Regulatory Dawn Raids: Data Protection and Privacy Issues

On 5 April 2016, the High Court (Barrett J) gave judgment in CRH plc and Seamus Lynch v The Competition and Consumer Protection Commission[1]. The decision is very significant for regulated entities – including those operating in the financial services sector. This is because it deals with issues which can arise where the regulator obtains information in the course of a regulatory inspection which is not necessary for its investigation. The decision also highlights the increasingly complex role of regulated entities as data controllers.

Background

The Competition and Consumer Protection Commission (the "Commission") carried out a "dawn raid" at the offices of Irish Cement Limited ("ICL") and CRH plc ("CRH") in connection with an investigation into alleged breaches of competition law. The Commission obtained the entire email account of a senior executive in the CRH group who also had held a position in ICL. The plaintiffs' complaint was that by taking the entire