[co-authors: Sarah Kelly, Matthew O'Shea]

The Irish Supreme Court, on 24 July 2025, issued a landmark decision offering greater clarity on non-material damages in the context of privacy claims under the General Data Protection Regulation (GDPR). The judgment in Dillon v Irish Life Assurance plc[1] (Dillon) marks a significant development for both individuals seeking compensation following data protection breaches and organisations responsible for safeguarding personal information.

1. GDPR and Non-Material Damages

The GDPR ensures high standards of data protection across Europe, compelling organisations to prioritise individuals’ rights regarding their personal data. The GDPR recognises that harm arising from data breaches is not always financial. Article 82 explicitly allows individuals to claim compensation for both material and non-material damage – meaning that emotional distress, anxiety, or reputational harm may also be grounds for compensation.

Non-material damage refers to injuries that do not result in direct financial loss. This type of damage includes anxiety, distress, loss of reputation, inconvenience, or upset arising from the mishandling of personal information. The CJEU has considered this type of damage and the requirements for bringing claims for non-material damage, discussed in our blog post: Europe: CJEU holds that mere infringement of the GDPR does not give rise to a right to compensation. In Ireland, the Dillon decision is significant as it is the first time that the Supreme Court has considered this issue.

2. Are claims for non-material damages “personal injuries claims“?

The Supreme Court in Dillon considered whether claims for non-material damage under the GDPR, such as emotional distress from a data breach, should be subject to the same procedures as personal injury claims. Specifically, the Court considered whether a claimant is required to obtain authorisation from the Injuries Resolution Board (formerly the Personal Injuries Assessment Board or PIAB) before issuing proceedings.

In Dillon, a cyber incident occurred when Irish Life Assurance plc accidentally issued letters, containing Dillon’s personal and financial information, to a third party. Dillon brought Circuit Court proceedings, arguing that the data breach resulted from negligence and breach of statutory duty, and claiming damages for “distress, upset, anxiety, inconvenience, loss and damage.”

Both the Circuit Court and, on appeal the High Court, found that Dillon’s claim amounted to seeking damages for personal injury, and consequently, PIAB authorisation was required before the proceedings could be validly issued.

Allowing Dillon’s appeal, the Supreme Court held that such claims for non-material damage do not require authorisation from PIAB. The Supreme Court clarified that only claims for recognised psychiatric injuries – those meeting the legal threshold of personal injuries – would necessitate following the PIAB procedure. Where a claimant alleges only general distress, anxiety, or upset that does not amount to a medically recognised psychiatric disorder, PIAB authorisation is not needed.

However, the Supreme Court also made it clear that the scope for obtaining significant compensation for these types of claims is very, very modest. Claimants seeking damages solely for distress or inconvenience, falling short of a psychiatric illness, should not expect more than very modest awards.

3. How will Dillon impact data controllers and data processors?

The Supreme Court’s decision has important consequences for both individuals and controllers / processors in Ireland.

• Lifting Procedural Barriers: Claimants no longer need to obtain PIAB authorisation when seeking non-material damages under the GDPR for harms below the threshold of personal injury. This simplifies the process for bringing such claims to court.

• Pleading Requirements: The Court emphasised that claimants remain responsible for clearly specifying the type of loss they are claiming and the legal basis for that claim. If a claimant alleges a medically recognised psychiatric injury, then the claim will be treated as a personal injury, requiring PIAB authorisation and potentially attracting higher damages.

• Limits on Compensation: The judgment also serves as a warning that awards for non-material damages – unless they meet the higher threshold of psychiatric injury – will be very, very modest. Controllers / processors may find reassurance in the Court’s decision to keep compensation for minor distress low, retaining the PIAB requirement for larger value claims.

[1] [2025] IESC 37.

[View source.]