Four Courts, Dublin
Mason Hayes & Curran takes a look at the key aspects of a decision regarding oral hearings and the Data Protection Commissioner, and the potential legal impact it might have.
The recent High Court case of Martin vs the Data Protection Commissioner (DPC) has clarified the DPC’s powers and obligations when investigating complaints.
The case concerned a complaint by an individual regarding the alleged verbal disclosure of information in breach of his data protection rights. Given the lack of documentary evidence of the disclosure, the complainant requested an oral hearing before the DPC. The DPC declined to grant such a hearing and the complainant brought proceedings challenging this decision.
In the case, the court found that data subjects are not entitled to an oral hearing before the DPC, even where there is a conflict of evidence.
Background to Martin vs DPC
In 2012, Mr Martin made a complaint to the DPC. This related to an alleged breach of his data protection rights by a Credit Union and, in particular, a director of the Credit Union. Martin alleged that the director verbally disclosed information to his father relating to outstanding loans that Martin had with the Credit Union. The Credit Union and the director denied that any such verbal disclosure occurred.
Responding to Martin’s complaint, the DPC’s office found that it was not possible to form a definitive opinion on a complaint that concerns verbal disclosure without documentary evidence. Following this, Martin’s solicitors requested that an oral hearing be arranged to resolve the factual dispute. The DPC’s office replied stating that there was no provision or obligation for the DPC to do so.
While this was ongoing, a formal decision was issued by the DPC, Helen Dixon. She found that there was no evidence that any verbal disclosure containing Martin’s personal data was made by the Credit Union or by the director.
No oral hearing
Justice Robert Haughton of the High Court agreed with the position taken by the DPC. He stated that nothing in Irish or EU law either required or empowered the DPC to conduct an oral hearing of a complaint.
According to the judge, EU data protection law did not oblige member states to establish supervisory bodies, such as the DPC, with the power to conduct oral hearings. Furthermore, the judge took the view that the Data Protection Acts 1988 and 2003 could not be interpreted as giving the DPC the power to conduct an oral hearing.
The judge added that the power to hold an oral hearing is very significant, and that the court should be slow to find that a regulator enjoyed such a power. He stated that the following powers, among others, were absent under the Data Protection Acts:
- Powers to take evidence under oath
- General power to compel discovery of records
- Power to summon a person to attend a hearing
- Power to provide for cross-examination
On this basis, and in the absence of express powers, the judge found that the DPC is not in a position to set up a tribunal to conduct an oral hearing with witnesses and cross-examination.
Importantly, the judge added that Martin did have the option to appeal the DPC’s decision to the Circuit Court. In the Circuit Court, the Credit Union could have been joined as a notice party and the dispute could have been determined after an oral hearing.
According to the judge, the factual dispute over the alleged disclosure of personal data would have been resolved if this option had been taken.
Impact of decision
It is worth noting that this case was decided on technical and procedural grounds. As a result, the judge’s comments in respect of DPC oral hearings are not strictly binding.
Nonetheless, the judgment is still likely to act as a benchmark with respect to any future challenges to the DPC’s investigatory powers and obligations
‘The judgment is likely to act as a benchmark with respect to any future challenges to the DPC’s investigatory powers and obligations’
The DPC received 932 complaints in 2015, slightly lower than the previous year. This is a substantial number of complaints and is likely to consume significant resources within the DPC’s office.
The decision in Martin v DPC might be welcomed, given that oral hearings would almost certainly demand additional resources and staff, not to mention the potential for the result of such oral hearings to be challenged in the courts.
The decision in this case is also a practical one. It acknowledges that Irish lawmakers did have the ability to grant the DPC power to hold oral hearings but decided not to. As a result, such powers should not be inferred.
Despite this, however, individuals still have a right of appeal to the Circuit Court, where an oral hearing can take place.
The ultimate impact of the case is that the DPC can inform complainants with certainty that they are not entitled to an oral hearing.
It is unlikely that we will see Irish lawmakers seeking to expand upon the DPC’s powers in the immediate future, although it might be something for future consideration.
The content of this article is provided for information purposes only and does not constitute legal or other advice.
Tech Law is a weekly series brought to you by Irish law firm Mason Hayes & Curran, whose legal tech team advises the world’s top social media organisations and emerging start-ups. Contact a member of the MHC Technology team or visit www.mhc.ie for more information.
Four Courts image via Shutterstock
