Supreme Court Clarifies PIAB Requirements for GDPR Distress Claims

Alison Kelleher, Partner and Sarah Biggin, Trainee Solicitor examine the recent Supreme Court decision which ruled that PIAB authorisation is required for personal injury claims arising from data breaches. The Court has provided helpful clarification that Plaintiffs who bring claims solely for mental distress, anxiety and upset, which do not require PIAB authorisation “cannot expect anything other than very, very modest awards”.

In the recent case of Dillon v Irish Life Assurance [2025] IESC 37, the Supreme Court found that claims for personal injury under the General Data Protection Regulation (GDPR) require prior authorisation from the Personal Injuries Assessment Board (PIAB).  However, the Court determined that emotional distress without psychiatric injury is not a ‘personal injury’ under the Personal Injuries Assessment Board Act 2003 and therefore does not require a PIAB authorisation.

Background

The Plaintiff alleged that Irish Life had wrongfully disclosed his personal data to an unauthorised third party over an extended period, causing him distress, upset, anxiety, and inconvenience. Several letters containing the Plaintiff’s personal data were sent to the third party, and the Plaintiff sought compensation for “non-material” damage under the GDPR.

Irish Life sought to have the action struck out, arguing that the Plaintiff’s claim constituted a “relevant claim” under Part 2 of the Personal Injuries Assessment Board Act 2003. As such, the claim could only proceed with prior authorisation from PIAB, which the Plaintiff had not obtained. The Circuit Court agreed with Irish Life and dismissed the proceedings. The Plaintiff appealed the decision to the High Court where the Circuit Court’s decision was upheld, finding that the applicant’s claim was a “civil action” within the meaning of the PIAB Act and as such required prior authorisation from PIAB.

Issues Before the Supreme Court

The Supreme Court granted leave to appeal the decision of the High Court on the basis that the case raised issues of general public importance.  The Court noted that the Plaintiff’s claim is one for compensation for “non-material” damage, as defined in Article 82 of the GDPR and S117 of the Data Protection Act 2018. The issue for the Court was therefore, to determine whether this concept of non-material damage, comes within the definition of a “relevant claim” under Part 2 of the PIAB Act and is therefore to be regarded as a claim for personal injury.

Supreme Court Ruling

On the 24 July 2025, the Supreme Court published its Judgment, holding that claims for non-material damage, falling short of a recognised psychiatric illness do not come within the definition of ‘personal injury’ as set out in the PIAB Act 2003 and therefore do not require prior PIAB authorisation. In contrast, infringements that give rise to medically recognised psychiatric injuries will fall within the definition of ‘personal injury’ and therefore require PIAB authorisation. The Supreme Court held:-

• It is for the Plaintiff to plead and properly identify the type of loss for which they seek compensation. Where their claims are solely for mental distress, upset and anxiety, they will fall outside PIAB.
• In contrast, claims based upon a medically recognised psychiatric injury will be actions for damages for personal injuries within the meaning of the 2003 Act and will accordingly have to go through the PIAB authorisation process.
• A claim for emotional disturbances, such as anxiety, distress, worry, fear, inconvenience and upset that fall short of a recognised psychiatric disorder is not a personal injury claim within the meaning of the PIAB Act 2003. The proper forum for such claims is the Courts, without any involvement from PIAB.
• Therefore, as this was a claim only for damages for distress, upset, anxiety and inconvenience that falls short of a recognised psychiatric disorder, an authorisation from PIAB was not required.

The decision in Dillon v Irish Life Assurance provides critical guidance and clarity on the definition of non-material damage in data protection law in Ireland, as distinct from the definition of “personal injury” under the PIAB Act.

Compensation for Non Material Damage

In his Judgement, Mr Justice Murray noted that Plaintiffs who bring claims solely for mental distress, anxiety and upset which do not require PIAB authorisation, “cannot expect anything other than very, very modest awards”.

The issue of non-material damage under the GDPR was also examined in the earlier case of MH and the Child and Family Agency [2023] IECC 11. In that case the Plaintiff suffered emotional distress after the Defendant mistakenly provided a detailed attendance note—containing information about childhood abuse suffered by the Plaintiff—to her now deceased brother. The information was subsequently shared with other family members, leading to significant emotional distress and damage to the Plaintiff’s familial relationships. In awarding the Plaintiff €7,500, the Court acknowledged the serious nature of the breach, noting that the Plaintiff, who is in long-term mental health treatment, experienced retraumatization and a profound loss of trust. The Court noted that this was not a case of mere upset and the Plaintiff suffered damage and upset of a very distressing kind on account of the breach. The damage in this case, whilst non-material, was at the most serious end of the scale.