Banner1.jpg

Dublin Circuit Civil Court - 2023 IECC 11

From GDPRhub
Circuit Court - 2023 IECC 11
Courts logo1.png
Court: Circuit Court (Ireland)
Jurisdiction: Ireland
Relevant Law:
Kaminski v Ballymaguire Foods
Decided: 07.11.2023
Published: 22.01.2025
Parties: Child and Family Agency Ireland
National Case Number/Name: 2023 IECC 11
European Case Law Identifier:
Appeal from:
Appeal to:
Original Language(s): English
Original Source: Courts.ie (in English)
Initial Contributor: ao

A court awarded a data subject €7,500 in non-material damages after the Child and Family Agency unlawfully disclosed her data to her former abuser.

English Summary

Facts

The data subject took a civil claim against the controller, here the Child and Family Agency, for unlawfully disclosing her data. The controller had been in possession of sensitive data relating to childhood abuse suffered by the data subject.

The controller accepted that it had caused a data breach, which resulted in the data subject’s now deceased brother having access to the information. The brother had been the subject of the report of abuse made by the data subject to the controller. After the report had been disclosed to her brother, her other siblings and family members also found out about the incident.

The data subject reported that this caused her extreme distress and resulted in a lack of trust in the controller and further mental health problems.

Holding

The court found that the data subject’s relationship with her family members had been damaged due to the data breach. The court reiterated that a breach of the GDPR does not automatically warrant damages. The court highlighted that in this case, the data subject had been retraumatised through the actions of the controller.

The court classified the data breach as serious in nature and awarded the data subject with damages in the sum of €7,500. In setting this number, the court highlighted the controller’s role in handling sensitive data and the high level trust required.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the English original. Please refer to the English original for more details.

Record No: 2021/03355


                                                       Neutral Citation: [2023] IECC 11

                                AN CHÚIRT CHUARDA

                                 THE CIRCUIT COURT




DUBLIN CIRCUIT CIVILCOURT                                 COUNTY OFTHE CITY OF

                                                          DUBLIN




IN THE MATTER OF


                                           M.H

                                                                   Plaintiff

                                            and


                         THE CHILDAND FAMILYAGENCY

                                                                     Defendant




Ex tempore Judgment of Her Honour Judge Jennifer O’Brien delivered this 7 Day ofth

November 2023

    1. Background: This matter comes before the Court by way of ordinary civil bill issued

       on the 28 of June 2021. The plaintiff’s claim for relief is for a data breach occasioned

       by the negligence and breach of duty including statutory duty on the part of the

       defendant. The plaintiff says that the defendant processed or circulated the plaintiff’s

       personal data, including sensitive and confidential data which related to abuse suffered
       by the plaintiff in the course of her childhood. The defendant accepts that a breach

       occurred, and that sensitive information was released to the plaintiff’s now deceased

       brother. The information released contained a detailed attendance note which should

       not at the relevant time have been provided to the person the subject of the allegations.
       The plaintiff gave evidence to this Court of the very unfortunate further consequence

       of the breach in that the detailed attendance was copied to all of her remaining siblings


                                             1    and also to the wife of her now deceased brother. The plaintiff gave evidence that this

    has damaged her relationship with her sister and other siblings. The plaintiff has
    experienced more upset and distress on account of the breach. She had trusted the

    defendant with this sensitive information and now she feels that she can no longer trust

    anyone. The plaintiff admits that she is in long-term treatment for mental health

    difficulties.


2. Turning to the guidelines given by Judge O'Connor in Kaminski v Ballymaguire Foods

    Limited [2023] IECC 5, with regard to the law on data protection and in particular in
    relation to damages for non-material loss. Firstly, a mere breach of GDPR is not

    sufficient to warrant an award for compensation. I am satisfied that the breach in this

    instance is of a serious nature, in that the most private and sensitive details relating to

    a serious allegation of abuse in childhood have been processed and handled by the
    defendants in a most unsatisfactory manner and in a manner that was likely to cause

    damage to the plaintiff. This is not a case of mere upset, the plaintiff in this case has

    clearly been retraumatised by the manner in which her data was processed and by the
    lack of care given when furnishing details of the matter to the person who was the

    subject of the allegation. There is, to my mind, a link between the damages claimed

    and the data infringement. I am also satisfied that the damage is genuine based on the

    evidence I have heard from the plaintiff and in particular regarding the damage caused
    to her relationships with her siblings and family. I am satisfied that the plaintiff has

    proved that she has suffered damage and upset of a very distressing kind on account of

    this breach. I do not believe medical evidence is required in this particular instance as
    the plaintiff is in a better position than any such expert when giving evidence about the

    impact on her familial relationships. I did not hear any evidence with regards to steps

    taken by the defendant to minimise the damage. It is noted that an apology was issued

    to the plaintiff, albeit some months later.


3. Finally, even where non-material damage is proved as it has been here and where it is

    not trivial, the guidelines suggest that damages would probably be modest. In the

    particular circumstances of this case, I am of the view that the damage proved is at the
    serious end of the scale and as such the award for compensation should be

    commensurate with that. As such the plaintiff is entitled to damages in the sum of

    €7,500.

                                            2    4. In assessing damages at this level, the Court is mindful of The Child and Family

        Agency’s role and the very high level of trust someone in the plaintiff’s position places
        in the Agency when making a report of abuse which occurred in childhood and

        following on from that, the necessity on the part of the Agency of handling such data

        with the utmost care and propriety.


    5. Given the decision of the Court, I will also make an order for costs in favour of the

        plaintiff, to include any reserved costs and costs of discovery to be taxed in default of

        agreement.




Appearances

Bébhinn Murphy BL instructed by Robinson Solicitors for the plaintiff.

Jim Benson BL instructed by the Office of Legal Services for the defendant.


































                                               3