The recent High Court case of Martin v the Data Protection Commissioner (“DPC”) has clarified the DPC’s powers and obligations when investigating complaints. The case concerned a complaint by an individual regarding the alleged verbal disclosure of information in breach of his data protection rights. Given the lack of documentary evidence of the disclosure, the complainant requested an oral hearing before the DPC. The DPC declined to grant such a hearing and the complainant brought proceedings challenging this decision.
In the case, the court found that data subjects are not entitled to an oral hearing before the DPC, even where there is a conflict of evidence. We take a look at the key aspects to this decision and the potential legal impact it might have.
Background to Martin v DPC
In 2012, Mr Martin made a complaint to the DPC. This related to an alleged breach of his data protection rights by a Credit Union and, in particular, a director of the Credit Union. Mr Martin alleged that the director verbally disclosed information to Mr Martin’s father relating to outstanding loans that Mr Martin had with the Credit Union. The Credit Union and the director denied that any such verbal disclosure occurred.
Responding to Mr Martin’s complaint, the DPC’s Office found that it was not possible to form a definitive opinion on a complaint that concerns verbal disclosure without documentary evidence. Following this, Mr Martin’s solicitors requested that an oral hearing be arranged to resolve the factual dispute. The DPC’s Office replied stating that there was no provision or obligation for the DPC to do so.
While this was on-going, a formal decision was issued by the DPC, Ms Helen Dixon. She found that there was no evidence that any verbal disclosure containing Mr Martin’s personal data was made by the Credit Union or by the director.
No oral hearing
Mr Justice Haughton, of the High Court, agreed with the position taken by the DPC. He stated that nothing in Irish or EU law either required or empowered the DPC to conduct an oral hearing of a complaint. According to the judge, EU data protection law did not oblige member states to establish supervisory bodies, such as the DPC, with the power to conduct oral hearings. Furthermore, the judge took the view that the Data Protection Acts 1988 and 2003 could not be interpreted as giving the DPC the power to conduct an oral hearing.
The judge added that the power to hold an oral hearing is very significant and that the court should be slow to find that a regulator enjoyed such a power. He stated that the following powers, among others, were absent under the Data Protection Acts:
powers to take evidence under oath;
general power to compel discovery of records;
power to summon a person to attend a hearing; and
power to provide for cross-examination.
On this basis, and in the absence of express powers, the judge found that the DPC is not in a position to set up a tribunal to conduct an oral hearing with witnesses and cross-examination.
Importantly, the judge added that Mr Martin did have the option to appeal the DPC’s decision to the Circuit Court. In the Circuit Court, the Credit Union could have been joined as a notice party and the dispute could have been determined after an oral hearing. According to the judge, the factual dispute over the alleged disclosure of personal data would have been resolved if this option had have been taken.
Impact of decision
It is worth noting that this case was decided on technical and procedural grounds. As a result, the judge’s comments in respect of DPC oral hearings are not strictly binding. Nonetheless, the judgment is still likely to act as a benchmark with respect to any future challenges to the DPC’s investigatory powers and obligations
The DPC received 932 complaints in 2015, slightly lower than the previous year. This is a substantial number of complaints and is likely to consume significant resources within the DPC’s Office. The decision in Martin v DPC might be welcomed, given that oral hearings would almost certainly demand additional resources and staff, not to mention the potential for the result of such oral hearings to be challenged in the courts.
The decision in this case is also a practical one. It acknowledges that Irish lawmakers did have the ability to grant the DPC power to hold oral hearings but decided not to. As a result, such powers should not be inferred. Despite this, however, individuals still have a right of appeal to the Circuit Court, where an oral hearing can take place.
The ultimate impact of the case is that the DPC can inform complainants with certainty that they are not entitled to an oral hearing. It is unlikely that we will see Irish lawmakers seeking to expand upon the DPC’s powers in the immediate future, although it might be something for future consideration.
For more information, contact a member of our Technology team.
The content of this article is provided for information purposes only and does not constitute legal or other advice.