Data Breach Claims and Injuries Board Rules: High Court Ruling

A significant judgment delivered by the Irish High Court has provided vital clarification on the intersection between data protection law and personal injuries procedures. In the case of Dillon v Irish Life Assurance plc [2024] IEHC 203, decided in 2024, the court addressed whether an individual seeking compensation for emotional distress following an alleged data breach must first seek authorisation from the Injuries Resolution Board. Formerly known as the Personal Injuries Assessment Board (PIAB), this statutory body assesses personal injury actions before they can proceed to litigation. The High Court determined that even where claims are framed around data privacy legislation, alleging anxiety and distress may classify the case as a personal injury action that cannot bypass the statutory assessment process.

The dispute originated after the plaintiff, who held a life assurance policy with Irish Life Assurance plc, initiated legal proceedings against the company. The plaintiff alleged that the insurer had breached its duties by sending correspondence containing his private personal data to an unauthorised third party. Within his pleadings, the plaintiff claimed that the insurer had acted with negligence and had committed a breach of duty, including breach of statutory duty. As a direct consequence of this alleged failure, the plaintiff asserted that he had suffered distress, upset, anxiety, inconvenience, loss and damage, for which he sought financial compensation before the courts.

When the matter was initially heard before the Circuit Court, the proceedings were dismissed on procedural grounds. The Circuit Court struck out the action because the plaintiff had failed to obtain prior authorisation from PIAB as mandated by the Personal Injuries Assessment Board Act 2003. Under Irish law, plaintiffs seeking damages for personal injuries must generally submit their claim to the board for assessment before initiating court proceedings. Dissatisfied with this outcome, the plaintiff appealed the dismissal to the High Court, maintaining that his claim was fundamentally an action for non-material damage under the General Data Protection Regulation (GDPR) as incorporated into Irish law by the Data Protection Act 2018, rather than a conventional personal injury lawsuit.

Defining a Civil Action and Mental Impairment

The central question before the High Court was whether the plaintiff's claim fell within the statutory definition of a civil action under Section 4(1) of the Personal Injuries Assessment Board Act 2003. Under this section, a civil action is defined as an action in respect of a wrong, pursued to recover damages, where the damages sought are for personal injuries. To evaluate this, the court referred to the Civil Liability Act 1961, which provides the definition of a wrong. The High Court referenced established legal authority, including the Supreme Court ruling in Clarke v O'Gorman [2014] IESC 72, which affirmed that the statutory concept of a wrong carries the broadest application under Irish law.

The High Court then turned its attention to whether the specific consequences pleaded by the plaintiff constituted a personal injury. Under the 2003 Act, personal injury is defined as any disease or impairment of a person's physical or mental condition. The court carefully differentiated between the various types of harm claimed in the summons. It held that words such as inconvenience, loss and damage could not be categorised as descriptions of a personal injury. However, the court determined that terms such as anxiety and distress could, in certain circumstances, amount to an impairment of an individual's mental condition, thereby falling within the statutory definition.

The plaintiff sought to rely on the operation of the Personal Injuries Guidelines, which govern compensation levels in Ireland. These guidelines limit the recovery of damages for non-physical injuries exclusively to cases where a claimant suffers from a recognisable psychiatric illness or injury. Under the guidelines, transient emotional responses such as upset, distress, grief, disappointment and humiliation do not attract an award of compensation. However, the High Court made a critical legal distinction: the mere fact that a claimed impairment does not meet the threshold necessary to secure a financial award under the Personal Injuries Guidelines does not remove the claim from the statutory definition of a personal injury under the 2003 Act. Consequently, the proceedings still met the threshold of a civil action requiring board authorisation.

Data Protection Claims and Section 117

The plaintiff strongly contended that his case was a distinct action for non-material damage under the GDPR, as implemented in Ireland under Section 117 of the Data Protection Act 2018. The High Court observed that while the plaintiff had included a claim for breach of statutory duty that could be treated as a Section 117 claim, he had also pleaded general negligence and breach of duty. Crucially, the court established that bringing a claim for damages under Section 117 does not automatically exempt an individual from the requirement to obtain Injuries Resolution Board authorisation.

Section 117 permits an individual to recover compensation for damage suffered as a result of an infringement of data protection legislation. However, the High Court noted that if an injured party seeks a remedy under this statutory provision that amounts to damages for personal injuries arising from a wrong, the mandatory requirements of the 2003 Act continue to apply. The formal statutory vehicle relied upon by the plaintiff does not override the fundamental nature of the underlying harm being pleaded in the court documents.

In reaching its decision, the High Court examined the earlier ruling in Keane v Central Statistics Office [2024] IEHC 20. In that case, the High Court had also determined that a plaintiff was required to apply to PIAB for assessment in a claim arising from an alleged data breach. However, the court observed distinct differences between the two disputes. In Keane, the underlying cause of action had accrued prior to the GDPR coming into effect, meaning it did not involve a claim for compensation under Section 117. Furthermore, the plaintiff in Keane had alleged specific medical consequences, claiming that stress and anxiety had negatively impacted his sleep patterns, reduced his appetite, and aggravated the symptoms of his pre-existing psoriatic arthritis.

In Dillon, the plaintiff placed far less emphasis on physical or clinical consequences. Instead, he argued that the words stress and anxiety were employed merely as everyday descriptors of his emotional reaction and should not be construed in ordinary language as an impairment of his mental condition. Despite this argument, and notwithstanding the inclusion of a plea that could be treated under Section 117, the High Court concluded that the claim remained a civil action under the 2003 Act, aligning the outcome with the principle in Keane.

Key Takeaways for Data Breach Proceedings

The decision in Dillon v Irish Life Assurance plc demonstrates the extensive reach of the 2003 Act across various areas of civil litigation in Ireland. It underscores that whenever a claim encompasses complaints of distress, upset, or anxiety, it risks inadvertently falling within the remit of the Injuries Resolution Board. Claimants seeking remedies under data protection legislation must recognise that framing a complaint around Section 117 will not inherently shield the action from statutory assessment requirements if personal injury elements are included in the pleadings.

Ultimately, parties involved in data breach disputes must exercise considerable caution when formulating their claims and determining procedural pathways before the Irish courts. Please note that this article is provided solely for general information and explainer purposes, and it does not constitute formal legal advice.