On 24 July 2025, the Supreme Court delivered its highly anticipated judgment in Dillon v Irish Life Assurance PLC [2025] IESC 37. It overturned the High Court decision, holding that non-material loss claims in respect of distress, upset, anxiety and inconvenience are not in the nature of personal injuries and therefore do not require authorisation from the Injuries Resolution Board prior to commencing proceedings.
This decision is a significant one for controllers and processors faced with non-material loss claims under the GDPR and Data Protection Act 2018, removing what was previously a procedural hurdle for plaintiffs, and making it more straight-forward to now bring such claims. Its ramifications are also potentially significant in the context of Ireland’s collective redress scheme.
Background
The Plaintiff, Mr Dillon alleged that the Defendant, Irish Life had, on several occasions, sent correspondence containing his personal and financial data to a third party in error. As a result, he brought a claim in the Circuit Court seeking damages in respect of distress, upset, anxiety and inconvenience arising from these alleged infringements of the GDPR.
The Circuit Court, and subsequently the High Court on appeal, found that the claims made by the Plaintiff constituted claims for personal injuries within the meaning of the Civil Liability Act 1961 and as such an authorisation from the Injuries Resolution Board (previously the Personal Injuries Assessment Board (“PIAB”)) ought to have been obtained before they were instituted. The Plaintiff had sought to distinguish that his claim was one for non-material damages pursuant to the GDPR, rather than a personal injuries action. The Defendant brought an application to dismiss the proceedings on the basis that PIAB authorisation had not been obtained and as a result, the proceedings were frivolous, vexatious or bound to fail. See our previous article on the High Court decision here.
The Supreme Court’s Decision
The Plaintiff was granted leave to appeal to the Supreme Court, on the basis that the question of whether a claim for non-material damages for “distress, upset and anxiety” could be regarded as a personal injuries claim was a matter of general public importance.
The Plaintiff argued that the phrase “personal injury” as it appears in the Personal Injuries Assessment Board Act 2003 (the “2003 Act”) refers only to an impairment of a person’s physical or mental condition, which does not include distress, anxiety and upset. The Defendant on the other hand argued that the term “personal injury” includes an emotional disturbance such as distress or upset and that, accordingly, the proceedings instituted by the Plaintiff should not have been commenced without PIAB authorisation.
The Supreme Court upheld the Plaintiff’s appeal. Delivering judgment, Murray J held, inter alia, that:
- A claim seeking compensation only for emotional disturbances such as distress, upset, anxiety, worry, fear, and inconvenience and not for a recognised psychiatric illness is not a claim for “personal injury” within the meaning of the 2003 Act.
- Although claims solely for mental distress, upset and anxiety fall outside the PIAB regime, they will attract only “very, very modest awards”.
- In cases in which plaintiffs allege that an infringement of their rights under the Data Protection Act 2018 have given rise to a medically recognised psychiatric injury, plaintiffs will have to go through the PIAB authorisation process.
One point of note for practitioners is the Supreme Court’s comment that, whilst the Plaintiff in this case could not be faulted for describing his non-material damage claim as a breach of statutory duty, in future it would be clearer if such claims are pleaded as claims under section 117 of the Data Protection Act 2018.
Murray J. emphasised that “it is first and foremost the responsibility of the plaintiff to plead and properly identify the type of loss for which they seek compensation and the precise legal basis on which they do so”.
Impact
This decision removes a procedural hurdle that plaintiffs previously had to overcome to bring non-material loss claims under data protection laws. In practice, this will make it more straightforward to advance such claims. This is also potentially significant as the removal of this procedural hurdle increases the prospect of there being collective actions in respect of similar non-material loss claims in the future.
Matheson LLP are currently advising on the first collective action to be launched in Ireland following the commencement of the Representative Actions for the Protection of Collective Interests of Consumers Act 2023 in April 2024, and the expectation is that these actions will only increase.
It’s not all bad news however! The decision will be welcomed by organisations in other respects. In particular, the Court has clearly signalled that claims for “distress, upset and anxiety” for data breaches will attract only “very, very modest” awards.
Our Digital Economy Group regularly advises clients across all industry sectors in respect of contentious and non-contentious data protection matters, including material and non-material loss claims. If you have any queries on this decision, or if you would like to discuss how it may affect your organisation’s approach to defending data breach claims, please do not hesitate to contact us.
Contact Us
For more information, please contact Technology and Innovation partner, Davinia Brennan, Disputes and Investigations partner, Connor Cassidy or any member of our Digital Economy Group or your usual Matheson contact.