A Health Service Executive fire-prevention officer has lost an appeal over a refusal of the Data Protection Commission to investigate an alleged data breach connected to the use of his work phone for personal use. Eamon McShane, from Burtonport, Co Donegal, claimed he lost €1,400 in cryptocurrency as a result of the May 2021 cyberattack on the HSE computer system.He said in June/July 2021, he discovered that his personal email accounts had been hacked along with his personal cryptocurrency account and that his work mobile was the source or cause of the hack. The court heard he acknowledged that using the phone for personal emails was not an acceptable use of the device. He made a complaint to the HSE seeking compensation for his loss but was not satisfied with its response. He then made a complaint to the commission. It rejected his grievance, saying the HSE was not a “data controller”. He attempted to appeal that decision, but this was also rejected by the commission.He then brought High Court judicial proceedings seeking orders quashing the commission’s dismissal of his complaint and compelling it to investigate. He claimed, among other things, that the work-related personal data on his phone was information that could identify him as an individual and therefore the HSE was a data controller. He claimed the commission acted outside its powers and that the approach it adopted to his complaint was unreasonable. The commission opposed his challenge, as did the HSE, which was a notice party. The High Court, in April last year, dismissed his case. But he appealed.He argued in the appeal that the High Court erred in law and fact in certain findings. The commission opposed the appeal.On Friday, the Court of Appeal rejected his case.Judge Charles Meenan, dismissing it, said McShane had, as part of his appeal, broadened his attack on the commission by suggesting his complaint had not been adequately investigated. He argued the commission had a duty to look behind the complaint and that had this been done, it would have led the complaint to be broadened to include work-related data.The judge said there were fundamental problems with this submission, including that it was up to McShane to formulate his complaint and it was not for the commission to investigate matters that were not the subject of the complaint. Were it to be so, there would be an obvious unfairness to the HSE in that it would be required to defend a complaint that was never made, he said. The judge was satisfied that he had identified no infirmity in the decision of the High Court.