PCI fails to justify sharing data on former church elder

The Presbyterian Church in Ireland (PCI) has failed to justify sharing sensitive personal data about a former church elder according to the Data Protection Commission (DPC).

The DPC upheld two complaints brought by Steven Smyrl, who was dismissed as an elder in the Church in 2019 following his same-sex marriage.

The DPC concluded that Dublin and Munster Presbytery failed to demonstrate that it had a lawful reason to use or share Mr Smyrl's personal information on two separate occasions.

The information included details about Mr Smyrl's sexual orientation and private life, which had originally been supplied in confidence during an internal Church disciplinary process.

In a letter of outcome, the DPC said it was engaging with the PCI about its data protection practices.

The complaints arose following two separate incidents that involved confidential documents being submitted to a commission established by Dublin and Munster Presbytery in 2019.

The six-member Presbytery Commission was set up to examine Mr Smyrl's position following his same-sex marriage.

During the proceedings, two documents of support were submitted - one by Mr Smyrl, the other by the minister & secretary to the church council of Christ Church Sandymount.

Mr Smyrl understood that the documents would remain confidential and would be seen only by the members of the judicial commission.

However, he later discovered that information contained in them had been used in other Church proceedings, which is why he complained to the DPC.

The first complaint related to December 2019, when four ministers in the Dublin and Munster Presbytery sought to establish a separate investigation into the minister and the church council of Christ Church Sandymount, because of their support for Mr Smyrl.

When ministers' request was refused, they appealed to the Presbyterian Church's Judicial Commission - its senior internal judicial body.

During that appeals process, one of the four ministers quoted directly from the confidential letter of support which included sensitive personal information about Mr Smyrl relating to his sexual orientation.

Mr Smyrl complained to the DPC that the information was used without his permission, and it agreed that the Presbytery had failed to demonstrate a lawful reason for this.

The second complaint related to a ruling by a Church inquiry in September 2021, which described Mr Smyrl and his spouse, Roy Stanley, as "sexually immoral people".

The couple considered the description defamatory and sought its withdrawal.

A draft letter prepared by the Church's solicitors was presented to a Presbytery meeting in February 2022, with the intention of retracting the description.

However, the letter was made available to approximately 30 ministers and elders attending the Presbytery meeting and was also sent to the minister and church council of Christ Church Sandymount the following day.

Mr Smyrl complained that the letter included highly sensitive personal information.

The DPC found that the Presbytery had failed to demonstrate why the additional private information was necessary, to retract the disputed description.

The DPC letter of outcome seen by RTÉ News, concluded that the Presbytery had failed to demonstrate a lawful reason for using the information in the two incidents.

It also noted that individuals who believe they have suffered harm because an organisation mishandled their personal information may be entitled to seek compensation through the courts.

Mr Smyrl has said that he intends to seek legal advice about possible compensation for the harm he believes he has suffered.

The DPC acknowledged that considerable time had passed since Mr Smyrl first submitted his complaint and expressed regret for the time taken in the case.

It added that it was engaging with the Presbytery about its data protection practices, with a view to addressing the shortcomings identified.

Mr Smyrl told RTÉ News that finally, he felt vindicated.

In a statement, he welcomed the outcome and thanked the DPC for upholding both complaints.

He said he had provided highly personal information in confidence and was deeply disturbed to discover that it had subsequently been shared with others.

"I find it deeply disturbing that PCI appears to have little regard for the privacy and dignity of individuals. I had supplied highly personal and deeply sensitive information in confidence and was utterly taken aback to discover that it was subsequently shared with others without consent," he said.

He said they had caused considerable embarrassment and humiliation, and he criticised what he described as the Church's apparent belief that its theological position gave it permission to demean people whose lives did not conform to its doctrines.

"A church should be expected to show compassion and respect for others," he said.

"Instead, my experience has been of an institution that seems to think it can do as it pleases, regardless of the consequences or hurt it causes."

Steven Smyrl said no organisation should consider itself above the law, and no individual's privacy or dignity should be treated as expendable.

The Presbyterian Church in Ireland and the Data Protection Commission have been contacted for comment.