Dillon v Irish Life Assurance Plc (Approved)

Factual and Procedural Background

The Plaintiff held a life-assurance policy with Company A. Between May 2008 and May 2020 six letters concerning the policy were mistakenly sent by Company A to a third party, disclosing the Plaintiff’s personal and financial data. Alleging data-protection breaches that caused “distress, upset, anxiety and inconvenience,” the Plaintiff commenced Circuit Court proceedings in June 2021 by Equity Civil Bill. He did not first obtain an authorisation from the Personal Injuries Assessment Board (“PIAB”).

Company A applied to strike out the claim on the basis that (i) the action sought damages for “personal injury” within the meaning of the Personal Injuries Assessment Board Act 2003 (“the 2003 Act”), (ii) prior PIAB authorisation was therefore mandatory, and (iii) the wrong originating document had been used. The Circuit Court agreed and dismissed the proceedings as frivolous, vexatious or bound to fail. The High Court (Judge O’Donnell, 2024 IEHC 203) affirmed that decision.

The Supreme Court granted leave to appeal ([2024] IESCDET 92). The Attorney General was joined as a notice party for assistance on EU-law questions. The present judgment (Judge Murray, 24 July 2025) allows the appeal.

Legal Issues Presented

1. Does non-material damage in the form of distress, upset and anxiety fall within the statutory definition of “personal injury” in the 2003 Act, thereby requiring PIAB authorisation before proceedings may be issued?
2. If such damage is classed as “personal injury,” would the PIAB pre-authorisation requirement render it excessively difficult to vindicate the right to compensation under Article 82 GDPR, contrary to the principles of equivalence and effectiveness in EU law?

Arguments of the Parties

Plaintiff’s Arguments

• “Personal injury” in the 2003 Act is confined to an impairment of physical or mental condition; mere emotional distress does not qualify.
• Requiring PIAB authorisation for a standalone GDPR claim would make it unduly onerous to obtain compensation for non-material damage, breaching EU law.
• The proceedings were correctly commenced by Equity Civil Bill because they are not a personal-injuries action.

Company A’s Arguments

• The statutory term “personal injury” is broad and includes emotional disturbances such as distress and anxiety, even absent a recognised psychiatric disorder.
• Consequently, the Plaintiff’s claim is a “civil action” for personal injury and could not validly be issued without prior PIAB authorisation or by Equity Civil Bill.
• The PIAB requirement is a neutral procedural rule consistent with Article 82 GDPR.

Table of Precedents Cited

Court's Reasoning and Analysis

1. Statutory Interpretation. The Court held that “personal injury” in s. 2 of the Civil Liability Act 1961 (incorporated into the 2003 Act) refers to an impairment of a person’s physical or mental condition that affects functional capacity. Transient emotional states such as distress, upset and anxiety, absent a recognised psychiatric disorder, do not meet that threshold.

2. Common-Law Context. At common law a negligence claim requires legally cognisable damage; pure distress is not such damage. Reading the 2003 Act as covering non-actionable claims would oblige PIAB to assess cases that could never succeed, an outcome the Oireachtas cannot be presumed to have intended.

3. Precedent Analysis. The High Court’s reliance on Murray v. Budds was misplaced. That decision did not decide that distress itself is “personal injury”; it merely treated the particular claim before it as time-barred because of how it was pleaded. Likewise, Clarke v. O’Gorman confirms that heads of damage and causes of action overlap but does not require PIAB involvement where no actionable injury is alleged.

4. EU-Law Question Rendered Moot. Because the claim is not a personal-injury action, the procedural requirement for PIAB authorisation never arose. The Court therefore did not need to decide whether such a requirement would breach Article 82 GDPR.

5. Application to the Present Case. The Plaintiff pleads only distress-type loss; no psychiatric injury is alleged. Accordingly (i) the negligence claim is misconceived, but (ii) the standalone statutory claim under s. 117 of the Data Protection Act 2018 is not subject to the PIAB regime. The lower courts erred in dismissing the action for want of PIAB authorisation.

Holding and Implications

APPEAL ALLOWED. The orders of the Circuit Court and High Court striking out the proceedings are set aside; the action may proceed without PIAB authorisation.

Implications: The judgment clarifies that: (a) standalone claims for non-material damage (distress, upset, anxiety) under the GDPR are not “personal injury” within the PIAB regime; (b) PIAB authorisation is still required where a claimant alleges a recognised psychiatric injury; (c) parties must plead clearly whether they rely on s. 117 of the 2018 Act and whether a psychiatric condition is claimed. No new cause of action is created, but significant guidance is provided for future data-protection litigation.