Data Protection Commissioner was entitled to find that the HSE was not a data controller concerning unauthorised personal data on work phone

The High Court has refused to quash the Data Protection Commissioner's (DPC) decision that the Health Service Executive (HSE) was not acting as a data controller in relation to personal data stored on a work phone without authorisation. The court found that the DPC conducted an appropriate investigation into the complaint, which focused on the unauthorized access of personal accounts through a work phone issued by the HSE. The complaint was dismissed on the basis that the HSE had not authorised the use of the phone for personal purposes, and therefore could not be considered the data controller for the personal data in question. The court also noted that it could not be determined whether the applicant's personal accounts were compromised due to the HSE cyberattack or through other means.