The Hospice CCTV policy stated that "….The purpose of the system is to prevent crime and promote staff security and public safety" and a sign was placed beside each camera, which read “Images are recorded for the purposes of health and safety and crime prevention”.  

Mr Doolin made a complaint to the Data Protection Commission (DPC). The DPC rejected Mr Doolin's complaint as it was of the view that the processing of Mr Doolin's data in relation to the security concerns was legitimate. The DPC considered that Mr Doolin’s data was confined to the CCTV images and beyond the first and only viewing of those, no further processing occurred. 

Mr Doolin unsuccessfully appealed to the Circuit Court, and then appealed again to the High Court. The High Court found against the DPC's decision, statingthat it was indisputable that the information contained in the CCTV footage was used for a different purpose than the one for which the data was originally collected. The fact that it was not downloaded does not mean that no further processing took place.  It therefore considered, contrary to the DPC’s findings, that the CCTV images were further processed.    

Court Of Appeal Decision 

The DPC argued that the case rested upon three fundamental propositions:   

1. The CCTV footage was viewed on one occasion only, for the purpose specified in the Hospice CCTV policy, namely security, and was not further processed thereafter.  Accordingly, no breach occurred.   

The COAfound that Mr Doolin's data was in fact processed three times: (i) when it was collected/recorded (ii) when it was watched for the purposes of the security incident and (iii)when the data regarding Mr Doolin taken from the CCTV was tabulated in the panel report for the purpose of supporting a disciplinary sanction against him. 

2. Alternatively, if the CCTV footage was further processed by the Hospice, it was processed for a security purpose.   

The COA stated that "the DPC appears to have considered that there was one investigation only into the security issue and therefore the outcome of that investigation must be regarded as security related", however, the COA did not agree. By way of example, the COA pointed out that the title of the investigation report does not refer to security but describes the report as an “investigation into staff member (Cormac Doolin) accessing the Anna Gaynor House Tea Room at unauthorised times.”  The COA went on to state that "the processing of Mr Doolin’s data was not for a security purpose as the DPC contends.  It was manifestly for a different purpose … but of course that is not the end of the inquiry. It is necessary thereafter to carry out a compatibility assessment  ..." 

3. In the further alternative, if the CCTV footage was further processed and such processing was not for a security purpose, then it was for a purpose that was not incompatible with the security purpose. 

The DPC argued that every employee entering the room for a defined period of time had to be regarded as a suspect for the graffiti incident, including Mr Doolin, and accordingly the unauthorised access had a clear security dimension and was integral to the investigation of the graffiti. The DPC argued that it must follow, that even if the disciplinary process was not expressly for a security purpose, it was for a related purpose and thus not incompatible with the specified purpose. The COA disagreed and restated that there was absolutely no evidence that the taking of unauthorised breaks represented a security issue in itself. 

What does this mean for employers? 

 The case provides a cautionary tale for employers in terms of relying on CCTV footage in disciplinary processes.