‘Mere Upset’ Not Enough for GDPR Payout, Irish Court Rules

Irish Court Reinforces High Bar for Data Breach Compensation Claims

In a ruling that provides further clarity on the evolving landscape of data protection litigation, the Irish Circuit Court has once again affirmed that a data breach, in itself, is not a golden ticket to compensation. The judgment in the case of *Walsh v Irish Prison Service*, delivered in December 2025, solidifies a crucial legal principle: claimants must demonstrate tangible harm that extends beyond “mere upset” to be awarded damages under the General Data Protection Regulation (GDPR).

The decision, handed down by Her Honour Judge Karen Fergus, saw a prison officer’s claim for non-material damages dismissed, despite the Irish Prison Service admitting a breach had occurred. The court found that the plaintiff failed to provide sufficient evidence of genuine distress, leaning heavily on the precedent set by the 2023 landmark case, *Kaminski v Ballymaguire Foods*. This latest judgment sends a clear signal to potential litigants and organisations alike: the judiciary is committed to preventing a floodgate of claims based on minor anxiety or annoyance, demanding instead a demonstrable and causal link between a data infringement and actual harm suffered.

The Accidental Email at the Centre of the Dispute

The case originated from a simple, yet significant, human error. The plaintiff, a Prison Officer, had interviewed for a promotion to the role of Chief Officer in November 2018. Following the interview process, he was placed 17th on the resulting panel. A standard administrative follow-up, involving an email containing a cover letter and his detailed scoring sheet, was intended for him. However, the email was inadvertently sent to another Prison Officer who happened to share the same name.

On 28 December 2018, the unintended recipient contacted the plaintiff to inform him of the error, bringing the breach to light. The documents contained sensitive personal data relating to his professional performance and career aspirations. The plaintiff, who had kept his application for the promotion confidential, immediately raised the issue with the Assistant Governor, triggering an internal investigation. The organisation’s Data Protection Administrator promptly apologised and gave assurances that preventative measures would be implemented within the HR Directorate to avoid a recurrence. Further steps were taken in April 2019, when the recipient was formally instructed to delete the email and confirm it had not been shared.

Allegations of Distress Versus a Lack of Evidence

In court, the plaintiff contended that the breach had caused him significant emotional and psychological distress. He gave evidence that he suffered from anxiety and disturbed sleep for approximately a year following the incident. He claimed that, having been unsuccessful in previous promotion attempts, the exposure of his application and performance scores led to him being subjected to “taunts” from unidentified colleagues. Furthermore, he expressed dissatisfaction with the apology he received, arguing it did not originate from a sufficiently senior figure within the Irish Prison Service to be considered adequate.

However, the defence, led by Mark Finan BL, systematically dismantled these claims by highlighting a critical lack of corroborating evidence. It was put to the plaintiff that he had never identified the specific individuals who had allegedly taunted him, nor had he availed himself of the established workplace procedures for dealing with bullying and harassment. Crucially, his claim of anxiety and sleep disturbance was not supported by any medical evidence, such as a doctor’s report or a record of treatment. The defence also pointed out that the plaintiff had not missed any time from work as a result of the alleged distress. They argued that the plaintiff’s experience, while regrettable, amounted to nothing more than annoyance, embarrassment, and upset. This argument was bolstered by the fact that the plaintiff successfully secured the position of Chief Officer just nine months after the breach occurred, suggesting no lasting professional detriment.

The Kaminski Doctrine: A Judicial Framework for GDPR Claims

The court’s approach was explicitly guided by the principles established in the seminal 2023 case, *Kaminski v Ballymaguire Foods*. That judgment, delivered by Judge John O’Connor, created a clear three-part test for assessing claims for non-material damage under GDPR and the Data Protection Act 2018. This framework has become the cornerstone of Irish data protection jurisprudence.

The test asks three sequential questions: 1. Was there a data breach constituting unlawful processing? 2. If so, did the claimant suffer damage that went beyond mere upset or displeasure? 3. If so, what level of compensation is appropriate?

The *Kaminski* ruling established several key tenets. It clarified that a mere violation of GDPR, while unlawful, does not automatically entitle a person to compensation. While there is no minimum threshold of seriousness for a claim to be considered, the harm must be genuine and proven. The court explicitly stated that “mere upset, annoyance or anxiety” does not meet this standard. There must be a clear causal link between the data breach and the damage claimed, and this damage cannot be speculative. The judgment also noted that mitigating factors, such as a prompt and sincere apology from the data controller, could be considered when assessing the situation.

The Verdict: Breach Admitted, but No Harm Proven

In applying this framework, Judge Fergus acknowledged that a data breach had undoubtedly occurred, a fact the Irish Prison Service had admitted from the outset. She also accepted that the incident likely caused the plaintiff some degree of discomfort and embarrassment in his workplace. However, the pivotal issue was whether this discomfort crossed the threshold from “mere upset” into legally recognisable non-material damage. On this point, the court was not satisfied.

Judge Fergus found the plaintiff’s description of his suffering to be “almost identical” to the claims dismissed in the *Kaminski* case. The absence of medical evidence or any other objective proof of significant harm was fatal to his claim. The court also looked favourably upon the defendant’s response to the breach. The apology, issued within three weeks, was deemed “fulsome” and appropriate. It acknowledged the error, apologised for any delay, and provided concrete assurances for the future. The subsequent actions to have the email deleted were seen as a reasonable and timely effort to mitigate the breach’s impact. Consequently, the plaintiff’s claim was dismissed in its entirety.

Implications for the Future of Data Protection Litigation

The *Walsh* decision serves as a powerful reinforcement of the judicial direction set by *Kaminski*. It provides much-needed certainty for organisations, insurers, and legal professionals navigating the complexities of GDPR. The key takeaway is that the evidentiary burden on claimants is substantial. Individuals seeking compensation for non-material damage must be prepared to present concrete proof of genuine harm directly caused by the data breach. Subjective feelings of distress, without objective evidence, will not suffice.

For organisations, the case provides a clear playbook for effective incident response. The court’s positive assessment of the Irish Prison Service’s actions underscores the critical importance of a swift, transparent, and empathetic approach. A timely acknowledgement of the breach, a sincere apology, and demonstrable steps to contain the damage and prevent future incidents can be a decisive factor in defending against a claim or mitigating potential damages. This ruling highlights that how an organisation behaves after a breach can be just as important as the breach itself. It moves the focus from a punitive stance to one that encourages responsible data stewardship and effective remediation.