The Supreme Court has issued a significant judgment in Dillon v Irish Life Assurance PLC concerning alleged repeated data breaches relating to a life assurance policy held with the Defendant.
Mr Justice Murray considered whether non-material damage in the form of "distress, upset and anxiety" falls within the statutory definition of "personal injury" and consequently whether the Plaintiff was required to obtain an authorisation from the Personal Injuries Assessment Board ("PIAB") before issuing court proceedings .
The Supreme Court overturned the High Court decision and found that where a plaintiff claims solely for emotional disturbances such as mental distress, upset and anxiety, they will not fall within the PIAB regime.
Background
The Plaintiff, Mr Dillon brought proceedings in the Circuit Court seeking damages for "distress, upset, anxiety, inconvenience, loss and damage" resulting from Irish Life Assurance PLC's repeated alleged data breaches. It was alleged that, on six occasions between May 2008 and May 2020, the Defendant issued correspondence containing the Plaintiff's personal and financial information to a third-party and that these constituted data breaches pursuant to the GDPR and Data Protection Act 2018.
In the first instance, the Circuit Court, and High Court on appeal, dismissed the proceedings on the basis that they had not been preceded by a PIAB authorisation, as required for personal injury claims under Section 12 of the Personal Injuries Assessment Board Act 2003 ("PIAB Act"). Accordingly, the High Court, deemed the claim as "frivolous and vexatious and bound to fail".
Following this, Mr Dillon pursued a leapfrog appeal directly to the Supreme Court as a matter of public importance, arguing that the High Court had erred.
Key issues considered by the Supreme Court
There were two central issues considered by the Supreme Court:
- Does a claim for distress, anxiety, inconvenience or upset constitute a ''personal injury'' as it is defined under Irish Law, specifically the definitions set out in the PIAB Act and the Civil Liability Act 1961?
- Would requiring PIAB authorisation in such claims make it excessively difficult for the Plaintiff to exercise his right to compensation for non-material damage under the GDPR, in breach of Ireland's obligation to give full effect to EU law?
The Supreme Court decision
The Supreme Court overturned the decision of both the Circuit Court and High Court. As this claim related solely to a claim for damages for "emotional disturbances such as, anxiety, distress, worry, fear and inconvenience that fall short of a recognised psychiatric disorder" it was a "freestanding claim" in tort and not one requiring an authorisation from PIAB as a precondition to issuing proceedings.
Impact on legal practice
This decision brings welcome clarity to claims for non-material damage, particularly those in the data protection sphere, and it draws a clear procedural line between claims that fall within the PIAB regime and claims that do not.
Of interest to organisations who may be the subject of data protection actions is that Mr Justice Murray indicated any plaintiff who brings a claim solely for mental distress, anxiety and upset, which does not require PIAB authorisation, "cannot expect anything other than very, very modest awards".
This strongly suggests that data breach claims of this nature will generally be suitable for determination at District Court level and should not be issued in the Circuit Court.
Conclusion
This decision offers much-needed guidance for Insurers and Defendants facing claims for emotional distress arising from data breaches.
Whether you're bringing or defending a data breach claim, clear legal advice from the outset is essential. To discuss how this ruling could impact your organisation or claims handling strategy, contact our Data, Privacy & Cyber or Casualty, Motor, and Property teams.
