Mr Justice O’Donnell handed down the judgment in the High Court on 3 April 2025 on an application for a judicial review made by Eamon McShane (the “Applicant”) against the Data Protection Commission (the “Respondent”) and the Health Service Executive (HSE) in relation to a dispute over data protection responsibilities.
The Applicant was a fire prevention officer for the HSE and used a work phone for both personal and work purposes. In 2021, the HSE was subject to a significant data breach and ransomware attack and the Applicant alleged his work phone had been compromised in this attack. In 2022, the Respondent determined that the HSE was not a “data controller” for the purposes of Article 4.7 of the General Data Protection Regulation (EU) 2016/679 (GDPR) as they had not authorised the Applicant to use his work phone for personal use, and therefore the HSE was not responsible for the Applicant’s breached data.
The Applicant sought judicial review on the grounds that the data on the work phone constituted “personal data” under Article 4.1 GDPR and that the HSE was a “data controller” under Article 4.7 GDPR. The Court noted that the Applicant’s complaint was specifically in relation to personal data, such as his Gmail and Fitbit accounts, as opposed to work-related data, which was a pivotal point in determining the responsibilities of the HSE.
The Court found that the HSE was not responsible for the Applicant’s personal data on the work phone, as it was not intended for personal use, and they could only be responsible for work-related data. The Court also held that the Respondent had conducted an appropriate investigation of the ransomware attack and had not misinterpreted the definition of a data controller under the GDPR. Additionally, it had remained unclear whether the Applicant’s personal accounts had even been hacked as a result of the HSE cyberattack or another cause. Finally, the Court ruled that the DPC’s decision was not outside its authority and was consistent with the evidence before it.
The Court refused the relief sought.
Click here to read the full judgment.