On 24 July 2025, the Irish Supreme Court (Court) issued an important decision in the case of Dillon v Irish Life Assurance Plc [2025] IESC 37 that clarifies the legal treatment of non-material damages, such as emotional distress, arising from data breaches.
In this case, the issue was whether an authorisation from the Personal Injuries Assessment Board (PIAB), now the Personal Injuries Resolution Board, is required when a plaintiff claims non-material damages arising from a data breach. This depends on how the right to compensation for non-material damage under Article 82 of the GDPR and section 117 of the Data Protection Act 2018 interacts with the Personal Injuries Resolution Board Acts 2003 to 2022 (PIAB Act).
The plaintiff (Dillon) brought a non-material damage claim under the GDPR alleging that the defendant (Irish Life) had wrongfully disclosed his personal data by sending letters containing his personal and financial data to an unauthorised third party between 2008 and 2020. He claimed damages for distress, upset and inconvenience, but did not allege any psychiatric injury. He did not seek authorisation from PIAB, which is typically required before personal injury proceedings can be instituted before the courts.
Further to Irish Life's application, the Circuit Court and the High Court, on appeal, dismissed Dillon's claim on the grounds that it was frivolous, vexatious or bound to fail. Both courts ruled that his claim was a personal injuries action, and an authorisation from PIAB was required before proceedings were instituted.
The Court granted leave to appeal and delivered a unanimous decision, overturning the lower courts' decisions. Murray J, giving the judgment, held that emotional distress without a diagnosable psychiatric injury does not constitute a personal injury under the PIAB Act. This position supports earlier case law that a personal injury action is one which includes damages to compensate for the loss of a physical or mental function, not standalone damages for distress or anxiety.
The Court made several key observations:
- Definition of Personal Injury, PIAB Authorisations and Non-Material Loss: The PIAB Act defines personal injury as including "any disease or impairment of a person's physical or mental condition." The Court clarified that this definition does not extend to transient emotional states such as distress or anxiety unless they amount to a recognised psychiatric disorder. As this claim encompassed damages for distress, upset, anxiety and inconvenience, falling short of a recognised psychiatric disorder within the meaning of the PIAB Act, authorisation from PIAB was not required as a precondition to instituting proceedings.
- "Very, Very Modest Awards": Under Article 82 of the GDPR, individuals have the right to compensation for material and non-material damage resulting from a breach of data protection rights. The Court emphasised that non-material damage, such as emotional distress, is compensable under the GDPR but does not automatically qualify as a personal injury under Irish law. The Court noted, that in such cases, plaintiffs cannot expect anything other than "very, very modest awards".
- Claim in Negligence: Murray J held that the plaintiff's claim in negligence was misconceived. It is not possible to claim damages in negligence solely for mental distress and upset. The damage element necessary to complete the tort of negligence was missing.
- Procedural Clarity: The Court stressed the importance of clear pleadings in data protection cases. Plaintiffs must specify the nature of the harm suffered and the legal basis for their claim—whether it is a personal injury requiring PIAB authorisation or a GDPR-based claim for non-material damage which does not require PIAB authorisation.
The Court, therefore, allowed the appeal because the claim made by Dillon was limited to damages caused by distress, upset, anxiety and inconvenience.
Summary:
The judgment provides much-needed clarity for data subjects, insurers and organisations (as controllers of personal data). It establishes that non-material damage in the form of distress, upset and anxiety does not amount to a personal injury under the PIAB Act, and so does not require an application to PIAB (for an authorisation), unless it constitutes a recognised psychiatric disorder. It reinforces the position that negligence claims for emotional distress alone are unlikely to succeed, as they lack the injury element required to sustain the tort claim. It also clarifies that emotional distress claims in GDPR compensation claims should be pleaded as claims under Article 82 the GDPR and section 117 of the Data Protection Act rather than generic claims for breach of statutory duty. The decision also assures data controllers that minor mental distress claims will not attract significant compensation.
You can access our previous related articles here, here and here.
Contributed by: Jessica Hill
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
