Judgment: 2023-11-07 · Court archive

Court awards €7,500 over disclosure of sensitive childhood abuse records

The Circuit Court found that a Child and Family Agency data breach caused serious distress and damage to a woman’s family relationships.

Dublin Circuit Civil Court, County of the City of Dublin · [2023] IECC 11

Who, what, where, when and why

Who
  • The Child and Family Agency (Defendant)
  • Jennifer O’Brien
What

The Circuit Court found that a Child and Family Agency data breach caused serious distress and damage to a woman’s family relationships.

Where

Places mentioned in the report

  • Dublin
When

Judgment:

Why

Reasons reported in the judgment

Judge Jennifer O’Brien said the case involved more than a mere breach of data protection rules or ordinary upset. She found that highly private information had been handled unsatisfactorily in a way likely to cause harm, and that the woman had been retraumatised. The judge was satisfied that the damage was genuine and linked to the breach, particularly in light of the evidence about family relationships. She said medical evidence was not required in this instance.

The Dublin Circuit Civil Court has awarded €7,500 in damages to a woman whose sensitive personal information about abuse she suffered in childhood was disclosed by the Child and Family Agency to her now deceased brother. The court also ordered costs in her favour, including reserved costs and discovery costs, to be taxed if not agreed.

The ordinary civil bill was issued on 28 June 2021. The woman claimed that the Agency had breached its duties by processing or circulating her personal data. The Agency accepted that a breach occurred and that sensitive information was released to her brother. The judgment says the information included a detailed attendance note that should not have been provided to the person who was the subject of the allegations.

The woman testified that the note was copied to her remaining siblings and to her brother’s wife. She said the disclosure damaged her relationship with her sister and other siblings, caused further upset and distress, and undermined her ability to trust others. She also told the court she was in long-term treatment for mental health difficulties.

Judge Jennifer O’Brien said the case involved more than a mere breach of data protection rules or ordinary upset. She found that highly private information had been handled unsatisfactorily in a way likely to cause harm, and that the woman had been retraumatised. The judge was satisfied that the damage was genuine and linked to the breach, particularly in light of the evidence about family relationships. She said medical evidence was not required in this instance.

The judge noted that she had heard no evidence about steps taken by the Agency to minimise the damage. An apology had been issued some months after the breach. Although non-material damages would generally be modest, she assessed the harm in this case as serious and awarded €7,500.

In setting that amount, the court emphasised the high level of trust placed in the Agency by someone reporting childhood abuse and the Agency’s responsibility to handle such information with the utmost care. The decision was delivered ex tempore on 7 November 2023.

Read the original court judgment

Something looks wrong?

Highlight the relevant passage or flag this article for review. Review requests do not immediately change the report.

Email a correction request

Request a review