A decision of the Data Protection Commissioner (DPC) in favour of a claimant making a data access to Dublin Bus for CCTV footage has been upheld by the High Court.

The alleged accident occurred on a Dublin Bus in October 2008 and the claimant instigated personal injury proceedings in October 2009. The woman applied to Dublin Bus for access to CCTV footage of her accident in February 2010, but this request was denied by Dublin Bus who argued that the documents and records had been prepared in contemplation of litigation and therefore fell within the legal professional privilege exemption for data access requests under the Data Protection Acts.

Following a complaint made by the claimant to the DPC, Dublin Bus was issued with an enforcement notice ordering it to release the CCTV footage on the grounds that the claimant had every right to request access to the footage and that Dublin Bus had no right to withhold it.

Dublin Bus appealed the decision to the Dublin Circuit Court, where Judge Linnane upheld the decision of the DPC and found that the footage was not privileged and that the Data Protection Acts do not allow the court any discretion in withholding access.

Dublin Bus subsequently appealed the decision to the High Court on a point of law: whether the existence of legal action between a person seeking information and the party holding the information, precludes that person from making a request for information under data protection legislation or justifies the data controller in refusing the request.

In dismissing the appeal, Judge Hedigan outlined that the Dublin Bus appeal was effectively an attempt to carve out a new exception in the legislation, to the effect that whenever a data requester has instituted litigation against a data controller, he or she is precluded from making a data access request. As no valid point of law was raised, the High Court refused to overturn the Circuit Court decision that Dublin Bus was not justified in refusing the access request.

The case confirms that images of an individual on CCTV constitute personal data within the meaning of the Data Protection Acts and that the data access exception relating to legal professional privilege does not automatically apply simply due to the existence of legal proceedings between the parties to a data access request.

Contributed by: John Magee