McShane v Data Protection Commission (Approved) [2025] IEHC 191 (03 April 2025)

McShane v Data Protection Commission (Approved) [2025] IEHC 191 (03 April 2025)

The DPC lawfully determined that the HSE was not a data controller for non-work-related personal data stored on the applicant's work phone in contravention of HSE policy, as the HSE did not determine the purposes and means of processing that data. The DPC's investigation was appropriate and proportionate to the specific complaint made, and there was no legal error or irrationality in the decision. The applicant was not entitled to relief as the DPC's decision was open to it on the evidence and within the statutory framework.

Citation
[2025] IEHC 191
Parties
Applicant: Eamon McShane; Respondent: Data Protection Commission; Notice Party: Health Service Executive
Jurisdiction
Ireland
Judgment Date
03 April 2025
Procedural Posture
Judicial Review / Final Judgment on Substantive Application
Outcome
Application for judicial review refused
Legal Topics
Data Controller Definition, Personal Data Breach, Statutory Appeal Vs Judicial Review, Scope of Complaint in Data Protection Proceedings, Employer Liability for Employee Data Use
Data Protection Administrative Law Employment Law Data Controller Definition Personal Data Breach Statutory Appeal Vs Judicial Review Scope of Complaint in Data Protection Proceedings Employer Liability for Employee Data Use

Case Brief

Summary, issues, holding and outcome

More case intelligence is available

Unlock the full research layer for this judgment.

Full judgment text Downloadable case file Legal principles 4 Authorities cited 10 Party arguments 2 Amounts and remedies 1
Sign in to unlock

Parties

Eamon McShane

Applicant

Data Protection Commission

Respondent

Health Service Executive

Notice Party

Procedural Posture

Judicial Review / Final Judgment on Substantive Application

Legal Issues

  1. 1 Whether the HSE was a 'data controller' under GDPR for personal data stored on a work phone used contrary to policy
  2. 2 Whether the DPC lawfully dismissed the applicant's complaint without further investigation
  3. 3 Whether the applicant was required to exhaust statutory appeal remedies before seeking judicial review

Ratio Decidendi

The DPC lawfully determined that the HSE was not a data controller for non-work-related personal data stored on the applicant's work phone in contravention of HSE policy, as the HSE did not determine the purposes and means of processing that data. The DPC's investigation was appropriate and proportionate to the specific complaint made, and there was no legal error or irrationality in the decision. The applicant was not entitled to relief as the DPC's decision was open to it on the evidence and within the statutory framework.

Court Disposition

Application for judicial review refused

Orders

  • Application for judicial review refused
  • Parties to seek agreement on final orders and costs; if not agreed, matter to be listed for further submissions