In a recent judicial review, Martin v The Data Protection Commissioner, Mr Justice Robert Haughton held that the Data Protection Commissioner (DPC) is not empowered under EU nor Irish law to hold an oral hearing when investigating data protection complaints.
The case in question involved Mr Martin, who claimed that his Credit Union showed his financial documentation to his father, thereby breaching his data protection rights. These allegations were denied by the Credit Union. Having brought a complaint to the DPC, Mr Martin was told that, lacking any physical evidence, it was impossible to form a definitive opinion. He therefore requested the Commissioner to conduct an oral hearing as part of her investigation.
The DPC refused to conduct the oral hearing on the grounds that it was outside the powers awarded to her by law. Mr Martin then brought judicial review proceedings.
In the High Court, Haughton J ruled that neither the EU Data Protection Directive 1995 nor the Data Protection Acts 1998-2003 give the DPC the power to hold sworn oral hearings. The judge distinguished this legislation from frameworks like the Central Bank Act, the Medical Practitioners Act and the Pharmacy Act, which do provide detailed provisions for such powers. On this basis, the judge dismissed the judicial review proceedings, and further stated that the option of an oral hearing would have been open to Mr Martin had he appealed the decision to the Circuit Court.
With regard to the upcoming EU General Data Protection Regulations, there are currently no proposals for a new complaints process which would allow for oral hearings and/or submissions.
Click here to read the commentary by McDowell Purcell.
Click here to read the commentary by the Irish Times.