Data Protection Archives - Lacey Solicitors | Specialist Insurance Law Firm

Data Breach Claims Solicitors | Lacey Solicitors Dublin & Belfast

Posted on 6 August 20254 August 2025 by Lacey Solicitors

At Lacey Solicitors, we understand how distressing it can be to learn that your personal information has been mishandled. Whether it’s your financial data, medical records or employment details – your privacy matters. Our data protection and privacy law solicitors in Dublin and Belfast, help individuals, employees, and professionals across Ireland and Northern Ireland take action when organisations fail to protect their personal data.

With specialist advice in data protection, privacy and GDPR claims and a proven track record of successful outcomes, we are here to help you claim compensation and protect your constitutional rights.

What Is a Data Breach Under GDPR?

A data breach occurs when personal data is lost, shared, exposed, or accessed without permission. This could happen due to poor cybersecurity, human error, or even malicious hacking. Under the EU General Data Protection Regulation (GDPR) and the Data Protection Acts, individuals are entitled to claim compensation if they’ve suffered emotional, psychological, or financial harm due to a breach.

Common examples of GDPR data breaches include:

Sending emails or letters containing personal data to the wrong person
Files or databases being left unsecured or accessible to unauthorised parties
Sensitive health information being shared without consent
Data being exposed during a cyberattack due to inadequate IT systems
Personal details being leaked online or passed to third parties without your knowledge

Who Is Responsible?

Under GDPR, organisations that collect and process personal data – called Data Controllers – are legally required to protect it. The law requires data controllers to demonstrate ‘accountability.’ The business should establish clear, documented procedures to continuously review and monitor the data they collect. This includes employers, public sector bodies, healthcare providers, insurers, financial institutions, and online service platforms.

If they fail to uphold these duties, and your data is breached as a result, they may be liable to compensate you.

Real-World Data Breach Cases at Lacey Solicitors

At Lacey Solicitors, we have acted in a number of high-profile and sensitive data breach matters, including:

The PSNI Data Breach (2023): We represent several PSNI officers whose personal and employment data, including names, ranks and work locations, were mistakenly published online. Many clients expressed genuine concerns for their safety and are now pursuing claims for distress and loss of privacy.
NHS Medical Records Misuse: We acted for a Antrim-based client whose confidential medical notes were inappropriately accessed by a third party following a poorly handled subject access request. The breach resulted in considerable emotional distress and embarrassment and we ultimately secured a settlement of several thousand pounds.
Banking and Financial Data Breaches: We have pursued claims for clients whose financial data was exposed due to outdated cyber security practices or internal processing errors at financial institutions.

Each case is handled with care, discretion, and strategic legal insight to maximise your entitlement and hold organisations accountable.

What Can You Claim For?

As outlined in our previous article You may be entitled to claim for:

Emotional distress or anxiety
Damage to your reputation or professional standing
Financial loss, fraud or identity theft
Loss of control over personal information
Breach of confidence

Compensation for Data Breach Claims in Ireland:

Type of Breach	Estimated Range
Basic contact data breach	€1,000 – €2,500
Confidential health or HR records	€3,000 – €6,500
Financial or identity theft breach	€5,000 – €15,000+
High-risk exposure (e.g. PSNI)	€8,500 – €25,000+

Each case is assessed individually. The more serious the impact, the higher the potential award.

What Are My Rights Under GDPR?

You have strong legal rights under GDPR, including the right to:

Be informed how your data is being used
Access your personal information on request
Rectify inaccurate or incomplete data
Erase data in certain circumstances (“right to be forgotten”)
Restrict or object to processing
Claim compensation for unlawful processing or data loss

If you’re not satisfied with an organisation’s response, you also have the right to make a complaint to the Data Protection Commission in Ireland or the Information Commissioner’s Office in Northern Ireland — or to take legal action with our help.

How Lacey Solicitors Can Help

At Lacey Solicitors, we combine legal precision with compassionate client service. Whether the breach involves public bodies, employers, medical organisations, or private companies, our dedicated data protection team is here to guide you every step of the way.

Why Choose Us?

Proven Track record in GDPR and Privacy Law Claims in both Ireland and Northern Ireland
Offices in Dublin and Belfast – Local knowledge with cross-border capability
Discreet, strategic approach tailored to your needs
Free initial advice and transparent fees

Take Action Today

If your personal data has been exposed, mishandled or used without your consent, you do not have to accept it. At Lacey Solicitors, we are here to help you hold the responsible party accountable and secure the compensation you deserve. With offices in Dublin and Belfast, our experienced data protection solicitors offer clear, confidential advice tailored to your situation. Contact us today by phone or through our secure online enquiry form to begin your data breach claim.

Cabot Financial Ireland Data Breach – Know Your Rights and How to Claim Compensation

Posted on 1 August 202512 August 2025 by Ruaidhri Austin

Lacey Solicitors are now initiating legal proceedings against Cabot Financial Ireland Limited on behalf of affected individuals. If your personal or financial data was compromised in the recent cyberattack, you may be entitled to claim compensation for both financial losses and emotional distress.

What Happened?

In September 2024, Cabot Financial Ireland Limited, a prominent debt collection and credit servicing firm regulated by the Central Bank of Ireland, suffered a significant cyberattack. The breach involved the theft of approximately 394,000 sensitive data files. These files contained personal, financial, and in some cases, even health-related or marital status information.

The compromised data affects:

Cabot’s direct customers
Customers of financial institutions for whom Cabot acts as credit servicer
Current and former Cabot employees

The exposed information includes:

Names, addresses, and contact information
Loan book and debt details
Potentially sensitive information shared by customers (e.g. health issues or family circumstances)

Cabot’s website and phone systems were temporarily disabled following the attack, and forensic IT specialists were brought in to assess the extent of the damage.

Cabot Financial Ireland Limited’s Response and Public Concern

Cabot states it has:

Notified the Data Protection Commission (DPC), Central Bank of Ireland, and Garda National Cyber Crime Bureau
Obtained a protective court order to reduce the likelihood of stolen data being misused online
Begun contacting impacted individuals

However, many former customers and staff have criticised the speed, clarity, and scope of these communications. Some did not receive timely notification despite their data being involved.

Your Rights as a Victim of a Data Breach

Under GDPR (General Data Protection Regulation) and the Data Protection Act 2018, individuals have a legal right to claim compensation when their personal data is exposed due to a company’s failure to protect it.

You may be eligible to claim for:

Material Damages

Fraudulent transactions
Identity theft
Out-of-pocket costs for credit monitoring or account security
Lost income
Banking and administrative fees

Non-Material Damages

Anxiety, distress, and emotional upset
Fear of future misuse of your personal data
Loss of sleep or mental wellbeing
Reputational damage or embarrassment

Recent developments in Irish data protection law outlined previously by our office namely the Supreme Court decision in Dillon v Irish Life Assurance PLC [2025] IESC 37 has removed the requirement to obtain IRB authorisation for such claims, as they do not constitute personal injuries. This has significantly reduced the procedural burden for claimants, allowing claims to proceed directly in the District Court (for amounts up to €15,000.00), making the process quicker and more accessible.

In the context of the Cabot breach, where nearly 400,000 files containing personal and financial data were compromised, these legal standards are highly relevant. Many affected individuals are likely to have experienced emotional consequences, such as fear, distress, or anxiety, especially if the compromised data included sensitive information like marital or health status. Based on recent court awards in similar cases—ranging from €2,000.00 to €7,500.00 for non-material harm—Cabot may face a significant volume of claims.

Lacey Solicitors is now writing to Cabot Financial Ireland Limited, representing victims seeking compensation for the violation of their data rights.

Lacey Solicitors – Data Breach Litigation Solicitors

At Lacey Solicitors, we are now intimating formal legal proceedings against Cabot Financial Ireland Limited. We are representing individuals affected by the breach and seeking compensation for both material and non-material damages.

We understand how unsettling it is to learn your private information may be in the hands of criminals. Ruaidhrí Austin, Partner is experienced in both Defence and Plaintiff GDPR litigation, and is committed to helping you secure the compensation you deserve.

We can assist with:

Submitting a Subject Access Request (SAR) to confirm if your data was affected
Gathering evidence of emotional distress or financial harm
Managing the full legal process with clear and transparent legal fees.

What Should You Do Now?

If you suspect or know that your data was part of the Cabot data breach, you should:

Contact Lacey Solicitors for a confidential case review
Request confirmation from Cabot via a Subject Access Request (we can assist with this)
Monitor your financial accounts for suspicious activity
Report any suspected fraud to the Gardaí
Follow cybersecurity best practices — e.g. change passwords, enable 2FA, and avoid phishing scams

How to Spot Suspicious Activity

Criminals may now impersonate Cabot or use your stolen information to conduct scams. Be wary of:

Unsolicited emails or phone calls asking for bank details
Messages claiming your Cabot account is in arrears or frozen
Unfamiliar credit card or loan applications appearing on your credit report
Social engineering attempts using your personal details

Cabot has published advice on how to protect yourself, and we encourage all victims to also consult trusted sources like:

Contact Lacey Solicitors, Data Breach Solicitors, Belfast & Dublin

If you believe your personal information was exposed in the Cabot data breach, contact Lacey Solicitors today. With offices in Dublin and Belfast, our experienced team specialises in data protection and privacy claims, and we are currently acting on behalf of individuals affected by this breach. We offer clear, confidential advice on your rights under GDPR and can help you pursue compensation for the harm caused.

Call us on +353 1 513 4375 (Dublin) or +44 28 9089 6540 (Belfast), or contact Lacey Solicitors today for a free consultation using our Online Portal.

Data Protection Litigation in Ireland : Irish Supreme Court Clarifies Emotional Distress Is Not a Personal Injury Under PIAB Legislation

Posted on 28 July 202525 July 2025 by Ruaidhri Austin

In a decision that brings long-awaited clarity to to those dealing with Data Protection litigation in Ireland, the Supreme Court has ruled that emotional harm — including distress, anxiety, upset, and inconvenience — does not amount to a personal injury under the Personal Injuries Assessment Board Act 2003 (the PIAB Act) unless it constitutes a recognised psychiatric disorder.

The ruling in Dillon v Irish Life Assurance plc [2025] IESC 37 redefines the threshold between personal injury and non-injury claims and has significant procedural implications for data breach litigation, negligence claims, and cases seeking compensation for emotional harm. The judgment confirms that not all emotional damage attracts the legal protections afforded to personal injuries, and that IRB authorisation is not required for certain classes of claims.

Background to the Case: A Data Breach and a Procedural Dispute

Mr Patrick Dillon initially brought an action in the Circuit Court against Irish Life Assurance plc, claiming compensation for emotional harm after his private policy documentation was repeatedly sent to a third party in error — six times over a twelve-year period.

He alleged distress, anxiety, upset, and inconvenience arising from these data breaches, but did not claim to have suffered any physical or psychiatric injury, nor did he apply to PIAB for authorisation before issuing proceedings — a step usually required in personal injury cases under section 12 of the PIAB Act. The case was brought by Equity Civil Bill, rather than the Personal Injuries Summons format used in injury litigation.

The Circuit Court dismissed the claim as frivolous or bound to fail on the basis that it constituted an unauthorised personal injury action. The High Court upheld that dismissal. However, the Supreme Court granted leave to appeal, recognising that the issues raised were matters of public interest to those dealing with Data Protection litigation in Ireland.

To be – or not to be – a Personal Injury?

Delivering the unanimous decision, Murray J provided a detailed examination of both statutory and common law interpretations of “personal injury” in Irish law.

Emotional Distress Without Psychiatric Injury Is Not a Personal Injury

The Court held that claims for emotional distress alone — such as worry, stress, upset, or anxiety — do not constitute personal injuries within the meaning of the 2003 Act unless they are supported by evidence of a recognised psychiatric disorder.

This position is consistent with long-standing case law, including:

Kelly v Hennessy [1995] 3 IR 253, where the Supreme Court required evidence of psychiatric illness to ground a claim in negligence;
Fletcher v Commissioners for Public Works [2003] 1 IR 465, which reaffirmed that “grief or sorrow” without accompanying injury is not actionable; and
Murray v Budds [2017] IESC 4, in which the Court confirmed there is no stand-alone right to damages for emotional upset alone.

Murray J rejected the lower courts’ finding that the distress Mr Dillon described fell within PIAB’s jurisdiction. The Court concluded that the 2003 Act was never intended to apply to non-clinical emotional harms, and requiring PIAB authorisation in such cases would misapply the legislation.

Two Distinct Legal Pathways for Privacy-Related Emotional Harm and Data Protection Litigation in Ireland

The judgment clarified that claimants alleging emotional harm from data breaches or privacy violations must now choose between two distinct procedural avenues, depending on the nature of their injury:

Psychiatric Injury Track:
Where a data breach results in a medically recognised psychiatric condition — such as depression, PTSD or anxiety disorder — the case is treated as a personal injury action and requires IRB authorisation.
Emotional Distress Track:
Where the plaintiff claims non-clinical distress, such as inconvenience, worry, or temporary anxiety, the claim does not fall under the IRB regime. These actions may be pursued directly in court without prior authorisation.

The judgment acknowledged the trade-off between the two tracks. The IRB system is more cost-effective and efficient but offers less flexibility than litigation before the courts. We previously published an article on How Irish Courts Are Handling Data Breach and GDPR Claims. Time will tell which route now becomes more common, particularly in data protection and consumer claims.

The Limits of Negligence for Emotional Distress

The Court also clarified that where emotional harm falls short of psychiatric injury, negligence is not a viable cause of action. This is because emotional upset alone does not meet the “damage” element required to sustain a tort claim in negligence.

As Murray J noted, Irish law has long distinguished between recognised injury and non-actionable emotional disturbance. While emotional distress may sometimes be compensable in contract or under statute (such as the Data Protection Act 2018), it does not transform into a personal injury for other legal purposes.

The Role of GDPR and the Data Protection Act 2018 for Data Protection Litigation in Ireland

Mr Dillon had also brought his claim under section 117 of the Data Protection Act 2018, mirroring Article 82(1) of the GDPR, which allows for compensation for both material and non-material damage.

While this legislative framework supports recovery for distress caused by data breaches, the Court confirmed that such claims do not become personal injury claims unless psychiatric injury is present. This distinction preserves access to redress under data protection law without triggering the procedural requirements of IRB.

A Warning on Pleading and Procedure

One of the most important procedural lessons from the case was the emphasis placed by the Court on accurate pleading. Murray J stated repeatedly that it is the responsibility of the plaintiff — not the courts or defendants — to clearly state:

The type of harm for which compensation is sought, and
The legal basis of the claim (tort, statute, contract, etc.).

Mislabelled claims, or those that blur the boundaries between personal injury and non-injury proceedings, may be vulnerable to procedural objections — or worse, outright dismissal.

Solicitors are now on clear notice that claims involving emotional distress should only proceed through IRB where there is evidence of psychiatric diagnosis. Otherwise, they must be pleaded accordingly and initiated through the ordinary civil courts.

What Can Insurers and Data Controllers Learn

This Supreme Court decision provides much-needed clarity for claimants, insurers, and legal practitioners:

Emotional upset claims without psychiatric evidence can now proceed outside the IRB regime.
IRB authorisation is only required for personal injuries supported by medical or psychiatric diagnosis.
Negligence claims for emotional harm alone are likely to fail, as they lack the injury element.
GDPR/data breach litigation can proceed in court for non-material harm, but awards are likely to be modest without clinical injury.
Solicitors must ensure claims are accurately pleaded and the correct procedural route is followed.

Final Thoughts from Lacey Solicitors

The judgment in Dillon v Irish Life marks a another turning point in Irish litigation. It draws a firm procedural and legal boundary between actionable personal injury and general emotional harm — offering clarity where confusion had prevailed.

At Lacey Solicitors, we act for both claimants and insurers in personal injury, insurance disputes, and data protection litigation across Dublin, Belfast and beyond. Whether you’re seeking to initiate proceedings or responding to a claim involving a data breach, our experienced litigation team can advise on the correct legal framework and best course of action. Use our Online Portal to speak with a member of our team.

How Irish Courts Are Handling Data Breach and GDPR Claims

Posted on 2 July 20255 August 2025 by Ruaidhri Austin

Lacey Solicitors, are known and respected as Insurance Defence litigators and represent a number of insurers across the entire island of Ireland. Our office is at front of one of the fastest-growing areas of litigation namely Data Breach Claims in Ireland. Particularly, those involving non-material damages—claims for emotional harm like distress or anxiety, rather than specific financial loss.

What Are Non-Material Damages?

Under Article 82 of the GDPR, individuals can claim compensation for:

Material damage (e.g. financial loss)
Non-material damage (e.g. distress, anxiety, embarrassment, or loss of control over personal data)

These claims are supported by the Data Protection Act 2018 in Ireland.

Where Are These Claims Heard?

As of January 2024, the District Court can hear data protection claims up to €15,000. This makes it the default forum for most non-material damages claims. If a claim is filed in the Circuit Court but is worth less than €15,000, insurers should seek to remit it to the District Court to reduce costs.

Do Claimants Need PIAB/IRB Authorisation?

Previously yes. If the claim involved distress, anxiety, or upset, it was be considered a personal injury. In that case, the claimant needed an authorisation from the Injuries Resolution Board (IRB) before issuing proceedings.

The Supreme Court judgment in Dillon v Irish Life Assurance PLC [2025] IESC 37 recently overturned that previous position. the High Court’s decision in Keane v CSO which held that IRB authorisation was a prerequisite for non-material damage claims arising from data breach.

The Supreme Court ruled that a freestanding claim in tort or contract seeking damages solely for emotional disturbances like anxiety, distress, and upset, which do not amount to a recognised psychiatric disorder, is not considered a “personal injury” claim under the PIAB Act 2003, and thus does not require PIAB authorisation as a prerequisite.

Key Irish and EU Cases

Here are the most important cases shaping how non-material damages are assessed:

Irish Cases

Kaminski v Ballymaguire Foods Ltd [2023] IECC 5
- Facts: Employee’s photo used in a training session without consent.
- Award: €2,000 for distress and embarrassment.
- Key Point: No medical evidence needed; plaintiff’s testimony was enough.
MH v Child and Family Agency (Tusla) [2023]
- Facts: Sensitive childhood abuse data disclosed to third parties.
- Award: €7,500 for emotional harm.
- Key Point: Seriousness of breach and lack of mitigation increased the award.
McCabe v AA Ireland Ltd [2024] IECC 6
- Facts: Employee was secretly recorded by a manager while on sick leave.
- Award: €5,500 for distress and embarrassment.
Dillon v Irish Life Assurance PLC [2025] IESC 37
- Issue: Whether PIAB authorisation is needed for distress claims.
- Decision: No—distress and anxiety do not fall under personal injury.

EU Cases (CJEU)

Österreichische Post (C-300/21)
- Key Point: A GDPR breach alone is not enough—actual damage and a causal link are required.
VB v Natsionalna agentsia za prihodite (C-340/21)
- Key Point: Data controllers must prove they had strong security in place. Strict liability doesn’t apply automatically, but the burden is high.
AT, BT v PS GbR (C-667/21)
- Key Point: Fear of future misuse of data can be compensable—but only if it’s real and proven, not hypothetical.

What can you receive Compensation for?

Under the GDPR, individuals can claim compensation for certain types of emotional harm caused by data breaches. Compensable non-material damages include distress, anxiety, embarrassment, and loss of control over personal data—these are recognised by courts as legitimate impacts of a breach.

However, not all emotional responses qualify. Mere upset or annoyance, as well as hypothetical fears that are not supported by evidence, are generally not compensable. Courts require a clear and demonstrable link between the breach and the emotional harm suffered.

How Much Are Courts Awarding for Data Breach Claims in Ireland?

Type of Breach	Typical Award (€)
Minor (e.g. Kaminski)	€500 – €2,500
Moderate (e.g. McCabe)	€2,500 – €5,500
Serious (e.g. MH)	Up to €7,500

Awards over €10,000 are rare and would require exceptional circumstances.

Strategies for Insurers dealing with Data Breach Claims in Ireland

When defending GDPR-related claims, insurers should take a practical and proactive approach. One of the first steps is to assess whether the case belongs in the District Court, especially if the claim is under €15,000—this can help manage legal costs more effectively. Insurers should also look closely at the evidence—is there clear proof of actual harm and a direct link to the alleged breach? If not, that’s a strong basis for challenge.

Taking early steps to apologise and correct the issue can also go a long way in reducing potential damages. In some cases, if the data in question is already accessible through a secure online portal, that may be enough to satisfy the claimant’s request. Finally, it’s worth considering mediation or other forms of alternative dispute resolution to settle matters quickly and avoid drawn-out litigation.

What About Cyberattacks?

Insurers should note:

Controllers are not automatically liable for every breach.
They must show they had strong security measures in place.
In complex cases, expert evidence may be needed to prove the breach was unforeseeable.

Need help defending a Data Breach Claim in Ireland?

At Lacey Solicitors, we offer expert legal advice and proven defence strategies tailored to the needs of insurers, businesses, and data controllers across Ireland. Ruaidhri Austin, Partner deals with data protection claims, as well as broader issues involving privacy law and cyber security. Whether you’re facing a data breach allegation, a non-material damages claim, or need guidance on compliance, Ruaidhri and our dedicated team are here to help.

Click through to our online portal to arrange a confidential discussion and see how we can support you:

Discovery, Implied Undertakings and Contempt of Court. A Conor McGregor Saga.

Posted on 21 January 202521 January 2025 by Lacey Solicitors

The headlines have been dominated this week by Conor McGregor and the case against him by Ms Nikita Hand where Italian news articles indicate an ‘imminent publication’ of the Discovery from the case.

In November 2024, Ms Hand won her claim for damages and was awarded just shy of €250,000 damages against Mr McGregor on foot of the jury verdict where they found that he had raped Ms Hand six years ago.

McGregor’s legal team have indicated that they intend to appeal against the decision.

Whilst much focus has been made on the legal costs, which is an eye watering 1.3million Euro, the legal principles surrounding Discovery in Ireland is also gathering media attention.

Background

Lawyers for Ms Hand and Mr McGregor made representations relating to key CCTV evidence which showed Ms Hand in the Beacon Hotel, Sandyford, Dublin.

The material was gathered by An Garda Siochana and supposedly her demeanour in the CCTV footage was one of the factors that prompted the Director of Public Prosecutions (DPP) not to bring criminal charges.

It was provided by An Garda Siochana on foot of a High Court order for preparing for and litigating the civil case.

It was shown several times during the case and was the subject of media coverage.

Lawyers for Ms Hand had sought assurances that Mr McGregor would not disseminate the material after newspapers reported on social media comments that claimed the footage would be released this month.

The comments were attributed to Gabriel Ernesto Rapisardo, who Justice Owens said was a business associate of Mr McGregor.

Ray Boland SC for Ms Hand said Mr McGregor intended to disseminate selected pieces of the evidence with a view to “undermining and discrediting” the findings of the court.

Remy Farrell SC, for Mr McGregor said such an order was not necessary as there was already an implied undertaking that material for the case would not be misused or disseminated.

Justice Owens stated that “such leaking would be a gross contempt of Court.”

Discovery and Implied Undertakings

Discovery is a pre-trial procedure where parties to a lawsuit can obtain evidence from each other. The purpose is to prevent surprises during the trial and ensure that both sides have access to all relevant information.

The Discovery process in Ireland is governed by Order 31, of the Rules of the Superior Courts though our office has also written about alternative means for Discovery.

Documents and information, in this case CCTV Footage obtained by way of discovery in litigation are subject to an implied undertaking that they will not be used other than for the purposes of the proceedings in which they are concerned.

I.e. McGregor and his legal representatives are prohibited from using the CCTV for any other purpose other than the Defence of the civil claim brought against him by Ms Nikita Hand.

The implied undertaking is owed to the court. Such discovery may not be used to found other causes of action. The law in Ireland is therefore broadly similar to that of NI.

The rationale underpinning the undertaking was explored in Greencore Group plc v Murphy, where Keane J highlighted that it was an invasion of private rights, constituted by discovery:

“The order requiring the production of…documents is an invasion of the right of the person against whom the order is made to keep his documents to himself and it is for this reason that the Court will ensure that documents are not used for any purposes other than the purpose of the particular legal proceedings in which they are produced by making the order for production subject to that implied undertaking.”

Leaking of documents/information would constitute a breach of undertaking.

In the current case Justice Owens confirmed that it would be a gross breach of Ms Hand’s privacy adding that “the material would quickly spread on the internet and reach the furthest corners of that dark hole”.

The undertaking survives notwithstanding that any discovery obtained is often used in open court. In this case the CCTV footage was show several times during the case and was the subject of significant media coverage. The fact that there is an inevitable degree of publicity does not justify widespread dissemination of the material for an ulterior purpose.

Breaching Implied Undertakings in Discovery in Irish case Law

Tobin v. Minister for Defence [2019] IESC 57 highlighted the importance of the discovery process in ensuring fair civil proceedings while acknowledging potential burdens.

Implications of breaching an implied undertaking were explored in the Irish Supreme Court case of Waterford Credit Union v. J & E Davy [2020] IESC 9 where both the High Court and Court of Appeal, whilst finding documentation to be relevant and necessary, denied discovery citing a breach of the implied undertaking by Waterford’s solicitor in separate proceedings, which had improperly used information obtained during discovery.

Upon appeal, the Supreme Court reversed the Court of Appeal’s decision, holding that the breach of the implied undertaking by Waterford’s solicitor in unrelated proceedings should not prevent the discovery of relevant and necessary documents in the current case. The Supreme Court emphasized the primary duty of ensuring substantive justice and maintaining the integrity of the discovery process over procedural technicalities involving breaches by legal representatives in separate instances.

Contempt of Court in Ireland

Justice Owens in this case confirmed that there was a “real and demonstrable risk” that the footage would be disseminated and, if that happened, it would be a breach of the implied undertaking not to misuse the material and would constitute civil contempt of Court.

Contempt of court is refers to any behaviour or action that disrespects, disobeys or challenges the authority, justice system and dignity of the work of the courts. It protects the administration of justice by ensuring that court orders are obeyed and that courts can run smoothly.

In Ireland, contempt of court remains on a common law footing. This is in contrast to NI where it is enshrined in legislation through the Contempt of Court Act 1981. Indeed the Supreme Court in Ireland has been calling for contempt-of-court legislation for some time. In Kelly v O’Neill ([2000] 1 IR 354), Keane J said that “our law in this area is, in many respects, uncertain and in need of clarification by legislation”.

Order 44 of the Rules of the Superior Courts provides that those in contempt of a court order can be attached (arrested) and committed to jail, but it doesn’t specify what “contempt” is.

The Law Reform Commission published a Consultation on Contempt of Court in July 1991 under which it recommended legislative codification on the law in this area, but as of 2025 the closest we have seen to codification is the Contempt of Court Bill 2017, which may have gained traction again if its sponsor, Josepha Madigan, had been re-elected.

In Irish Bank Resolution Corp Ltd v Quinn and Ors [2012] IESC 51, the Supreme Court commented that the law of contempt of court was amorphous and extremely difficult for the layperson to understand and could be unclear even to judges and lawyers.

The Judge even referred to the position in NI in stating;

“It is 20 years now since the Law Reform Commission urged the need for statutory reform in this area, and some 31 years since such reform took place by statute in the neighbouring jurisdiction. It is most unfortunate that no positive steps have been taken here, with the result that this fraught matter has come on for resolution in an uncertain state of the law.”

It is understood that the Law Reform Commission continues to consider the matter, but due to the urgency of other work in hand, its report on contempt is not expected to be published until late 2025.

Minister for Justice Helen McEntee has stated that the publication of this final report is awaited before her department considers any changes to this complex area of law.

Dealing with Contempt

An infamous line that any UFC fans attribute to Mr McGregor comes to mind, “You’ll do nothing.”

Another is ‘I’d like to apologise…to absolutely nobody.’

In dealing with Civil Contempt, there is the question of the appropriate order, if any, on foot of any finding of contempt.

Such orders may include, but are not limited to custodial orders, but may also include financial orders. This is against a backdrop of Justice Owens referring to Mr McGregor as ‘one of the wealthiest men in the country.’

The Judge considered social media posts in which Mr McGregor was said to have “scandalised the court” after the jury’s verdict where he referred to Ms Hand as a liar and the court as a ‘kangaroo court’. He indicated that any action at that stage would only give oxygen and more publicity. He opted to take no action on the “kangaroo court” comments as it would be a “distraction” and “only keep him in the news cycle”.

Justice Owens has indicated it was necessary to ‘nip this in the bud’ and directed Mr McGregor to return ‘all fobs or sticks’ containing the footage to his solicitor and arrange the permanent deletion of the files from computers and phones within one week.

The judge also directed him to make an affidavit indicating what copies had been made and how they were deleted.

Jenna Curran of Lacey Solicitors attends Law Society House for Seminar hosted by TRADATA

Posted on 26 February 20193 August 2024 by Damian McGeady

Jenna Curran of our office recently attended the TRADATA (Training of lawyers on the European Union’s Data Protection Reform) Seminar at Law Society House, Belfast and was granted a Certificate in recognition of her participation.

The event was operated with the European Lawyers Foundation as coordinator and eight other European partners.

Topics covered included the impact of GDPR nine months after its inception, the potential impact of Brexit and GDPR Employment Practices.

The seminar also featured a section on Cyber Security awareness in a world where the amount of information we deal with is increasing exponentially. Practical tips on regularly changing passwords, not using the same passwords for multiple accounts and considering the use of strong passwords was a simple but effective reminder of how we can try to meet our responsibility to protect not only our own data, but that of others.

Cyber Crime is on the increase and the perpetrators of this type of crime have at their fingertips very sophisticated software packages which can allow them to infiltrate various devices and make use of that data for their own gain. Often, their gain comes at the expense of the person from whom the data has been taken. We are all too familiar with the cases of hackers intercepting emails containing bank account details and changing these details. This can, of course, have huge ramifications for the person who ultimately ends up transferring money to a non-intended beneficiary.

The training served as a sobering reminder that information and personal data are very valuable and it is imperative that we treat that data with the level of respect it deserves. To ignore doing so has potentially devastating consequences.