When Patrick Dillon received an apology from Irish Life after the company mistakenly shared his personal and financial data with a third party, he probably didn’t expect his pursuit of compensation would reshape data protection law across Ireland. Yet his recent Supreme Court victory has done exactly that, establishing crucial precedents for anyone who has suffered distress from data breaches.
The Supreme Court’s ruling in July 2025 clarifies a critical distinction that could benefit thousands of people: claims for emotional distress caused by data breaches do not require approval from the Personal Injuries Resolution Board (PIRB), making the path to compensation significantly more accessible.
Understanding the Legal Landscape
For years, individuals seeking compensation for data breach distress faced a complex hurdle. Both the Circuit Court and High Court had previously ruled that such claims constituted “personal injury” cases under the Personal Injuries Assessment Board Act 2003, requiring claimants to obtain PIRB authorisation before proceeding to court.
This interpretation created significant barriers. PIRB approval processes can be lengthy and may not adequately address the nuanced nature of data protection violations. More importantly, it suggested that emotional disturbance from privacy violations should be treated identically to physical injuries sustained in accidents.
The Supreme Court’s five-judge panel, led by Mr Justice Brian Murray, fundamentally disagreed with this approach. Their ruling establishes that claims for “emotional disturbances” such as distress, upset, anxiety, and inconvenience that fall short of recognised psychiatric disorders are not personal injury claims under the Act.
What This Means for Data Breach Victims
This landmark decision opens new avenues for individuals who have experienced data breaches but may not have developed medically recognised psychiatric conditions. The ruling acknowledges that privacy violations can cause genuine harm worthy of legal remedy, even when that harm doesn’t manifest as a formal psychiatric disorder.
Under the Data Protection Act 2018, individuals have the right to seek judicial remedy, including compensation, for infringement of their data protection rights. The Supreme Court’s decision removes a significant procedural barrier that previously prevented many victims from accessing this protection.
However, the Court was careful to manage expectations. Mr Justice Murray noted that those bringing claims solely for mental distress, anxiety, and upset “cannot expect anything other than very, very modest awards.” This pragmatic approach balances accessibility with proportionality.
The Broader Implications
The ruling creates important distinctions within data protection law. Where a data breach causes genuine psychiatric injury that meets medical criteria, PIAB authorisation would still be required. This preserves the existing framework for serious psychiatric harm while recognising that not all emotional disturbance reaches this threshold.
This nuanced approach reflects the evolving understanding of how data breaches affect individuals. Modern life involves extensive sharing of personal information with organisations we trust to protect it. When that trust is violated through negligent data handling, the emotional impact can be significant, even if it doesn’t constitute a formal psychiatric condition.
Learning from Recent Precedents
The legal framework surrounding psychiatric injury claims has been evolving rapidly. Recent cases have shown Irish courts moving away from rigid categorisations toward more individualised assessments. The decision in Sheehan v Bus Éireann demonstrated this approach in the context of nervous shock claims, establishing that cases should be “considered on their particular merits” rather than forcing claimants into predetermined categories.
Similarly, cases involving workplace psychological harm, such as those faced by content moderators exposed to distressing material, have highlighted the need for legal frameworks that acknowledge the full spectrum of psychological impact from negligent conduct.
The Supreme Court’s ruling in Dillon’s case continues this trend, recognising that emotional harm exists on a continuum and that legal remedies should be appropriately calibrated to address different levels of impact.
Practical Steps for Potential Claimants
If you believe you’ve suffered distress from a data breach, several factors will influence the strength of your potential claim:
Document the breach thoroughly. Keep records of when and how you discovered the breach, what data was involved, and any communications with the organisation responsible. This documentation forms the foundation of your case.
Record the impact. Note how the breach has affected you emotionally and practically. Has it caused ongoing anxiety about identity theft? Have you needed to change banking arrangements or monitor credit reports more frequently? These practical consequences support your claim for compensation.
Understand the legal standards. Your claim must demonstrate that the organisation breached its duties under data protection law and that this breach caused your distress. The connection between the breach and your emotional response must be clear and reasonable.
Consider the proportionality. As the Supreme Court noted, awards for emotional distress are likely to be modest. This doesn’t diminish the validity of your claim, but it’s important to have realistic expectations about potential compensation.
The Role of Professional Legal Support
While the Supreme Court’s ruling removes significant procedural barriers, data protection law remains complex. Understanding how the Data Protection Act 2018 applies to your specific circumstances, gathering appropriate evidence, and presenting your case effectively all require specialist knowledge.
The interplay between data protection rights and compensation claims involves technical legal principles that can significantly impact the outcome of your case. Professional legal guidance ensures that your rights are protected and that your case is presented in the strongest possible terms.
Looking Forward
This Supreme Court decision represents more than just a procedural clarification; it signals a recognition that data protection rights deserve meaningful enforcement mechanisms. As our lives become increasingly digital, and as organisations collect ever more personal information, the importance of holding data controllers accountable for breaches cannot be overstated.
The ruling also reflects a broader trend toward recognising that harm in the modern world extends beyond physical injury. Emotional distress, privacy violations, and dignitary harm are real consequences of organisational negligence, and the legal system is adapting to provide appropriate remedies.
For organisations handling personal data, this decision should serve as a reminder that data protection compliance isn’t just about regulatory requirements—it’s about respecting the fundamental rights and dignity of the individuals whose information they hold in trust.
Taking Action
If you’ve experienced distress as a result of a data breach, you now have clearer pathways to seek compensation. The Supreme Court’s ruling removes artificial barriers and recognises that your emotional response to privacy violations is valid and worthy of legal protection.
However, each case depends heavily on its specific facts, and the success of any claim requires careful preparation and presentation. Understanding your rights under data protection law, gathering appropriate evidence, and navigating the legal process all benefit from professional expertise.
At HOMS Assist, we understand the profound impact that data breaches can have on individuals and families. Our experienced team can help you understand your rights, evaluate the strength of your potential claim, and guide you through the legal process with the sensitivity and expertise these cases demand.
Don’t let a data breach violation of your privacy go unaddressed. Contact our team today to discuss your situation and explore your options for seeking the justice and compensation you deserve.
