In one of the first written judgements in Ireland regarding non-material damage under the GDPR, the Dublin District Court awarded €2,000 compensation to a plaintiff regarding the use of CCTV footage of him by his employer which resulted in slagging by colleagues, serious embarrassment and sleep loss.
In Arkaiusz Kaminski v Ballymaguire Foods Limited, CCTV footage was shown to various employees as part of a meeting between the quality control and other managers and supervisors. The meeting was intended to address incidences of poor food safety practice and the plaintiff appeared in one of the clips intended to demonstrate this. The plaintiff was not at the meeting and became aware the footage was used afterwards.
The Court found that the company's data protection policies regarding CCTV were not clear or transparent. Of note is that the company did not plead legitimate interests as a legal basis for the data processing involved, although this was referred to in later legal submissions. No legitimate interest assessment was carried out and the court held that the plaintiff's rights under the GDPR were infringed.
The Court examined the limited Irish case law in the area, as well as English case law and the CJEU decision in UI v Österreichische Post, before determining that:
- A mere breach of the GDPR is not sufficient to warrant an award of compensation.
- There is no minimum threshold of seriousness for a claim for non-material damage. Compensation for non-material damage does not cover 'mere upset'.
- There must be a causal link between the infringement and the damages claimed.
- Supporting evidence is strongly desirable (e.g. a psychologist's report or other medical evidence).
- An apology where appropriate may be considered in mitigation of damages (e.g. the individual's employment is safe and not at risk).
- Even where non-material damage can be proved and is also not trivial, damages in many cases will probably be modest.
Notwithstanding that there was no medical evidence regarding the non-material damage, the Court found that the plaintiff was a truthful and conscientious witness and awarded him general damages of €2,000.
It is worth noting that the Data Protection Act 2018 provides for data protection actions to be brought in the Circuit Court and High Court. However, legislation is currently going through the Oireachtas (Irish houses of parliament) which would amend the 2018 Act to also give the District Court jurisdiction to hearing data protection actions.
In future, the majority of data protection cases should be heard at the District Court level where the maximum quantum of damages is €15,000. Only in the most extreme cases are damages likely to be at the Circuit Court or High Court level, albeit a breach of data protection rights may form one part of a wider claim. However, concerns will undoubtedly be raised by insurers and companies concerned at the prospect of a multitude of claims and the accompanying costs, particularly where damage suffered by data subjects is not supported by medical evidence and amounts to embarrassment and loss of sleep.
