Irish court awards first GDPR damages for emotional distress over CCTV use

Arkadiusz Kaminski went to work at Ballymaguire Foods in Lusk, County Dublin, unaware that his image had been captured on the factory's CCTV system and was about to become the subject of a training video shown to his colleagues. When the footage was played during a supervisors' meeting he did not attend, something shifted. Colleagues who recognized him began approaching him with knowing looks, telling him they'd seen him on camera "doing something he should not have been doing." What followed was mockery from coworkers, sleepless nights, and a gnawing sense that his authority as a supervisor had been undermined in front of the people he managed.

On July 13, 2023, Judge John O'Connor of the Circuit Civil Court handed down a decision that would become the first of its kind in Ireland: an award of €2,000 in damages to Kaminski for emotional distress caused by the unauthorized use of his personal data. The ruling marked a watershed moment in how Irish courts would interpret the General Data Protection Regulation and what it means when an employer processes an employee's image without consent.

Kaminski's legal team, led by solicitors Tracey Brady and Richard Crowley at McGuigan Solicitors, had brought the case under the Data Protection Act 2018, arguing that Ballymaguire Foods had breached both the Act and GDPR provisions by using his CCTV footage in the training video. The company's defense was straightforward: even if there had been a breach, Kaminski was not entitled to recover damages because his suffering amounted to nothing more than "mere upset, anxiety and embarrassment"—emotional states the law traditionally did not compensate. The company's barrister, Eoin Coffee, pressed this argument with the confidence of established precedent.

But Judge O'Connor saw the case differently. In a detailed written judgment that would serve as guidance for future proceedings, he laid out the legal framework with precision. Both parties agreed that Kaminski was identifiable in the footage and that the court was satisfied an infringement of his GDPR rights had occurred. The question was whether the damage went beyond mere displeasure into territory the law recognized as compensable. The judge found it did. The CCTV footage had been stored on a communal work computer without password protection—a serious security lapse, though one that had not resulted in unauthorized access. More importantly, Kaminski had not been present at the training meeting and had no knowledge his image would be used. The mockery that followed, the sleep loss, the erosion of his standing among his team—these were not abstract emotional reactions but concrete consequences flowing directly from the breach.

"The court accepts Kaminski's loss went beyond mere upset and created an emotional experience and negative emotions of insecurity which did affect him for a short time," Judge O'Connor wrote. He noted that while Kaminski had presented no medical evidence, he had come across as a truthful and conscientious witness who had not exaggerated the impact of what had happened to him. The judge also acknowledged that Ballymaguire Foods had since addressed its data policies and CCTV practices—a point in the company's favor when it came to calculating the award. The damage, he found, had not been long-lasting.

The €2,000 award, coupled with an order that Ballymaguire Foods pay all legal costs, was calibrated to recognize genuine harm without inflating it. It was a measured decision, one that respected both the seriousness of the breach and the reality that Kaminski's distress, while real and consequential, had been temporary. What made it historic was not the size of the payout but the principle it established: in Ireland, a court would now recognize that unauthorized processing of personal data in the workplace could cause non-material damage worthy of compensation, even when that damage took the form of embarrassment, anxiety, and lost sleep. The ruling opened a door that had been closed, signaling to employers that GDPR was not merely a compliance checkbox but a protection with teeth, and to workers that their dignity in the workplace had legal weight.