[2025] IESC 37
O'Donnell C.J.
Dunne J.
Hogan J.
Murray J.
Collins J.
Supreme Court Appeal Number: S:AP:IE:2024:000055
AN CHÚIRT UACHTARACH
THE SUPREME COURT
Torts – Damages – Emotional disturbances – Appellant seeking damages for distress, upset, anxiety, and inconvenience – Whether the claims advanced by the plaintiff could have been properly commenced without a Personal Injuries Assessment Board authorisation
Facts: The plaintiff/appellant, Mr Dillon, claimed damages for distress, upset, anxiety, and inconvenience consequent upon an alleged breach by the defendant/respondent, Irish Life Assurance plc, of his rights as protected by various iterations of data protection legislation. He did not obtain an authorisation from the Personal Injuries Assessment Board (PIAB) before commencing the case. The Circuit Court, and the High Court on appeal, found that the proceedings sought damages for ‘personal injury’, that an authorisation from PIAB ought to have been obtained before they were instituted and that the action should be dismissed in consequence as being frivolous, vexatious or bound to fail. In the appeal to the Supreme Court against the decision of the High Court, the plaintiff said that the phrase ‘personal injury’ as it appears in the Personal Injuries Assessment Board Act 2003 refers only to an impairment of a person’s physical or mental condition, that this does not include the distress, anxiety and upset for which he sought compensation in this case and, therefore, his action was not one to recover damages for personal injury as that phrase is used in the 2003 Act. The defendant said that the term ‘personal injury’ includes an emotional disturbance such as distress or upset and that, accordingly, the claims advanced by the plaintiff could not have been properly commenced without a PIAB authorisation. The defendant also said - for the same essential reason - that the proceedings ought to have been commenced by Personal Injuries Civil Bill (they were instituted by means of an Equity Civil Bill).
Held by Murray J that a freestanding claim in tort or contract seeking to recover damages for emotional disturbances such as anxiety, distress, worry, fear, inconvenience and upset that fall short of a recognised psychiatric disorder is not a personal injury claim within the meaning of the 2003 Act. Murray J held that any other construction would assume that the Oireachtas intended the phrase ‘personal injury’ to deviate from its normal usage by the legal profession, that it imposed a requirement for authorisation by PIAB in respect of claims for damages for negligence that could not in law be sustained, and that it imposed on PIAB the burden of assessing categories of tort or contract actions that were in no sense within the contemplation of that legislation. As this was a claim only for damages for distress, upset, anxiety and inconvenience that fell short of a recognised psychiatric disorder, Murray J held that an authorisation from PIAB was not required as a precondition to instituting proceedings. Murray J held that the other questions canvassed in the course of the hearing did not, therefore, arise.
Murray J held that the appeal should be allowed.
Appeal allowed.
JUDGMENT OF Mr. Justice Brian Murray delivered this 24 rd day of July 2025
. Section 12 of the Personal Injuries Assessment Board Act 2003 (‘ the 2003 Act’), requires that a party proposing to bring proceedings to recover damages for ‘ personal injury’ obtain an authorisation from the Personal Injuries Assessment Board (‘ PIAB’) 1 before instituting such an action. In this case, the plaintiff claims damages for distress, upset, anxiety, and inconvenience consequent upon an alleged breach by the defendant of his rights as protected by various iterations of data protection legislation. He did not obtain an authorisation from PIAB before commencing the case. The Circuit Court, and the High Court on appeal, found that the proceedings sought damages for ‘ personal injury’, that an authorisation from PIAB
ought to have been obtained before they were instituted and that the action should be dismissed in consequence as being frivolous, vexatious or bound to fail. In this appeal against the decision of the High Court, the plaintiff says that the phrase ‘ personal injury’ as it appears in the 2003 Act refers only to an impairment of a person's physical or mental condition, that this does not include the distress, anxiety and upset for which he seeks compensation in this case and, therefore, his action is not one to recover damages for personal injury as that phrase is used in the 2003 Act. The defendant says that the term ‘ personal injury’ includes an emotional disturbance such as distress or upset and that, accordingly, the claims advanced by the plaintiff could not have been properly commenced without a PIAB authorisation. The defendant also says – for the same essential reason – that the proceedings ought to have been commenced by Personal Injuries Civil Bill (they were instituted by means of an Equity Civil Bill).
. The facts are simple and, for present purposes, not in dispute. The plaintiff held a life assurance policy with the defendant. At various points between May 2008 and May 2020 six letters in relation to that policy were issued in error by the defendant and sent to a third party. Those letters contained personal and financial data of the plaintiff. In June 2021, the plaintiff issued these proceedings in the Circuit Court. It was his case that those events gave rise to data breaches, and that those breaches were caused by negligence and breach of duty, including breach of statutory duty, on the part of the defendant, thereby causing him “ distress, upset, anxiety, inconvenience, loss and damage”. On account of the time period over which the breaches were alleged to have occurred, the plaintiff relied on the provisions of both the Data Protection Acts 1988 and 2003, and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (‘ the GDPR’). The GDPR is implemented by the Data Protection Act 2018 (‘ the Act of 2018’).
. In the Circuit Court, the plaintiff sought (i) a declaration that the defendant had breached the Data Protection Acts 1988 and 2003 and/or the GDPR and (ii) damages for negligence and breach of duty, including statutory duty. In response to a Notice for Particulars served by the defendant on 26 October 2021, the plaintiff confirmed that the alleged “ inconvenience, loss and damage” did not consist of or include anything beyond or additional to the “ distress, upset and anxiety” that was pleaded, nor was he claiming special damages at that stage.
. Article 79 of the GDPR provides that a data subject is entitled to an effective judicial remedy, as against a controller or processor, where his or her rights under the Regulation have been infringed as a result of the processing of his or her data in non-compliance with the Regulation. Article 82(1) provides for a right to compensation in such instances:
“ Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.”
. It is clear that the right to compensation will not arise simply because there has been an infringement of the GDPR: ‘ such an infringement cannot, in itself, constitute ‘non-material damage’ within the meaning of that regulation’ (Case C-741/21 GP v. juris Gmbh Case at para. 37). However, the provision does include a right to compensation where the claimant has suffered ‘ no harm other than those adverse emotional effects of a temporary nature’ (Case C-300/21 UI v. Österreichische Post AG at para. 12). This includes ‘ the fear experienced by a data subject with regard to a possible misuse of his or her personal data by third parties as a result of an infringement of that regulation’ (Case C-340/21 VB v. Natsionalna agentsia za prihodite at para. 86).
. The State has given effect to the right to compensation under EU law by means of s. 117 of the Data Protection Act 2018 (‘ the 2018 Act’), the relevant provisions of which are as follows:
“ (1) Subject to subsection (9), and without prejudice to any other remedy available to him or her, including his or her right to lodge a complaint, a data subject may, where he or she considers that his or her rights under a relevant enactment have been infringed as a result of the processing of his or her personal data in a manner that fails to comply with a relevant enactment, bring an action (in this section referred to as a “data protection action”) against the controller or processor concerned.
(2) A data protection action shall be deemed, for the purposes of every enactment and rule of law, to be an action founded on tort.
…
(4) The court hearing a data protection action shall have the power to grant to the plaintiff one or more than one of the following reliefs:
(a) relief by way of injunction or declaration; or
(b) compensation for damage suffered by the plaintiff as a result of the infringement of a relevant enactment.
…
(10) In this section—
“damage” includes material and non-material damage; …”
. Obviously, the issue in this appeal depends on how the right to compensation for ‘ non-material damage’ envisaged by these provisions interacts with the requirements of the 2003 Act. Section 12 of that Act provides that unless and until an application is made to the Board for an assessment of the relevant claim under s. 11, and the...
