Irish Life Assurance – Court Ruling (Ireland, 2025)

The data subject took out a life insurance policy with the controller, an insurance company. Between 2008 and 2020, a few letters containing the data subject’s personal and financial data were mistakenly sent to a third party. In June 2021, the data subject took proceedings to the court of first instance (Circuit Court) claiming that the controller acted negligently and in breach of duty, causing the data subject “distress, upset, anxiety, inconvenience, loss and damage”. The data subject sought a declaration that that the controller violated the GDPR, implemented by Data Protection Act 2018, and the Data Protection Acts of 1988 and 2003, and further sought damages for negligence and breach of duty. However, the court of first instance dismissed the case on the grounds that the data subject had not obtained authorisation from the Personal Injuries Assessment Board (PIAB), an independent body which was set up to make personal injuries claims faster and cheaper. (In most personal injury claims in Ireland, it is required to obtain an authorisation from the PIAB, before taking a claim to court.) The data subject appealed the decision before the court of appeal (High Court), limiting his claim to data breaches that allegedly occurred after the implementation of the GDPR in 2018. He also contended that his claim was not an action for personal injuries as that term is used in the [https://www.irishstatutebook.ie/eli/2003/act/46/section/12/enacted/en/html section 12 of the Personal Injury Assessment Board Act 2003] (the 2003 Act). Instead, it was a claim for non-material damages under the GDPR. The High Court upheld the Circuit court's decision that the PIAB authorisation should have been obtained first and ruled that the action should be dismissed. However, the data subject was granted leave to appeal to the Supreme Court regarding the question of whether a claim for damages for “distress, upset and anxiety” arising from an alleged data breach, falls within the statutory definition of “personal injury” in the 2003 Act and consequently requires a PIAB authorisation. The Supreme Court, after assessing the statutory and common law definitions of “personal injury”, found that the data subject’s claim was wrongly characterised as such. It held that only claims for damages characterised as medically recognised psychiatric injuries constitute personal injuries under the 2003 Act and have to go through the PIAB authorisation process. The Supreme Court held that claims based on mental distress, upset and anxiety should fall under [https://www.irishstatutebook.ie/eli/2018/act/7/section/117/enacted/en/html#:~:text=(1)%20Subject%20to%20subsection%20(,his%20or%20her%20personal%20data section 117 of the Data Protection Act 2018], allowing data subjects to take claims in tort when their GDPR rights have been breached. Nevertheless he noted that they are expected to be compensated very modestly. Therefore, as the classifications of the Circuit and High Court were wrong, the Justice allowed the appeal.