The Supreme Court has allowed an appeal by Patrick Dillon, ruling that a claim for distress, upset, anxiety and inconvenience after an alleged data breach did not require prior authorisation from the Personal Injuries Assessment Board (PIAB).
Dillon held a life assurance policy with Irish Life Assurance plc. Six letters concerning the policy, sent between May 2008 and May 2020, were mistakenly issued to a third party and contained his personal and financial data. He began Circuit Court proceedings in June 2021, seeking a declaration of data protection breaches and damages. He said the alleged breaches caused distress, upset, anxiety and inconvenience. On appeal to the High Court, he limited the claim to alleged breaches after the GDPR took effect on 25 May 2018.
The Circuit Court dismissed the proceedings in May 2022, accepting Irish Life’s argument that the claim concerned personal injury and required PIAB authorisation. The High Court dismissed Dillon’s appeal and affirmed that order. The Supreme Court considered whether distress and similar effects, without a recognised psychiatric disorder, fell within the statutory meaning of personal injury for the PIAB regime.
In a judgment delivered by Justice Brian Murray on 24 July 2025, the Court concluded they did not. It said claims for emotional effects short of a recognised psychiatric disorder are outside the PIAB regime, even though compensation for non-material damage may be available under the data protection legislation. The Court held that a medically recognised psychiatric injury alleged to result from a data protection breach would be a personal injury claim requiring PIAB authorisation.
The judgment also distinguished Dillon’s negligence claim from his data protection claim. It said distress alone, without a psychiatric injury, cannot support a negligence claim because the required legally recognisable damage is absent. The Court described the claim as one for non-material damage under section 117 of the Data Protection Act 2018 and said it would be clearer for future claims relying only on that provision to be pleaded on that basis.
The appeal was allowed. The Court held that PIAB authorisation was not a precondition to instituting Dillon’s distress-only claim. It said the other questions canvassed at the hearing did not arise. The judgment noted that awards for claims solely involving distress, upset and anxiety could be very modest; it did not determine the amount of any compensation.