Handling of Data Breaches by the Courts

Legislation introduced by way of the Data Protection Act 2018 paved the way for individuals to claim compensation arising out of a Data Breach where there is Material Damage (e.g. a financial loss) and Non-Material Damage (e.g. upset, distress). A personal data breach is defined as a breach of security leading to the accident or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed.

Once it has been established that there was a data breach, the right for compensation may arise.

As Data breaches become an ever-increasing problem and claims become more frequent in the Irish Courts, the case law surrounding compensation and procedural rules is ever evolving.

Looking at Material Damage claims, these are generally easier to quantify and the Court jurisdiction will be determined by the amount of the loss.

For non- material damage claims, the case-law is still relatively new but certain points and trends are now emerging.

If the damage suffered is limited to embarrassment and inconvenience,  the Courts have indicated that such proceedings are more suited to the District Court where “modest” damages may be awarded. For example, in the case of Kaminski v Ballymaguire Foods Ltd [2023] IECC 5, an employee’s photo, captured through CCTV, was used in a training session without consent and an award was made of €2,000.

However, if the breach was of more significance and caused greater distress to the Plaintiff, then a higher award of damages may be expected. This happened in the case of MH v Child and Family Agency (Tusla) [2023] IECC 11. This case involved the disclosure of information relating to abuse suffered by the plaintiff during her childhood. It was accepted that a personal-data breach occurred. Given the highly sensitive nature of the personal data involved, the court classified the breach as serious. The Plaintiff gave testimony that the breach caused substantial emotional distress and that was accepted by the Court as sufficient evidence to establish damage without the need for additional medical evidence.

In that case, an award was made of €7, 500 and the Court made reference to the seriousness of breach and lack of mitigation when making the award. To date, this is the highest level of compensation award given by the Irish Courts for a data breach. The court also noted that the Defendant provided no evidence regarding the steps taken to mitigate the damage caused to the Plaintiff by the personal data breach.

In some  cases, the extent of the data breach may cause such emotional distress to render it a personal injury. It is important to note that in the case, Dillon v Irish Life Assurance PLC [2024] IEHC 203,  the Court dismissed the claim for failure to first get an Authorisation from the Injuries Resolution Board and the Court found that the distress and anxiety claimed fell under the heading “personal injury”. This case is the subject of a review by the Supreme Court.

So far, there are a few key points that we can glean from the case-law;

• It is likely that the damages, where the breach does not cause serious personal injury, will fall within the jurisdiction of the District Court
• The Court will consider what steps the Defendant took to mitigate the damage caused by the breach
• The Court may make a determination based on the Plaintiff’s evidence only and without the need for medical evidence. However, this is likely to be determined on a case by case basis.
• A injuries Board Authorisation is required where injury is being claimed

Contact us at Cantillons Solicitors at +353 (0)21 4275673 or info@cantillons.com  if you would like more information.

* In contentious business, a Solicitor may not calculate fees or other charges as a percentage or proportion of any award or settlement.  Many Personal Injury Solicitors portray themselves as “no win no fee Solicitors Cork”. This term can be misleading, and it is essential that you discuss fees with the Personal Injury Solicitor you ultimately choose. At Cantillons Solicitors, we are entirely transparent.