The thinking behind using an IO handle rather than a string was that I could use the Text::CSV::getline_hr() method to do some post processing of the uploaded data and store the results in a separate data structure.

However, my immediate requirement is to get the data into a spreadsheet, so Text::CSV_XS looks like a better option. It's man page has some useful advice on how to handle the embedded newlines.