The Supreme Court judgement (of O’Donnell CJ, Dunne J, Hogan J, Murray J and Collins J) in Patrick Dillon v. Irish Life Assurance PLC which was handed down on 24th July 2025, considered whether claims for emotional distress as a result of a data breach falls within the definition of ‘personal injury’ under the Personal Injuries Assessment Board Act 2003 and whether obtaining PIAB authorisation to initiate proceedings was required. It found that such a claim did not come within the definition of a ‘personal injury’ claim. It will be interesting to see the application of this decision going forward to other potential claims in the employment law area.
Facts: The Plaintiff, Patrick Dillon, held a life assurance policy with the Defendant, Irish Life. The Defendant issued in error six letters in relation to the Plaintiff’s policy containing his personal and financial data between 2008 and 2020 and sent them to a third party. The Plaintiff issued proceedings in the Circuit Court alleging that the data breaches were caused by negligence and breach of duty, including breach of statutory duty and caused him “distress, upset, anxiety, inconvenience, loss and damage”. This was due to the alleged breach by the Defendant of the Data Protection legislation.
The Defendant argued that the Plaintiff’s claim fell within the definition of ‘personal injury’ within the meaning of the Civil Liability Act 1961 which requires a pre-authorisation from PIAB, which the Plaintiff had not obtained. Also, it argued that he should have commenced proceedings by Personal Injuries Civil Bill rather than the Equity Civil Bill in which they were instituted. Both the Circuit Court and the High Court on appeal found that the proceedings sought damages for ‘personal injury’ and that PIAB authorisation should have been obtained before instituting proceedings and therefore they dismissed his claim.
The Supreme Court granted Plaintiff the leave to appeal the High Court decision as it considered this case raised issues of general public importance about whether a claim for damages for “distress, upset and anxiety” arising from a data breach could possibly be seen as a claim for damages for personal injury and the compatibility of PIAB authorisation requirement with EU law.
Decision: In this decision there was two key issues that fell for consideration . One being whether the non-material damage (distress, upset and anxiety) fell within the statutory definition of ‘personal injury’ as found by the High Court. The second issue being if the Plaintiff’s claim is a form of ‘personal injury’ , whether a requirement to apply to PIAB for pre-authorisation would render it extensively difficult for the plaintiff to exercise his rights to compensation for non-material damage under the GDPR in breach of the EU Directive.
The Supreme Court judgement delves into the statutory and common law definition of the term ‘personal injury’. This judgment highlights that in relation to the various statutory definitions:
‘it is easy to lose sight of the fact that while the definition of ‘personal injury’ used in these statutes is comprehensive, in none of them does it purport to be of general application. It is instead used for various distinct, related but quite specific purposes.’
The Court also refers to the case of Clark v O’Gorman where it was held that a personal injury action is not a claim in which standalone damages are sought to compensate for distress and anxiety.
Mr. Justice Brian Murray held that the Plaintiff’s claim in negligence was misconceived as he cannot obtain damages in negligence for mental distress that falls short of a psychiatric injury. However, he held that the Plaintiff had a standalone claim for non-material damage pursuant to the unique claim set out in Section 117 of the Data Protection Acts. He also held that where a plaintiff’s claims are solely for mental distress, upset and anxiety that the plaintiff cannot expect anything other than very, very modest awards.
Takeaway for Employers: The Supreme Court’s Decision in Dillon v Irish Life Assurance Plc is important to note where claims for emotional upset, distress, or anxiety without a recognised psychiatric illness do not qualify as personal injury but also illustrates where such claims may still proceed in respect of certain statutory obligations. While this decision specifically related to the breach of GDPR and the remedy provided for in that legislation, it will be interesting to see if the decision will be applied to other statutory remedies where there is non-material damage such as under the Protected Disclosures Acts or under the Safety, Health and Welfare at Work Acts.
Authors – Anne O’Connell & Abigail Ansell
18 September 2025
Anne O’Connell Solicitors
19-22 Lower Baggot Street
Dublin 2.
If you found this article useful you might like our employment law newsletter. We write monthly articles, like this, covering interesting cases, decisions, news and developments in Ireland.