On 24 July 2025, the Supreme Court delivered an important judgement in the case of Patrick Dillon -v- Irish Life Assurance plc [2025] IESC 37. The Court clarified that a freestanding claim in tort or contract seeking to recover damages arising from a data breach for emotional disturbances such as anxiety, distress, worry, fear, inconvenience and upset that falls short of a recognised psychiatric disorder is not a personal injury claim within the meaning of the Personal Injuries Assessment Board Act 2003.
Background
The Plaintiff in this case held a life assurance policy with the Defendant. On various dates between May 2008 and May 2020, six letters containing personal and financial data of the Plaintiff were issued in error by the Defendant to a third party.
The Plaintiff issued Circuit Court proceedings claiming that these events gave rise to data breaches and that such breaches were caused by the negligence, breach of duty, including breach of statutory duty, of the Defendant causing him to suffer distress, upset, anxiety, inconvenience, loss and damage. During the exchange of pleadings, the Plaintiff confirmed that the alleged inconvenience, loss and damage did not include anything beyond the distress, upset and anxiety that was pleaded, nor was he claiming special damages at that stage.
The Plaintiff did not obtain an authorisation from the Personal Injuries Assessment Board (PIAB) (now the Personal Injuries Resolution Board (PIRB)) before issuing his court proceedings. The Circuit Court, and the High Court on appeal, found that the proceedings sought damages for personal injury, that an authorisation from PIAB ought to have been obtained prior to the commencement of proceedings and that the action should be dismissed in consequence as being frivolous, vexatious or bound to fail.
The Law
The law provides for a right to compensation for non-material damage arising from a data breach. The relevant provisions are set out in Section 117 of the Data Protection Act 2018:
(1)Subject to subsection (9), and without prejudice to any other remedy available to him or her, including his or her right to lodge a complaint, a data subject may, where he or she considers that his or her rights under a relevant enactment have been infringed as a result of the processing of his or her personal data in a manner that fails to comply with a relevant enactment, bring an action (in this section referred to as a “data protection action”) against the controller or processor concerned.
(2) A data protection action shall be deemed, for the purposes of every enactment and rule of law, to be an action founded on tort.
(4)The court hearing a data protection action shall have the power to grant to the plaintiff one or more than one of the following reliefs:
relief by way of injunction or declaration; or
- compensation for damage suffered by the plaintiff as a result of the infringement of a relevant enactment.
(10) In this section – “damage” includes material and non-material damage;
Section 12 of the Personal Injuries Assessment Board Act 2003 prohibits court proceedings for personal injuries being issued unless certain conditions have been satisfied. One of those conditions is the issuing of an authorisation document from the PIRB, which permits a Plaintiff to progress a claim for personal injuries through the courts.
The issue on which the Supreme Court had to rule upon in this case was how the right to compensation for non-material damage pursuant to the Data Protection Act 2018 interacts with the requirements of Section 12 of the Personal Injuries Assessment Board Act 2003.
Personal Injury
The Supreme Court analysed both the statutory and common law definitions of personal injury and concluded that a plaintiff cannot obtain damages in negligence for mental distress that falls short of a psychiatric injury. It recognised that the Plaintiff’s claim in this case was for non-material damage pursuant to the unique nature of a claim enabled by S117 of the Data Protection Act 2018. The Supreme Court did acknowledge that there may well be cases in which plaintiffs allege an infringement of rights under the Data Protection Act 2018 have given rise to a recognisable psychiatric injury and that such claims will have to go through the PIRB authorisation process, but only “very, very modest awards” can be expected.
Conclusion
The decision of the Supreme Court provides clarification on the interaction of the PIRB process with claims for non-material damage arising from data breaches. The guidance on the level of award for successful claims is also most welcome with such claims only attracting very modest awards of compensation.
If you require advice on how the General Data Protection Regulation (GDPR) (EU) 2016/679 and the Data Protection Act 2018 impact your business, contact a member of our team.
*Before acting or refraining from acting on anything in this guide, legal advice should be sought from a solicitor.