Supreme Court judgement set to shape the nature of litigation claims resulting out of data breaches

Supreme Court Rules “distress, upset and anxiety” do not Constitute Personal Injuries Claims in Significant Ruling for Litigation Resulting from Data Breaches

The Supreme Court issued judgment on 24 July 2025 in Dillon v Irish Life Assurance PLC [2025] IESC 37¹, which will shape the future litigation of claims resulting out of data breaches. The judgment clarifies that claims for distress, upset, anxiety, and other forms of minor emotional distress, when not amounting to a recognised psychiatric disorder, do not constitute personal injuries under the Personal Injuries Assessment Board Act 2003 (the PIAB Act).

1. KEY TAKEAWAYS:

• A claim for damages for distress, upset, anxiety and inconvenience falling short of a recognised psychiatric disorder is not a personal injury claim. Where claims are solely based on this, they will fall outside the PIAB regime, and plaintiffs cannot expect anything other than “very, very modest awards”.

• The Plaintiff should not have claimed in negligence, as a plaintiff can not obtain damages in negligence for mental distress that falls short of a psychiatric injury (i.e. non-material damage), and therefore the damage element of a claim in negligence was not met.

• In order to make pleadings clearer, plaintiffs should not in future claim for breach of statutory duty in addition to/instead of claiming for damages under s. 117 Data Protection Act 2018 (the 2018 Act).

• Where plaintiffs allege infringement of rights under the 2018 Act leading to a medically-recognised psychiatric injury, these will be personal injuries actions, and they will have to go through the PIAB Authorisation process.

• The court emphasised that plaintiffs bear the responsibility to plead and properly identify the loss for which they seek compensation, and the legal basis that they do so, and not put defendants in the position of seeking to clarify this point. 

2. BACKGROUND: 

The Plaintiff, Patrick Dillon brought a case against Irish Life Assurance PLC (Irish Life), claiming compensation for “distress, upset, anxiety, inconvenience, loss and damage” resulting from six data breaches over a 12-year period (2008–2020). He did not however, seek authorisation from PIAB, which is required prior to commencing an action seeking compensation for personal injuries, under Section 12 of the PIAB Act. Further the proceedings were issued by way of an Equity Civil Bill and not by way of a Personal Injuries Summons as required in the case of proceedings in the Circuit Court. 

Judge O’Connor dismissed the case as frivolous, vexatious, or bound to fail, ruling that the plaintiff had effectively brought a personal injuries claim and should have first gone through the PIAB process. Judge O'Donnell in the High Court upheld the Circuit Court’s decision. The Supreme Court granted the plaintiff leave to appeal the case recognising that the issues in the appeal were matters of public importance and in the public interest. 

3. REASONING:

Murray J considered the statutory Interpretation of “Personal Injury” in the PIAB Act and “Personal Injury” at Common Law. 

3.1. Statutory Interpretation:

Murray J outlined that the definition of personal injuries in s. 2(1) of the Civil Liability Act 1961 (the 1961 Act) echoes the common law definition, and is broad enough to encompass the concept of "personal injury” developed by the courts.

Turning to the meaning of personal injury under the PIAB Act, he noted that the plain language of the PIAB Act is ambiguous in relation to the issues that arise in this case, and therefore he had to engage in a consideration of the context and purpose of the PIAB Act. He noted that: 

“The 2003 Act was introduced to advance the objective of enabling the early, efficient and fair resolution of a particular type of claim. Those claims were not defamation actions, or actions in trespass or false imprisonment, in which plaintiffs sought compensation for the distress, anxiety or upset that followed from their being libelled or imprisoned, as the case may be, ancillary to their main claims for damages.”²

He found that considering the purpose and context of the PIAB Act it weighed heavily in favour of the Plaintiff’s argument: i.e. that words in their ordinary meaning refer to the kind of injury that can be diagnosed as a condition that is more than fleeting, has specific effect on capacity, and which in the normal course require medical/psychological treatment or diagnosis. 

The court came to the conclusion that the narrower interpretation of the definition of "personal injury” urged by the plaintiff is the correct one, and he rejected the Defendant’s argument under Clarke v O’Gorman³, outlining that this would expand the scope of the PIAB Act beyond recognition, into all manner of claims in which damages for mental distress and anxiety are claimed. 

3.2. Common Law definition of Personal Injury

Murray J emphasised that courts have repeatedly held that damages for worry and stress alone, not giving rise to psychiatric injury, are not recoverable in tort actions. 

He further noted that damages for emotional or mental distress can be recovered for other actionable wrongs, however they are consequent on proven and recognised damage, or where the protection of the plaintiff was envisaged as part of a contract. He then outlined that the purpose of compensatory damage is to compensate for the effects of a wrongful act⁴, however, critically he noted that: “none of this means that emotional distress is converted for some purposes into a personal injury”⁵.

He suggested that Irish Life’s position led to the suggestion that in any case where the plaintiff sought damages for mental distress, including so called “holiday disappointment” cases would have to go through PIAB. 

4. HELD: 

The Supreme Court found:

• The claim did not fall under the PIAB regime.

• Emotional distress without psychiatric injury is not a personal injury under the PIAB Act.

• Therefore, the plaintiff was not required to obtain PIAB authorisation.

The appeal was allowed, and the rulings of the Circuit Court and High Court were overturned. 

5. IMPACT OF THIS JUDGMENT 

This judgment provides crucial clarity for practitioners, insurers and claimants alike: 

• Claims solely for emotional harm (absent recognised and diagnosable psychiatric injury) are now definitively outside the PIAB framework.

• Plaintiffs must take care in pleading claims accurately, particularly when relying on the 2018 Act.

• Future claims for emotional distress, in the context of data breaches, now have procedural certainty for proceeding through the courts, but with the expectation of “very, very modest awards”⁶. 

For further information or legal advice, please contact Byrne Wallace Shields LLP Litigation and Regulation Partner Mona Costelloe, or Solicitor Annie Connolly.