Thomas O'Dwyer and Sinead Grace

This was an appeal from a Circuit Court decision where the key issue was whether a plaintiff who pleads stress/anxiety because of a data breach should have made an application to the Personal Injuries Resolution Board (PIRB) before commencing proceedings.

Facts

The plaintiff was employed as a census enumerator in 2016. The defendant processed the plaintiff’s sensitive personal data for employment purposes including data relating to salary and tax.

In 2017 the defendant erroneously disclosed the plaintiff’s P45 documents to third parties as part of a broader disclosure. The plaintiff commenced proceedings by way of civil bill claiming the defendant acted in breach of contract allegedly breaching her privacy rights, her right of confidence and her data protection rights. She also alleged negligence and breach of statutory duty.

The principal reliefs claimed were an order directing the defendant to disclose the identity of the third party to whom the data was disclosed and damages for breach of confidence, breach of privacy rights and breach of data protection rights. There was no claim for damages for breach of contract and no claim of damages for personal injury.

Notwithstanding this, the plaintiff placed considerable emphasis on the severe anxiety and distress she suffered due to the actions of the defendant in disclosing her personal data. In replies to particulars, the plaintiff confirmed that she would be seeking damages for the stress and anxiety caused as a result of the data breach. She referenced appetite loss, sleep disruption and an exacerbation of psoriatic arthritis.

In the civil bill, the plaintiff asserted that the defendant breached the duty of care provided for in section 7 of the Data Protection Act 1998. She referred to the decision of Feeney J in Collins v FBD Insurance [2013] IEHC 137 and claimed it was authority for the proposition that to obtain compensation for a breach of section 7 duty of care it was necessary for the claimant to establish there had been a breach, that there had been damage, and the breach caused the damage.

McAleese J in the Circuit Court found that the plaintiff’s claim was a civil one within the meaning of section 3 (d) of the Act and accordingly should have applied to PIRB for an assessment of the claim pursuant to section 11 of the Act but had not done so. Accordingly, the proceedings remained extant, but the principal remedy sought (damages for personal injury) was bound to fail by reason of non-compliance with the Act.

The High Court appeal

The High Court considered the nature of the plaintiff’s case and the relevant provisions of the Act. The court found that the Act applies to civil actions intended to be pursued for the purpose of recovering damages, in respect of a wrong, for personal injuries or both personal injuries and damage to property but does not include actions where it is bona fide intended to claim damages or other relief in respect of any other cause of action.

The court also found that the Personal Injuries Assessment Board Act 2003 adopts the definitions of “wrong” and “personal injury” from the Civil Liability Act 1961, which are broad and inclusive concepts that capture most causes of action and impairments of physical or mental conditions.

The only loss and damage expressly pleaded by the plaintiff in her civil bill are all impairments of her physical or mental condition and thus firmly captured by the definition of “personal injury” in the Act (adopting the definition from the Act of 1961). The defendant argued that, as found by Judge McAleese, none of the exceptions in section 4 of the Act are applicable.

In summary, O’Donnell J found that the plaintiff should have made an application to PIRB before commencing the proceedings.

Takeaways

Where a similar factual matrix arises respondents/defendants should be alert to the need for PIRB referral prior to the issue of personal injury proceedings.

• Thomas O’Dwyer is a partner and Sinead Grace is a knowledge lawyer at Beauchamps.