Do data breach claims require authorisation from Ireland’s Injuries Resolution Board?

This article was co-authored by Wayne Miley, Trainee Solicitor. 

Is it necessary to get an authorisation from Ireland’s Injuries Resolution Board (formerly PIAB) prior to issuing a claim under data protection legislation for damages for distress and anxiety caused by a data breach?

Ireland’s highest court, the Supreme Court, is set to consider this issue.

Journey to the highest court

Earlier this year, the Irish High Court struck out a claim for non-material damages, namely “distress, upset and anxiety”, arising from an accidental data breach on the basis that the plaintiff had not obtained prior authorisation from the Injuries Resolution Board, a prerequisite when bringing proceedings seeking damages for personal injuries (Dillon v Irish Life Assurance [11.04.24]).

The plaintiff had argued that he was not required to seek an authorisation from the Injuries Board as the claim was a data protection action under section 117 of the Data Protection Act 2018.

However, the High Court found that:

• The “distress, upset and anxiety” claimed to have been suffered by the plaintiff constituted a “personal injury” within the meaning of the Personal Injuries Assessment Board Act 2003;
• The plaintiff was therefore required to seek an authorisation from the Injuries Resolution Board before commencing proceedings;
• The Oireachtas (Irish Parliament) could have taken steps to disapply the 2003 Act to data protection actions brought under the EU General Data Protection Regulation (GDPR) and the Data Protection Act 2018, but it chose not to do so.

Shortly before the court’s summer vacation, the Supreme Court granted the plaintiff permission to appeal this High Court finding.

The requirement to obtain authorisation

Broadly speaking and subject to certain exceptions, the 2003 Act applies to actions intended to be pursued for the purpose of recovering damages, in respect of a wrong, for personal injuries.

Where the 2003 Act applies, a claimant must apply to the Injuries Resolution Board for an assessment of the claim before issuing court proceedings.

In a previous decision delivered shortly before the decision in Dillon, but not brought under the Data Protection Act 2018 (the DPA), the Hight Court found that:

“a claim that arising from a tort or breach of contract, a person has suffered stress or anxiety… is a claim that constitutes a civil action that requires authorisation from PIAB under the terms of the Act of 2003.” (See Claim for stress caused by data breach not properly constituted).

Issue of general public importance

The fact that the Supreme Court has agreed to hear the appeal in Dillon is significant in itself because the Supreme Court only hears appeals that raise matters of general public importance.

The issues of general public importance and of significant practical importance identified by the Court include:

• Whether a claim for “distress, upset and anxiety” (i.e. non-material or emotional damage) arising from an alleged data breach, brought under section 117 of the DPA and the EU GDPR, is to be regarded as a claim for damages for “personal injury”;
• Whether distress, upset or anxiety can be properly characterised as a form of “personal injury” or a form of harm not constituting a personal injury; and
• Whether a requirement to ger PIAB authorisation is compatible with the EU GDPR.

Watch this space

Recent years have seen an increase in claims for non-material or emotional damages arising from data breaches. The High Court decision in Dillon suggests that these claims require authorisation from the Injuries Resolution Board, even if brought under the Data Protection Act 2018. This will have impacted a number of these claims. Indeed in the application for permission to appeal, the plaintiff claimed that the decision would have a “direct impact on (at least) hundreds of other proceedings” (though the Court noted that there was no evidence to support this assertion).

Following Dillon, claimants in similar cases will have rushed to apply for authorisation from the Injuries Resolution Board and to re-issue proceedings. But the decision will have been fatal for other cases that may have faced statute issues.

As permission to appeal was only granted at the end of July, the Supreme Court appeal has not yet issued. It is difficult at this stage to predict when the appeal will be heard or a judgment delivered. But no doubt this is a case that will be watched closely by many.

 

Read other items in Personal Injury Brief – October 2024