Judgment: 2024-04-11 · Court archive

High Court finds data breach claim required prior PIAB authorisation

The court held that pleaded claims of distress, upset and anxiety made the proceedings a civil action under the PIAB legislation. It listed a further hearing to settle final orders and costs.

High Court · [2024] IEHC 203

Who, what, where, when and why

Who
  • Irish Life Assurance plc (Respondent)
What

The court held that pleaded claims of distress, upset and anxiety made the proceedings a civil action under the PIAB legislation. It listed a further hearing to settle final orders and costs.

Where

Places mentioned in the report

  • Dublin
When

Judgment:

Other dates in the report
  • 25 May 2018

    For the appeal, the plaintiff narrowed his claim to alleged breaches after the GDPR took effect on 25 May 2018. The judgment therefore proceeded on that basis, although no formal motion to narrow the claim had been brought. The plaintiff sought a declaration and damages for negligence and breach of duty, including statutory duty. In replies to particulars, he said he was not claiming special damages at that stage and that his alleged inconvenience, loss and damage involved nothing beyond distress, upset and anxiety.

  • 26 April 2024

    The High Court concluded that the proceedings were a civil action under the Personal Injuries Assessment Board Act 2003 and required prior PIAB authorisation. It did not make final orders in this judgment. The judge listed the matter for a hearing on 26 April 2024 to address the wording of the final orders, including costs, and invited the parties to try to agree their terms.

Why

Reasons reported in the judgment

The High Court has found that a policyholder’s proceedings against Irish Life Assurance plc required prior authorisation from the Personal Injuries Assessment Board (PIAB), because his pleaded claims included distress, upset and anxiety arising from alleged data breaches.

The High Court has found that a policyholder’s proceedings against Irish Life Assurance plc required prior authorisation from the Personal Injuries Assessment Board (PIAB), because his pleaded claims included distress, upset and anxiety arising from alleged data breaches.

Mr Justice Barry O’Donnell delivered the judgment on 11 April 2024 in an appeal from the Dublin Circuit Court. The underlying case concerns six letters about the plaintiff’s life assurance policy that he says were mistakenly sent to an unauthorised third party. The judgment records letters dated between May 2008 and May 2020.

For the appeal, the plaintiff narrowed his claim to alleged breaches after the GDPR took effect on 25 May 2018. The judgment therefore proceeded on that basis, although no formal motion to narrow the claim had been brought. The plaintiff sought a declaration and damages for negligence and breach of duty, including statutory duty. In replies to particulars, he said he was not claiming special damages at that stage and that his alleged inconvenience, loss and damage involved nothing beyond distress, upset and anxiety.

The defendant argued that the proceedings should be struck out because the plaintiff had not obtained PIAB authorisation and had not brought the case using a Personal Injuries Summons. The Circuit Court dismissed the proceedings in May 2022 as frivolous, vexatious or bound to fail. On appeal, the High Court considered whether the claim fell within the statutory definition of a civil action requiring PIAB authorisation.

The judge rejected the argument that describing the claimed harm as non-material damage under data protection law took the case outside that definition. He said a data protection action is treated by the Data Protection Act 2018 as founded on tort, and the question was whether the remedy sought included damages for personal injuries. Although inconvenience, loss and damage did not themselves describe personal injuries, he found it difficult to distinguish the pleaded distress, upset and anxiety from “worry and stress” previously treated by the Supreme Court as a form of personal injury claim.

The High Court concluded that the proceedings were a civil action under the Personal Injuries Assessment Board Act 2003 and required prior PIAB authorisation. It did not make final orders in this judgment. The judge listed the matter for a hearing on 26 April 2024 to address the wording of the final orders, including costs, and invited the parties to try to agree their terms.

Read the original court judgment

Something looks wrong?

Highlight the relevant passage or flag this article for review. Review requests do not immediately change the report.

Email a correction request

Request a review