GDPR DATA PROTECTION ISSUES

In a judgment handed down this morning in cases in which I represented the Defendant, His Honour Judge O'Connor, the Circuit Court provided useful direction with regard to data protection issues.

The ruling is the first written decision to take into account the statutory claim procedure created by section 117 of the Data Protection Act of 2018. Both data processors and practitioners will benefit from the verdict.

During a meeting of managers and supervisors to discuss poor work habits, an employer used CCTV footage. The Court determined that the employer's data protection rules lacked transparency and clarity and determined:

- That the Plaintiff's rights were violated in accordance with the GDPR;

- That infringement resulted in non-material damage, and

- The infringement and the damage are related in a causal way.

The court awarded €2000 in damages for non-material harm that included shame and lost sleep. The decision to award damages offers some direction for future claims of this sort in terms of how they will be appraised. The low level of damages awarded would indicate that the District Court, which will now have jurisdiction to hear data protection claims after the passage of the Courts and Civil Law (Miscellaneous Provisions) Act 2023, will handle the majority of non-material damage claims under Section 117 of the 2018 law. On July 5, 2023, the President approved that Act. Data processors will welcome this because they have previously been required to defend even the smallest GDPR violation before the Circuit Court.

Data processors will also need to be aware of the judgment, especially the need to be explicit and open about the policies they are using to process data. Additionally, data processors must make sure that they conduct a legitimate interest assessment in cases when they rely on this legal justification for processing.