The High Court has overturned a €15,000 Circuit Court award to Michael Collins in his data protection claim against FBD Insurance plc, ruling that compensation under section 7 of the Data Protection Acts required proof of damage caused by the breach.
The appeal was a rehearing limited to whether Mr Collins could receive general damages under section 7 without proving actual loss and, if so, the amount. The Circuit Court’s March 2012 order did not specify which claim its award addressed. On appeal, both sides proceeded on the basis that the award was for a breach of the Data Protection Acts and that no special damages had been proved.
FBD accepted the Data Protection Commissioner’s findings that it had breached the Acts. The Commissioner had found failures relating to a delayed data access response and disclosure, and to the company’s use of a private investigator, including the handling of information about an earlier criminal conviction. The judgment records that FBD acknowledged the explanation it gave for asking about a possible conviction was based on incorrect information and was, on its face, concocted.
The judge found that Mr Collins had not proved damage resulting from the admitted breaches. Although limited evidence was given about lost earnings while he was without his van, it was too imprecise to establish provable loss or link it to the data protection breaches. The van had been stolen from outside his home after a break-in and was returned in early January 2009. The judgment also records that the insurance policy did not cover other financial loss from temporary loss of the vehicle.
The court concluded that section 7 imposed a duty of care but did not provide automatic compensation or strict liability. Reading the provision alongside the European directive it implemented, the judge held that a claimant had to prove damage and show it flowed from the breach. The court therefore found Mr Collins was not entitled to damages and vacated the Circuit Court order.
The judge reserved the question of costs, saying the court would consider both FBD’s conduct during the Data Protection Commissioner’s investigations and the fact that the legal issue on the limits of section 7 damages had not been argued in the Circuit Court.