by Laura Fannin , John Deignan August-30-2023 in Commercial & Business, Data Protection
In a recent written judgment of Dublin Circuit Court (Kaminski v BallyMaguire Foods Ltd [2023] IECC 5, a plaintiff was awarded €2,000 in compensation for “non-material damage” – in other words, non-financial loss such as anxiety or distress – in a data breach claim. Below, we examine the significance of this judgment and other recent developments in this area.
Compensation for Non-Material Damage in Data Breach Claims
This area has been something of a hot topic in recent times due to the creation of a new right to compensation for non-material damage coming about by virtue of Article 82 of the GDPR and section 117 of the Irish Data Protection Act 2018 (DPA). We previously discussed this issue here in the context of discussing the Advocate General’s opinion in the case of UI v Österreichische Post AG. More recently, the Court of Justice of the EU (“CJEU”) delivered its judgment in that case and the most salient points to emerge from the CJEU’s judgment are as follows:
- A right to compensation for non-material damage does not automatically arise from a mere infringement of the GDPR;
- The non-material damage must be causally linked to the alleged data breach; and
- The GDPR does not require a de minimisthreshold for non-material damage claims to succeed. In other words, there is no minimum requirement in terms of the “non-material damage” suffered.
While the CJEU’s judgment is helpful in a number of respects, it essentially remitted the question of the amount of compensation to Member State courts when it held at para 54:
"…in the absence of rules of EU law governing the matter, it is for the legal system of each Member State to prescribe [...] the criteria for determining the extent of the compensation payable in that context, subject to compliance with [the] principles of equivalence and effectiveness ".
Accordingly, the CJEU decision did not resolve the question of the amount of compensation to be paid for such claims (where successful) and accordingly the significance of the Kaminski case is that it is one of the first written judgments to consider and make an assessment of the appropriate amount of compensation in the aftermath of the CJEU Judgment.
Background to Kaminski Case
The background to the Kaminski case is that the Plaintiff issued proceedings against his employer seeking compensation for non-material damage, which in this case was humiliation, embarrassment and sleep disturbance. The claim arose from footage which was shown by the Plaintiff’s employer to managers and supervisors of the Defendant company at a training session, in which the Plaintiff was identifiable. The footage in question demonstrated poor food quality and safety practices (of which the Plaintiff’s conduct was an example) and the Plaintiff claimed that he was laughed at and mocked by his colleagues as a result. He also alleged that he suffered stress as a result of the incident, that he felt humiliated and that he had problems with his sleep. Furthermore, the Plaintiff claimed the Defendant had breached his data protection rights under the GDPR and the DPA by virtue of this unlawful processing of his personal data and accordingly he sought compensation under Article 82 of the GDPR and section 117 of the DPA.
Ruling
Judge O’Connor delivered a detailed written judgment holding that he was satisfied that there was an infringement of the Plaintiff’s rights under the GDPR. In doing so, he found that the Defendant had no legal basis for processing the Plaintiff’s personal data in the manner adopted by it and it had not established a legitimate interest for processing the personal data in this manner. Judge O’Connor also found that there was non-material damage arising from that breach and that there was a causal link between the two.
In coming to his decision in the case, Judge O’Connor referred to a list of relevant factors to be considered in determining compensation for non-material damage. The relevant list is contained at paragraph 11.6 of the judgment. Some of the relevant factors which he cited include: a) strong supporting evidence from the plaintiff (e.g. a medical report being strongly desirable; b) the steps taken by the defendant to minimise the risk of harm from the data breach; and c) whether there is any delay in handling the data breach. Judge O’Connor also noted that damages in many of these cases will “probably be modest”. In this regard, he suggested that some form of alternative dispute resolution could be an appropriate forum within which to determine claims of this nature.
Judge O’Connor accepted that the Plaintiff’s loss went beyond “mere upset” and that the incident affected the Plaintiff negatively for a short period of time. Notwithstanding that the Plaintiff’s claim was not supported by a medical report, Judge O’Connor viewed the Plaintiff’s evidence as truthful and he did not perceive him to be exaggerating the damage.
Further Developments
In light of Judge O’Connor’s comments that damages in these types of claims are likely to be “modest”, it looks likely that the appropriate forum for these claims is the District Court (which has monetary jurisdiction for claims of up to €15,000). In this regard, the introduction of Courts and Civil Law (Miscellaneous Provisions) Act 2023 is timely as it provides a mechanism for these claims to be litigated in the District Court. Specifically, Part 12 (Section 77) of that Act amends section 117 of the Data Protection Act 2018 thereby allowing claims to be brought in the District Court. However, that section has not yet been commenced so this is something to watch out for over the coming months.
Conclusion
In conclusion, the recent developments in this area are helpful for companies in that they suggest that damages for successful non-material damage claims are likely to be modest. Furthermore, the legislative amendment to the DPA referred to above (once fully implemented) should lead to lower legal costs being awarded to plaintiffs.
For more information on this topic, please contact Laura Fannin (lfannin@hayes-solicitors.ie) or John Deignan (jdeignan@hayes-solicitors.ie) of this office.
Back to Full NewsShare this article:
About the Authors
Laura Fannin
Laura is a partner in the Commercial & Business team at Hayes solicitors. Laura advises clients on a diverse range of corporate and commercial matters and regulatory requirements. She is an experienced adviser on terms and conditions of sale and purchase, IT issues, data protection, product liability, advertising and promotions, intellectual property and a wide range of commercial agreements.
John Deignan
John Deignan is an associate solicitor in the Commercial & Business team at Hayes solicitors. John predominantly specialises in commercial litigation and dispute resolution, and has acted for a wide variety of private companies, State bodies and financial institutions in contract law cases, enforcement and recovery actions, commercial landlord and tenant disputes and defamation actions.