AFR Advocates appealed a determination and reprimand by the authority from February 2023. It was the first appeal made against a determination of the regulator.
In July 2022 a paralegal from the law firm had hand-delivered a bundle of court documents in relation to a Petty Debts hearing to an individual's home.
The person involved was not at home and after waiting some 15 minutes, he left a ring binder on the front step in the porch, just a few metres from a busy main road. The householder arrived home a few minutes later and immediately made a complaint that his private and sensitive personal data had been put at risk.
Having been reprimanded, the law firm took their case to court, arguing errors of law and that the determination was unreasonable, disproportionate and contained material errors in facts or procedure. Judge Fionnuala Connolly rejected all grounds of the appeal in her judgment published just before Christmas. The appeal was heard earlier this year.
The bundle contained over 200 pages relating to a private legal claim brought by the individual against a third party.
Among other items, the bundle, which was left on the individual’s doorstep, contained various pages relating to the individual’s health data – defined in the law as ‘special category data’.
The bundle was in an ordinary ring binder folder and was not enclosed in an envelope, box or any other form of container. The law firm argued that placing the folder into an envelope would have placed it at a greater risk of being taken, whereas a folder was clearly of no value to any passer-by.
Nor was it delivered to a ‘safe place’ or out of sight of the road. The individual was not at home at the time of the delivery and considered that had put their private and sensitive personal data at risk.
The DPA agreed and ruled that AFR had contravened section 6, the principle of integrity and confidentiality, and section 41, the duty to take reasonable steps to ensure security of personal data, of the data protection law.
In court its advocate said it found AFR’s reaction to the determination to be ‘bewildering’.
‘We welcome the court’s judgment that upholds our determination while confirming our proportionate approach to investigation,’ said data protection commissioner Brent Homan.
‘We further appreciate the awarding of costs, as our preferred approach continues to involve constructive engagement with organisations to help them “get it right” rather than to be brought into costly and lengthy litigation.
‘There are also important lessons from the determination upheld by the court.
‘The law requires anyone working with people’s data to take appropriate safeguard measures ensuring the security of personal data at all times. Special category data such as health data, requires additional measures to ensure confidentiality.’
You need to be logged in to comment. If you had an account on our previous site, you can migrate your old account and comment profile to this site by visiting this page and entering the email address for your old account. We'll then send you an email with a link to follow to complete the process.