knowledge 30 July 2025 |

Data Protection Actions and PIAB - the Supreme Court’s judgment in Dillon

In 2024, the High Court upheld a Circuit Court decision which found that a claim for damages for “distress, upset, anxiety, and inconvenience” under the GDPR¹ was a “personal injury” action, and therefore required the plaintiff to obtain an authorisation from the Injuries Resolution Board (formerly known as, and referred to in the relevant judgments and herein as the Personal Injuries Assessment Board (“PIAB”)) before instituting such an action. In Dillon v. Irish Life Assurance plc [2025] IESC 37, the Supreme Court, in a judgment delivered by Mr Justice Murray, in allowing an appeal against the decision of the High Court, has now determined that freestanding claims in tort or contract seeking to recover damages for emotional disturbances such as anxiety, distress, worry, fear, inconvenience and upset that fall short of a recognised psychiatric disorder are not personal injury claims within the meaning of the Personal Injuries Assessment Board Act 2003 (the “2003 Act”) and do not require authorisation. They will however attract only “very, very modest awards”.

1. Background

In Dillon, the plaintiff initially brought an action for damages against the defendant (with whom he held a life insurance policy) alleging negligence and breach of duty (including statutory duty) causing “distress, upset, anxiety, inconvenience, loss and damage” after the defendant sent letters containing the plaintiff’s personal information to the wrong address on several occasions, in breach of the GDPR.

In replying to a notice for particulars served by the defendant, the plaintiff confirmed that the loss or damage complained of did not consist of, or include anything beyond or additional to, the “distress, upset and anxiety” that was pleaded.

The defendant argued that the plaintiff’s action was one in which he sought damages for “personal injuries”, and that as a result, consequent on his failure to (a) institute proceedings by way of Personal Injuries Civil Bill, and (b) obtain PIAB authorisation prior to such institution as required under s.12 of the 2003 Act, his action should be dismissed.

The defendant was successful in the Circuit Court in having the proceedings dismissed. On appeal by the plaintiff, the High Court upheld the Circuit Court decision, determining that the action was (a) an action in respect of a “wrong” within the meaning of s.2(1) of the Civil Liabilities Act 1961 (the “1961 Act”), (b) was pursued for the purpose of recovering damages, and (c) that the damages were for “personal injuries”, thereby satisfying the constituent elements of a “civil action” under s.4(1) of the 2003 Act. It followed that the claim was a “relevant claim” for the purposes of Part 2 of the 2003 Act and therefore required PIAB authorisation.

2. Leave to Appeal to the Supreme Court and the Issues on Appeal

The Supreme Court granted the plaintiff leave to appeal the High Court decision, considering that the case raised issues of general public importance, including the compatibility of the requirement for prior PIAB authorisation with Article 82 of the GDPR², insofar as these issues are of significant practical importance for litigants and for the courts dealing with data protection claims.

The Supreme Court considered that there were two issues before it:

(i) whether non-material damage in the form of distress, upset and anxiety falls within the definition of “personal injury”; and

(ii) if so, whether a requirement to apply to PIAB would render it excessively difficult for the appellant to exercise his right to compensation for non-material damage under the GPDR, in breach of Ireland’s obligation to give full effect to EU law.

3. Consideration of the Issues by the Supreme Court

3.1 Whether distress, upset and anxiety are “personal injuries”

In considering the interpretation of the term “personal injury”, the court discerned clear legislative intent to distinguish “personal injury” on the one hand and “mental distress” on the other in the 1961 Act, including because the Act makes reference to “injury or mental distress” in terms that presume these were viewed as distinct from claims for damages for personal injury³. The court found further support for its interpretation in the fact that specific provision had been made in the Statute of Limitations (Amendment) Act 1991 for a limitation period for claims for mental distress that was separate and distinct from the limitation period applying to claims for personal injury. 

The Court found however that no legislation purported to replace the common law definition of “personal injury”, which the Court held to mean “the test applied by the courts to determine if there is damage to the person that will complete the tort of negligence, or will be of such substance as to enable a court to award damages where sought on a standalone basis in claims based on torts other than negligence”.

With this renewed focus on “personal injury” as a constituent part of tortious liability, the court, citing a number of authorities⁴, reiterated the well-established principle that damages for worry and stress alone, not giving rise to a psychiatric injury are not recoverable in tort.  Such damages may, however, be recovered for other actionable wrongs where they flow from proven and recognised damage.⁵

The Court found the “array of surprising consequences” which would necessarily flow from adoption by the Court of the defendant’s definition of “personal injury” (i.e. as including distress, upset and anxiety) undesirable. For example, such a definition would deviate from the elements of damage required at common law to complete the tort of negligence, extend further than the concept of compensatable harm as recognised in all other torts, would not reflect common usage in the legal profession and the courts of the term, and would mean that the term “civil action” in the 2003 Act includes a type of claim that is unknown to the law and therefore not actionable.

Further, and “most significantly”, the Court was unconvinced by the proposition – which flowed naturally from the defendant’s position – that in any case in which a plaintiff seeks damages for mental distress or anxiety consequent upon, for example, defamation, trespass to the person, or professional negligence, such actions would require PIAB authorisation in the first instance.

The Court concluded as follows:

“…a construction of the 2003 Act that focusses on its context and purpose means – if the defendant is correct – that the 2003 Act extended the requirement for authorisation to claims for negligence that could not in law be sustained, while at the same timing imposing on PIAB the burden of assessing categories of tort or contract actions that were in no sense within the contemplation of the legislation. The inherent unlikeliness of that outcome and of the distinction to which I alluded earlier between ‘personal injury’ and ‘recoverable personal injury’ points coercively to the conclusion that the narrower interpretation of the definition of ‘personal injury’ urged by the plaintiff is the correct one.”

3.2 Consideration of Supreme Court authorities

Clarke v. O’Gorman⁶

The issue in Clarke v. O’Gorman was whether a claim for assault, sexual assault, battery and trespass to the person was an action for personal injuries to which the authorisation requirements of the 2003 Act applied. The Supreme Court in that case rejected the argument that if an action was in reality and in substance a claim for trespass to the person and assault, it was not a civil action for personal injuries.

The Supreme Court in Dillon held that if this logic was extended to claims for mental distress or anxiety under the GDPR, and if such claims were found to constitute personal injuries for the purposes of the 2003 Act, all such claims would have to be the subject of authorisation from PIAB, which the Court found would “expand the scope of the 2003 Act (and the role of PIAB) beyond recognition”.

Murray v. Budds⁷

The defendant in Dillon sought to rely on the decision of the Supreme Court in Murray v Budds which suggested that mental distress could constitute a psychiatric injury and both complete the tort of negligence and constitute recoverable damage.

The Court clarified that its decision in Murray was categorically not authority for the proposition that claims for “worry and stress” were claims for “personal injuries”. While the decision seemed to suggest otherwise, this was simply a consequence of how the Court had been compelled to deal with the appeal due to the way in which it had been framed by the appellant. Murray, in fact, is authority only for the proposition that a claim for worry and stress cannot be pursued as the only damage alleged in an action in tort.

4. Conclusion

The Supreme Court held that the plaintiff’s action in negligence was misconceived as a plaintiff cannot obtain damages in negligence for mental distress that falls short of a psychiatric injury. The damage which is a constituent element of the tort of negligence was not alleged, and there could, therefore, never have been liability in negligence. The claim for breach of duty was, the Court held, “at best otiose”.

Instead, as the Court noted, the plaintiff’s claim was properly for non-material damage pursuant to the sui generis claim enabled by section 117 of the Data Protection Act 2018 (the “2018 Act”). The Court said that in future it would be desirable that any claims made only pursuant to section 117 are pleaded as such.

As this was a claim only for damages for distress, upset, anxiety and inconvenience that falls short of a recognised psychiatric disorder, an authorisation from PIAB was not required as a precondition to instituting proceedings.

Arising from these conclusions, the other questions canvassed in the course of the hearing did not arise.

Murray J noted that there may well be cases in which plaintiffs allege that an infringement of their rights under the 2018 Act gave rise to medically recognised psychiatric injury and that such claims will be actions for personal injuries within the meaning of the 2003 Act and will require PIAB authorisation. He noted that defendants faced with pleadings which do not clearly identify the injuries for which compensation is sought will quite understandably wish to ascertain at an early stage whether a claim is or is not being advanced for a type of injury that requires PIAB authorisation, stating that:

“It is first and foremost the responsibility of the plaintiff to plead and properly identify the type of loss for which they seek compensation and the precise legal basis on which they do so.”

He went on to note that where claims are solely for mental distress, upset and anxiety, they will fall outside the PIAB regime, “but they cannot expect anything other than very, very modest awards”.

Also contributed to by Stephen Archer, Associate