Data Breached and PIAB Authorisations

Introduction:

The High Court has confirmed that Claimants pursuing damages in personal injuries arising out of data breaches require a PIAB Authorisation.

Background:

The plaintiff was employed as a Census Enumerator in 2016. She had provided personal data to the Central Statistics Office (CSO) for salary and tax purposes. In 2017, Ms Keane's P45 was allegedly unlawfully disclosed by the CSO to third parties. The Plaintiff initiated legal proceedings, alleging a complete breach of her privacy rights, which caused her to suffer anxiety and stress, impacting her sleep, appetite and worsening her psoriatic arthritis. The plaintiff sought damages for the stress and anxiety caused as a result of this alleged data breach.

Circuit Court Decision:

The Circuit Court held that the plaintiff ought to have obtained a PIAB authorisation in advance of issuing her proceedings. Because she didn’t do so, her main claim for damages in personal injuries was, in the words of His Honour Judge Simon McAleese "doomed to fail". The remaining aspect of Ms Keane's claim would be confined to other damages, if any, that might be awarded for the inadvertent breach. In practical terms, this meant that she could still succeed in her claim for non-material damages as outlined in Article 82 of the GDPR and section 117 of the Data Protection Act 2018. In this case, no award was provided in respect of non-material damages.

High Court Appeal:

This decision was upheld on appeal to the High Court. Final orders, including in respect of loss are awaited.  

Insights:

In similar fact patterns, legal practitioners should be aware of the necessity of a PIAB authorisation prior to proceedings being issued.

Siobhan Keane v Central Statistics Office [2024] IEHC 20.

Judgment of Mr. Justice Barry O'Donnell delivered on the 17 day of January, 2024.

Written by: Killian O'Reilly and Niamh McDonagh