The Supreme Court held that claims for distress and anxiety alone are not “personal injury”, and do not require PIAB authorisation, though awards will be modest.

The Plaintiff, a policyholder, brought proceedings against the Defendant after six letters containing his personal and financial data were erroneously sent to a third party over a twelve-year period.

The Plaintiff claimed damages for distress, upset, anxiety and inconvenience, alleging breaches of data protection legislation, including the Data Protection Acts 1988 and 2003 and the GDPR, as implemented by the Data Protection Act 2018. The Plaintiff claimed a right to compensation for non-material damage under Article 82 of the GDPR.

 The Plaintiff did not obtain PIAB authorisation prior to issuing proceedings.

The Defendant argued that the claim was for ‘personal injury’ as defined in section 2 of the Civil Liability Act 1961 (which includes “any disease and any impairment of a person’s physical or mental condition”) and therefore required PIAB authorisation under section 12 of the 2003 Act. Both the Circuit Court and the High Court agreed with the Defendant, dismissing the proceedings as being bound to fail for want of PIAB authorisation.

The Plaintiff appealed to the Supreme Court, contending that his claim for distress and anxiety did not amount to ‘personal injury’ within the statutory meaning and that the PIAB requirement was incompatible with the right to compensation for non-material damage under Article 82 of the GDPR.

The Supreme Court allowed the appeal, holding that a freestanding claim for damages for emotional disturbances such as distress, upset, anxiety and inconvenience does not constitute a claim for ‘personal injury within the meaning of the 2003 Act, provided that such emotional disturbances fall short of a recognised psychiatric disorder.

The Court clarified that worry and stress alone do not constitute ‘personal injury’ for the purposes of the statutory definition. However, the Court did hold that “Where their claims are solely for mental distress, upset and anxiety they will fall outside the PIAB regime, but they cannot expect anything other than very, very modest awards.”

The Court further observed that requiring PIAB authorisation for claims for non-material damage under the GDPR would be inconsistent with the legislative intent and would impose unnecessary procedural burdens on claims that are not, in substance, person injury actions.

Ultimately, the Court concluded that as the claim did not allege a recognised psychiatric injury, and instead was limited to distress, upset, anxiety and inconvenience, PIAB authorisation was not required prior to instituting proceedings.

Employers should be aware that PIAB authorisation is not required for claims for non-material damage under the GDPR.

Any award for a claim for non-material damage that does not meet the PIAB requirement of a “personal injury” should only result in “very, very modest awards”.