McVann v Data Protection Commissioner (Approved) [2023] IECC 3 (19 April 2023)

McVann v Data Protection Commissioner (Approved) [2023] IECC 3 (19 April 2023)

The court found that the DPC did not commit a serious or significant error in concluding that the IPS and Hospital had a lawful basis for processing and disclosing the appellant's personal data under GDPR and the Data Protection Act 2018. The use of CCTV footage in disciplinary proceedings was not incompatible with the original purpose of collection, given the context of a serious security incident and the reasonable expectation that such footage could be used for investigation and related disciplinary action. The DPC correctly applied the Orange Test and relevant GDPR principles. The appeals were dismissed.

Citation
[2023] IECC 3
Parties
Appellant: Simon McVann; Respondent: Data Protection Commission; Notice Party: Irish Prison Service; Notice Party: Health Service Executive
Jurisdiction
Ireland
Judgment Date
19 April 2023
Procedural Posture
Appeal Under Data Protection Act 2018 Section 150(5) / Judgment on Appeal
Outcome
appeal dismissed
Legal Topics
GDPR Compliance, Purpose Limitation, Lawful Basis for Processing, Transparency, Disciplinary Proceedings, Disclosure of Personal Data, Appeal Standards
Data Protection Administrative Law Employment Law GDPR Compliance Purpose Limitation Lawful Basis for Processing Transparency Disciplinary Proceedings +2 more

Case Brief

Summary, issues, holding and outcome

More case intelligence is available

Unlock the full research layer for this judgment.

Full judgment text Downloadable case file Legal principles 5 Authorities cited 7 Party arguments 2
Sign in to unlock

Parties

Simon McVann

Appellant

Data Protection Commission

Respondent

Irish Prison Service

Notice Party

Health Service Executive

Notice Party

Procedural Posture

Appeal Under Data Protection Act 2018 Section 150(5) / Judgment on Appeal

Legal Issues

  1. 1 Whether the IPS and Hospital had a lawful basis under GDPR for processing and disclosing the appellant's personal data (CCTV footage)
  2. 2 Whether the use of CCTV footage in disciplinary proceedings breached the purpose limitation principle under GDPR
  3. 3 Whether the DPC erred in law or fact in its decisions dismissing the appellant's complaints

Ratio Decidendi

The court found that the DPC did not commit a serious or significant error in concluding that the IPS and Hospital had a lawful basis for processing and disclosing the appellant's personal data under GDPR and the Data Protection Act 2018. The use of CCTV footage in disciplinary proceedings was not incompatible with the original purpose of collection, given the context of a serious security incident and the reasonable expectation that such footage could be used for investigation and related disciplinary action. The DPC correctly applied the Orange Test and relevant GDPR principles. The appeals were dismissed.

Court Disposition

appeal dismissed

Orders

  • The appeals of Simon McVann against the decisions of the Data Protection Commission are dismissed.