Court dismisses data protection claim where apology and deletion of erroneous email caused only minor embarrassment without proven damage.

NEUTRAL CITATION:[2025] IECC 8 RECORD 2019/00145

THE CIRCUIT COURT

MIDLAND CIRCUIT COUNTY OF ROSCOMMON

IN THE MATTER OF THE DATA PROTECTION ACT 2018 AND IN THE MATTER OF EU REGULATION 2016/279

BETWEEN:

MARK WALSH

PLAINTIFF AND

IRISH PRISON SERVICE DEFENDANT

Ex Tempore Judgement of Her Honour Judge Karen Fergus delivered on 5th Day of December 2025

1. This matter comes before the Court by way of Equity Civil Bill wherein Pursuant to the Data Protection Act 2018 and in the matter of EU Regulation 2016/279 the Plaintiff seeks a Declaration that the processing of the Plaintiffs personal data by the Defendant was unlawful and seeking Damages pursuant to Section 117 of the Data Protection Act 2018 and Article 82 of the General Data Protection Regulation.

BACKGROUND

2. The Plaintiff is a Prison Officer from Co Roscommon and is and was at all material times an employee of the Defendants. On or about the 22nd November 2018 the Plaintiff interviewed for the job of Chief Officer 11 (Work and Training). As a result of his interview he was placed at No 17 on the panel for the job and an Interview Scoring Sheet was attached to the covering letter advising him of this. These documents were emailed in error to Prison Officer Mark Walsh of Wheatfield Prison and not the Plaintiff who worked in Castlerea Prison at the time.

On 28th December 2018 Prison Officer Mark Walsh of Wheatfield Prison contacted the Plaintiff to advise him he had received the documents on 27th November 2018. The Plaintiff emailed Lorraine Mc Carthy Assistant Governor of Castlerea Prison and requested an immediate investigation. Assistant Governor McCarthy emailed Stephen Kelly Data Protection Administrator immediately and asked him to look into it and advised the plaintiff on 3rd January 2019 that she had contacted Stephan Kelly .

On 12th January 2019 the Plaintiff sent a reminder to the Assistant Governor looking for an update she responded that she had not heard from Mr Kelly and had sent him another email and also gave the Plaintiff Mr Kellys contact number if he wished to follow up himself. On 21st January 2019 the Plaintiff emailed Mr Kelly looking for assurance that what had occurred in his case would not happen again.

The following day 22nd January 2019 Mr Stephen Kelly Data Protection Administrator for the Irish Prison Services sent an email to the Plaintiff which I will read in full

Mark Apologies for the delay in responding. I have spoken to HR Directorate and received assurances that this type of error will not occur again. My apologies on be3half of all for any inconvenience caused to yourself and assure you that all staff in the Irish Prison Service are very conscientious about their work and disappointed when issues like this arise.

Please again accept my apologies.

3. Proceedings were issued in September 2019.

4. The questions for the Court are on all fours with the Kaminski -v- Ballymaguire Foods Limited [2023] IECC 5 where Judge John O’Connor set out guidelines with regard to the law on data protection and in particular in relation to damages for non material loss.

• Was the email sent to another prison officer with the same name a breach of the Plaintiffs personal data such as to constitute an unlawful processing under the 2018 Act and GDPR.

• If the answer is yes did the damage go beyond mere upset or displeasure as a result of the infringement of the Plaintiffs person data.

• If the answer is yes what if any compensation is recoverable.

5. The Breach has been admitted by the Defendants.

6. The Plaintiff gave evidence that he had entered the competition without telling anyone as he had been unsuccessful at past interviews so he wished to keep it to himself. He said his workplace is like a small village and he was subjected to oblique taunts by unnamed colleagues, he did not feel like going into work at times, and he suffered from disturbed sleep. He was distressed and anxious and this went on for about a year.

He also stated he was very disappointed with the Irish Prison Service and felt the apology was a poor effort. He felt annoyed that he got no assurance that his details had been retrieved and/or destroyed. It is noteworthy that the Plaintiffs description of the impact of the breach was almost identical to that experienced by the Plaintiff in the Kaminski case.

It was put to the Plaintiff that if he was experiencing bullying or harassment in the workplace there were procedures that he could have used to address this. He did not identify any person or persons that he claims taunted or bullied him. It was also put to him that there was no medical evidence to support his claim that he lost sleep. There was no evidence that the disclosure of data had any adverse consequences for the Plaintiff. He did not miss any work as a result of this and in fact went on to be successful in the attaining the position of Chief Officer 11 some 9 months later.

The Plaintiff also stated in evidence that he did not feel the apology issued from a senior enough source in the Prison Service. It was put to him that Mr Kelly is Data Protection Administrator and the appropriate person to tissue the apology.

The Defendants submitted that the height of the plaintiffs non material damage claim is that he experienced annoyance, embarrassment and upset.

7. In assessing damages for non material loss the judgement in Kaminski provides a useful list of the factors that might be considered . Not all are relevant to this particular case but they have provided a useful guidance to the Court.

• A mere breach or violation of GDPPR is not sufficient to warrant an award of compensation.

• There is no minimum threshold of seriousness required for a claim for non material damage to exist but it does not cover ‘mere upset’.

• There must be a link between the data infringement and the damages claimed.

• The damage must be genuine and not speculative and must be proved.

• An apology where appropriate may be considered in mitigation of damages.

• Delay in dealing with the breach by either party is a relevant factor in assessing damages.

8. Applying these factors to the facts I am satisfied that there was a data breach which is admitted. The non material damage in this case resulted in some discomfort and embarrassment for the plaintiff in the workplace but I am not satisfied that the threshold beyond mere upset has been reached in this case. There was no evidence that there was a causal link between the breach and his alleged damage.

I am satisfied that the apology that issued some three weeks after the matter came to light acknowledged the breach, apologised for any delay in responding and provided assurance that this would not happen again. Furthermore on 3rd April 2019 the recipient of the email was contacted and asked to delete it from his account and confirm that he had not disseminated it any further. These steps addressed the Plaintiffs concerns in a reasonable timeframe and the apology that issued was a fulsome one.

9. Dismiss the Plaintiffs claim.

10. Having heard brief submissions from the parties regarding the issue of costs I am satisfied that this is an appropriate case in which to exercise my discretion in making no order as to costs.

Appearances

Mr Eugene Deering BL instructed by Mahon Sweeney Solicitors for the plaintiff

Mr Mark Finan BL instructed by the Chief State Solicitor for the defendants