The High Court has set aside an award of compensation made by the Circuit Court to an individual for breach of his data protection rights. The decision clarifies that compensation may only be awarded, pursuant to section 7 of the Data Protection Acts 1988 and 2003 (the Acts), when the breach causes loss or damage.
The Circuit Court ordered the defendant insurance company to pay the plaintiff €15,000 in damages, on the grounds that it had breached the Acts by failing to supply personal data requested by the plaintiff within the prescribed 40 day time limit; by omitting to reveal the existence of a private investigator's report in its possession; by failing to have in place a written contract with the private investigator (data processor) whom it had contracted to investigate the plaintiff; and by failing to access District Court conviction orders in the proper manner. This was the first compensation award made by the courts pursuant to section 7 of the Acts.
On appeal, the issue arose as to whether as a matter of law the data subject was entitled to compensation pursuant to section 7 of the Acts, in the absence of evidence of actual loss or damage.
The High Court set aside the award of €15,000, but ordered the defendant to pay the plaintiff's costs. The Court held that section 7, which imposes a statutory duty of care on a data controller to the data subject, does not go beyond the obligation for compensation contained in the Data Protection Directive 95/46/EC. The obligation under the Directive does not provide for either strict liability or the automatic payment of compensation, but limits itself to providing for the existence of a duty of care within the law of torts. For that duty of care to arise, it is necessary for a claimant to establish that there has been a breach, that there has been damage, and that the breach caused the damage.
In the present case, the plaintiff had failed to prove any damage resulting from the breach of the duty of care owed by the defendant. Therefore the plaintiff was not entitled to an award of damages. In addressing the question of costs, the Court had regard to the manner in which the defendant had conducted itself, and also to the fact that the issue as to the limitation of the nature of damages under section 7 of the Acts, which resulted in the defendant succeeding in the appeal, had not been argued in the Circuit Court. Accordingly the High Court directed that the insurance company pay the costs of the proceedings.
This decision clarifies that in order for a data subject to be awarded compensation under section 7 for breach of the Acts, he or she must prove that the breach caused him or her damage. It shows that in cases where such damage is proved, the courts are willing to award significant amounts of compensation.
The decision also serves as a reminder that companies must have a written agreement in place when engaging Private Investigators (or other data processors), and that companies should disclose Investigators' reports to data subjects upon request. It is worth noting that the Data Protection Commissioner, in his last Annual Report, highlighted that none of the restrictions to the right of access to personal data, which are set down in Section 5 of the Acts, could reasonably be applied to refuse an access request by an individual for a copy of a surveillance report or accompanying photographs or video footage taken by a private investigator.