The Circuit Court has ruled that a woman’s claim for damages for personal injuries arising from a 2017 Central Statistics Office data breach was subject to assessment by the Personal Injuries Assessment Board (PIAB). She did not apply for an assessment, the court found, meaning her principal personal injury remedy is doomed to fail. The wider proceedings remain extant.
Judge Simon McAleese delivered the ruling on 30 June 2023, after hearing a preliminary issue at Waterford Circuit Court on 27 June. The issue was raised in the CSO’s amended defence, which argued that any personal injury claim had not been authorised by PIAB and was statute-barred if authorisation were sought later.
The plaintiff had worked as a census enumerator during Census 2016. Her Civil Bill alleges that the CSO disclosed the P45 documents of 3,000 enumerators to third parties between 10 and 14 November 2017, due to system failure, human error and inadequate security. A generic letter sent to affected people on or about 17 November acknowledged the breach and apologised, according to the judgment’s account of the pleadings.
She claimed the disclosure caused anxiety, distress, sleep problems and loss of appetite, and exacerbated her psoriatic arthritis. In answers to the CSO’s questions, she said she feared unknown third parties might take out debts or bills in her name. She also said she returned to methotrexate and attended a rheumatology clinic in or around August 2018. These are claims and particulars recorded in the judgment; the court did not decide their medical merits at this preliminary stage.
The plaintiff argued that PIAB authorisation was not required because of the nature of her claims, which included breach of confidence, privacy and data protection rights. The CSO argued that the proceedings were a civil action for personal injuries under the PIAB Act 2003. Applying principles from the Supreme Court decision in Clarke v O’Gorman, Judge McAleese concluded that the pleaded causes of action did not take the claim outside the Act where the principal remedy sought was damages for personal injuries.
The judge held that the plaintiff should have applied to PIAB under section 11. However, non-compliance did not remove the court’s jurisdiction or end the proceedings. The CSO could rely on it as a defence, and the judge said its plea on the issue was bound to prevail against the principal personal injury damages claim.
The ruling does not determine whether any other damages may be awarded for the data breach. The proceedings remain in place to that limited extent, and the judge expressed no view on any other defence the CSO might raise or whether such a defence would succeed at a hearing.