High Court allows appeal on a point of law of decision of the Circuit Court, and sets aside a decision of the Data Protection Commissioner, on the grounds that CCTV footage was unlawfully further processed for the purpose of disciplinary action against the appellant.
Data protection – appeal on a point of law - whether CCTV footage viewed by the Appellant’s employer was further processed by OLHCS in breach of the Data Protection Act 1988 as amended – argued that the CCTV was viewed for a permissible use, i.e. to prevent crime and promote staff security and public safety, but that information derived from same was unlawfully further processed for the purpose of disciplinary action against him - threatening graffiti message in a staff room – reviewed the CCTV - Appellant was one of a number of staff members identified on the CCTV footage accessing the staff room - CCTV footage was only viewed once for the purpose of investigating the graffiti incident -subsequent use of the information from that footage was a breach of the act – chronology of events - unauthorised breaks – recommendations – legal framework - purpose limitation principle - general framework for compatibility assessment – notion of ‘further’ processing - notion of incompatibility - four key factors to be considered during the compatibility assessment - complaint by Appellant – decision of the Data Protection Commissioner – determined that the information gathered from that viewing may subsequently have been used for another purpose i.e. disciplinary proceedings against you but this does not constitute a different purpose, because the CCTV images were not further processed for that second purpose - that no further processing had occurred was that the CCTV images had not been viewed in the disciplinary proceedings against the Appellant – decision did not engage with the Appellant’s point that it was not CCTV footage that was used to sanction him but rather data retrieved and processed from the CCTV footage – the proceedings - evidential basis for decision of Circuit Court – argued that no further processing in the context of the disciplinary proceeding since that process was founded exclusively on admissions made by the Appellant – not identified in its original Decision - became the sole basis for the rejection by the Circuit Court of the Appellant’s appeal – fact that employer asserted that the material was not used as a basis for the disciplinary process and that the process was based on admissions makes it clear that OLHCS were not justifying use of the derived material in the disciplinary process on security grounds - the evidence indicates that the use of the information from the CCTV footage in the context of the disciplinary hearing was used for an entirely different purpose to that for which it was collected - had CCTV material been intended to be used for disciplinary purposes as well as the other purpose identified, that would require to be identified - where a processor wishes to use CCTV data for identified purposes, if those purposes are clearly identified before the material is collected (assuming of course that they are otherwise permissible purposes having regard to the Act) then the use of such material is likely to be uncontroversial - there was no evidence upon which the Circuit Court could safely conclude that the further processing in the context of the disciplinary hearing was for security purposes, since the sole basis for this finding i.e. the averments of the Appellant were not themselves grounded on any material put forward by the employer - no evidence for the conclusion that the disciplinary action, in which information derived from the CCTV footage was used, was carried out for security purposes – relevance of the admissions of the appellant – whether decision of the Data Protection Commissioner should be overturned - indisputable that the information contained in the CCTV footage was used for the disciplinary proceedings, which use constituted a different purpose from the one for which the data was originally collected - having regard to the definition of processing in the Act, and contrary to the conclusion reached by the DPC, the CCTV images were further processed – decision of the Data Protection Commissioner set aside.