Fáilte o Bhaile Átha Cliath — Greetings from Dublin!

Since before May 2018, there has been much discussion about Article 82 of the EU General Data Protection Regulation which grants individuals the right to seek compensation for "material or non-material damage" arising from an infringement of the GDPR. One issue discussed has been what is the level of nonmaterial damage that must be established to bring a claim under Article 82?

This issue led to cases being referred to the Court of Justice of the European Union. In the Österreichische Post Case, the CJEU confirmed the right to compensation under Article 82 requires an infringement of the GDPR, damage suffered by an individual and a causal link between the damage and the infringement.

However, there is no minimum threshold of damage required for an individual to be awarded compensation. It is up to each national court to determine the extent of compensation on a case-by-case basis.

In Ireland, the first written judgment on this issue was delivered on 27 July. The case, Kaminski v Ballymaguire Foods Ltd ([2003]IECC 5), involved the use of closed-circuit television footage by the defendant who was the plaintiff's employer. The plaintiff featured in CCTV footage, which was used to provide training to managers in a meeting on poor work practices. The plaintiff was not aware his image was used until after the training had occurred and he was not at the training session. The plaintiff claimed nonmaterial damage including embarrassment and sleep loss.

The circuit court held there was a lack of clarity and transparency in the defendant's data protection policies. It also held there was no legal basis for the processing of this data and the defendant had not established a legitimate interest for using the footage in this manner. The court noted that where legitimate interest is relied upon as a legal basis, an assessment must be carried out. The Plaintiff was awarded 2,000 euros in damages, and his legal costs.

The level of damages awarded in this case may set a benchmark for future Article 82 cases in Ireland.

Interestingly, earlier this week, Ireland's government commenced the Courts and Civil Law (Miscellaneous Provisions) Act 2023 which took effect from 31 July.

Section 77 of that act grants the district court jurisdiction to hear data protection claims where previously only the superior court had jurisdiction. Given the relatively low benchmark for damages set by the Kaminski case, it is likely that most data protection compensation litigation of this nature will be heard in the district court. This will have a significant impact on the level of legal costs awarded to plaintiffs, as the District Court has rules which limit the amount of legal costs.

In summary, the amount of damages awarded in similar nonmaterial loss cases in Ireland is likely to be "modest" with a knock on effect on costs orders. Whether this will result in a decrease in nonmaterial loss claims remains to be seen.