Irish Court of Criminal Appeal

THE CIRCUIT COURT

SOUTH EASTERN CIRCUIT                               COUNTY OF WATERFORD

[Record No. 2019/128]

BETWEEN

SIOBHAN KEANE

PLAINTIFF

AND

 

CENTRAL STATISTICS OFFICE

DEFENDANT

 

JUDGMENT of His Honour Judge Simon McAleese delivered on the 30^th day of June 2023.

1.                  The Plaintiff prosecutes these proceedings on foot of an ordinary Civil Bill 128/2019, the proceedings having been issued on 3 April 2019.

Background

2.                  Paragraphs 3 to 6 of the Civil Bill briefly recite the facts which have given rise to these proceedings:  

"3.  The Plaintiff was employed by the Defendant as a census enumerator during Census 2016.  The Defendant processed sensitive personal data in respect of the Plaintiff for the purpose of the employment including making payments of salary and tax.

 

4.  On the completion of her employment with the Defendant, the Plaintiff was provided with a copy of her P45. 

 

5.  The Defendant held P45 documents in respect of three thousand census enumerators.  Between the 10th and 14th of November 2017, the Defendant disclosed each and every P45 on file to third parties.  The Defendant had a system in place for the storage and processing of the P45s which did not provide a level of security appropriate to the risk to the personal data held.  The disclosure was the fault of the Defendant and was caused by a combination of a number of errors including system failure, human error and lack of appropriate security.  The combination of errors resulted in a total failure of the Defendant's systems for storage of the Plaintiff's personal data.  The full disclosure of all personal data held was a complete breach of the Plaintiff's privacy rights.

6.  On or about the 17th of November 2017, a generic pro forma letter was sent by the Defendant to all 3,000 affected data subjects, including the Plaintiff. The letter admitted the breach and offered an apology”.  

3.                  The Plaintiff (at paragraph 7 of her Civil Bill) claims that she

"…suffered anxiety and distress due to the actions of the Defendant in disclosing her personal data to third parties."

and pleads that the Defendant's IT system was not sufficiently adequate to protect her sensitive personal data.

4.                  She also pleads (at paragraph 10 of the Civil Bill) that: 

"As a result of the breach, she has suffered from symptoms of severe stress and anxiety.  The symptoms affect the Plaintiff in her daily life.  The upset is manifested by a deterioration of the Plaintiff's appetite and has affected her sleep". 

and (at paragraph 11 of the Civil Bill) that: 

"The Plaintiff suffers from psoriatic arthritis, the anxiety and stress caused by the breach has exacerbated the Plaintiff's symptoms".

 

and (at paragraph 12 of the Civil Bill) that: 

"The Plaintiff reserves the right to adduce additional particulars upon receipt of further expert reports in this regard".

5.                  Under the heading

 

“Particulars Of Breach Of Contract, Negligence, Misrepresentation, Breach Of Duty Including Breach Of Statutory Duty”,

 

the Plaintiff sets out at paragraphs 13 to 16 of her Civil Bill various pleas to the effect that the Defendant failed to adequately secure her sensitive personal data, resulting in the breach of her privacy rights, her right of confidence, and her data protection rights.

6.                  The final paragraph of the Plaintiff's Civil Bill seeks the following reliefs/remedies: 

(a) An order directing the Defendant to disclose the identity of the third parties to whom the breach was made. 

(b) Damages for breach of confidence. 

(c) Damages for breach of privacy rights. 

(d) Damages for breach of data protection rights.

7.                  The Defendant's Notice For Particulars, dated 27 June 2019, asks a number of questions about the Plaintiff's claim that she suffered anxiety and stress.  For convenience I set out below those questions ("Q") and the answers ("A") delivered on 30 July 2019 by the Plaintiff.

Q. 1.  With regard to paragraph 7 of the Civil Bill, please provide full particulars of the alleged anxiety and distress caused to the Plaintiff herein. 

A. 1. Following the data breach, subject matter of these proceedings, the Plaintiff has suffered from stress and anxiety.  The Plaintiff suffered from nausea and anxiety when she received a letter confirming that her personal information had been sent to a third party.  Reassurances made by the Central Statistics Office that the Plaintiff's information was destroyed by the third party did nothing to relieve these symptoms.  On receipt of the letter from the Defendant, the Plaintiff suffered significant stress which manifested itself in difficulty sleeping and loss of appetite.  The Plaintiff was afraid and nervous that she may be liable for debts or bills for which she was not responsible and which had been taken out in her name by unknown third parties. 

Q. 2. Please confirm whether or not the Plaintiff is seeking damages for same. 

A. 2. Yes, the Plaintiff will be seeking damages for the stress and anxiety caused as a result of this data breach.  

Q. 3. Please confirm the name of any doctor or specialist from whom the Plaintiff sought medical assistance.  Please provide full details, dates of same if applicable. 

A. 3. The Plaintiff attended Dr. Sloan, Kilcohan Medical Centre, in relation to the stress and anxiety the Plaintiff is suffering as a result of this breach.

Q. 7.  With regard to paragraph 11 of the Civil Bill, please provide full particulars of what symptoms of the Plaintiff's psoriatic arthritis have allegedly been exacerbated as a result of the breach as pleaded.  Please provide full particulars of the Plaintiff's age and what medication she is on for the psoriatic arthritis.  Please provide full details of any medical professional that diagnosed the said alleged exacerbation.

A. 7.  At the time of the data breach, the Plaintiff was symptom free of psoriatic arthritis due to a long course of treatment using Methotrexate.  The Plaintiff did not take Methotrexate for over a year prior to the breach as she was pain free and experiencing no stiffness.  However, following this data breach the Plaintiff began to suffer from pain and stiffness in her shoulder, hands, wrists, chest and feet again and reluctantly had to return to use of Methotrexate to ease her symptoms.  The Plaintiff attended Dr. Sheehy's Rheumatology Clinic at Waterford Regional Hospital and discussed the severity the side effects of the psoriatic arthritis she was now experiencing.  At this appointment, Dr. Sheehy stated that the most likely reason for the return of the pain and stiffness was stress as arthritis is particularly susceptible to stress.  The Plaintiff also received an injection in the shoulder joint as she was experiencing limited movement in her shoulder.  The appointment with
Dr. Sheehy took place in or around August 2018.

Q. 8. With regard to the reliefs sought in the Civil Bill, please provide full particulars of the factual and legal basis upon which it is alleged that the Plaintiff is entitled to same. 

A. 8. ... the Plaintiff will rely on section 7 of the Data Protection Act and the above decision of  Mr. Justice Feeney in Collins ‑v‑ FBD Insurance PLC
[2013] IEHC 137 to hold the Defendant liable in tort". 

8.                  A Defence was delivered on 2nd September 2019.  It broadly denied liability to the Plaintiff.

9.                   In August 2021, an affidavit of discovery was sworn on behalf of the Defendant.  In November 2022, the Plaintiff’s affidavit of discovery was sworn. In it she disclosed all of her medical records relating to a two year period (9 November 2015 to 9 November 2017) prior to the date of the data breach, comprising records held by:

(a)  Waterford Medical Centre and

(b) University Hospital Waterford. 

10.              By way of Notice of Motion, the Defendant applied for an order permitting it to amend its defence.  That motion was grounded upon the affidavit of Aisling Quinn, solicitor.  Ms. Quinn's affidavit exhibited a draft of the proposed amended defence. 

11.               On 22 March 2023, Her Honour Judge Morrissey gave the Defendant liberty to amend its defence. 

 

 

Preliminary Issue

12.               The amended defence, delivered 22 March 2023, flags a preliminary issue as follows: 

            Preliminary issue: 

1. In so far as the Plaintiff claims damages for personal injuries in the within proceedings, same has not been authorised by the Personal Injuries Assessment Board and the said claim is not properly constituted, and furthermore, any such claim for personal injuries is statute barred pursuant to section [word missing] of the Statute of Limitations 1957, as amended, in so far as any authorisation is sought hereafter. 

 

13.               On 27 June 2023, at Waterford Circuit Court, I agreed to hear and determine this preliminary issue.  Helpful outline legal submissions had been prepared by counsel for the Plaintiff,  Mr. Stafford and also by counsel for the Defendant, Mr. Finan.  Counsel and solicitors had agreed and prepared a comprehensive book of authorities.  Oral submissions were made by counsel on behalf of the parties.  I want to thank the parties' counsel and solicitors for the amount of work they put into preparation of the matter, it has saved hours of Court time and has directed the Court towards the core of the issues involved.

Discussion

14.               Mr. Stafford contends that Personal Injuries Assessment Board (“PIAB”) authorisation for the institution of these proceedings was not required having regard to the nature of the Plaintiff's claim and the reliefs sought.

15.              Mr. Finan argues to the contrary.  He says that these proceedings amount to an action to recover damages for personal injuries and that the proceedings, accordingly, constitute a "civil action" within the meaning of section 3(d) of the PIAB Act 2003 (I will refer to that Act, as amended, as the “Act of 2003”). 

 

Section 4 of the Act of 2003 tells us that:   

""Civil action" means an action intended to be pursued for the purpose of recovering damages, in respect of a wrong, for

(a) personal injuries, or

(b) both such injuries and damages to property (but only if both have been caused by the same wrong),

but does not include —

 

(i)         an action intended to be pursued in which, in addition to damages for the foregoing matters, it is bona fide intended, and not for the purpose of circumventing the operation of section 3, to claim damages or other relief in respect of any other cause of action." 

 

16.              Section 4 of the Act of 2003, defines "personal injury", as having the same meaning as it has in the Civil Liability Act 1961 (the “Act of 1961”), viz:

""personal injury" includes any disease and any impairment of a person's physical or mental condition, "injured" shall be construed accordingly."

17.              The Act of 2003 defines "wrong" as having the same meaning as it has in the Act of 1961, viz:

""Wrong" means a tort, breach of contract or breach of trust, whether the act is committed by the person to whom the wrong is attributed or by one for whose acts he is responsible, and whether or not the act is also a crime, and whether or not the wrong is intentional."

18.              The answer to the issues at play here lies in the judgment of the Supreme Court, handed down by Mr. Justice O'Donnell, as he then was, in Clarke  v.  O'Gorman [2014] IESC 72.  Although that action related to a claim for damages for assault, sexual assault, battery and trespass to the person, the legal principles outlined therein are applicable to this matter.  The Irish Reports contain an excellent headnote which summarises the Supreme Court's findings.  I refer to paragraph 2 of that headnote which reads as follows:

 

"A civil action as defined by section 4(1) of the Act of 2003 was not in itself a cause of action.  It was a description relating to the type of damage suffered as a result of the facts giving rise to the cause of action.  Civil actions for personal injury were not limited to those wrongs where proof of personal injury was a necessary element of the cause of action.  Actions alleging wrongs that were actionable per se, such as trespass to the person, were still capable of being civil actions for personal injuries where the remedy sought was damages for personal injuries".  [Emphasis added]

19.              Mr. Finan has contended that the data breach is the cause of action.  There is no other cause of action.  With respect, I do not agree with his contention.  The cause for action is the data breach.  The causes of action are those set out in the Civil Bill viz

* breach of confidence

 * breach of privacy rights.

* breach of data protection rights. 

I do not believe that the order sought by the Plaintiff in the Civil Bill (see par. 6 above) amounts to a "cause of action". 

Mr. Stafford has contended that each cause of action requires different proofs notwithstanding that the factual matrix may be common to each cause of action.  That may be so.  He also says that because the proofs are different, the causes of action are different.  With respect, I do not accept that to be so.  The causes of action set out in the Civil Bill are different precisely because they are different causes of action. 

 

20.              Turning back to Clarke  v  O'Gorman,  Mr. Justice O'Donnell, at paragraph 18 of his judgment emphasised that: 

"It is important however to note however that a "claim for personal injuries" which is the central concept in the 2003 Act, is not itself a cause of action.  Personal injuries are the injuries suffered which, if caused by a wrong, may give rise to a remedy, most often an award of damages". 

By way of illustration, Mr. Justice O'Donnell then referred to Order 19, rule 5(1) of the Rules of the Superior Courts 1986.  At paragraph 19 of his judgment he commented that:

"Pleadings, and, in particular, a general endorsement in a plenary summons, identify causes of action not injuries suffered.  Thus, while proceedings may be described colloquially as proceedings for personal injuries, as a matter of law they are proceedings for remedies flowing from asserted causes of action".

21.               Now, the question has to be asked:  Would the proceedings in this case be described, colloquially, as proceedings for personal injuries?  The answer has to be "No". 

The Courts regularly encounter situations where the description of something is at variance with the legal reality of the matter.  Common examples:  when something described as a licence transpires to carry all the attributes of a lease; when something described as a contract for services transpires to carry all the attributes of an employment contract; when a document headed "Contract" doesn't contain the ingredients necessary for a contract, and so forth.  In such scenarios, the Court looks at the matter in the round and applies both common sense and the applicable law.  It does not blithely accept what is said on the tin. 

22.              Back once again to Clarke v. O'Gorman and paragraph 18 of Mr. Justice O'Donnell's judgment.  He refers to the Act of 2003 and says that it requires:

"...an analysis and understanding of related and intersecting concepts of "wrong", "civil action", "cause of action" and "action for personal injuries".

"Civil action", he reminds us, is defined in section 4 of the Act of 2003 as an action intended to be pursued for the purposes of recovering damages in respect of a wrong for, broadly speaking, personal injuries, subject to the exclusions contained in sub-paragraphs (i), (iii) and (iv) of the definition. Referring to the exclusion at (i), Mr. Justice O'Donnell, at paragraph 30 of his judgment says that: 

"I accept that some confusion can be caused by the terms of s.4(1)(i) which excludes claims where in addition to a claim for personal injuries, it is bona fide intended to claim damages or other relief "in respect of any other cause of action".  This might be read as implying that a claim for personal injuries is itself a cause of action.  But I think that it is clear that "other cause of action" means here, other than the cause of action giving rise to the claim for personal injuries". [Emphasis added]

23.              So, we must ask whether any of the causes of action pleaded by the Plaintiff in this case are causes of action which do not give rise to a claim for damages for personal injuries.  On its face the claim does not display the usual indicia of a personal injuries claim.  For a start it is not based upon a Personal Injury Summons, and instead rests upon an ordinary Civil Bill.  The causes of action which have been pleaded are, prima facie, not such as would regularly give rise to a personal injuries claim.  However, scrutiny of the pleadings makes it clear that the principal remedy being sought by the Plaintiff is damages for personal injuries.  As mentioned, this remedy is being sought under the auspices of causes of action which ordinarily do not give rise to personal injury claims. On the facts of this case, none of the causes of action which have been pleaded amount to actions which fall outside the definition of "civil action" as set out at section 4(1) of the Act of 2003.  They are not causes of action which escape the obligation imposed by the Act of 2003 in respect of "civil actions", that is the obligation under section 11 of that Act to make an application to PIAB for an assessment of the claim.

24.              Breach of privacy is essentially a tort which derives from breach of a constitutional right.  Might the Plaintiff's claim for breach of privacy therefore be excepted from the definition of "civil action" by virtue of section 4(1)(iii) of the Act of  2003?  The answer is "No".  The claim for damages for breach of privacy in this case is an action intended to be pursued for the purpose of recovering damages for personal injury.  It should therefore not be excepted from the definition "civil action".  In that regard I refer to paragraph 33 of Mr. Justice O'Donnell's judgment in Clarke  v  O'Gorman.

Decision

25.               Having regard to the foregoing I find that: 

(a) The Plaintiff's claim is a "civil action" within the meaning of section 3(d) of the Act of 2003.

 

(b) The Plaintiff should have applied to PIAB for assessment of her claim pursuant to section 11 of the Act of 2003.  She did not do so. 

Section 12(1) of the Act of 2003 states that: 

"Unless and until an application is made to the Board under section 11 in relation to the relevant claim and then only when the bringing of those proceedings is authorised under section 14, 17, 32 or 36, rules under section 46(3) or section 49 and subject to those sections or rules, no proceedings may be brought in respect of that claim".

 

Section 9 of the Act of 2003 states that:

"In this Chapter "relevant claim" means a civil action to which this Act applies".

(c) It has been established that section 12 of the Act of 2003 does not operate to deprive the Court of jurisdiction in the event of non-compliance by the Plaintiff with its strictures.  Such non compliance may however be invoked - as in this case - by the Defendant in its defence and used as a shield.

Mr. Justice O'Donnell made that clear in Clarke  v  O'Gorman - see paragraphs 41 et seq.

(d) Arising from the foregoing, the Plaintiff's proceedings remain extant.  However, the principal remedy (damages for personal injury) which is being sought by the Plaintiff is doomed to failure by virtue of non compliance with the Act of 2003.  In that regard, the Defendant's plea at paragraph 1 of its Amended Defence is bound to prevail.  This, I believe, will have the effect of restricting the Plaintiff's claim to such other damages, if any, as might be awardable for the truly limited (in so far as it concerns the Plaintiff) and accidental data breach which occurred in this case.  The Court expresses no view upon such defence(s) as might be available to the Defendant in that regard or as to whether or not such defence(s) will prevail if what remains of this matter runs to hearing.

 

 

 

 

 

 

 

Counsel for the Plaintiff: Peter Stafford BL, instructed by Gibson & Associates LLP.

Counsel for the Defendant: Mark Finan BL, instructed by the Chief State Solicitors Office.