Supreme Court Clarifies that Non-Material Data-Breach Damages Are NOT “Personal Injuries” for PIAB Purposes

Commentary on Dillon v Irish Life Assurance Plc [2025] IESC 37

1. Introduction

Dillon v Irish Life Assurance Plc is a landmark decision of the Supreme Court of Ireland delivered on 24 July 2025. The Court (Murray J. delivering judgment for a seven-judge panel headed by O’Donnell C.J.) overturned earlier Circuit and High Court rulings and clarified, once and for all, that a claim limited to distress, upset, anxiety and inconvenience arising from a wrongful data disclosure does not constitute a claim for “personal injury” within the meaning of the Personal Injuries Assessment Board Act 2003 (“the 2003 Act”). Consequently, such a plaintiff is not obliged to seek an authorisation from the Personal Injuries Assessment Board (“PIAB”) before issuing court proceedings.

The judgment resolves a practical dilemma that had paralysed many low-value data-protection claims since the advent of the GDPR and its domestic counterpart, the Data Protection Act 2018. It also recalibrates the interaction between long-standing personal-injury legislation and the sui generis compensation right enshrined in Article 82 GDPR.

2. Summary of the Judgment

• Main holding: Non-material damage such as distress or anxiety—absent a medically recognised psychiatric disorder—is not an “impairment of a person’s physical or mental condition” and therefore is not a “personal injury” for the purposes of s. 4 2003 Act / s. 2 Civil Liability Act 1961.
• Effect: A purely emotional-distress claim under s. 117 Data Protection Act 2018 can be commenced by ordinary civil bill or plenary summons without prior PIAB authorisation.
• Consequential findings:
  • The Circuit Court had erred in striking out the action as frivolous or bound to fail.
  • The Court noted (but did not decide) the EU-law question on the compatibility of the PIAB prerequisite with Article 82, because once the PIAB route was held inapplicable the issue became moot.

3. Analysis

3.1 Precedents Cited and their Influence

1. Clarke v O’Gorman [2014] IESC 72
   Clarified the scope of “civil actions” under the 2003 Act and emphasised the separate concepts of cause of action and type of damage. The Supreme Court applied that distinction to reject arguments that emotional-distress damages embedded in other torts slide automatically into the PIAB regime.
2. Murray v Budds [2017] IESC 4
   Often (mis-)cited for the proposition that “worry and stress” are personal injuries, Murray J. painstakingly re-examined that case, concluding it never decided the definitional point; it simply held that such damages are unrecoverable in tort absent recognised psychiatric injury. This reinterpretation was central to freeing non-material GDPR claims from PIAB.
3. High-Court authorities on non-recoverability of mere distress in negligence—Walter v Crossan [2014], Larkin v Dublin City Council [2008], Hegarty v Mercy University Hospital [2011]—were endorsed: emotional upset is not standalone damage in negligence.
4. EU Court of Justice trilogy (UI v Österreichische Post, GP v juris GmbH, VB v Natsionalna agentsia za prihodite) confirmed that “non-material damage” under Article 82 includes transient anxiety, but does not require Member States to dispense with ordinary procedural rules. The Supreme Court cited these cases primarily in addressing (and ultimately parking) the “EU effectiveness” argument.

3.2 The Court’s Legal Reasoning

1. Textual ambiguity acknowledged: The statutory wording (“any impairment of a person’s … mental condition”) can, superficially, capture anxiety; but equally the ordinary meaning of “impairment” implies a functional deficit, not a fleeting emotion.
2. Context & purpose of the 2003 Act: PIAB was designed to front-load classic bodily-injury claims. Extending it to every case claiming “upset” would:
   • Overburden PIAB with assessments outside its medical competence.
   • Create procedural traps for defamation, false imprisonment, holiday-ruin and countless other actions that traditionally lie outside personal-injury practice.
   • Contradict everyday forensic usage of “personal injury”.
3. Common-law lineage: Historically, compensation for psychiatric injury demands a medically recognisable condition (Kelly v Hennessy test). Mere distress has never sufficed to ground negligence.
4. Legislative clues: Other statutes treat “mental distress” separately from “personal injury” (e.g. s. 48 Civil Liability Act 1961 on fatal-accident “mental distress” awards; Statute of Limitations (Amendment) Act 1991). If lawmakers equated distress with injury, these carve-outs would be redundant.
5. Re-reading Murray v Budds: The Court meticulously dissected the earlier Supreme Court judgment, concluding it turned on limitation-period pleading strategy rather than any definitive pronouncement that distress = personal injury. Hence Murray is not binding on the definitional issue.
6. Practical coherence: Accepting the insurer’s broad reading would force, for example, PIAB processing of a defamation claim merely because the plaintiff pleaded “hurt feelings”. Such an outcome was deemed “inherently unlikely” to have been intended by the Oireachtas.

3.3 Potential Impact

• Data-protection litigation: Clears the path for straightforward Circuit Court claims for GDPR non-material damage, reducing cost and delay. Cases involving recognised psychiatric injury still fall within PIAB.
• Personal-injury practice: Re-draws the line between PIAB and general civil litigation, re-affirming that PIAB is for injuries requiring proof of functional impairment (physical or psychiatric).
• Pleadings discipline: Plaintiffs must now articulate precisely whether they allege (a) mere distress; (b) clinically recognised psychiatric harm; or (c) both. Defendants can use Murray J.’s guidance to challenge vague or hybrid pleadings.
• EU-law interface: Because non-material GDPR claims bypass PIAB, contentious questions about PIAB’s compatibility with Article 82 GDPR are largely neutralised—unless a future claimant sues for both types of damage.
• Statutory interpretation more broadly: The decision is a textbook reminder that context and purpose may trump literalism, especially where an expansive reading produces anomalous or unworkable consequences.

4. Complex Concepts Simplified

Personal Injuries Assessment Board (PIAB): A statutory body that must authorise most bodily-injury claims before they go to court. It aims to reduce litigation cost by encouraging early, medical-led compensation assessments.

Non-Material Damage under GDPR: Harm that is intangible—e.g. emotional upset or reputational harm—stemming from unlawful data processing.

Recognised Psychiatric Injury: A diagnosable mental disorder (e.g. PTSD, depression) proved by medical evidence. Required to recover “nervous shock” damages in negligence.

Article 82 GDPR v s. 117 2018 Act: Article 82 creates an EU-wide right to compensation; s. 117 provides the domestic court procedure and labels the action “founded on tort”, but does not redefine “personal injury”.

Statute of Limitations Interaction: Personal-injury actions have shorter (two-year) limitation periods than ordinary tort/contract claims (six years). Whether a plaintiff’s distress claim is “personal injury” affects both PIAB and limitation defences.

5. Conclusion

The Supreme Court’s judgment in Dillon v Irish Life Assurance Plc restores doctrinal clarity to an area blurred by overlapping statutory regimes and the rise of data-breach litigation. By confirming that transient emotional upset is not a “personal injury” under the 2003 Act, the Court:

• Realigns statutory language with long-standing common-law principles;
• Spares PIAB from a torrent of small, non-medical data-protection claims;
• Assures claimants of an efficient route to vindicate Article 82 rights; and
• Signals that only medically established psychiatric harm attracts the procedural rigours—and shorter limitation periods—of personal-injury litigation.

Practitioners should treat the case as the leading Irish authority on the boundaries of “personal injury” and a pivotal reference point for pleading, defending, and settling data-protection and other emotional-distress claims into the future.