Employee’s Appeal Dismissed: Employer Not The Controller Of Non-Work-Related Data On Work Phone

The Court of Appeal (Court) in McShane v Data Protection Commission [2026] IECA 141, has upheld the High Court’s rejection of a judicial review challenge against the Data Protection Commission’s (DPC) refusal to investigate a personal data breach complaint in connection with the 2021 cyberattack on the Health Service Executive’s (HSE) ICT systems.

The underlying complaint

The appellant was employed by the HSE as a fire prevention officer. He was provided with a laptop and a mobile phone by the HSE for use solely in connection with his work. The appellant also used the work phone for personal purposes in breach of HSE policies. The appellant used his work phone for personal emails, lifestyle tracking and his cryptocurrency account.

In 2021, the HSE was the subject of a serious personal data breach. In the months that followed, the appellant discovered that his mobile phone had been hacked, resulting in third parties unlawfully accessing his personal email accounts and stealing from his cryptocurrency account. He first lodged a complaint with the HSE and subsequently, the DPC.

The DPC dismissed the complaint on the basis that the HSE could not be considered a “data controller” of the appellant’s non-work-related personal data stored on the mobile phone under Article 4(7) of the GDPR.

The appellant was granted leave to judicially review the DPC decision. As discussed in our previous article, Non-Work Data on Work Mobile: Employer Not Responsible, the High Court dismissed the judicial review proceedings. The appellant appealed that dismissal to the Court of Appeal.

Court submissions and findings

In dismissing the appeal, the Court placed particular emphasis on the scope of the original complaint made by the appellant. The Court considered the complaint concerned the appellant’s non-work-related personal data (i.e. from his personal accounts and apps), rather than work-related data processed in the course of his employment. The issue of work-related personal data was not raised by the appellant until later, in response to the DPC’s decision dismissing his complaint.

The Court was satisfied that the DPC, and subsequently the High Court, were entitled to assess the complaint by reference to the appellant’s non-work-related personal data. This was significant because the question of whether the HSE was acting as a “data controller” for the purposes of the GDPR fell to be assessed on the data forming the scope and subject matter of the complaint, i.e., the non-work-related data. In relation to that data, and in the absence of any challenge by the appellant on the point, the Court upheld the finding that the HSE was not a “data controller” as defined in Article 4(7) of the GDPR.

In the course of his submissions, the appellant sought to broaden the grounds of the appeal, alleging that the DPC did not properly investigate the complaint. He submitted that the DPC was obliged to “look behind” the complaint and investigate matters beyond those expressly identified. Had the DPC done so, the appellant argued, the investigation would have expanded to include work-related personal data processed by the HSE. The Court rejected that argument. It held that it is for the complainant (here, the appellant) to formulate the complaint, reaffirming that the DPC is not generally required to investigate matters not raised in a complaint. The Court also noted the potential unfairness that could arise if the HSE were required to defend allegations not actually made in the complaint.

Concluding remarks

Although the judicial review proceedings and the appeal were framed around the question of controllership under the GDPR, the Court’s analysis focused primarily on the scope of the original complaint and the matters the DPC was required to investigate (and the resulting matters which the HSE was required to defend). In that regard, the decision confirms that the DPC is entitled to assess complaints by reference to the issues actually raised by a complainant, and is not generally required to expand its investigation beyond those issues.