Work Phones And Personal Data: Who's In Control?

A recent judgment issued by Justice Barry O Donnell saw the dismissal of a Judicial Review (JR) concerning personal data on a work phone provided by the HSE. The case highlights the challenges well known to those working in this area involving mixed personal data on work devices. The case provides some comfort to employers, like the HSE, who had a clear Policy which provided that, absent express agreement, non-work use of the phone was not permitted. This was critical in the finding that the HSE was not a controller of non-work-related personal data which was the issue of contention here.

Background

The applicant alleged that his work phone had been hacked as a result of the 2021 ransomware attack on the HSE's computers and technical devices. The applicant stored two types of data on his HSE issued phone, namely 'work related personal data' which was collected and stored in the course of and for the purposes of his work related activities and 'non-work related