A recent decision of the Commercial Court, in Nolan & Ors v Dildar & Ors [2024] IEHC
4, addresses the scope of data controllers' liability
to data subjects for infringement of their rights under the Data
Protection Acts 1988 and 2003. Whilst the breach occurred in 2013,
and is therefore outside of the scope of the GDPR and Data
Protection Act 2018, the judgment is noteworthy to the extent that
it indicates the potential quantum of damages that may be awarded
to data subjects bringing compensation claims for damage suffered
due to data protection violations under the new regime.
Background
The decision of the Court of Justice of the European Union
("CJEU") in Oesterreichische
Post (previously discussed here), held that in order to recover
compensation for non-material damages under the GDPR, three
cumulative conditions must be satisfied, including: (1) there has
been a GDPR infringement; (2) the data subject has suffered
material or non-material damage; and (3)
