Court awards damages for serious GDPR data breach causing retraumatization and family relationship damage.

Record No: 2021/03355

Neutral Citation: [2023] IECC 11

AN CHÚIRT CHUARDA

THE CIRCUIT COURT

DUBLIN CIRCUIT CIVIL COURT COUNTY OF THE CITY OF DUBLIN

IN THE MATTER OF

M.H

Plaintiff

and

THE CHILD AND FAMILY AGENCY

Defendant

Ex tempore Judgment of Her Honour Judge Jennifer O’Brien delivered this 7th Day of November 2023

1. Background: This matter comes before the Court by way of ordinary civil bill issued on the 28th of June 2021. The plaintiff’s claim for relief is for a data breach occasioned by the negligence and breach of duty including statutory duty on the part of the defendant. The plaintiff says that the defendant processed or circulated the plaintiff’s personal data, including sensitive and confidential data which related to abuse suffered by the plaintiff in the course of her childhood. The defendant accepts that a breach occurred, and that sensitive information was released to the plaintiff’s now deceased brother. The information released contained a detailed attendance note which should not at the relevant time have been provided to the person the subject of the allegations.

The plaintiff gave evidence to this Court of the very unfortunate further consequence of the breach in that the detailed attendance was copied to all of her remaining siblings and also to the wife of her now deceased brother. The plaintiff gave evidence that this has damaged her relationship with her sister and other siblings. The plaintiff has experienced more upset and distress on account of the breach. She had trusted the defendant with this sensitive information and now she feels that she can no longer trust anyone. The plaintiff admits that she is in long-term treatment for mental health difficulties.

2. Turning to the guidelines given by Judge O'Connor in Kaminski v Ballymaguire Foods Limited [2023] IECC 5, with regard to the law on data protection and in particular in relation to damages for non-material loss. Firstly, a mere breach of GDPR is not sufficient to warrant an award for compensation. I am satisfied that the breach in this instance is of a serious nature, in that the most private and sensitive details relating to a serious allegation of abuse in childhood have been processed and handled by the defendants in a most unsatisfactory manner and in a manner that was likely to cause damage to the plaintiff. This is not a case of mere upset, the plaintiff in this case has clearly been retraumatised by the manner in which her data was processed and by the lack of care given when furnishing details of the matter to the person who was the subject of the allegation. There is, to my mind, a link between the damages claimed and the data infringement. I am also satisfied that the damage is genuine based on the evidence I have heard from the plaintiff and in particular regarding the damage caused to her relationships with her siblings and family. I am satisfied that the plaintiff has proved that she has suffered damage and upset of a very distressing kind on account of this breach. I do not believe medical evidence is required in this particular instance as the plaintiff is in a better position than any such expert when giving evidence about the impact on her familial relationships. I did not hear any evidence with regards to steps taken by the defendant to minimise the damage. It is noted that an apology was issued to the plaintiff, albeit some months later.

3. Finally, even where non-material damage is proved as it has been here and where it is not trivial, the guidelines suggest that damages would probably be modest. In the particular circumstances of this case, I am of the view that the damage proved is at the serious end of the scale and as such the award for compensation should be commensurate with that. As such the plaintiff is entitled to damages in the sum of €7,500.

4. In assessing damages at this level, the Court is mindful of The Child and Family Agency’s role and the very high level of trust someone in the plaintiff’s position places in the Agency when making a report of abuse which occurred in childhood and following on from that, the necessity on the part of the Agency of handling such data with the utmost care and propriety.

5. Given the decision of the Court, I will also make an order for costs in favour of the plaintiff, to include any reserved costs and costs of discovery to be taxed in default of agreement.

Appearances

Bébhinn Murphy BL instructed by Robinson Solicitors for the plaintiff.

Jim Benson BL instructed by the Office of Legal Services for the defendant.