A HSE fire prevention officer has lost an appeal over a refusal of the Data Protection Commission (DPC) to investigate an alleged data breach connected to the use of his work phone for personal use.

Eamon McShane, Burtonport, Co Donegal, claimed he lost €1,400 in cryptocurrency as a result of the May 2021 cyberattack on the HSE computer system.

He said in June/July 2021, he discovered that his personal email accounts had been hacked along with his personal cryptocurrency account and that his work mobile was the source or cause of the hack.

The court heard he acknowledged that using the phone for personal emails was not an acceptable use of the device.

He made a complaint to the HSE seeking compensation for his loss but was not satisfied with its response. He then made a complaint to the DPC.

The DPC rejected his complaint saying the HSE was not a "data controller". He attempted to appeal that decision but this was also rejected by the DPC.

He then brought High Court judicial proceedings seeking orders quashing the DPC's dismissal of his complaint and compelling it to investigate it.

He claimed, among other things, that the work-related personal data on his phone was data that could identify him as an individual and therefore the HSE was a data controller.

He claimed the DPC acted outside its powers and that the approach it adopted to his complaint was unreasonable.

The DPC opposed his challenge as did the HSE, which was a notice party.

The High Court, in April last year, dismissed his case and he appealed.

He argued in the appeal that the High Court erred in law and fact in certain findings. The DPC opposed the appeal.

On Friday, the Court of Appeal (CoA) rejected his case.

Judge Charles Meenan, dismissing the appeal, said Mr McShane had, as part of his appeal, broadened his attack on the DPC by suggesting his complaint had not been adequately investigated.

He argued the DPC had a duty to look behind the complaint and had this been done,it would have led the complaint to be broadened to include work related data.

Judge Meenan said there were fundamental problems with this submission including that it was up to Mr McShane to formulate his own complaint and it was not for the DPC to investigate matters that were not the subject of the complaint.

Were it to be so, there would be an obvious unfairness to the HSE in that it would be required to defend a complaint that was never made, he said.

The judge was satisfied that he had identified no infirmity in the decision of the High Court.