purpose.
- The question of whether a person is a data controller is a question of fact based on the application of the definition contained in the Data Protections Acts 1988 and 2008.
A copy of the decision is available here.
Provided by Elaine Morrissey (firstname.lastname@example.org) of DAC Beachcroft in Dublin, Ireland.
What action could be taken to manage risks that may arise from this development?
Companies should be reminded that it is not possible to contract out of a party’s obligations as data controller and its status will be a matter of fact rather than agreement.