PCI fails to justify sharing data on former church elder

The Data Protection Commission (DPC) has upheld two complaints against the Presbyterian Church in Ireland (PCI) for sharing sensitive personal data on former church elder Steven Smyrl. Smyrl was dismissed as an elder in 2019 after coming out as gay. The DPC ruled that PCI failed to provide a lawful reason for using or sharing Smyrl's personal information, including details about his sexual orientation, on two separate occasions.

The information was obtained during an internal Church disciplinary process and was intended to remain confidential. The first incident occurred in December 2019 when four ministers attempted to launch a separate investigation against Christ Church Sandymount due to their support for Smyrl. They appealed to PCI's Judicial Commission, during which one of the ministers quoted directly from the confidential support letter containing Smyrl's sensitive information.

The second incident happened in September 2021 when a Church inquiry described Smyrl and his spouse as "sexually immoral people," which the couple found defamatory. A draft letter retracting the description was made available to approximately 30 ministers and elders, including Christ Church Sandymount, causing harm to Smyrl. The DPC found PCI had not demonstrated a lawful reason for using the information in these two incidents.