Data Protection Breaches-Are You Entitled to Damages?

by

data protection breach ireland

Have you suffered a breach of your data protection rights?

If so, what is your redress?

And are you entitled to damages/compensation for the breach?

If you are concerned that your data protection rights have been breached you may bring a complaint to the Office of the Data Protection Commissioner. This is a free service and covers situations where

  1. There has been no response to a data protection request you have made
  2. There has been a response but it has been inadequate
  3. Data is being withheld incorrectly, by claiming an exemption
  4. Other problems.

If your complaint is upheld the Data Protection Commissioner will seek to ensure compliance with his finding, and can make a legal order concerning the issue. The failure of the data controller to comply with this order can be punished by the Courts.

What about compensation/damages for you, however?

Compensation and Damages

The question arises, though: are you entitled to compensation for mishandling of your personal data, or breaches of your data protection rights?

Section 7 of the Data Protection act, 1988 states that data controllers and data processors owe data subjects a duty of care.

But what does this mean in practice?

A 2013 case, Collins v FBD Insurance p.l.c. [2013 IEHC 137], provides clarity in this area. In this case Mr. Collins’s data protection rights were breached by FBD, according to the Data Protection Commissioner. In fact, there were two findings against FBD for breaches of the Data Protection acts.

Mr. Collins brought a claim to the Circuit Court seeking damages against FBD and was awarded €15,000 general damages by way of compensation for the tort-the civil wrong-and the failure of FBD to discharge its duty of care, as set out in section 7.

FBD appealed the case to the High Court and the High Court found that in order to be entitled to damages a data subject needed to prove 3 things:

  1. There has been a breach of the Data Protection Act and the duty of care contained in section 7
  2. That damage has resulted from the breach
  3. The breach has caused the damage/loss.

If you cannot prove all three elements you will not be entitled to damages for the breach, according to the High Court, and it overturned the decision of the Circuit Court.

Justice Feeney held:

4.4 Section 7 is limited and goes no further than providing for a duty of care that is a duty of care within the law of torts. To obtain a compensation for a breach of duty of care, it is necessary for a claimant to establish that there has been a breach, that there has been damage and that the breach caused such damage. The tort of negligence, unlike the tort of trespass to person, requires proof of damage.

6.1 In this case the plaintiff has failed to prove any damage resulting from the breach of the duty of care owed by the defendant.

Read the full decision here.

UPDATE MAY 2018

Please note the situation has changed since the introduction of GDPR in Ireland from 25th May, 2018.