In the recent case of O’Brien v The Data Protection Commission and Ors [2026] IEHC 250, the High Court upheld the Data Protection Commission’s (“DPC”) decision that an organisation was entitled to rely on certain exemptions contained in the Irish Data Protection Act 2018 (the “2018 Act”) to refuse a data subject’s access request (“DSAR”).
The Court upheld the relevant exemptions as compatible with the GDPR (EU 2016/679) in particular, Article 23 GDPR, which permits Member States to restrict certain data subject rights in specified circumstances. This judgment is a welcome development for organisations relying on Irish statutory exemptions when dealing with DSARs.
Background
This case arose from a DSAR submitted by the appellant to Red Flag Consulting Limited (“Red Flag”) in 2018, in the context of long-running litigation concerning a dossier prepared by Red Flag on behalf of an unidentified client relating to the appellant. In the DSAR, the appellant sought access to a copy of all personal data relating to him, and information concerning the recipients or categories of recipients under Article 15 GDPR.
In response, Red Flag furnished the appellant with a limited set of personal data and asserted that full disclosure would violate legal professional privilege and compromise client confidentiality. To support the refusal Red Flag relied on: (i) Section 60(3)(a)(iv) of the 2018 Act (restrictions necessary and proportionate in connection with a legal claim), (ii) Section 162 of the 2018 Act (legally privileged material), and (iii) Article 15(4) GDPR (right of access must not adversely affect third-party rights).
The appellant complained about this refusal to the DPC, arguing that Red Flag’s refusal amounted to a blanket refusal of his request, the DPC dismissed the complaint finding that the exemptions contained in the 2018 Act could be relied on by Red Flag. The DPC concluded that full disclosure would have revealed the identity of Red Flag’s client and recipients of the dossier, breaching confidentiality obligations and that the partial refusal did not constitute a blanket refusal as it withheld only the information that fell within the applicable statutory exemptions.
Judgement
The appeal to the High Court against the DPC’s decision focused on three issues:
- Whether the DPC correctly held that Red Flag was entitled to rely on Section 60(3)(a)(iv) of the 2018 Act in circumstances where the appellant argued that provision was not consistent with Article 23 GDPR;
- Whether the DPC had properly dealt with documents claimed to be the subject of legal professional privilege under Section 162 of the 2018 Act; and
- Whether the DPC correctly held that Red Flag had not applied a blanket refusal to the appellant’s DSAR and that its refusal to provide a copy of personal data which might reveal the identity of its client was justified under Article 15(4) GDPR as disclosure would adversely affect the rights and freedoms of others.
First ground of appeal – the Section 60 argument
Compatibility of Section 60(3)(a)(iv) with Article 23 GDPR
The appellant argued firstly that Red Flag was not entitled to refuse the appellant’s DSAR, insofar as it related to the recipients or categories of recipients to whom the personal data contained in the dossier had been or would be disclosed, on the basis that Section 60(3)(a)(iv) of the 2018 Act is incompatible with Article 23 GDPR.
Article 23 GDPR permits Member States to adopt a law that restricts data subjects’ rights, provided that any such legislative restriction (i) respects the essence of the rights and freedoms of data subjects; (ii) is a necessary and proportionate measure in a democratic society to safeguard interests listed in Article 23(1); and (iii) contains specific provisions, where relevant, as to the factors specified in Article 23(2) GDPR.
The Court rejected the appellant’s argument of incompatibility between Section 60(3)(a)(iv) of the 2018 Act and Article 23 GDPR. The Court held that Section 60 of the 2018 Act benefits not only from a presumption of constitutionality, but also a presumption of compatibility with EU law, and must be interpreted insofar as possible in a manner that is consistent with the GDPR. The Court held that Section 60(3)(a)(iv) allows for the restriction of access to data in the context of legal claims subject to the requirement that such restrictions are necessary and proportionate. This is to further a legitimate objective identified in Article 23(1)(j) GDPR, namely “the enforcement of civil law claims”. The Court further noted that Article 23(2) does not require national legislation to address exhaustively every factor listed in Article 23(2) (a) to (h) and the phrase “where relevant” in Article 23(2) is significant. Section 60(3)(a)(iv) was found to contain adequate safeguards and was therefore upheld as compatible with Article 23 GDPR.
Discussion on overlap between Section 162 and Section 60(3)(a)(iv) of the 2018 Act
The Court also addressed the scope of, and overlap between, the exemptions set out in Sections 60(3)(a)(iv) and 162 of the 2018 Act, which have been subject to some legal uncertainty since the 2018 Act came into force. The Court noted that Section 162 amounts to a description of legal professional privilege, which is a concept clearly understood in common law. In contrast, the language of Article 23(1) GDPR refers to restrictions which are necessary and proportionate to safeguard “the enforcement of civil law claims”, and Section 60(3)(a)(iv) is designed to give effect to this. Such claims and defence thereof may involve the “protection of the data subject or the rights and freedoms of others” which is an objective enshrined in Article 23(1) GDPR. To this extent, the restriction permitted by Section 60(3)(a)(iv) is broader than that permitted by Section 162. The Court therefore rejected the assertion that Section 60(3)(a)(iv) does no more than enshrine the principle of legal privilege. Rather the Court found that “Section 162 and Section 60 offer separate and distinct grounds upon which a data subject’s request may be refused or limited”.
The Court further noted Section 60(3)(a)(iv) enables a balancing exercise of competing rights and freedoms, including third party rights, fair trial rights and the rights of data subjects. In practice, therefore a litigant might not be able to refuse to furnish the identity of a client on the grounds of legal professional privilege under Section 162, but justification for such a refusal could be found in Section 60(3)(a)(iv) where it is necessary and proportionate to do so.
Second Ground of Appeal – the Section 162 Argument
In the appellant’s submissions, it was argued that the DPC should have invoked Section 151 of the 2018 Act to seek a High Court determination on whether the relevant material was in fact subject to legal professional privilege under section 162 of the 2018 Act. The Court upheld the DPC’s view that it was neither appropriate or proportionate to investigate the entire set of documentation for this purpose and that Section 151 did not need to be engaged. This ground of appeal was not ultimately pursued by the appellant before the Court.
Third Ground of Appeal – the Article 15(4) GDPR Argument
The third ground of appeal asserted that the DPC erred in concluding that Red Flag could withhold a copy of the appellant’s personal data where disclosure would risk revealing the identity of its client under Article 15(5) GDPR. The appellant argued that neither the 2018 Act nor the GDPR permits Red Flag to consider confidentiality obligations to third parties when determining whether access rights can be restricted. In addition, the appellant argued that Red Flag had relied on Article 15(4) GDPR to issue what amounted to a blanket refusal of access.
The Court rejected these arguments and upheld the DPC’s finding that the Red Flag’s client’s right to confidentiality fell within the scope of the phrase “the rights and freedoms of others” as set out in Article 15(4) GDPR. The Court held that on a balancing exercise, Red Flag was entitled to withhold information where disclosure would reveal the identity of a third party to whom a duty of confidentiality is owed. This did not amount to a blanket refusal on the part of Red Flag to furnish personal data to the appellant, as the only information withheld was that which would identify Red Flag’s client.
The Court concluded that the DPC had made no error of law in its finding under Article 15(4) GDPR.
The appellant therefore was unsuccessful on all grounds of appeal.
Key takeaways for organisations responding to DSARs
This decision (which is subject to appeal) will be welcomed to the extent that it provides some helpful clarity on the scope of the statutory exemptions set out in section 60(3)(a)(iv) and section 162 of the 2018 Act, along with Article 15(4) GDPR, and when they can be relied on to refuse a data subject request. In particular, the clear distinction drawn by the Court between Section 60(a)(iv) and Section 162 is helpful. To recap, Ms Justice Lankford explicitly stated that “Section 162 and Section 60 offer separate and distinct grounds upon which a data subject’s request may be refused or limited”. The Court confirmed that Section 60(3)(a)(iv) is broader that Section 162, and rejected the assertion that Section 60(3)(a)(iv) does no more than enshrine the principle of legal privilege.
The decision further reinforces the principle that the limitation in Article 15(4) GDPR, which protects against adverse effects on the rights and freedoms of others, including third party rights to confidentiality and privacy, can outweigh a data subject’s right to obtain a copy of their personal data.
Nonetheless, any limitation on a data subject’s rights must be justified and applied in accordance with the requirements of Article 23 GDPR and the 2018 Act. Organisations that treat any of the statutory exemptions to the right of access as an absolute bar to disclosure, without undertaking a case-by-case assessment, risk being found in violation of the GDPR. Organisations should always ensure that reliance on any statutory exemptions is properly documented and proportionate, having regard to the specific circumstances at hand.
Contact us
If you have any questions on anything contained in this article, please feel free to reach out to a member of the Technology and Innovation Group or your usual Matheson contact.
