England and Wales High Court (Queen's Bench Division) Decisions

IN THE HIGH COURT OF JUSTICE
QUEEN'S BENCH DIVISION

		Royal Courts of Justice
		Tuesday 12 June 2018

HIS HONOUR JUDGE PARKES QC:

1. This is my judgment on the application by Ms. Azra Sabados for a Norwich Pharmacal order against the defendant, Facebook Ireland Limited. The claimant is represented by Mr. Callus.
2. The claimant is a British citizen who was born in Bosnia but who has lived in London since the Yugoslav war forced her to move in 1992. She married a fellow Bosnian in 1987 and had a son by him. They separated in 2007 but remained friends.
3. The defendant, which I shall refer to as "Facebook", is a company incorporated in the Republic of Ireland. As is well-known, it operates the world's largest social media platform with over two billion users.
4. The background to the application is that the claimant had a serious, long-term romantic relationship with a childhood friend called Mirza Krupalija ("Mirza"), a man who, after service in the Bosnian army from 1992 to 1995, devoted himself largely to jazz. He played drums in his own band, he opened and managed a jazz club and opened the first Sarajevo Jazz Festival. He had been married to a woman named Lejla Somun, by whom he had a daughter. They divorced in 2006 in circumstances that seem not to have been amicable, although Mirza remained devoted to his daughter.
5. The reunion of the claimant and Mirza occurred in 2010, and their relationship lasted until his sudden and unexpected death in March 2016 during a medical procedure. Their relationship was necessarily conducted at a long distance for most of the time because she lived (and still does live) in London, while he lived in Sarajevo. However, they spent around seven weeks a year together in Bosnia and the claimant was planning to move back to Sarajevo when she retired, which she hoped would be in 2019. They would talk every day, chiefly by Facebook Messenger and by Skype, and Mirza used Facebook heavily, particularly to post his music, photographs, poems and the like. According to the claimant, some of the information on Mirza's Facebook page will have been her own personal data, because it will have contained all the intimate messages which she sent to him and he to her. In her witness statement, she describes the messages that charted the six years during which they were together as the most private and intimate correspondence.
6. After Mirza's death, the claimant was treated by his family as his wife and was allowed to make all the decisions about his funeral arrangements.
7. Around six months after Mirza died, Facebook received and acceded to a request from a person unknown to delete his account. As a result, the material posted by him (including music videos, photographs, poems and messages) was deleted and (as Facebook have informed the Irish Data Commissioner) cannot be recovered. Facebook will not say who requested the deletion, except that it was a family member, but they maintain that their normal processes were followed. Such a request could only be made, they say, by an executor or immediate family member of the deceased.
8. It is hardly surprising that the claimant was devastated by the loss of so much material which was the fruit of her relationship with Mirza. His loss was terrible, but no doubt the further loss of so many memories would have made his death still harder to bear. She finds it very hard to imagine how or why anyone could have done such a thing, nor how that person could have persuaded Facebook that they had the standing to request it when she alone was and was known to be his life's partner.
9. In the circumstances, it is entirely understandable that the claimant wants to know who made the request for deletion and to see the correspondence between that person and Facebook. I should say in that context that Mr. Callus told me that Facebook has warned that it may not now have the information requested.
10. Facebook responded to a subject access request by the claimant, and to the Irish Data Commissioner, but has not sent any substantive response to the claimant's letter before action of 23 May 2017.
11. The Part 8 Claim Form was issued on 10 December 2017. I am told that it was served on Facebook in Dublin on 28 December 2017 by registered post under CPR rule 6.40(3)(b) and (c), applying Article 10(1) of the Convention on the Service Abroad of Judicial and Extrajudicial Documents in Civil or Commercial Matters (the Hague Service Convention), that being a method of service permitted under Irish law, and to which the Republic of Ireland does not object under Article 10 of the Convention. Given that Facebook is domiciled in the Republic of Ireland, leave to serve out was not required.
12. The claimant filed a certificate of service, but Facebook have never acknowledged service. They are of course now long out of time to do so. But on 14 April 2018, the London office of White & Case LLP sent the claimant a notice of acting on behalf of Facebook. However, they made it clear that they were not authorised to accept service, or to enter into correspondence, and that all correspondence should continue to be sent to Facebook's office in Dublin. Master Kay QC, on the claimant's application, released the claim to be heard before a judge today and Facebook has been informed of the hearing but is not represented.
13. What cause of action is asserted? It is the claimant's position that the person who secured the deletion of Mirza's Facebook profile has at least caused the deletion of personal data belonging to her because among the material on the profile were photographs of her with Mirza. It is likely that there were other personal data. If their deletion was caused by the unknown person responsible, then there would have been a breach of the Data Protection Act. Moreover, the unknown person plainly convinced Facebook of their authority to request deletion and if so, the claimant fears (it seems to me not without reason) that they may also have gained access to her personal data and private communications with Mirza, thereby committing a breach of confidence and/or misuse of private information. She believes it likely that the information given by that person to Facebook will be untrue. She speculates that if there are multiple communications amounting to a course of conduct she may have a remedy in the tort of harassment.
14. That, I have to say, seems improbable. For a claim in harassment to have any prospect of success, the matters relied on for the course of conduct would have to have an impact upon the claimant. Leaving harassment to one side, she wishes to know what information the unknown person had access to and whether he or she still has it.
15. What is the position as far as jurisdiction is concerned? As against Facebook, the primary rule under Art.4 of the Brussels Recast Regulation ("BRR") would apply, namely, that it should be sued in the courts of the member state where it is domiciled, which is to say the Republic of Ireland. However, Mr. Callus submits that this court has jurisdiction under Art.7(2) of the BRR, on the footing that this is a matter relating to tort, delict or quasi delict, and England and Wales is the place where the harmful event occurred.
16. As against the unknown person, of course, much will depend on where that person is domiciled. If he or she is domiciled in Bosnia, which is not a member state of the EU, leave to serve out would, of course, be required and would, I assume, be sought under para.3.1(9) of CPR PD6B or alternatively under para 3.1(21), where a claim is made for breach of confidence or misuse of private information and (a) detriment is suffered or will be suffered within the jurisdiction or (b) detriment has been or will be suffered as a result from an act committed or likely to be committed within the jurisdiction.
17. I need not, I think, speculate further about that at this stage. I should just say that Mr. Callus has referred me to the decision of Tugendhat J in Vidal-Hall v Google [2014] EWHC 13 (QB) and the Court of Appeal's decision in the same matter ( [2015] EWCA Civ 11 ). I need not refer to those decisions further, save to say that they give me some confidence that the approach which Mr. Callus urges me to take on the effect of Art.7(2), and as to the extent to which distress is an element of a claim for misuse of private information or breach of data protection rights, is well- founded.
18. I was initially sceptical of the submission that Art.7 (2) saw Mr. Callus home. It seemed to me at first sight that if the harmful event occurred anywhere, it would have been in the Republic of Ireland, where Facebook would have received and acted on the request, and possibly also at the place from which the request was made. There appears to be no reason whatever to suppose that the place where the request was made was England and Wales. It seems much more likely from the claimant's witness statement that it emanated from Bosnia, a country where Mirza lived and worked and to which the claimant had very strong bonds and spent all the time which she was able to spend with him.
19. This is not a case where the claim is brought on publicatio n of offensive material on the internet, where it may be appropriate to bring a claim in the EU country where the claimant has his or her centre of interest. I refer in that context to the case of eDate Advertising GmbH and Others in the European Court of Justice. Mr. Callus argues otherwise, submitting that the ratio of eDate, which is concerned with personality rights, extends beyond cases where the cause of action depends on publication on the internet, but insists he does not have to rely on eDate because he can get home on Art.7(2).
20. Mr. Callus has explained to me that it is necessary to break down Art.7(2) BRR into its components. He has referred me to authority on the predecessor of Art.7(2), which is Art.5(3) of the original Brussels Convention or the Judgments Regulation which superseded it. In the case of Handelswerkerij GJ Bier B.V. v Mines de Potase d'Alsace S.A. [1978] QB 708, the European Court of Justice held that Art.5(3) was to be construed as referring both to the place where the tortious act occurred and the place where the damage occurred, giving the plaintiff an option of suing the courts of either place.
21. That was a case where the act (the dumping of salt in the Rhine) took place in France, but the damage occurred in the Netherlands, where the plaintiff used Rhine water for his activities as a nurseryman. So here, Mr. Callus submits, the wrong was probably done in the Republic of Ireland, but the sole damage caused was suffered by the claimant in England, where she lives. That damage is constituted by the grave distress which she has suffered as a result of the actions of the unknown person.
22. Article 5(3) has also been examined by the courts of this country, and Mr. Callus pointed me to the decision in JSC BTA Bank v Ablyazov [2017] QB 863, a Court of Appeal decision founded on contempt of court by breach of a worldwide freezing order. The claimant brought an action in this jurisdiction against the alleged contemnors in the tort of conspiracy to injure by unlawful means, that means being serial contempts of court.
23. In that case, a slightly different distinction was drawn between (a) the place giving rise to the damage, which was the hatching of the conspiracy, said to be England, and (b) the place where the damage occurred, which was the place where the assets had been wrongly dealt with in breach of the freezing order, which was in one or more foreign jurisdictions.
24. I confess that I have not found this at all an easy point to determine on a short hearing, at which Facebook has not been represented. I am concerned by the proposition that the claimant can found jurisdiction by suffering distress in this country in respect of actions which in all other respects took place in the Republic of Ireland and possibly also in Bosnia, a non- member state of the EU. I have been troubled by the analogy of a libel published by the unknown person to Facebook in the Republic of Ireland, a libel of which the claimant was then informed by Facebook in response to her inquiries. In that event also, she would have suffered distress in this jurisdiction as a result of publication of the libel to Facebook, but the courts of England and Wales would certainly not have jurisdiction to entertain the claim. Mr. Callus' answer is that the essence of damage in defamation is injury to reputation, and the element of distress is essentially parasitic on that.
25. Ultimately, I can see no reason of principle, and Mr. Callus certainly has not suggested one, why I should not conclude that there is an arguable case that the claimant can maintain a claim against Facebook for Norwich Pharmacal purposes on the footing that this is the place where the damage occurred for the purpose of Art.7(2), and ultimately against the unknown person for a substantive action founded on breach of data protection principles, breach of confidence and misuse of private information.
26. No doubt as Mr. Callus points out, if there is jurisdiction to make a Norwich Pharmacal order, then it can be enforced in other EU member states such as the Republic of Ireland under the BRR, and he refers to a decision in the case of Credit Suisse Trust v Intesa San Paulo SpA, Banca Monte dei Pasche di Siena [2014] EWHC 1447 (Ch) at para.11 where the judge refers to Art.36 (in fact Art.26 is mistakenly referred to) of the BRR as showing that any judgment of this court would be capable of enforcement in other EU member states without any further special procedures.
27. The test which the court has to apply on a Norwich Pharmacal application was helpfully summarised by the court in Ramilos Trading Ltd v Buyanovsky [2016] EWHC 3175 (Comm) at para.11 as follows:

"11. The three conditions to be satisfied for the court to exercise its power to grant Norwich Pharmacal relief are:

i) a wrong must have been carried out, or arguably carried out, by an ultimate wrongdoer;

ii) there must be the need for an order to enable action to be brought against the ultimate wrongdoer; and

iii) the person against whom the order is sought must:

(a) be mixed up in so as to have facilitated the wrongdoing; and

(b) be able or likely to be able to provide the information necessary to enable the ultimate wrongdoer to be sued."

28. As to the first threshold condition, I am prepared to accept that there is a good arguable case that a person unknown posing as a family member contacted Facebook to seek the deletion of Mirza's Facebook profile (and the page for his band Kaitan) some six months after his death, which meant the irretrievable destruction of posts and messages on his profile, including his poems and music and photographs which were stored on that profile. Some of that information (such as the photographs of the claimant and Mirza together) will be the claimant's personal data within the meaning of the Data Protection Act. Procuring its destruction would in principle give rise to a claim for breach of that Act and possibly to a claim for misuse of private information. It is arguable also that whoever was able to arrange for the deletion of the Facebook profile will have had access to that profile prior to its deletion. In that event, the person unknown would have had access to the private messages exchanged between Mirza and the claimant for the many years they were together, and would thereby have committed a breach of confidence and/or misuse of private information.
29. It is also conceivable, though I put it no higher, that there could be a Wilkinson v Downton claim, given that it may well be that whatever was done by the unknown person was done maliciously.
30. Leaving that aside, I conclude that there is a good arguable case that the first threshold is satisfied.
31. As to the second threshold, without an order the claimant does not have sufficient information to be able to identify the person unknown. Moreover, until she knows what representations were made by that person to Facebook, she is not able to formulate her course of action. The information sought is therefore necessary for her to formulate claims against the person unknown.
32. As to the third threshold condition, Facebook is the social media platform that hosted Mirza and the claimant's private information, and deleted it at the unknown person's request. It is unequivocally mixed up in the unknown person's wrongdoing. Its procedures for the deleting of deceased relatives' Facebook profiles includes capturing details of the requestor and official documentation. Facebook indicated in early correspondence with the claimant that they held this information, although they have since expressed some doubt that they do. That doubt is no reason not to make an order if the other conditions are satisfied. On any view, Facebook is not a mere witness. The third condition, in my judgment, is therefore satisfied.
33. Of course, even when the three conditions are made out, the court still retains a discretion. In Ramilos at para.27 the judge set out the non-exhaustive list of factors identified by Lord Kerr in Rugby Football Union v Viagogo [2012] UKSC 55 at [17].
34. It is material, in my judgment, to note, having regard to those principles, that the essential purpose of the remedy is to do justice. Unless the court makes the order sought, the claimant will have no remedy whatever for very hurtful, distressing and on the face of it, very possibly malicious behaviour by the person unknown.
35. There is no question of the names of innocent persons being revealed ,and although the person unknown, himself or herself, has privacy rights under Art.8 of the ECHR, and data protection rights, undertakings not to use the information obtained for any purposes other than the purpose of proceedings against that person, which are in any event implied on such applications even if not given expressly, with such further safeguards as the court may decide at a later stage are appropriate, should draw the sting from any intrusion into those rights.
36. For all those reasons I am prepared to make the order sought.