A family from Wirral, Merseyside, has won the right to claim compensation after their son was attacked by another three-year-old with a car jack two years ago.

Jay Jones needed stitches in his head after the assault, which happened when the two toddlers were left alone for a few minutes in a car in Birkenhead in December 2007. Within hours, doctors at Arrowe Park hospital, Merseyside, were confident that Jay would survive, but it took much longer to confirm that he would suffer no lasting brain damage.

He suffered nightmares and bedwetting for months afterwards and was terrified to go near windows because it reminded him of being in the car.

Jay's family won a ruling on Tuesday allowing for compensation for the injuries he received, even though his attacker was not prosecuted because of his age. Jay's mother, Renai Williams, 29, said the Tribunals Service ruled in her favour although the Criminal Injuries Compensation Authority (CICA) had twice refused to pay out as it disputed whether such a young child could be guilty of a crime of violence.

Williams told the BBC: "This has been a long and hard-fought process. We have been knocked back twice by the CICA because in my opinion they didn't take my son's case seriously. My son was hit 11 times on his head and face with a car jack, his attacker kept on lashing out even though Jay was screaming out in pain and covered in blood. It was a vicious attack with such force that his attacker, who was also only three himself, managed to crack the car windscreen."

Williams and her partner had been preparing to go to a post-Christmas dinner and had allowed their son to travel with friends.

"We were getting ready to get into the car when we received a phone call from the other family saying we had better come quick," Williams said. "We drove round, but we weren't too worried – boys fight. But when we got there we noticed the crack in the car windscreen – that was the first bit of panic. Then the other parents came running out the house.

"My partner, Jay's dad David, got out of the car saying 'where's Jay?' They pointed to the house and he went inside and I heard him shouting 'what happened' and they pointed to the car jack, which had blood on it. David came out carrying Jay, who was covered in blood and all limp. He just looked dead."

Jay spent two nights in hospital and suffered bruising to his head and wounds on his arms.

Simon Gibson, a partner at Kirwans, said CICA rejected the family's claims initially, arguing that the attacker lacked sufficient knowledge to be able to carry out a criminal attack. The age of criminal responsibility in England, Wales and Northern Ireland is 10.

"From the point of view of criminal law that makes good sense, but a claim for damages is civil law. Under that you only have to prove the act was deliberate," he said. "We succeeded on Tuesday before an independent appeal. They said this was a unique case."

Gibson said the ruling could open the floodgates for similar claims – even schoolyard attacks involving young children.

CICA said: "We express our sympathy to all victims of crime and their families. All cases are decided on their own merits and, if an applicant does not think their case was assessed fairly, they may apply to have it reviewed. If the applicant remains unhappy after the review they can appeal to an independent tribunal."

The amount of compensation is yet to be decided.