Denis O’Brien Loses High Court Appeal Against DPC Decision

Denis O’Brien has failed to overturn the dismissal of his complaint by the Data Protection Commission (DPC) regarding the refusal of a public relations firm, Red Flag, to disclose information about him. On November 3, 2023, High Court Judge Siobhán Lankford ruled against O’Brien, stating that he “had not succeeded on any of the grounds argued” in his appeal.

The controversy dates back to June 2018, when O’Brien submitted a data access request to Red Flag under EU law. His request sought confirmation of whether the firm held personal information about him, including its source, purpose, and any individuals with whom it had shared that information. This request emerged amid ongoing litigation between O’Brien and Red Flag concerning a dossier prepared by the firm for an unidentified client.

Red Flag denied O’Brien’s request, citing legal professional privilege and client confidentiality as reasons for not disclosing certain information. Following this, O’Brien lodged a complaint with the DPC in July 2020, insisting he was not seeking any privileged material. He argued that it was implausible to suggest that the dossier was protected under such privileges.

In early November 2022, the DPC rejected O’Brien’s complaint, asserting that Red Flag was justified in refusing the request. The DPC stated that disclosing the requested information would potentially reveal the identities of individuals who received the dossier, thereby breaching client confidentiality.

Following the DPC’s ruling, O’Brien challenged the decision in the High Court. Judge Lankford’s judgment focused on whether the DPC was correct in allowing Red Flag to invoke section 60 of the Data Protection Act 2018, which permits data controllers to deny requests deemed necessary for defending legal claims. O’Brien contended that this section was incompatible with GDPR laws.

Lankford noted that it would be unrealistic to view O’Brien’s request independently of the surrounding litigation. She emphasized that the request must be assessed within the context of ongoing legal proceedings, requiring a balance between the enforcement of civil law claims and the public’s right to access justice.

The judge dismissed O’Brien’s argument that the DPC acted prematurely by not initiating an inquiry to establish whether the requested material was legally privileged. Such an inquiry is outlined in Section 151 of the Data Protection Act 2018. O’Brien further claimed the DPC erred in concluding that Red Flag was justified under GDPR for declining to provide the data based on potential client identity disclosure. The judge countered that O’Brien offered no substantial evidence to support his assertion that the DPC could not consider Red Flag’s duty of confidentiality to its client.

In her provisional remarks, Judge Lankford indicated that she was inclined to order O’Brien to cover the costs incurred by both the DPC and Red Flag, which was a notice party in the action. She stated that she would stay this order for one month to allow for discussions regarding the costs involved.