About this case:

• Citation:
  [2022] IECC 5
• Judgment:
  External link
• Court:
  Circuit Court
• Judge:
  Judge John O'Connor

Delivering judgment in the appeal, His Honour Judge John O’Connor held that a verbal communication was not a communication for the purpose of GDPR and that the DPC was correct to determined that the disclosure by the barrister satisfied the legitimate interest test (Rigas Case (C13/16)).

The court held that the barrister made the disclosure on foot of professional obligations and any issue of acting in conflict of interest did not give rise to GDPR concerns.

Background

The appellant, Ms Aimee Scott, had a dispute with a previous employer in which a barrister acted on her behalf. Two years later, Ms Scott had another employment dispute before the Workplace Relations Commission in an unrelated matter. The same barrister was instructed by a solicitors’ firm to act against Ms Scott.

Prior to acting in the case, the barrister engaged in a conflict of interest check. It was disclosed that they had acted for Ms Scott previously in an unrelated despite and that they no longer held papers in that case, having returned them to the instructing solicitor.

Ms Scott was unhappy that the barrister was acting against her and was not satisfied with the disclosure provided to the solicitors’ firm. As such, she lodged a complaint with the DPC. It was alleged that the barrister disclosed personal information to the firm without permission and that the information was gained through privilege.

The DPC determined that the disclosed information constituted personal data but held that the disclosure did not come within the material scope of the GDPR. It was held that data must be recorded in electronic or manual form to come within the scope of GDPR, but the communication in this case was verbal. As such, GDPR did not apply (David Scott v LGBT Foundation Ltd [2020] EWHC 483 applied).

Further, the DPC considered the issue of legitimate interests under Article 6(1) GDPR. It was submitted by the barrister that the legitimate interests exception applied because they were required to provide the information to comply with their professional obligations under the Code of Practice for Barristers. The barrister was under a duty to allow the instructing solicitors consider whether a conflict of interest arose.

Applying the Rigas Case, the DPC held that a clear legitimate interest arose from the disclosure and the disclosure was necessary to achieve the legitimate interests of the barrister and the law firm. Further, in balancing the rights of the barrister and Ms Scott, it was held that the balance tipped in favour of the disclosure having regard to the barrister’s professional obligations.

Accordingly, the court held that a lawful basis existed for the disclosure and Ms Scott’s complaint was not upheld. She appealed this decision to the Circuit Court.

Circuit Court

Judge O’Connor began by outlining the submissions of Ms Scott and the DPC. The key issues were 1) whether the DPC was correct that the disclosure did not come within the scope of the GDPR; 2) whether the DPC was correct to issue a decision in relation to legitimate interest; and 3) whether the barrister had a lawful basis to process the data.

The court outlined the relevant provisions of the GDPR, including Article 2 which stated that the scope of the Regulation related to the processing of personal data by automated means and to processing which formed part of a filing system. It was also noted that personal data and filing system were defined broadly.

In reaching a decision, the court noted that the standard of review had previously been considered in a similar decision of Aimee Scott v the Data Protection Commissioner (No. 1) [2022] IECC 4. In that case, the court applied the test in Orange v. Director of Telecommunications Regulations [2000] 4 IR 159, holding that an appeal from the DPC was not a re-examination of the merits of the decision and a court should not substitute its assessment for the statutory decision-maker.

The entire adjudicative process had to be considered and a decision had to be assessed on the basis of the evidence that was before the DPC at the time, the court held (see Millar v Financial Services Ombudsman [2015] IECA 126). The burden of proof was on the appellant, Ms Scott. It was also stated that curial deference was more circumspect on questions of law.

In determining the appeal, the court held that a purely verbal communication was not a communication for the purposes of the GDPR “as it cannot reasonably be interpreted as falling within the definition of Material Scope as outlined in Article 2”. However, a barrister’s notes were sufficient to constitute a filing system even if the notes were later disposed of.

It was held that the DPC was correct to determine that the disclosure satisfied the legitimate interest test. The court commented that the substance of the proceedings related to an allegation that the barrister was acting in conflict of professional interest. While a different tribunal might reach such a decision, this did not automatically invalidate the legitimate interest of the original disclosure.

For data purposes, the barrister had professional ethical commitments to disclose the information which could not be invalidated by acting in conflict of interest. It was a matter for an entirely different legal forum to determine whether the barrister actually acted in conflict of interest, the court said.

Conclusion

The appeal was dismissed.

Scott v. Data Protection Commissioner (No. 2) [2022] IECC 5