Dublin Circuit Civil Court - 2023 IECC 11
Circuit Court - 2023 IECC 11 | |
---|---|
Court: | Circuit Court (Ireland) |
Jurisdiction: | Ireland |
Relevant Law: | Kaminski v Ballymaguire Foods |
Decided: | 07.11.2023 |
Published: | 22.01.2025 |
Parties: | Child and Family Agency Ireland |
National Case Number/Name: | 2023 IECC 11 |
European Case Law Identifier: | |
Appeal from: | |
Appeal to: | |
Original Language(s): | English |
Original Source: | Courts.ie (in English) |
Initial Contributor: | ao |
A court awarded a data subject €7,500 in non-material damages after the Child and Family Agency unlawfully disclosed her data to her former abuser.
English Summary
Facts
The data subject took a civil claim against the controller, here the Child and Family Agency, for unlawfully disclosing her data. The controller had been in possession of sensitive data relating to childhood abuse suffered by the data subject.
The controller accepted that it had caused a data breach, which resulted in the data subject’s now deceased brother having access to the information. The brother had been the subject of the report of abuse made by the data subject to the controller. After the report had been disclosed to her brother, her other siblings and family members also found out about the incident.
The data subject reported that this caused her extreme distress and resulted in a lack of trust in the controller and further mental health problems.
Holding
The court found that the data subject’s relationship with her family members had been damaged due to the data breach. The court reiterated that a breach of the GDPR does not automatically warrant damages. The court highlighted that in this case, the data subject had been retraumatised through the actions of the controller.
The court classified the data breach as serious in nature and awarded the data subject with damages in the sum of €7,500. In setting this number, the court highlighted the controller’s role in handling sensitive data and the high level trust required.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
Record No: 2021/03355 Neutral Citation: [2023] IECC 11 AN CHÚIRT CHUARDA THE CIRCUIT COURT DUBLIN CIRCUIT CIVILCOURT COUNTY OFTHE CITY OF DUBLIN IN THE MATTER OF M.H Plaintiff and THE CHILDAND FAMILYAGENCY Defendant Ex tempore Judgment of Her Honour Judge Jennifer O’Brien delivered this 7 Day ofth November 2023 1. Background: This matter comes before the Court by way of ordinary civil bill issued on the 28 of June 2021. The plaintiff’s claim for relief is for a data breach occasioned by the negligence and breach of duty including statutory duty on the part of the defendant. The plaintiff says that the defendant processed or circulated the plaintiff’s personal data, including sensitive and confidential data which related to abuse suffered by the plaintiff in the course of her childhood. The defendant accepts that a breach occurred, and that sensitive information was released to the plaintiff’s now deceased brother. The information released contained a detailed attendance note which should not at the relevant time have been provided to the person the subject of the allegations. The plaintiff gave evidence to this Court of the very unfortunate further consequence of the breach in that the detailed attendance was copied to all of her remaining siblings 1 and also to the wife of her now deceased brother. The plaintiff gave evidence that this has damaged her relationship with her sister and other siblings. The plaintiff has experienced more upset and distress on account of the breach. She had trusted the defendant with this sensitive information and now she feels that she can no longer trust anyone. The plaintiff admits that she is in long-term treatment for mental health difficulties. 2. Turning to the guidelines given by Judge O'Connor in Kaminski v Ballymaguire Foods Limited [2023] IECC 5, with regard to the law on data protection and in particular in relation to damages for non-material loss. Firstly, a mere breach of GDPR is not sufficient to warrant an award for compensation. I am satisfied that the breach in this instance is of a serious nature, in that the most private and sensitive details relating to a serious allegation of abuse in childhood have been processed and handled by the defendants in a most unsatisfactory manner and in a manner that was likely to cause damage to the plaintiff. This is not a case of mere upset, the plaintiff in this case has clearly been retraumatised by the manner in which her data was processed and by the lack of care given when furnishing details of the matter to the person who was the subject of the allegation. There is, to my mind, a link between the damages claimed and the data infringement. I am also satisfied that the damage is genuine based on the evidence I have heard from the plaintiff and in particular regarding the damage caused to her relationships with her siblings and family. I am satisfied that the plaintiff has proved that she has suffered damage and upset of a very distressing kind on account of this breach. I do not believe medical evidence is required in this particular instance as the plaintiff is in a better position than any such expert when giving evidence about the impact on her familial relationships. I did not hear any evidence with regards to steps taken by the defendant to minimise the damage. It is noted that an apology was issued to the plaintiff, albeit some months later. 3. Finally, even where non-material damage is proved as it has been here and where it is not trivial, the guidelines suggest that damages would probably be modest. In the particular circumstances of this case, I am of the view that the damage proved is at the serious end of the scale and as such the award for compensation should be commensurate with that. As such the plaintiff is entitled to damages in the sum of €7,500. 2 4. In assessing damages at this level, the Court is mindful of The Child and Family Agency’s role and the very high level of trust someone in the plaintiff’s position places in the Agency when making a report of abuse which occurred in childhood and following on from that, the necessity on the part of the Agency of handling such data with the utmost care and propriety. 5. Given the decision of the Court, I will also make an order for costs in favour of the plaintiff, to include any reserved costs and costs of discovery to be taxed in default of agreement. Appearances Bébhinn Murphy BL instructed by Robinson Solicitors for the plaintiff. Jim Benson BL instructed by the Office of Legal Services for the defendant. 3