As data breaches and cyberattacks have increased, litigation claims seeking compensation arising from these incidents has also increased. Typically, these claims seek compensation for the anxiety and distress arising from personal data being accessed by third parties.

A key recent issue in relation to the progression of these types of claims in Ireland is whether or not these claims were personal injury claims, with the attendant requirement to follow a very specific legislative process, prior to issuing proceedings.

The Irish Supreme Court, on 24 July 2025, delivered a comprehensive judgment in Dillon v. Irish Life,¹ confirming that claims seeking compensation for "distress, upset and anxiety" are not personal injury claims.

This arguably makes it easier for impacted individuals to maintain such claims as medical evidence is not required to substantiate the alleged mental distress, albeit the compensation for any such claims will be "very, very modest".²

A wider issue is the impact that this could have on Ireland being a location of choice for mass data breach litigation claims, pursuant to the Representative Actions Directive. Given that several of the large tech companies have their EMEA hubs in Ireland, it appears that Ireland could see a significant influx in this type of litigation over the coming years, should Ireland's current prohibition on litigation funding be relaxed.

Compensation for non-material loss

Article 82 of the General Data Protection Regulation (GDPR) and s. 117 of the Data Protection Act 2018 provide that data subjects can claim for both material and non-material loss as a result of a breach of data protection laws by a controller or processor. Non-material loss is damage not directly causing financial loss and includes anxiety, distress, inconvenience and/or upset.

Case law from the Courts of Justice of the European Union (CJEU) over the past two years has stated that a breach does not entitle a data subject to redress without showing some actual damage, but there is no "minimum threshold" to meet for damages to be awarded.³

Dillon v. Irish Life

Mr Dillon issued Circuit Court proceedings seeking compensation for the "distress, upset, anxiety, inconvenience, loss and damage" caused by Irish Life accidentally issuing six letters relating to his life assurance policy to a third party.

The Circuit Court dismissed the claim and, of note, held that this claim was akin to a personal injuries action. Under Irish law, there is a very specific process that needs to be followed for personal injuries actions.⁴ This process requires all personal injury claimants (with some exceptions) submitting the relevant claim for assessment to the Injuries Resolution Board (IRB), an independent statutory board. This step needs to be taken before a claimant can issue legal proceedings. This Circuit Court decision was upheld by the Irish High Court.

Overturning the High Court's decision, the Supreme Court held that actions under the Data Protection Act 2018 which allege mental distress and upset (but not psychiatric injury) are not "personal injuries" actions within the meaning of the PIAB Act. Such actions accordingly do not require an authorisation under the PIAB Act to proceed to litigation.

This decision is of significance as it:

• removes a number of potential procedural barriers for non-material loss claimants. Notably, claimants do not need to submit a medical report to initiate a claim which may have been a disincentive in certain low value claims;
• confirms that data breach claims for pure mental distress are not personal injury claims. This re-establishes that the common law rule against claiming for pure mental distress does not apply to data breach claims;
• means that the limitation period in which an action can be brought will be six years, instead of two years; and
• allows non-material loss claimants for mental distress that had not submitted a claim to IRB within two years to now progress their claims.

Irish landscape for mass data breach claims

The Supreme Court in Dillon made it clear that it expected awards in pure mental distress cases to be "very, very modest". Even an award of this size, however, can lead to significant exposure for a controller or processor in mass data breach claims. Mass data breach claims involve thousands, or even millions, of data subjects initiating claims emanating from the same incident. Often mass data breach claims follow a large data breach or a cyberattack.

Mass data breach claims have to date been rare in Ireland. However, cyberattacks are currently surging worldwide, driven by technological advances in AI amongst other developments.⁵ It is therefore anticipated that there will be more mass data breach claims in the future.

We analyse below two legal developments that may drive mass data breach actions in Ireland, namely the "Representative Actions Directive (RAD)" and litigation funding.

• Representative Actions Directive

On 24 April 2024, the Irish law transposing the EU's RAD was commenced. The RAD is a landmark EU directive which requires member states to establish a mechanism whereby designated bodies ("qualified entities") can bring actions on behalf of consumers for breaches of specified laws (including data protection laws). Actions under the RAD can be taken cross-border, meaning a cross-border qualified entity can take an action on behalf of consumers in multiple EU member states.

The Irish law implementing the RAD⁶ established for the first time an effective class actions mechanism in Ireland. On 29 May 2025, the first action under the RAD was issued in the High Court in Ireland, alleging that a global real-time bidding advertising platform breached data protection laws.⁷

There are currently two "qualified entities" registered to bring actions on behalf of consumers in Ireland. Notably, one of these is "Noyb", a privacy body founded by activist Max Schrems. Noyb states on its website that it plans on issuing the first of its actions in 2025.

• Jurisdiction under the RAD: Ireland a target?

RAD is expressly subject to the existing rules on jurisdiction in the EU, namely the Brussels Recast Regulation.⁸ The Brussels Recast Regulation provides for a "general rule" that a party is to be sued in the jurisdiction in which that party is domiciled.

There are a number of exceptions to the general rule, including to protect consumers. The Brussels Recast Regulation provides that consumers can bring proceedings against the other party to a contract either in the courts of the member state where the other party to a contract is domiciled, or where the consumer is domiciled. In a tort action, the claim can also be brought in the place where the harmful event occurred.

A cross-border claim under the RAD would likely involve consumers and possibly wrongful events from multiple jurisdictions, and it is, as of yet, unclear how the RAD will operate in relation to the most suitable jurisdiction to maintain these types of claims. Given the uncertainty, it may be that actions under the RAD are taken in accordance with the "general rule", meaning parties which are domiciled in Ireland will be sued under the RAD in Ireland.

As several of the large technology companies have their EMEA headquarters in Ireland, this might mean that Ireland is the most suitable jurisdiction for mass data breach claims under the RAD.

• Litigation funding

Although Ireland may be the most suitable jurisdiction, a key issue potentially impacting the progression of mass data breach claims is the current position which generally prohibits third-party litigation funding for profit. However, the law in this area is in a state of change and there are signs that change is on the horizon.

Firstly, the Irish Supreme Court recently acknowledged that the boundaries of what is forbidden in the context of litigation funding have continued to be narrowed:

"It is not irrelevant in this context then that this is an area in which the law has recently developed, and at each point expanding the steps which are permissible, and narrowing the forbidden area."⁹

Secondly, Ireland's litigation funding laws may in the not-too-distant future be the subject of legislative reform. The Law Reform Commission is due to publish its review of the law on third-party litigation funding later this year and it is expected that some form of reform will be recommended.

If the law is reformed to allow third party litigation funding for profit, this will provide "qualified entities" with a greater ability to source the funding required to maintain mass litigation claims in Ireland under RAD.

1. [2024] IEHC 203↩
2. Ibid, para 56↩
3. Case C-300/21 UI v Österreichische Post A↩
4. Personal Injuries Assessment Board Act 2003 (as amended) (PIAB Act)↩
5. https://www.ft.com/content/d3119d3f-97bd-4ff4-905d-b471a8828beb↩
6. Representative Actions for the Protection of the Collective Interests of Consumers Act 2023↩
7. H.P.2025.0003009↩
8. Regulation (EU) No 1215/2012↩
9. Scully v. Coucal Limited [2025] IESC 20↩