Triona Cody

Earlier this summer, in Philip McCabe and AA Ireland Limited [2024] IECC 6, the Circuit Court awarded €5,500 for damages suffered by an employee as a result of data protection infringements by his employer.

Background

The plaintiff, Mr McCabe, is a mechanic and was an employee of the defendant, AA Ireland Limited.

Mr McCabe was absent from work on sick leave in August 2022. On the final day of his sick leave, while assisting his mother-in-law in cutting an overhanging branch at her home, Mr McCabe became aware of a vehicle on the opposite side of the road.

The occupants of the vehicle were senior management of AA Ireland. The operations manager was recording Mr McCabe on a mobile phone. Mr McCabe became angry and annoyed, claiming that he was being wrongly recorded outside of the workplace and without his knowledge and consent.

The following day, Mr McCabe was requested to attend a meeting with the operations manager when he was suspended with pay pending an investigation.

One week later Mr McCabe attended a disciplinary hearing. The outcome of the disciplinary hearing was the summary dismissal of Mr McCabe with immediate effect. Mr McCabe unsuccessfully appealed against his dismissal. The video recording was not used in the disciplinary process but one of the grounds for Mr McCabe’s dismissal was his reaction to being video recorded by the operations manager.

Mr McCabe brought an unfair dismissal claim against AA Ireland to the Workplace Relations Commission which was resolved prior to the hearing of the Circuit Court proceedings. The proceedings in the Circuit Court related to the issues arising on the processing by AA Ireland of Mr McCabe’s personal data.

Circuit Court proceedings

Mr McCabe claimed that:

1. AA Ireland’s conditions of employment guide for employees provide that any breach of their data protection policy will result in an investigation under their disciplinary and grievance policy and may result in disciplinary action. No investigation or action was taken against the operations manager, whereas Mr McCabe was summarily dismissed as a result of the incident.

2. AA Ireland, its servants or agents were not entitled to use or disclose or process Mr McCabe’s confidential information or any part thereof without his prior consent or any consent for an unlawful purpose.

3. The information was recorded, used, and processed by AA Ireland in breach of the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Data Protection Act 2018.

4. The processing, disclosure and/or publication of the confidential and sensitive information constituted a violation of his rights under the Irish Constitution and the European Convention on Human Rights (ECHR).

5. AA Ireland, its servants or agents, were negligent and/or in breach of duty, including statutory duty, and/or in breach of confidence in the manner in which they used his personal data.

6. He suffered significant distress, stress and anxiety as a result of his loss of control of his personal data, violation of his movements while not working and outside the workplace, being wrongfully required to defend and explain his private movements to AA Ireland, a complete lack of trust in AA Ireland, its servants or agents to exercise their duty of care to defend and protect his privacy and AA Ireland’s misuse and unlawful recording of him to his financial detriment in placing a blemish and reputational damage on his working career.

Mr McCabe claimed for damages, including non-material damages, and damages for wrongful invasion and breach of his right to privacy pursuant to the provisions of the Irish Constitution and the ECHR.

Mr McCabe also issued a motion and sought an order under section 117 of the 2018 Act directing AA Ireland to comply with his data subject access request and furnish him with a copy of his personal data, including the mobile phone recording. If necessary, an order was sought that AA Ireland account for the loss, erasure or destruction of the video recording.

AA Ireland denied the claims at 1-6 above and submitted that the recording was not taken on its instruction and had been deleted.

Decision

The Court referred to the decision in Kaminski v Ballymaguire Foods Limited [2023] IECC 5, which sets out the relevant legislation and terms of the GDPR provisions which are of relevance to this case and held that:

1. there was a clear causal link between the actions of the operations manager and the ultimate dismissal of Mr McCabe;

2. given the seriousness of the steps taken by AA Ireland against Mr McCabe and given the reason cited for his dismissal (his angry reaction to the video being recorded), it was in the interests of fairness and transparency to provide a copy of the video to Mr McCabe or inform him of the destruction of his personal data;

3. Mr McCabe enjoys a right to data collected by AA Ireland which is closely connected to his role; and

4. AA Ireland’s defence of “legitimate interest” does not have a bearing on the matter, as it denied it relied on or used the recording in reaching a decision to dismiss Mr McCabe. Such a defence would only arise where the use of the data was admitted or proved.

The Court made the following orders:

• a declaration that AA Ireland, its servants and/or agents breached Mr McCabe’s personal data rights;
• an order directing AA Ireland to account to Mr McCabe for the loss, erasure, or destruction of the video recording;
• compensation for the damage suffered by Mr McCabe pursuant to section 117(4)(b) of the 2018 Act as a result of the infringement in the sum of €5,500; and
• an order for costs in favour of Mr McCabe, to include reserved and discovery costs, including the costs of the motion, to be taxed in default of agreement.

The Court made no findings on the below:

• Privacy rights and the alleged infringements of same. It is important to note this does not exclude the possibility that the provisions of the Irish Constitution and the ECHR may have application in a case such as this.
• Negligence and/or in breach of duty, including statutory duty, and/or breach of confidence in the manner in which AA Ireland used Mr McCabe’s personal data.

Conclusion

This case highlights the importance for employers of transparency in processing employees’ personal data and employee consent to such processing.

Employers must meet their GDPR obligations, including data security, and be accountable for their data processing activities.

Employers should have procedures in place to respond promptly to data subject access requests and provide GDPR training to all employees.

• Triona Cody is a partner in Kane Tuohy’s employment and litigation department. Niamh Meagher and Jim Gibbons assisted in the writing of this article.