Newspaper publisher Mediahuis Ireland, previously known as Independent News & Media (INM), has revealed in legal documents that INM's former chief executive for Ireland, Joe Webb, and Mandy Scott, the former INM chief executive Gavin O'Reilly's executive assistant, had the contents of their email accounts over many years secretly reconstructed in a data breach at INM in 2014.
Mr Webb and Ms Scott, along with Mr O'Reilly and Karl Brophy, who was INM's director of corporate affairs, were the four people whose email accounts and private data was most closely targeted in the illegal secret data operation ordered by former INM chairman Leslie Buckley and paid for by a company connected to Denis O'Brien, who in 2014 was INM's major shareholder.
The company’s email system was also separately searched for information about the so-called INM19, a group of people with various connections to the business interests of Mr O’Brien. But only Mr Webb, Ms Scott, Mr Brophy and Mr O’Reilly had all their emails reconstructed.
In documents filed by Mediahuis Ireland in a case taken against it over the data leak by Mr Brophy and Mr O'Reilly, the company also confirms that Blaydon, an Isle of Man company connected to Mr O'Brien, is known to have paid more than €60,000 towards the data search costs. The uncovering of the data search sparked State investigations by High Court inspectors and the Data Protection Commission, as well as a slew of private legal actions by those affected.
Mediahuis's law firm, Matheson, outlines in legal documents lodged in recent weeks as part of the case that Blaydon paid an invoice of €46,260 that was submitted in December 2015 to INM by Welsh IT firm TDS. It also refers to a separate invoice of €14,944.50 that was submitted in December 2016 to Mr O'Brien's Island Capital group by DMZ Limited, a company connected to IT consultant Derek Mizak, who helped Mr Buckley with the data operation.
Data rules
In the latest legal documents, Mediahuis confirms that the backup IT tapes from which the email data was harvested were “destroyed” by the company in February 2018, six months after it became aware that the Office of the Director of Corporate Enforcement was investigating the issue. It said this happened as part of its preparation for the introduction of GDPR data rules.
Mediahuis refuses in the documents to release to Mr Brophy and Mr O'Reilly's lawyers copies of two internal reports into the data breach, which were carried out for INM by Deloitte. Mediahuis says the reports are legally privileged. The company also denies that Mr Buckley was acting on its behalf when he ordered the data search operation.
Mr Buckley, who is also being sued by Mr Brophy and Mr O’Reilly over the data search operation, has previously denied any wrongdoing related to the case.
Mediahuis has also denied that it bears responsibility for any wrongdoing and it says it awaits the report of the High Court inspectors to find out the “true purpose” of the data operation ordered by Mr Buckley and paid for by Mr O’Brien’s company.
