Supreme Court Ruling: Data Protection Distress Claims

Introduction

The recent decision of the Supreme Court in Dillon v Irish Life Assurance PLC is of particular relevance to those who have endured emotional distress as a result of breaches of their data protection rights, and specifically considers the need (or lack thereof) to obtain authorisation from the Injuries Resolution Board (formerly the Personal Injuries Assessment Board) in advance of bringing proceedings.

Data Breaches

The case pertained to numerous data breaches which had allegedly been committed by the Defendant over several years. The Plaintiff claimed that these breaches resulted in him suffering emotional distress, upset and anxiety, and, therefore, he sought non-material damages. However, the Defendant was ultimately successful in both the Circuit Court and High Court, such that it was deemed that as the Plaintiff had suffered a personal injury as a consequence of these breaches, and as he had failed to obtain prior authorisation from the Injuries Board, his case failed.

However, the Plaintiff appealed the decision of the High Court to the Supreme Court on grounds of general public importance.

Supreme Court Decision

Significantly, the Supreme Court held that as the Plaintiff’s claim did not relate to a medically recognised psychiatric illness, it could therefore not be considered a personal injury. As such, no prior authorisation was required from the Injuries Board. Notwithstanding this, it was held that the distress suffered must go beyond mere frustration, as would be expected in such circumstances.

Medical Report Required

Furthermore, the Supreme Court emphasised that where a claimant has suffered a recognised psychiatric illness as a result of the breach, he or she will be required to obtain authorisation in advance of instituting proceedings. As such, the claimant will be required to produce a medical report to substantiate the claim.

Personal Injuries Summons

Once the claim has been approved by the Injuries Board, a personal injuries summons must be issued seeking damages for the injury suffered. The Court affirmed that plaintiffs must further ensure to correctly identify their claims (such that it is one for non-material damages pursuant to section 117 of the Data Protection Act 2018) so as to provide clarity for all concerned.

Conclusion

In conclusion, this decision confirms that claimants who have suffered purely emotional distress as a result of a data breach will not be required to obtain approval from the Injuries Resolution Board before bringing proceedings.

While this will serve to facilitate faster and more efficient litigation (and consequently reduce legal costs), the Supreme Court emphasised that any award for claims of this nature will be considerably modest. 

Further Information

For expert legal advice, please contact Ciarán Leavy, Partner or Rory Knight, Solicitor in our award-winning Litigation & Dispute Resolution Team.