HSE Found Not to be Data Controller of Non-Work-Related Personal Data of Employee

Background:(Non-Work-Related Personal Data of Employee)

In the recent case of Eamon McShane v Data Protection Commission [2015] IEHC 19, the High Court upheld a decision of the Data Protection Commissioner (“DPC”) which dismissed a complaint by Mr. McShane (the “Applicant”) on the basis of a finding that the HSE was not the “data controller” in respect of non-work related personal data stored by the Applicant on a work phone issued to him by the HSE.

Facts:

This case arose out of the well-publicised HSE hack in 2021. The Applicant’s case was that in June/July, 2021 he discovered that his personal email accounts had been hacked as well as his personal cryptocurrency account from which €1,400 of cryptocurrency had been stolen. The Applicant believed that his work mobile phone was the source or cause of the hack, and as such, believed his work mobile phone had been affected by the hack of May 2021. He made a complaint about the matter to the HSE in September 2021. The Complainant was not satisfied with the response he received and thereafter made a complaint to the DPC.

Continue reading here