A carpenter’s assistant at Harold’s Cross hospice has spoken of his fears of losing his house over huge legal bills as he fought the Data Protection Commissioner (DPC) in a six- year legal battle over his employer’s use of CCTV to take disciplinary action against him.

Cormac Doolin, a 37-year-old father of two with a third child on the way, said he became obsessed with data protection law after Our Lady’s Hospice and Care Services sanctioned him for taking unauthorised breaks based on CCTV footage that was original reviewed as part of an investigation into a potential terrorist threat.

In November 2015, the hospice discovered graffiti carved into a table in a staff area which read ‘Kill all whites, Isis is my life’.

The discovery, coming a week after the Paris Bataclan attacks, caused the hospice to notify gardaí.

Hospice management said gardaí recommended they review the CCTV of the staff tea-room and Doolin received a letter saying the hospice was investigating offensive graffiti and “unauthorised breaks”.

From reviewing the footage and fob data, management could tell Doolin he had been recorded as being in the tea – room for between 46 and 55 minutes on three consecutive days.

There is no suggestion that Doolin had anything to do with the graffiti.

A sign placed by each camera said the images were recorded for “the purposes of health and safety and crime prevention”.

Doolin, who was later subjected to a final written warning regarding an absence to attend a court hearing over a road traffic ticket, decided to file a complaint with the DPC in June 2016. He complained his personal data had been processed unlawfully and not with the purposes for which it was collected.

When Doolin received a negative finding from the DPC, he felt it was incorrect based on previous cases. The carpenter’s assistant said he went down a “rabbit hole” of studying data protection case law.

“I never had mental health issues before, but I became depressed and anxious”, Doolin said.

“I was convinced I was treated unfairly because there was never any notice the CCTV would be used like this. What was the worst for me was that I felt the DPC wouldn’t listen to me. I felt they had an arrogant attitude”.

The DPC had upheld a complaint from an Aircoach driver who was disciplined after CCTV showed her using a mobile phone while driving, but it refused to find that Doolin’s data rights were breached in a similar way.

He engaged solicitor Fintan Lawlor and senior counsel Edward Walsh to appeal the DPC’s decision to the Circuit Court. Lawlor warned him he was likely to lose initially and could face legal costs of up to €60,000.00

“He said we would probably lose in the Circuit and win in the High Court and that’s what happened”, said Doolin. After losing in the Circuit Court, Doolin said he took the weekend to think about appealing as he was now facing a potential bill of over €100,000 if he lost in the High Court.

“It was a traumatic time”, he said. “I was thinking ‘I could lose my house’. I have two small children and I could lose my partner if things went really wrong. My father had just died, and I remember driving home with tears in my eyes. I was talking to my partner Michelle later and I remembered this poem my father gave me as a kid; “Don’t quit” and that was it. I rang Fintan and said, ‘we’re going for it’”.

The High Court ruled in Doolin’s favour and said it was “remarkable” that the DPC had gone from saying there was no breach because there was no further processing of footage to asserting that any further processing had been done for security reasons. An affidavit from John O’Dwyer, a deputy commissioner, said taking unauthorised breaks was “a serious and bona fide security issue”. This was an argument that even the hospice had not made.

The DPC appealed to the Court of Appeal, which ruled in Doolin’s favour in May. The court said there was “no justification” for O’Dwyer’s statement that the issue of unauthorised breaks was a security issue, based on the evidence before the court. Doolin received confirmation that the DPC would not appeal the case to the Supreme Court in the last week. The regulator will have to pick up a legal bill now likely to exceed €150,000.

“It’s a huge weight of my shoulders and I’m buzzing after it, but I have to decompress, too”, said Doolin.

His case prompted the Oireachtas Justice Committee to write to Justice Minister Helen McEntee last month after the Green Party TD Patrick Costello highlighted criticisms made of the DPC in the judgment. The letter from committee chair James Lawless called for two extra commissioners to appointed. McEntee is currently considered the proposal.

Graham Doyle, a deputy commissioner at the DPC, said the DPC wins “the vast majority of cases” it is involved in.

“The DPC welcomes the clarify from the court in this decision on the application of the purpose limitation period in this CCTV context”, he said. “It underlines the need for careful consideration by all organisations deploying CCTV of matters concerning legal basis and full transparency as to uses and purposes.”

Doyle said the DPC believes it did handle Doolin’s complaint appropriately. In relation to the Justice committee’s letter to the minister, the DPC questioned if appointing extra commissioners was a “silver bullet solution” and said the Doolin case was “an outlier”.

Source