The High Court has ruled that a woman’s claim against the Central Statistics Office over the disclosure of her employment tax documents required prior authorisation from the Personal Injuries Assessment Board (PIAB). The court allowed the Office’s preliminary objection, but left the formulation of final orders, including costs, for a later hearing.
The case concerns the Office’s erroneous disclosure of the woman’s P45 documents to third parties in November 2017. She had worked as a census enumerator for the Office in 2016. The judgment said about 3,000 data subjects were affected by the broader disclosure.
The woman’s 2019 proceedings alleged breach of contract, negligence, breach of statutory duty, breach of confidence, privacy rights and data protection rights. She sought disclosure of the recipient’s identity and damages. Although the claim did not expressly seek personal injury damages, her pleadings described stress, anxiety, sleep and appetite problems, and a worsening of her psoriatic arthritis. In replies to particulars, she said she would seek damages for stress and anxiety.
The Circuit Court decided the preliminary issue in June 2023, holding that PIAB authorisation was required. It found the proceedings remained extant, but that the personal injury damages claim could not proceed without authorisation. The woman appealed to the High Court.
Delivering judgment on 17 January 2024, Mr Justice Barry O’Donnell said the Personal Injuries Assessment Board Act 2003 turns on the remedies sought and the damage pleaded, rather than simply the labels attached to a claim. “Personal injury” under the relevant legislation includes any impairment of physical or mental condition. The judge concluded that the only specific damage pleaded was stress, anxiety and an exacerbation of arthritis, and that these amounted to claimed personal injuries.
The woman argued that the case was a data protection compensation claim and that her symptoms did not amount to a recognisable psychiatric injury warranting damages. The judge rejected those arguments. He said the statutory definition was not limited to impairments that would currently attract damages, and that the pleaded claims under the Data Protection Act 1988 still required proof of damage to recover compensation.
The High Court held that the woman was required to apply to PIAB before starting the proceedings. It allowed the preliminary objection, meaning the claims could not proceed in their current form without the required authorisation. The judgment did not determine the underlying data breach allegations or make a final order on costs. The court listed the matter for 1 February 2024 to address final orders and invited the parties to try to agree their terms.