Denis O’Brien fails in High Court appeal against DPC dismissal of Red Flag complaint
High Court reporters
Denis O’Brien has failed to overturn the Data Protection Commission’s (DPC) dismissal of a 2020 complaint the businessman made over a public relations firm’s refusal to disclose information it held about him.
In a judgment on Friday, Judge Siobhán Lankford threw out O’Brien’s High Court challenge to the DPC dismissal, stating that he had “not succeeded on any of the grounds argued”.
O’Brien submitted a data access request to Red Flag in June 2018 under EU law, seeking confirmation that it held personal information about him and requesting the source of the information, the purpose of holding that information and the people with whom it shared that information.
This request arose against the backdrop of long-running litigation between O’Brien and Red Flag, concerning a dossier prepared by Red Flag on behalf of an unidentified client.
In response, Red Flag refused to provide O’Brien with certain information, saying that it would violate its legal professional privilege and client confidentiality.
In July 2020, O’Brien made a complaint to the DPC about Red Flag’s refusal to share information, saying that he was not looking for any privileged material from the PR firm and that it was not plausible to suggest the dossier was privileged.
In early November 2022, the DPC rejected O’Brien’s request, telling the businessman that Red Flag was entitled to refuse his request because it would involve disclosing the names of people who received the dossier and might reveal a client’s identity, breaching confidentiality.
O’Brien challenged the DPC decision in the High Court a month later.
In her judgment, Lankford said the court had to decide if the DPC was correct to say that Red Flag was entitled to rely upon section 60 of the Data Protection Act 2018 in claiming privilege over requested information.
This section allows for a data controller to refuse a data request when necessary for the defence of a legal claim.
O’Brien claimed that this section was incompatible with GDPR laws.
The judge stated it would be unrealistic to view O’Brien’s data request to Red Flag in isolation. She said the request was made in the context of litigation, and fell within the ambit of section 60.
“A decision on what is necessary and proportionate can only be made against the full factual backdrop of the request and involves a balancing of rights in the interests of the enforcement of civil law claims and the public protection of the right of access to justice,” she said.
The judge also rejected O’Brien’s argument that the DPC was “premature” in deciding not to launch an inquiry to determine if the requested material was legally privileged. Such an inquiry is provided for in Section 151 of the 2018 Act.
O’Brien further argued that the DPC was wrong to find that Red Flag was justified under GDPR in declining to provide the data on the basis that it might reveal the firm’s client.
The judge noted that O’Brien offered no authority for asserting that the DPC was not entitled to consider Red Flag’s duty of confidentiality to its client. She dismissed the argument.
The judge said her provisional view was to make an order against O’Brien to pay the costs of the DPC and Red Flag, a notice party to the action.
She said she would place a stay on such an order for one month to allow for arguments over the costs issue.
