Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 17 APRIL 2025

Market Intelligence Thought Leadership Award Winner

Non-Work Data On Work Mobile: Employer Not Responsible

William Fry LLP
William Fry LLP
Contributor
William Fry LLP

William Fry LLP

William Fry advises leading Irish and international companies, covering both the public and private...

View firm profile
Explore more from William Fry LLP

The High Court (Court) has rejected a judicial review challenge against the Data Protection Commission's (DPC) refusal to investigate a personal data breach complaint allegedly arising out of a cyberattack on the Health...

IrelandPrivacy
Rachel Hayes
Rachel Hayes
Adele Hall
Adele Hall
Gail Nohilly
Gail Nohilly
Author LinkedIn connections

The High Court (Court) has rejected a judicial review challenge against the Data Protection Commission's (DPC) refusal to investigate a personal data breach complaint allegedly arising out of a cyberattack on the Health Service Executive's (HSE) information and communication technology (ICT) systems in May 2021.

McShane v Data Protection Commission [2025] IEHC 191

The HSE employed the applicant as a fire prevention officer. In December 2021, he complained to the DPC that personal data on a work mobile phone provided to him by the HSE was unlawfully breached. He alleged that his data was compromised and as a result he suffered a loss of €1,400 from his cryptocurrency account. The applicant used the work mobile phone for personal use, and it contained non-work-related personal data, including personal email accounts and a cryptocurrency exchange account. Non-work phone use was contrary to the HSE's ICT Acceptable Use Policy. Furthermore, the HSE's Electronics

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

The Data Act – “Access By Design” Requirement Comes Into Force

The European Union's Data Act introduces a groundbreaking "access by design" requirement that fundamentally changes how manufacturers must approach product development for connected devices and IoT products. From September 2026, businesses placing connected products on the EU market must ensure users can directly access their generated data by default, shifting data accessibility from a reactive request-based model to a proactive design imperative.
IrelandPrivacy
Matheson
Matheson
Article

The Data Act: “Access By Design” Requirement Comes Into Force For Medical Devices

The Data Act's "access by design" requirement came into force on 12 September 2026, mandating that manufacturers of connected products and providers of related services must enable direct user access to generated data by default. This article examines the scope of this new obligation and its practical implications for businesses in the Life Sciences sector, particularly those developing medical devices and Internet of Things products.
IrelandPrivacy
Matheson
Matheson
Article

The Data Act – Part I: Key Considerations Regarding Data Access And Sharing

The EU Data Act, which became applicable on 12 September 2025, fundamentally reshapes how businesses handle data generated by connected devices and related services. With Ireland's General Scheme published in February 2026 designating ComReg and CCPC as enforcement authorities, companies must now assess their compliance obligations across data sharing frameworks, contractual terms, and user access rights or face significant fines.
IrelandPrivacy
Matheson
Matheson
Article

DPC AI Insights Report: Key Takeaways

Ireland's Data Protection Commission has published a comprehensive report examining its supervisory engagement with organizations developing AI products between 2021 and 2025, revealing a tenfold increase in AI-related engagements and highlighting critical compliance areas including lawful basis, transparency, and children's data protection. The report provides detailed insights into the DPC's quasi-regulatory sandbox approach and outlines key observations on data protection obligations for AI technologies,
IrelandPrivacy
Matheson
Matheson
Article

Ireland’s Data Centre Connections: Back Online

Ireland has lifted its data centre connection moratorium and introduced a demanding new framework requiring developers to provide their own generation capacity, source 80% of electricity from new Irish renewables within six years, and meet strict grid stability requirements. The policy creates significant opportunities for developers who can navigate the complex intersection of grid connection, planning permission, and renewable energy procurement, though a pending legal challenge adds uncertainty to the la
IrelandEnergy and Natural Resources
William Fry LLP
William Fry LLP
Article

Government Legislative Priorities For Autumn 2026

The Government has published its Autumn 2026 Legislation Programme, identifying 32 bills for priority publication and 32 bills for priority drafting. This article explores a selection of measures likely to be of interest to businesses, spanning digital economy, strategic infrastructure, litigation reform, financial regulation, competition law, corporate structures, employment, pensions, and healthcare sectors.
IrelandGovernment, Public Sector
William Fry LLP
William Fry LLP
Article

Data For Sale: Can Insolvent Companies Realise The Value Of Corporate Data?

Spirit Airlines' proposed $10 million sale of a massive de-identified corporate dataset to Google in its Chapter 11 bankruptcy proceedings raises fundamental questions about whether operational business data can be treated as a realisable asset in insolvency. The transaction highlights the legal tension between preserving a dataset's commercial utility and ensuring individuals cannot be identified, particularly when the data maintains referential integrity across multiple systems.
IrelandInsolvency/Bankruptcy/Re-Structuring
William Fry LLP
William Fry LLP
Article

Time Running Out As AI Transparency Guidelines Published

The European Commission has published comprehensive guidelines on AI transparency obligations under Article 50 of the EU AI Act, with enforcement beginning August 2, 2026. These guidelines establish how organizations must disclose AI systems, mark synthetic content, label deepfakes, and demonstrate compliance, with significant penalties for non-compliance reaching up to €15 million or 3% of global turnover.
IrelandTechnology
William Fry LLP
William Fry LLP
Article

CBI Consults On Third-Party Risk

The Central Bank of Ireland has published a consultation paper proposing new guidance on managing third-party risks that extends beyond traditional outsourcing to encompass partnerships, joint ventures, and fintech collaborations. The proposed framework aligns with recent European Banking Authority guidelines and DORA, introducing a lifecycle-based approach with enhanced contractual provisions and broader scope than the 2021 guidance it will replace. Financial entities now face the challenge of identifying
IrelandFinance and Banking
William Fry LLP
William Fry LLP