Collins -v- FBD Insurance Plc

Factual and Procedural Background

This appeal arises from a Circuit Court order dated 9th March 2012 awarding Plaintiff damages of €15,000 plus costs against Defendant. The Plaintiff’s original claims included damages for discrimination, harassment, negligence, breach of contract, and damages under section 7 of the Data Protection Acts 1988 and 2003. The damages awarded by the Circuit Court were understood by both parties to relate solely to the Plaintiff’s claim under section 7 of the Data Protection Acts for breach of data protection obligations by Defendant.

The dispute originated from the Plaintiff’s insurance claim after his van was stolen in September 2008. Defendant investigated the claim, including commissioning a private investigator who reported on the Plaintiff’s prior criminal conviction. Defendant subsequently questioned the Plaintiff about this conviction and threatened to cancel the insurance policy. Plaintiff’s requests for documentation were delayed, leading to involvement of the Data Protection Commissioner, who found Defendant in breach of multiple provisions of the Data Protection Acts for delays and improper handling of personal data.

Following the Commissioner’s decisions, Plaintiff commenced Circuit Court proceedings seeking damages under section 7 of the Data Protection Acts for Defendant’s breaches. The High Court hearing was a re-hearing of the Circuit Court case, focusing on whether Plaintiff was entitled to damages under section 7 in the absence of proven actual loss or damage. Defendant acknowledged breaches of the Data Protection Acts and accepted the Commissioner’s findings. Plaintiff did not prove special damages or loss related to the breaches.

Legal Issues Presented

1. Whether the Plaintiff is entitled to damages under section 7 of the Data Protection Acts in the absence of proof of actual loss or damage.
2. The proper interpretation of the scope of damages recoverable under section 7 of the Data Protection Acts, specifically whether strict liability or proof of damage is required.

Arguments of the Parties

Plaintiff's Arguments

• Section 7 of the Data Protection Acts establishes a statutory duty of care and allows recovery of damages for breach of that duty under tort law.
• Damages under section 7 may be awarded without proof of actual loss or damage, enabling enforcement of data protection rights.
• The breaches identified by the Data Protection Commissioner justify an award of general damages.

Defendant's Arguments

• Damages under section 7 require proof of actual loss or damage; no damages should be awarded absent such proof.
• Section 7 imposes a duty of care but does not impose strict liability or automatic entitlement to compensation.
• English authorities under the UK Data Protection Act 1998 are not applicable as that legislation expressly allows damages for distress, unlike Irish law.

Table of Precedents Cited

Precedent	Rule or Principle Cited For	Application by the Court
Larkin v. Dublin City Council [2008] 1 IR 391	Requirement of proof of damage to recover damages for breach of statutory duty; no damages for distress without recognisable psychiatric injury.	Used to illustrate that statutory duty claims require proof of damage and that damages for non-pecuniary loss are limited absent actual injury.
Re Criminal Proceedings against Lindqvist [2004] QB	Member States may extend the scope of national legislation implementing EU Directives beyond the Directive's minimum requirements.	Referenced to explain that Ireland could have legislated for broader compensation than required by the Directive but did not do so in section 7.

Court's Reasoning and Analysis

The Court analyzed section 7 of the Data Protection Acts in light of the Directive 95/46/EC and the Strasbourg Convention, which require compensation only for persons who have suffered damage due to unlawful data processing. The Court emphasized that section 7 imposes a statutory duty of care on data controllers and processors but does not create strict liability or an automatic right to compensation without proof of damage.

The Court found that the Irish legislation reflects the Directive's requirement that compensation be linked to actual damage suffered. It rejected the Plaintiff’s contention that damages could be awarded without proof of loss, noting that the Directive and section 7 do not mandate automatic compensation or strict liability.

Comparisons with other Member States’ legislation demonstrated that compensation is generally conditioned on proof of harm. The Court also distinguished the UK Data Protection Act 1998, which allows damages for distress, from Irish law, which does not provide for such compensation absent proof of actual damage.

Applying established tort principles and precedent, the Court held that the Plaintiff must prove that the breach caused damage to recover damages. The evidence presented was insufficient to establish any provable damage flowing from Defendant’s admitted breaches of the Data Protection Acts.

Holding and Implications

The Court VACATED the Circuit Court’s order awarding damages to the Plaintiff under section 7 of the Data Protection Acts.

The Plaintiff was not entitled to damages because he failed to prove any actual loss or damage resulting from Defendant’s breach of the statutory duty of care. The decision underscores that under Irish law, compensation for breach of the Data Protection Acts requires proof of damage and is not automatic. No new precedent beyond the proper interpretation of section 7 in accordance with EU Directive 95/46/EC was established. The direct effect is that the Plaintiff’s claim for general damages without proof of loss is dismissed, but the Court noted the Defendant’s conduct during the investigation and the procedural posture regarding costs.