- September 11, 2024
- Posted by: Colm Hurley
- Category: News
Amy McNicholas, Solicitor CKT, examines the Supreme Court’s decision to hear an appeal regarding damages in data breach claims and specifically whether non-material damages for “distress, upset and anxiety” under the GDPR qualify as personal injury claims. The outcome of this appeal is expected to have broad implications for future GDPR – related compensation claims in Ireland.
Background
The Irish Supreme Court recently granted the Plaintiff permission to appeal a decision of the High Court in Patrick Dillon v Irish Life Assurance PLC [2022] 79 CA. The proceedings concern a claim for compensation for non-material damage arising from an alleged GDPR violation.
In its decision to allow the appeal, the Supreme Court has recognised that the following questions raise issues of public significance:
- Whether a claim for non-material damages for “distress, upset, and anxiety” under the GDPR qualifies as a “personal injury” claim under the Civil Liability Act 1961; and
- Whether a Plaintiff must therefore obtain authorisation from the Personal Injuries Assessment Board (PIAB) to pursue the claim.
The Court noted the practical importance of these issues for both litigants and courts handling data protection claims. The Supreme Court’s forthcoming decision is expected to significantly influence the way non-material damage claims are pursued in the future.
The Circuit Court Decision
In these proceedings, the Plaintiff initially filed a claim in the Dublin Circuit Court, alleging that Irish Life wrongfully disclosed his personal data to an unauthorised third party, causing “distress, upset, anxiety, inconvenience, loss, and damage.” The Plaintiff, who held a life insurance policy with Irish Life, alleged that letters containing his personal data were mistakenly sent to a third party over an extended period. The Circuit Court dismissed the case, citing the Plaintiff’s failure to obtain prior authorisation from PIAB, in accordance with the Personal Injuries Assessment Board Act 2003 (2003 Act).
The High Court Decision
In an appeal to the High Court, the Plaintiff argued that his claim was for non-material damages under the GDPR and was not a personal injury claim. The High Court upheld the Circuit Court’s decision, ruling that claims for “distress, upset, and anxiety” resulting from an alleged GDPR breach are essentially personal injury type claims which require PIAB authorisation. Mr Justice O’Donnell held that, even if such impairments do not warrant recoverable damages, they still fall within the definition of “personal injury” as set out in the Civil Liability Act 1961 and the 2003 Act.
In its decision, the High Court referenced and sought to differentiate the earlier case of Keane v Central Statistics Office [2024] IEHC 20 (a matter in which the High Court found that a claim seeking damages for anxiety and stress caused by an accidental data breach was not properly constituted due to the fact that the Plaintiff had not sought authorisation from PIAB before issuing proceedings).
The High Court also found that the requirement for PIAB authorisation before seeking damages for a GDPR infringement is consistent with EU law, noting that such cases are governed by national procedures, subject to the principles of equivalence and effectiveness.
Application for Leave to Appeal to the Supreme Court
In granting leave to appeal, the Supreme Court considered inter alia the following:
- The Court had not previously addressed the concept of “non-material damage”.
- Whether a claim for non-material damage under Article 82 of the GDPR or section 117 of the Data Protection Act 2018 falls under the 2003 Act, specifically whether a claim for “distress, upset, and anxiety” from an alleged GDPR breach constitutes a “personal injury” claim and is a matter of public importance.
- Whether distress, upset, or anxiety should be seen as a type of “personal injury”.
- Whether requiring PIAB authorisation is compatible with Article 82 of the GDPR.
- Having regard to the fact that no other avenue of appeal was available to the Plaintiff (as there is no appeal to the Court of Appeal from a High Court decision on appeal from the Circuit Court), and due to the issues raised by the Plaintiff being of general public importance, that an appeal is in the public interest.
Key Takeaways
Several recent decisions by the Court of Justice of the European Union have clarified how Article 82 of the GDPR should be interpreted concerning compensation for non-material damage. However, the situation remains to be clarified in Ireland, particularly regarding procedural requirements for certain non-material damage claims. There is a noticeable trend of plaintiffs citing distress, upset, and anxiety in cases seeking non-material damages for data protection violations.
If the Supreme Court upholds the High Court’s decision, the requirement to obtain PIAB authorisation before filing such claims will continue to be a procedural challenge for plaintiffs. This could significantly impact ongoing cases where such authorisation was not sought. However, not all non-material damage claims under Article 82 GDPR or section 117 of the Data Protection Act 2018 are framed in this way, so the broader implications of any such decision remain uncertain.
For more information on anything related to this article, please contact our Data Protection/GDPR Team