knowledge 17 July 2023 |

Compensation in Data Breach Claims – Recent Irish Developments

Background

In this case, the data subject brought proceedings against his employer, a food manufacturer, alleging non-material damage arising from the further processing of his personal data collected via CCTV contrary to the GDPR and the Data Protection Act 2018. 

At a meeting of managers and supervisors to address instances of poor food safety practice and to highlight food quality and safety issues, the defendant showed CCTV footage to employees in which the data subject appeared. 

The data subject claimed that as a result of this incident, he suffered damage and distress in the form of anxiety and embarrassment, due to the remarks made by work colleagues on foot of the alleged data breach. 

Decision

In its judgment, the Court referred to the recent decision of the Court of Justice of the European Union (“CJEU”) in the Austrian Post Case² (see previous briefing here), in which it was held that there is no de minimis standard of loss to be suffered for an individual to recover compensation for non-material damage under Article 82 of the GDPR.

The Court held that there was a lack of clarity and transparency with regard to the employer’s data protection policies and the processing of personal data collected via CCTV. The Court was satisfied that: 

• there was an infringement of the data subject’s rights under the GDPR;
• there was non-material damage resulting from that infringement; and
• there was a causal link between the damage and the infringement.

The Court determined that the damage suffered by the data subject in this case consisted of “some slagging by [his fellow] employees, culminating in the plaintiff’s own evidence in some serious embarrassment and sleep loss”. In these circumstances, the Court considered that this went beyond “mere upset” and created an emotional experience and negative emotions of insecurity which affected him for a short period of time. The Court noted that the data subject was viewed by the Court to have been truthful and conscientious when giving evidence and perceived not to have exaggerated the effects of the infringement on him. In these circumstances, the Court awarded the data subject damages of €2,000 for non-material damage.

Comment

The Circuit Court’s judgment raises a number of interesting points:

• Absence of a legitimate interests assessment (“LIA”)
  • In response to the employer’s claim that it had a legitimate interest for the processing of the employee’s data in the manner outlined above, the Court was critical of the employer’s failure to carry out an LIA identifying such a legitimate interest.
• Level of damages 
  • The Court was of the view that “damages in many cases” for non-material damage will be “modest” and in the absence of guidelines from the Oireachtas, the Superior Courts and/or the Judicial Court, the Court took into account the factors outlined in the Judicial Council Personal Injuries Guidelines 2021 in respect of minor psychiatric damages “as instructive guidance”. 
  • The Court also noted that an independent adjudicative or conciliation resolution process would be a “suitable alternative dispute pathway to resolve data breach assessments”.
  • In terms of mitigation of damages, the Court noted that an apology by the controller “where appropriate” may be considered.
• Data protection claims in the District Court
  • The relatively low level of damages awarded in this case indicates that most claims of non-material damage under section 117 of the Data Protection Act will fall within the remit of the District Court, which now has jurisdiction to hear data protection claims pursuant to the Courts and Civil Law (Miscellaneous Provisions) Act 2023.