The Data Protection Commissioner – Court Ruling (Ireland, 2022)

An Irish Hospice placed CCTV cameras in the staff tearoom, following advice from Gardai (Irish Police) after graffiti had been left on a table saying: "Kill all whites, ISIS is my life". The incident happened in 2015, shortly after terrorist attacks in Paris. A sign was placed beside each camera which read: “Images are recorded for the purposes of health and safety and crime prevention.” The same information was included in the hospice policy. The CCTV footage, that was reviewed as part of security investigation, revealed numerous unauthorised breaks of the data subject, who was one the hospice employees at that time. Although there was no suggestion that the data subject had any involvement in the graffiti incident, the data collected from the CCTV prompted disciplinary proceedings against him. The data subject made a complaint to the DPC. The complaint was rejected, on the basis that the CCTV images were not processed beyond the original security purpose. It was argued by the hospice that the evidence for the data subject's disciplinary proceedings was based on records from a key fob used by the data subject to enter the tearoom. The data subject appealed to the Circuit Court. The Circuit Court upheld the DPC’s decision. The data subject appealed again to the High Court. The High Court found that the DPC incorrectly interpreted the term "processing" under the Data Protection Act 1988. The DPC appealed the decision to the Court of Appeal. The Court of Appeal upheld the High Court decision. The Court decided that: 1. The data subject was not made aware, at or before the time when the data was obtained, of the purpose for which the data was intended to be processed, contrary to the fair processing requirement of the Section 2D of the Data Protection Act 1988. 2. Based on the Court’s analysis of Article 29 of the Data Protection Directive of 1995 entitled “Working Party on the Protection of Individuals with regard to the Processing of Personal Data”, the CCTV data was used for a purpose other than, and incompatible with, the specified purpose, making such use unlawful. The incompatibility stemmed from the fact that the data subject was neither notified that the CCTV could be used for disciplinary purposes nor he ought reasonably to have expected such use.