Overview

Section 77 of the Courts and Civil (Miscellaneous Provisions) Act 2023 amends section 117 of the Data Protection Act 2018 to extend jurisdiction to hear and determine data protection actions to the District Court and it is now operational.

The extension of jurisdiction to hear data protection claims is a welcome development against the backdrop of the recent Kaminski judgment (discussed here), in which it was held that modest compensation was payable for non-material damage under the GDPR and the Data Protection Act 2018.

Importantly, from a costs perspective, the level of costs awarded to successful claimants in the District Court will be considerably lower than in the Circuit Court. The District Court does not deliver written decisions however and therefore it may be more difficult to discern trends in the assessment of data breach claims.

Looking Ahead

In the Kaminski judgment, the court suggested that, alternative dispute resolution in the format of an independent adjunctive or conciliatory process may be an appropriate way to resolve data-breach assessments. For now, however, the courts remain the central avenue for redress.

While this legislative amendment brings a welcome additional avenue of redress for data protection claims, we anticipate an ongoing and prominent role for the superior courts in this area, not least in the context of collective redress. While not yet commenced, the Representative Actions for the Protection of the Collective Interests of Consumers Act 2023 (discussed in detail here) provides that the High Court will have jurisdiction to hear representative actions brought on behalf of consumers for alleged infringement of their rights under relevant enactments, including the Data Protection Act 2018.