High Court of Ireland Decisions

 

THE HIGH COURT

[2024] IEHC 20

[2023 No. 156 CA]

 

BETWEEN:

 

SIOBHAN KEANE

APPELLANT  / PLAINTIFF

AND

 

CENTRAL STATISTICS OFFICE

RESPONDENT / DEFENDANT

 

Judgment of Mr. Justice Barry O'Donnell delivered on the 17 day of January, 2024.

INTRODUCTION

1.      This matter comes before the court by way of an appeal from a decision of the Circuit Court. The defendant had raised a preliminary issue in its amended Defence that, insofar as the plaintiff claimed damages for personal injuries, the claim was not properly constituted because it had not been authorised by the Personal Injuries Assessment Board ("PIAB"). The Circuit Court agreed with the arguments made by the defendant and found that, while the plaintiff's proceedings remain extant, the principal remedy sought by the plaintiff was damages for personal injury and that aspect of the claim was bound to fail because of her failure to obtain prior authorisation under the Personal Injuries Assessment Board Act 2003 ("the Act of 2003").

 

2.      Section 12(1) of the Act of 2003 provides that: -

"Unless and until an application is made to the Board under section 11 in relation to a relevant claim and then only when the bringing of those proceedings is authorised under section 14, 17, 32 or 36, rules under section 46(3) or section 49 and subject to those sections or rules, no proceedings may be brought in respect of that claim."

 

3.      In Clarke v. O'Gorman [2014] 3 I.R. 340, the Supreme Court clarified that section 12(1) of the Act of 2003 does not operate as a jurisdictional bar, but instead operates to bar a remedy where a plea to that effect was made by the defendant. In that regard, section 12(1) of the Act of 2003 corresponded with various provisions in the Statute of Limitations 1957, as amended.

 

4.      Here, it is common case that the plaintiff had not sought an authorisation from PIAB prior to the commencement of the proceedings, and the issue has been pleaded as a preliminary matter by the defendant. As such, the court must consider the nature of the case in order to determine if prior authorisation ought to have been sought prior to the commencement of the proceedings. For the reasons set out in more detail below, the court finds that the only substantive remedies sought by the plaintiff are damages for personal injuries and that an authorisation should be sought. Thus, the defendant will succeed on the preliminary issue raised in the amended Defence.

 

THE PLAINTIFF'S PLEADED CASE

5.      The facts giving rise to the proceedings are relatively straightforward. The plaintiff was employed by the defendant as a census enumerator for a period in 2016. The defendant processed sensitive personal data in respect of the plaintiff for the purpose of that employment, including data relating to salary and tax. In November 2017, the defendant erroneously disclosed the plaintiff's P45 documents to third parties, as part of a broader disclosure. It appears that the plaintiff was among approximately 3000 data subjects affected by the disclosure.

 

6.      The plaintiff commenced proceedings by way of a Civil Bill dated 2 April 2019. The plaintiff claims that the defendant acted in breach of contract, and was negligent and breached its duty of care, including its statutory duty, towards the plaintiff. As a result, it is claimed, the defendant breached the plaintiff's privacy rights, her right of confidence, and her data protection rights. The principal reliefs claimed are an order directing the defendant to disclose the identity of the third party to whom the data was disclosed, and damages for (a) breach of confidence, (b) breach of privacy rights, and (c) breach of data protection rights. There is no claim for damages for breach of contract, and no claim in terms for damages for personal injury. The pleaded particulars of loss are stated to be "miscellaneous expenses (not yet ascertained)".

 

7.      Nevertheless, in describing the consequences of the breach in the Indorsement of Claim, the plaintiff placed heavy emphasis on the fact that she claims to have suffered anxiety and distress due to the actions of the defendant in disclosing her personal data. In particular, at paragraphs 10 and 11 of the Indorsement of Claim the following is pleaded:-

"10. As a result of the breach, the Plaintiff has suffered from symptoms of severe stress and anxiety. The symptoms affect the Plaintiff in her daily life. The upset is manifested by a deterioration of the Plaintiff's appetite and has affected her sleep.

11. The Plaintiff suffers from Psoriatic Arthritis, the anxiety and stress caused by the breach has exacerbated the Plaintiff's symptoms."

 

8.      The defendant raised a notice of particulars, which was replied to on 30 July 2019. The notice raised several queries for clarification, including queries seeking more detailed information on the claims that the plaintiff suffered anxiety and distress; and the defendant asked whether the plaintiff was seeking damages for same. In the replies, the plaintiff states that she suffered initial nausea and anxiety when she was informed of the data breach, and goes on to state that she suffered significant stress which manifested itself in difficulty sleeping and loss of appetite. The plaintiff confirmed that she will be seeking damages for the stress and anxiety caused as a result of the data breach.

 

9.      The plaintiff was asked to provide full particulars of what symptoms of psoriatic arthritis allegedly were exacerbated because of the breach. In that regard, the plaintiff stated that at the time of the data breach she was symptom-free of psoriatic arthritis and that she had not taken that medication for over a year prior to the breach. The following is then stated as part of the reply to query 7:-

"However, following this data breach the Plaintiff began to suffer from pain and stiffness in her shoulder, hands, wrists, chest and feet again and reluctantly had to return to use of methotrexate to ease her symptoms. The Plaintiff attended Dr Sheehy's Rheumatology Clinic at Waterford Regional Hospital and discussed the severity of the side effects of the Psoriatic Arthritis she was now experiencing. At this appointment Dr Sheehy stated that the most likely reason for the return of the pain and stiffness was stress as Arthritis is particularly susceptible to stress. The Plaintiff also received an injection on the shoulder joint as she was experiencing limited movement in her shoulder. The Appointment with Dr Sheehy took place in or around August 2018."

 

10.  Finally in this regard, the notice for particulars sought clarification of factual and legal basis for the reliefs claimed in the Civil Bill. In reply, the Plaintiff asserted that the defendant breached the duty of care provided for in section 7 of the Data Protection Act 1988 and referred to the decision of Feeney J. in Collins v. FBD Insurance plc [2013] IEHC 137. The plaintiff asserted that the case was authority for the proposition that to obtain compensation for a breach of the section 7 duty of care, it was necessary for the claimant to establish that there had been a breach, that there had been damage, and that the breach caused the damage. The plaintiff expressly asserted that the defendant breached the Data Protection Act, 1988 and the duty of care imposed on it by section 7, and as a result the plaintiff suffered damage/loss caused by said breach. Significantly, from the court's perspective, the damage or loss suffered by the plaintiff is stated to be that particularised to the Indorsement of Claim.

 

11.  The Defence was delivered on 2 September 2019 and the matter progressed until March 2023, when the defendant was given permission by the Circuit Court to amend its Defence to include a plea raising the preliminary issue.

 

12.  The case came before His Honour Judge McAleese who delivered a helpful and considered written judgment on 30 June 2023. The judgment dealt with the preliminary issue only, and, following a detailed discussion of the issues, Judge McAleese concluded that the plaintiff's claim was a "civil action" within the meaning of section 3(d) of the Act of 2003. The learned Judge found that the plaintiff should have applied to PIAB for the assessment of claim pursuant to section 11 of the Act of 2003, but she had not done that. As a consequence, and having regard to the approach adopted by the Supreme Court in Clarke v. O'Gorman, the Circuit Court found that the plaintiff's proceedings remain extant but the principal remedy, damages for personal injury, which was being sought by the plaintiff was bound to fail by reason of non-compliance with the Act of 2003, and the preliminary issue raised by the defendant in the amended defence was bound to prevail. As a further consequence the learned Judge found that that state of affairs "will have the effect of restricting the plaintiff's claim to such other damages, if any, as might be available for the truly limited (insofar as it concerns the plaintiff) and accidental data breach which occurred in this case."

 

13.  The plaintiff issued a Notice of Appeal on 21 July 2003, from that decision of Judge McAleese and this court had the benefit of helpful written and oral submissions made on behalf of each of the parties.

 

LEGAL PRINCIPLES

14.  The Act of 2003 describes the civil actions to which it applies in section 3, which provides: -

"This Act applies to the following civil actions-

(a)   a civil action by an employee against his or her employer for negligence or breach of duty arising in the course of the employee's employment with that employer,

[...]

(d)   a civil action not falling within any of the preceding paragraphs (other than one arising out of the provision of any health service to a person, the carrying out of a medical or surgical procedure in relation to a person or the provision of any medical advice or treatment to a person)."

 

15.  Accordingly, and as noted by the Supreme Court in Clarke v O'Gorman, the Act of 2003 applies to a wide range of actions. The qualifying criteria is the nature of the relief sought in those actions, as confirmed by section 4 (1), which provides that:-

""civil action" means an action intended to be pursued for the purpose of recovering damages, in respect of a wrong, for -

(a)   personal injuries, or

(b)   both such injuries and damage to property (but only if both have been caused by the same wrong),

but does not include -

(i)     an action intended to be pursued in which, in addition to damages for the foregoing matters, it is bona fide intended, and not for the purpose of circumventing the operation of section 3, to claim damages or other relief in respect of any other cause of action,"

 

16.  Section 4(2) of the Act of 2003 goes on to confirm that for the purposes of a "civil action", the word "wrong" has the same meaning as it has in the Civil Liability Act, 1961 ("the Act of 1961"). As noted by the Supreme Court, that is "a concept of the broadest application which captures most, if not every, cause of action litigated in civil proceedings at common law". "Wrong" is defined in section 2(1) of the Act of 1961 as:-

"... a tort, breach of contract or breach of trust, whether the act is committed by the person to whom the wrong is attributed or by one for whose acts he is responsible, and whether or not the act is also a crime, and whether or not the wrong is intentional."

 

17.  In addition to incorporating the definition of a "wrong" from the Act of 1961, the Act of 2003 also adopts the definition of "personal injury" from the same Act. As set out below this is significant to the claims made in this case and certain arguments made by the plaintiff which sought to cast the claims as something other than a claim for damages for personal injuries. The Act of 1961 defines "personal injury" as follows: -

""personal injury" includes any disease and any impairment of a person's physical or mental conditions, and "injured" shall be construed accordingly;"

 

18.  The decision in Clarke v. O'Gorman explains the critical importance of understanding the distinction between, on the one hand, the cause of action pleaded, and, on the other hand, the relief being claimed in respect of the wrong alleged in the cause of action. As put by O'Donnell J. (as he then was) at paragraph 18, "[p]ersonal injuries are the injuries suffered which, if caused by a wrong, may give rise to a remedy, most often an award of damages." That distinction is further explained at paragraph 29, where the Court was considering whether the Act of 2003 required PIAB authorisation for a claim in tort actionable per se, in that case trespass to the person:-

"For reasons already touched on, causes of action on the one hand, and claims for personal injuries on the other, are not similar concepts. In my view, it is wrong to pose the question whether this was an action for trespass to the person and assault or a civil action for personal injuries, as if these were mutually exclusive categorisations. They are not. A cause of action is something logically and legally different from the type of damage suffered as a result of the facts giving rise to the cause of action. The fact that a claim can be described as one for personal injuries does not mean it is not an action for assault, for example. Since they are different things, the description of the cause of action on the one hand and the damage alleged in consequence on the other are not mutually exclusive categories of causes of action, but instead overlap and intersect. Some claims for trespass to the person and assault may not involve personal injuries (although that is rare), and there are obviously many actions for personal injuries that do not involve assault (although they may all be, at some technical level, a trespass to the person). But the vast bulk of actions for trespass to the person and assault will also be, and be properly described as, actions for personal injuries. That this is so is reinforced by the provisions of s. 17 of the Act of 2003 which permits, but does not require, the Board to refuse to provide an assessment in certain cases containing elements out of the ordinary."

 

19.  Hence, regardless of how the proceedings may be described colloquially, the actions captured by the Act of 2003 are those where the remedies claimed in the action are damages for personal injuries. One of the potential difficulties with the operation of the Act of 2003 highlighted by the Supreme Court arose in cases which were not obviously identifiable as personal injuries cases. The situation was described by the Supreme Court in paragraph 19 of Clarke v. O'Gorman in the following way: -

"But at the margins, of which this case as an illustration, the requirement to approach proceedings drafted to assert causes of actions by reference to whether they are or are not 'personal injuries proceedings' causes problems, particularly when there is no standard form required for the drafting of a claim, and pleadings will often seek not so much to identify with precision the claims made, as employ language which is broad enough to facilitate any possible argument which might prove helpful in the course of the proceedings. This is particularly problematic because the Act of 2003 does not, as it might, provide, for example, that if any claim is made in respect of personal injuries than the entire proceedings are captured by the Act of 2003. Subsection (i) of s. 4(1) excludes actions for personal injuries from the concept of civil action, if, in addition to any claim for damages for personal injuries, 'it is bona fide intended, and not for the purpose of circumventing the operation of section 3, to claim damages or other relief in respect of any other cause of action.'"

 

DISCUSSION

20.  Returning to the current case, the causes of action identified in the Civil Bill are for breach of contract, negligence, breach of duty including breach of statutory duty, breach of confidence and breach of privacy rights. These clearly are "wrongs" within the meaning of section 2(1) of the Act of 1961. Damages are sought by the plaintiff in respect of these wrongs. What is the nature of the damage that the plaintiff claims to have suffered in respect of those wrongs? Here, there is a need to adopt a common sense approach to the pleadings, including the replies to particulars. There is no room for doubt in my mind that the entire tenor of the pleaded case is that as a result of the breach of contract and torts alleged to have been committed by the defendant the only damage expressly identified by the plaintiff was stress, anxiety, distress and a consequent exacerbation of her psoriatic arthritis. Significantly, no other specific loss or damage is referred to in the Civil Bill or in the replies to particulars. In those premises, prima facie, this strongly supports the defendant's argument that this claim is a civil action intended to be pursued for the purposes of recovering damages for personal injuries in respect of a wrong. As such, there is a strong argument that the defendant is correct in its analysis and its preliminary objection that the proceedings are not properly constituted. However, before reaching a final conclusion, it is necessary to engage with certain arguments made by the plaintiff.

 

21.  In their submissions, both parties placed considerable emphasis on Clarke v. O'Gorman [2014] 3 I.R. 340, and on the terms of the Act of 2003.

 

22.  In essence, the argument made by the defendant is that the only loss and damage which has been expressly pleaded by the plaintiff in her Civil Bill consists of stress and anxiety, insomnia, augmentation of her arthritis, loss of appetite and stiffness. These are all impairments of the plaintiff's physical or mental condition and thus are firmly captured by the definition of "personal injury" in Act of 2003 (adopting the definition from the Act of 1961). The defendant highlights that, as found by Judge McAleese, none of the exceptions in section 4 of the Act 2003 are applicable. As noted above, this appears to be correct.

 

23.  The approach adopted by the plaintiff on this appeal was somewhat unusual. Two main arguments were made. First, according to the plaintiff, this is not a case in which any physical personal injury has arisen; instead, it is a civil action for damages or compensation in tort pursuant to section 7 of the Data Protection Act 1988 and Article 23 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data [1995] OJ L281 ("Dir 95/46/EC"). The plaintiff maintains that she remains entitled to bring a claim seeking compensation for the data breach the subject of these proceedings and is entitled to have the court take account of anxiety, distress and stress insofar as this can be evidenced at the trial of the action. However, the plaintiff seeks to argue that because she cannot recover damages in respect of those ailments the need to obtain authorisation from PIAB has not been engaged.

 

24.  As put by the plaintiff's submissions at paragraph 10, "[w]hile the pleadings and particulars do suggest that a flareup of a pre-existing Psoriatic Arthritis condition may be linked to stress, there is no evidence to support this or to claim that the stress that the Plaintiff's GP suggested might be a causative factor, in-fact was that or a causative factor." With respect, this submission contradicts the entire tenor of the matters pleaded in the Civil Bill and replies to particulars. Those pleadings very clearly lead the reader, whether the court or the defendant, to understand that the claim is made that the plaintiff's medical and psychological difficulties flowed directly from the wrongful data release by the defendant.

 

25.  The plaintiff goes on to assert that this cannot be a claim for personal injuries because the nature of the harm suffered by the plaintiff does not amount to a recognisable psychiatric injury of the type that would attract an award of damages by reference to existing principles.

 

26.  The court does not accept that submission. The definition of "personal injuries" in the Act of 2003 expressly is framed by reference to the definition in section 2 of the Act of 1961. That definition is very broad and includes "any impairment of a person's physical or mental condition". It is not restricted to impairments that currently give rise to recoverable damages or loss in an action.

 

27.  In my view, a claim that arising from a tort or breach of contract, a person has suffered stress or anxiety and an exacerbation of pre-existing arthritis is a claim that constitutes a civil action that requires authorisation from PIAB under the terms of the Act of 2003. In reaching that conclusion it is important to highlight that this is a claim in which no other specific loss or damage is pleaded by the plaintiff. Therefore, but bearing in mind the restrictions identified by the Supreme Court in Murray v. Budds [2017] 2 I.R. 178, it is not necessary to engage with potential issues that may arise in other cases as to whether an authorisation is required where there is an ancillary claim for stress or distress in addition to a primary claim for other pecuniary or non-pecuniary damages claimed to arise from a tort or breach of contract.

 

28.  The second main point made by the plaintiff related to the breach of data protection law. The plaintiff correctly emphasises that these proceedings predate the introduction of the GDPR regime, and as such fall to be determined by reference to the Data Protection Act, 1988 and Dir 95/46/EEC. Article 23(1) of the Directive provides that "Member States shall provide that any person who suffered damage as a result of an unlawful processing operation or of any act incompatible with the national provisions adopted pursuant to this Directive is entitled to receive compensation from the controller for the damage suffered.".

 

29.  Section 7 of the Act of 1988 gives effect to Article 23, and provides that:-

"7. - For the purposes of the law of torts and to the extent that that law does not so provide, a person, being a data controller or a data processor, shall, so far as regards the collection by him of personal data or information intended for inclusion in such data or his dealing with such data, owe a duty of care to the data subject concerned ..."

 

30.  The primary authority on the correct meaning and operation of section 7 is Collins v. FBD Insurance plc [2013] IEHC 137. In that case, Feeney J. carried out an extensive analysis of the provision and the underlying Directive and found at paragraph 3.6 that section 7 does not provide either for strict liability or the automatic payment of compensation. Instead the section "limits itself to providing for the existence of a duty of care within the law of torts". It can be noted that while this was not an issue that arose in Collins, by framing the section 7 duty of care as one arising within the law of torts, the inevitable conclusion is that this is a "wrong" within the meaning of the Act of 1961. In Collins, the court proceeded from the proposition that a completed tort requires damages to find that in the absence of proof of damage no compensation can be awarded for a breach of section 7.

 

31.  Counsel for the plaintiff clarified in the course of the hearing before this court that the plaintiff was not seeking to have this court revisit or alter the approach adopted by Feeney J. to section 7 of the Act of 1988. Accordingly, with respect to the claim for breach of the section 7 duty of care, the position remains that a claim arising from an alleged breach of the section 7 duty of care is a tort in respect of which it is necessary for the plaintiff to demonstrate proof of damage to recover compensation. This brings the plaintiff back to a place in which the only damage pleaded in the proceedings are damages for "personal injuries" within the meaning of section 2 of the Act of 1961, and no application for authorisation was made in that regard to PIAB.

 

32.  Finally, although this was not pressed by the plaintiff, the court does not consider that the plaintiff's claim in this case benefits from the exceptions set out in section 4(1) of the Act of 2003. Section 4(1)(i) of the Act of 2003 excludes claims where, in addition to a claim for personal injuries, it is bona fide intended to claim damages or other relief "in respect of any other cause of action". In Clarke v O'Gorman, the Supreme Court made clear that the "other cause of action" referred to should be interpreted or understood as meaning "other than the cause of action giving rise to the claim for personal injuries." This is explained in paragraph 30, where O'Donnell J. observed: -

"A civil action is defined as an action for the purpose of recovering damages in respect of a wrong, for personal injuries. The term 'other cause of action' refers back to 'wrong' and not 'personal injuries'. The phrase 'other cause of action' in s. 4(1)(i) means therefore in my view a cause of action other than that in which personal injuries are claimed."

 

33.  Here, while a number of causes of action are pleaded by the plaintiff, the Civil Bill makes clear that the only remedies claimed in respect of each are damages, and in that regard the only loss or damage specifically pleaded is in the nature of personal injuries.  

 

SUMMARY

34.  In all the premises and for the reasons set out above, the plaintiff was required by the Act of 2003 to make an application to PIAB for an assessment of her claims prior to commencing these proceedings. It follows that the preliminary objection raised by the defendant must succeed and the plaintiff's claims in that regard cannot proceed. As this judgment is being delivered electronically, I will list the matter for a final hearing to address the formulation of final orders, including costs. In that regard, I will invite the parties to consider the judgment with a view to agreeing, if possible, on the terms of the final orders and list the matter before me on 1 February 2024.