APPROVED                                                                                          [2021] IEHC 287

THE HIGH COURT

2020 No. 1419 P

BETWEEN

BOARD OF MANAGEMENT OF SALESIAN SECONDARY COLLEGE (LIMERICK)

PLAINTIFF

AND

FACEBOOK IRELAND LIMITED

DEFENDANT

JUDGMENT of Mr. Justice Garrett Simons delivered on 19 May 2021

INTRODUCTION

1.       The objective of these proceedings is to compel the social media platform, Instagram, to identify the individuals behind one of its user accounts.  The proceedings are taken by the board of management of a secondary school (“ the school authorities”).  The school authorities apprehend that the now inactive user account had been operated by individuals who are either students or staff members of the school.  The school authorities seek to identify these individuals for the stated purpose of “dealing with” them by way of what the school authorities describe as a “disciplinary or pastoral response”.

2.       The disclosure application presents significant legal issues in respect of privacy, data protection and freedom of expression.  For the reasons set out in this judgment, I have concluded that it is necessary to make a reference to the Court of Justice of the European Union for a preliminary ruling on these issues.  This reference will be made pursuant to Article 267 of the Treaty on the Functioning of the European Union (“ TFEU”). 

PROCEDURAL HISTORY

3.       These proceedings relate to a user account which had been published on the social media platform, Instagram.  This platform is, seemingly, provided by the defendant, Facebook Ireland Ltd.

4.       The user account had only been active for a short period of time, between 14 October and 24 October 2019.  The user account had been employed to publish a series of posts, consisting of photographs or other images with supposedly humorous text superimposed.  It should be explained that the photographs and images themselves do not feature any one associated with the school.  Rather, they appear to be stock images sourced elsewhere on the internet.  It is the text which links the photographs and images to individuals and events at the school.

5.       In total, approximately fifty two posts were published via the user account.  Much of the content is coarse and vulgar.  In some instances, the content of the posts ridicules members of the school’s staff by reference to their personal appearance, weight and sexuality.  In other instances, the posts reference aspects of school life, such as, for example, the high cost of food on campus and a change to the structure of the timetable.

6.       It is said that a named student has been ridiculed or mocked, but no detail whatsoever has been provided on affidavit as to what is being referred to here.

7.       The user account featured, without permission, the secondary school’s address, crest and name, and referred to its official website.  Given the coarse and vulgar content of the posts, however, it is inconceivable that anyone viewing the user account would mistake it for an “official” school account. 

8.       The school authorities became aware of the existence of the user account within a matter of days of its first being activated.  Thereafter, a solicitor representing the school authorities posted a series of messages to the user account, calling on those operating it to delete the user account immediately.  In response, the operators of the user account removed the published content the next day.

9.       On the day following that, the school authorities obtained access to the password to the user account.  The password was seemingly obtained from a student, who, in turn, had been provided with it anonymously by an individual operating the user account.  Armed with the password, the school authorities were in a position to access the messaging function.  This revealed that twenty-one students from the school had been in communication with those operating the user account.  The school authorities are especially concerned about the content of two messages which had a sexual element.  It is accepted on affidavit, however, that these messages may have been intended to be sarcastic.  The school authorities reported the matter to An Garda Síochána and the Child and Family Agency.  There is no evidence before the court as to what steps, if any, these authorities considered necessary.

10.     The school authorities have since removed the school’s crest and details from the user account. 

11.     The school authorities sought to contact the company providing the social media platform and requested information with a view to identifying the individuals who had operated the user account.  Facebook Ireland Ltd.’s position is set out as follows in a letter dated 23 December 2019 to the solicitors acting for the board of management.

          “We write on behalf of our client Facebook Ireland in response to your letter dated 11 December 2019, which requests that Facebook Ireland provide the information related to the Instagram account Pallaskenrymemes (the ‘Account’) requested in your letters dated 8 November 2019 and 12 November 2019 on or before Friday, 20 December 2019.

          Our client cannot disclose user information to a private third party without a court order or request from law enforcement.  Any court order or law enforcement request requiring disclosure of account information must be addressed to and served upon Facebook Ireland, identify the Instagram account at issue by specific uniform resource locator (‘URL’).

          It is a matter for the Court to determine whether such Norwich Pharmacal relief is appropriate.  We are willing to review your client’s application for Norwich Pharmacal relief to ensure that any court order is properly formulated and that Facebook Ireland may comply therewith.

          Please note that we are not authorised to accept service on behalf of Facebook Ireland.  As a courtesy, you may continue to copy us on any further correspondence related to this matter.

          Facebook Ireland expressly reserves all of its rights.”

12.     The school authorities instituted these proceedings, by way of plenary summons, on 21 February 2020.  No statement of claim has ever been delivered in the proceedings.

13.     The principal relief sought in the proceedings is as follows.

          “An Order directing the Defendant to furnish to the Plaintiff within 7 days all data (including, but not limited to, the name(s), address, contact details, IP address or any other information capable of identifying the relevant individual) it holds, which records or evidences the identity and contact details of all persons who established and operated the Instagram profile entitled ‘ Pallaskenrymemes’ or any associated profiles;”

14.     A notice of motion was issued on behalf of the board of management on 21 February 2020, seeking this relief on an interlocutory basis.  The motion is grounded on an affidavit of the principal of the secondary school.  It is evident from the affidavit that the primary purpose of seeking to identify those behind the user account is to deal with them by way of a “disciplinary or pastoral response”.  (See, in particular, paragraphs 22 and 24 of the affidavit).

15.     The fixing of a hearing date for the motion was delayed in consequence of the restrictions on court sittings in non-urgent matters introduced as part of the public health measures in response to the coronavirus pandemic.  The motion was ultimately fixed for hearing on 7 December 2020.  The motion was part-heard on that date, and then adjourned to 21 December 2020 to allow the Attorney General to be put on notice of the proceedings.  Counsel on behalf of the Attorney appeared on that occasion, and provided a very helpful oral submission on the nature of the court’s jurisdiction and the need for an appropriate balancing of competing rights.  Counsel emphasised that, in circumstances where the Attorney is a stranger to the specifics of the case, it would not be appropriate to make other than general submissions. 

16.     The inter partes hearing resumed on 1 February 2021, with the benefit of detailed written legal submissions on behalf of the school authorities.

17.     The position adopted by Facebook Ireland Ltd, as presaged in the correspondence set out above, is that they are not formally consenting to the order but have not offered any substantive opposition to same. 

18.     The motion has been adjourned from time to time since 1 February 2021 to allow notice of the proceedings to be served on the Data Protection Commission, and to allow the school authorities to file supplemental written legal submissions addressing the implications of the data protection legislation.

19.     The motion was listed for further directions on 23 March 2021.  At that stage, I indicated that I was considering making a reference for a preliminary ruling to the Court of Justice pursuant to Article 267 of the TFEU.  The parties were invited to make submissions in respect of the necessity for same.  The school authorities filed written submissions on 22 April 2021.  Counsel for the school confirmed, at a directions hearing on 18 May 2021, that his side were content to rest on the written submissions and did not require a further oral hearing.

DISCLOSURE ORDER: PROCEDURAL ISSUES

20.     One of the striking aspects of applications of this type is that the individuals most directly affected, i.e. the very individuals whose identity the disclosure order is intended to reveal, are not on notice of the proceedings.  If a disclosure order is granted, then it will be too late thereafter for the identified individuals to object in that the applicant will already have succeeded in obtaining the entirety of the relief sought in the proceedings. 

21.     It follows that, generally, there will be no legitimus contradictor before the court on the hearing of an application for a disclosure order.  The nominal respondent to the proceedings, i.e. the internet service provider or the social media platform provider, while not formally consenting to an order will not normally actively oppose the application.  (A rare example of opposition being offered is provided by Muwema v. Facebook Ireland Ltd [2018] IECA 104.  The facts of that case were extreme: it was alleged that the making of a disclosure order would expose the individual involved to arrest and ill-treatment at the hands of the authorities in Uganda).

22.     An application for a disclosure order is thus analogous to an application for ex parte relief.  In the absence of a legitimus contradictor, there is a duty of candour on the applicant.  This entails not only a duty to put all material facts before the court, but extends to an obligation to identify the relevant legal principles governing the court’s jurisdiction, including any EU law principles.  Where, as in the present case, the nominal respondent is neither opposing nor consenting to the application, the legal constraints which make a court order necessary should be explained to the judge.

23.     An applicant must put before the court evidence which satisfies the threshold conditions for the grant of a disclosure order.  The court must be satisfied that the disclosure is necessary for, and proportionate to, a legitimate aim.  The affidavit grounding the application must explain the precise purpose for which the disclosure order is sought.  If granted, a disclosure order will be made conditional on an undertaking that the information disclosed will not be used for any purpose other than seeking redress in respect of the wrongs complained of.  ( Parcel Connect v. Twitter International Company [2020] IEHC 279 (at paragraph 22)).

24.     As to costs, the respondent to an application for a disclosure order will ordinarily be entitled to recover, as against the applicant, the costs of the application and the costs of complying with the disclosure order.  This follows from the fact that, in almost all cases, the respondent will not itself have been guilty of any wrongdoing.  These costs may ultimately be recoverable from the wrongdoers in the subsequent set of proceedings.

DISCUSSION

25.     The sole purpose of these proceedings is to seek an order as against Facebook Ireland Ltd (“ Facebook”) requiring it to furnish information to the school authorities.  The proceedings are, in effect, an action for discovery.  It is not alleged that Facebook itself is responsible for any wrongdoing.  Rather, it is sought to compel Facebook to disclose information which will, potentially, allow the school authorities to identify the individuals who had operated the user account.  This information is then to be used for the stated objective of “dealing with” these individuals by way of a “disciplinary or pastoral response”.  As discussed presently, the fact that the information is not sought for the purpose of pursuing legal proceedings is significant.

26.     An excellent discussion of the jurisdiction to make disclosure orders of this type is to be found in a very recent article written by Mr. David Culleton, Solicitor: Culleton, “ The Law Relating to Norwich Pharmacal Orders”, 2021 01 The Irish Judicial Studies Journal 20.  The nature of the jurisdiction is summarised, correctly, as follows (at pages 20/21).

          “A Norwich Pharmacal Order is a particular type of disclosure order where the only cause of action is discovery.  Essentially, the order compels a defendant, who has become mixed up in the alleged wrongdoing of a third party in some manner, either knowingly or innocently, to disclose information that would assist to identify this third party wrongdoer to the plaintiff.  The purpose of the order is therefore to place a plaintiff in a position to identify and seek redress against a previously unknown wrongdoer.

          The authority to grant Norwich Pharmacal relief is founded on the court’s equitable jurisdiction, derived from a ‘contemporary incarnation of the equitable bill of discovery’.

          Therefore, it is a versatile remedy, granted at the discretion of the court, when deemed to be a proportionate and necessary response in all of the circumstances of a matter.”

          *Footnotes omitted.

27.     The use of the term “ Norwich Pharmacal Orders” to describe such disclosure orders is a nod to the eponymous decision of the Ho use of Lords in Norwich Pharmacal Co. v. Customs and Excise Commissioners [1974] AC 133.  This is the first modern authority from England and Wales in which an action for discovery alone was allowed in order to identify wrongdoers.  The House of Lords rejected the contention, which had found favour with the Court of Appeal, that it was an indispensable condition for the ordering of discovery that the person seeking discovery should have a cause of action against the person from whom it was sought. 

28.     The classic statement of the nature of the jurisdiction is that of Lord Reid as follows (at page 175 of the reported judgment).

          “[…] if through no fault of his own a person gets mixed up in the tortious acts of others so as to facilitate their wrong-doing he may incur no personal liability but he comes under a duty to assist the person who has been wronged by giving him full information and disclosing the identity of the wrongdoers.”

29.     For ease of exposition, I propose to use the more self-explanatory term “ disclosure order” in preference to “Norwich Pharmacal Order”.

30.     The jurisdiction to grant relief in an action for discovery alone was first recognised, in modern times, by the Irish Courts in Megaleasing UK Ltd v. Barrett [1993] I.L.R.M. 497 (Supreme Court, 20 July 1992) (“ Megaleasing”).  The Supreme Court accepted, in principle, that the High Court has jurisdiction to entertain an action for discovery alone, prior to the institution of other proceedings against the as yet unidentified wrongdoers.  The Supreme Court indicated that the remedy is confined to cases where what is really sought are the names and identity of the wrongdoers, rather than factual information concerning the commission of the wrong.

31.     On the particular facts of Megaleasing, the application was refused by the Supreme Court.  This outcome seems to have been informed, in part at least, by the unusual chronology of the case.  The party seeking the disclosure order had, seemingly, reached some sort of settlement with the alleged wrongdoers.  It had not been obvious, therefore, as to what was the practical purpose of the application.  There was also a suggestion that there had been a lack of candour in making the application.

32.     Relevantly, the Supreme Court emphasised that the granting of an order in an action for discovery alone is “a power which for good reasons must be sparingly used, though, where appropriate it may be of very considerable value towards the attainment of justice”.  The threshold which must be met on such an application is a high one: there must be a very clear and unambiguous establishment of a wrongdoing.  McCarthy J., in his concurring judgment, cautioned as follows.

          “A procedure of this kind is plainly open to abuse which the courts must be alert to prevent.  The procedure requires a balancing of the requirements of justice and the requirements of privacy.”

33.     One of the strongest safeguards against such potential abuse is the setting of a high threshold for the making of a disclosure order. 

34.     The discretionary nature of the relief has recently been emphasised by the Court of Appeal in Muwema v. Facebook Ireland Ltd [2018] IECA 104 (at paragraph 3).

          “Where the Court is satisfied that the applicant’s right to disclosure of the information is outweighed by some countervailing right or interest of the person sought to be identified, it may refuse to make the order sought.  In such cases the Court must carry out a careful balancing exercise to see where the balance of justice lies.  Each case will be considered on its own facts and circumstances.”

35.     Although the jurisdiction to make disclosure orders had first been recognised several decades prior to the advent of the internet, the remedy has proved adaptable to modern technology.  It has successfully been invoked to compel an intermediary, such as an internet service provider or a social media platform, to disclose information which would identify otherwise anonymous wrongdoers.  The case law to date has been concerned primarily with applicants seeking to protect their intellectual property rights or their right to a good name.  Two examples illustrate the point.  In E MI Records (Ireland) Ltd v. Eircom Ltd [2005] 4 IR 148, the High Court (Kelly J.) directed that an internet service provider disclose the names, postal addresses and telephone numbers of certain of its account holders.  This order was made on the application of the holder of the copyright in sound recordings.  The court had been satisfied that there had been a prima facie demonstration of a wrongful activity, namely infringement of the applicant’s copyright in the sound recordings.

36.     In Parcel Connect v. Twitter International Company [2020] IEHC 279, the High Court (Allen J.) directed the providers of the eponymous social media platform to disclose details relating to the identity of the person or persons who had created or controlled a specific user account.  The user account, at various times, bore a user name or “handle” which resembled the name of an unrelated company which provides logistics and parcel delivery services.  The content of the user account parodied the company, and the operators of the user account responded to genuine messages from the company’s customers with silly, vulgar and crass replies. 

37.     Allen J. had been satisfied on the company’s evidence that it had a prima facie case in defamation.  The court was further satisfied that a strong prima facie case had been made out that the goodwill in the name and registered trademark of the company had been damaged by its use on the user account and by its association with the comments posted.

38.     The disclosure order was made expressly conditional on an undertaking that the information disclosed would not be used for any purpose other than seeking redress in respect of the wrongs complained of.  The rationale for requiring the undertaking is explained as follows (at paragraph 22 of the judgment).

          “[…] The jurisdiction invoked by the plaintiff on this application is a very specific one.  It is a jurisdiction to order the disclosure of information as to the identity of an alleged wrongdoer for the specific purpose of allowing the plaintiffs to institute proceedings against him or her or them.  It seems to me that in principle it must be inherent in the invocation of the jurisdiction that the order is sought and made on the basis of an implied undertaking (similar to that which is well established in the case of discovery of documents) that any information disclosed will not be used for any purpose other than the specific purpose for which it is sought but for the avoidance of doubt (and with a view to ensuring that the order is clear on its face) I will follow EMI Records Ireland Ltd. v. Eircom Ltd. and make the order expressly conditional on an undertaking that the information disclosed by the defendant will not be used for any purpose other than seeking redress in respect of the wrongs complained of.  That undertaking may be given in writing by the plaintiffs’ solicitors.”

39.     The striking feature of the application before me is that the school authorities do not seek the disclosure order in aid of any intended proceedings.  Rather, the school authorities seek the disclosure order for the stated purpose of “dealing with” the individuals behind the user account by way of what they describe as a “disciplinary or pastoral response”.

40.     (There was some suggestion at the hearing that the school authorities might, in principle, also have an action in defamation.  This is not, however, the primary basis on which the application is put on affidavit.  In any event, a prima facie case for defamation is not made out on the papers before the court.  Whatever might be the position in respect of individual staff members, the school authorities have failed to demonstrate, even on a prima facie basis, that the school, the board of management or its individual members have been defamed.  As explained earlier, it is inconceivable, given the coarse and vulgar content of the posts, that anyone viewing the user account would mistake it for an “official” school account.  Insofar as it is suggested that a number of posts might be understood as referring to a particular member of the board of management, this is not supported by affidavit evidence.  The member is not even named in the grounding affidavit.  In any event, an action for defamation based on these particular posts would be personal to such an individual.)

41.     Put shortly, the school authorities invite this court to depart from the longstanding requirement that an applicant seeking a disclosure order must have an intention to pursue legal proceedings for tortious wrongdoing against the persons to be identified.  To this end, counsel on behalf of the school authorities has cited a number of more recent judgments from England and Wales which demonstrate the evolution of the Norwich Pharmacal jurisdiction there.  Particular emphasis is laid on the judgment of the UK Supreme Court in Rugby Football Union v. Consolidated Information Services Ltd [2012] UKSC 55 (at paragraphs 14 to 18); and the decisions of the House of Lords in British Steel Corp v. Granada Television Ltd [1981] AC 1096 (at page 1200) and Ashworth Hospital v. MGN Ltd [2002] UKHL 29, [2002] 4 All ER 193.

42.     Counsel submits that this case law establishes two principles which are germane to this application.  First, the availability of a disclosure order is not confined to cases where the alleged wrongdoing is tortious in nature.  It is also available where what is alleged is a breach of contract.  Secondly, it is not necessary that an applicant intends to bring legal proceedings in respect of the alleged wrongdoing.  Relevantly, it would be sufficient in an employment law context that the applicant, as employer, intends to discipline an as yet unidentified employee.

43.     There is no doubt but that the position advocated for on behalf of the school authorities would represent a significant departure from the existing case law of the Irish Courts.  The case law to date indicates that disclosure orders have only ever been granted in the context of intended legal proceedings, and where the applicant has satisfied the court that there is at the very least a prima facie case of tortious wrongdoing on behalf of the individuals sought to be identified.  Indeed, the judgment in Megaleasing arguably posits a higher standard, namely that there must be a very clear and unambiguous establishment of a wrongdoing.  The necessity for an intention to pursue legal proceedings is reflected in the form of order granted in Parcel Connect v. Twitter International Company [2020] IEHC 279.  As noted at paragraph 37 above, the purpose of disclosure orders was described in terms of facilitating the institution of proceedings against the unidentified wrongdoers.

44.     Put otherwise, the domestic jurisprudence has remained true to the threshold for relief by way of disclosure order as formulated by the House of Lords in Norwich Pharmacal Co. v. Customs and Excise Commissioners [1974] AC 133 (at page 175).

45.     It is, of course, open in principle for the domestic jurisprudence to evolve.  A very recent example of the High Court adopting a flexible approach to the exercise of its inherent jurisdiction is provided by Grace v. Hendrick [2021] IEHC 320.  There, the applicant sought an order requiring the disclosure of the names of members of a religious fraternity.  The case did not fit within the existing equitable jurisdiction to make disclosure orders in that no clear evidence of wrongdoing, nor even prima facie evidence of wrongdoing, had been established.  The High Court (Hyland J.) relied instead on the court’s inherent jurisdiction.  Relevantly, the judgment emphasises that the making of the order sought would not prejudice the parties to be identified in that their membership of the religious fraternity had been a matter of public record.  As Hyland J. memorably put it, it was not as if the religious brothers were part of some secret society, whose members never expected to have their identity disclosed.

46.     By contrast, the disclosure order sought in the present proceedings does engage the right to privacy.  It also engages rights to data protection and freedom of expression.  As discussed under the next heading, there is a strong argument that persons using a social media platform anonymously have an expectation that their identity will not be disclosed without their consent.  This is subject, of course, to any countervailing public interest in the disclosure of their identity.

47.     Before turning to discuss the implications of EU law, it may be convenient first to dispose of the following discrete argument made by the school authorities. 

48.     Counsel on behalf of the school authorities submits (in the written legal submissions of 27 January 2021) that in balancing an applicant’s right to know the identity of a wrongdoer against the wrongdoer’s right to confidentiality, the latter right must yield to the applicant’s right once there is prima facie evidence of wrongdoing.  This is said to apply irrespective of whether the wrongdoer’s right to confidentiality arises by statute, contract or at common law.  The judgment in EMI Records (Ireland) Ltd v. Eircom Ltd [2005] 4 IR 148 is cited as authority for this proposition.

49.     With respect, the judgment in EMI Records (Ireland) Ltd is more nuanced.  As appears from the passages set out below, the decision in that case was informed by the specific statutory context, and, in particular, the statutory protections afforded to copyright holders.  See paragraphs 8 to 10 of the reported judgment as follows.

          “Whilst I reiterate again there is no suggestion of any wrongdoing on the part of the defendants, they are concerned because they owe duties of confidentiality to their subscribers.  All of the parties to this litigation accept that whilst the court has jurisdiction to make the orders sought, it is a jurisdiction which falls to be exercised sparingly.  It involves the court in balancing the rights of the plaintiffs with the obligations of the defendants towards their subscribers and the rights of those subscribers.  These obligations are obligations of confidentiality or privacy.  These duties of confidentiality owed by the defendants to their subscribers and the subscribers’ entitlements may arise under statute, by contract or at common law.

          Each of the statutory entitlements, whether they arise under the data protection legislation or the postal and telecommunications legislation, are subject to a provision which permits of the confidentiality to be legitimately breached by an order of the court.  Each of the Acts in question so provides.  It is, therefore, clear that the legislature built in such a possibility, although it did not prescribe the conditions under which such an order might be made.

          I am satisfied that whether the right to confidentiality arises by statute or by contract or at common law, it cannot be relied on by a wrongdoer or a person against whom there is evidence of wrongdoing to protect his or her identity.  The right to privacy or confidentiality of identity must give way where there is prima facie evidence of wrongdoing.  There is such evidence here.”

50.     The judgment in EMI Records (Ireland) Ltd is not, therefore, authority for any “bright line” rule to the effect that the establishment of a prima facie case automatically trumps any countervailing right to privacy.

51.     This is consistent with the approach adopted by the UK Supreme Court in Rugby Football Union v. Consolidated Information Services Ltd (cited on behalf of the school authorities).  See paragraph 46 of the judgment as follows.

          “In suggesting that it would ‘generally be proportionate’ to make an order where it had been shown that there was arguable wrongdoing and there was no other means of discovering the identity of the arguable wrongdoers, [the Court of Appeal] might be said to have somewhat overstated the position, although it is to be noted that this was not expressed as a presumption in favour of the grant of an order.  The particular circumstances affecting the individual whose personal data will be revealed on foot of a Norwich Pharmacal order will always call for close consideration and these may, in some limited instances, displace the interests of the applicant for the disclosure of the information even where there is no immediately feasible alternative way in which the necessary information can be obtained.  […]”

52.     It should be noted that a number of the other judgments from England and Wales relied upon by the school authorities were also concerned with legislative measures intended to afford protection to intellectual property rights.  These legislative measures include Directive 2004/48/EC on the enforcement of intellectual property rights.  As to the application of this directive in this jurisdiction, see Sony Music Entertainment Ireland Ltd v. UPC Communications Ireland Ltd [2016] IECA 231, [2018] 2 I.R 623.

53.     There is no equivalent statutory underpinning to the rights asserted on behalf of the school authorities. 

DATA PROTECTION UNDER EU LAW

54.     The rights afforded to privacy, data protection and freedom of expression under EU law present a potential obstacle to the extension of the domestic law jurisdiction to grant disclosure orders. 

55.     The starting point for consideration of these issues is the Charter of Fundamental Rights of the European Union (“ the Charter”).  The Charter confers a right to privacy, a right to the protection of personal data and a right to freedom of expression.  Article 52 provides that any limitation on the exercise of the rights and freedoms recognised by the Charter must be provided for by law and respect the essence of those rights and freedoms.  Subject to the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others.

56.     It does not appear that the Court of Justice has yet had to address the question of whether an expectation of anonymity on the internet is an aspect of the right to the protection of personal data and the right to freedom of expression.

57.     Relevantly, the European Court of Human Rights (“ ECtHR”) has recognised the value of anonymity on the internet and the contribution which it can make towards freedom of expression.  See Delfi AS v. Estonia (App no 64569/09) (2015) 62 EHRR 199 (Grand Chamber, 16 June 2015) at paragraph 147 of the judgment as follows.

          “[…] the court is mindful of the interest of internet users in not disclosing their identity.  Anonymity has long been a means of avoiding reprisals or unwanted attention.  As such, it is capable of promoting the free flow of ideas and information in an important manner, including, notably, on the internet.  At the same time, the court does not lose sight of the ease, scope and speed of the dissemination of information on the internet, and the persistence of the information once disclosed, which may considerably aggravate the effects of unlawful speech on the internet compared to traditional media.”

58.     The ECtHR further observed that anonymity on the internet, although an important value, must be balanced against other rights and interests. 

59.     Were a similar approach to be adopted by the Court of Justice, then an expectation that a person’s choice of anonymity would be respected would form part of the protected rights.  Any limitation on this right would have to be provided for by law, be necessary, proportionate, and pursue a countervailing public interest objective.

60.     In this regard, it is to be noted, by analogy only, that the Court of Justice has recently held that the users of electronic communications services are entitled to expect, in principle, that their communications and data relating thereto will remain anonymous and may not be recorded, unless they have agreed otherwise.  (Judgment of 6 October 2020 (Grand Chamber), Privacy International, Case C-623/17, EU:C:2020:790).

61.     The right to data protection is given concrete form under the General Data Protection Regulation (“ the GDPR”).  (Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data).  One of the core principles of the GDPR is that personal data, which has been collected for specified, explicit and legitimate purposes, shall not be further processed, without consent, in a manner that is incompatible with those purposes.  The disclosure to a third party of information which is capable of identifying the individual operating a user account on a social media platform represents the “processing” of personal data. 

62.     Such disclosure will be lawful in certain circumstances.  Relevantly, the GDPR does not apply to processing by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences.  Thus, a request by An Garda Síochána for access to information which is capable of identifying the individual operating a user account on a social media platform is not affected by the GDPR.

63.     Leading counsel on behalf of Facebook explained, at a directions hearing on 18 May 2021, that requests received from governments typically must be accompanied by formal legal process, such as a subpoena, search warrant, or court order.  However, in emergencies, law enforcement may submit requests without legal process.  Based on the circumstances, Facebook may voluntarily disclose information to law enforcement where it has a good faith reason to believe the matter involves imminent risk of serious physical injury or death.

64.     The school authorities rely on a different provision for their application for a disclosure order, namely Article 6(1)(c) of the GDPR.  This article provides that the processing of personal data, without consent, is lawful to the extent that the processing is necessary for compliance with a “legal obligation” to which the controller is subject.  The legal basis for any such “legal obligation” must be laid down either in EU law or in the domestic law of the Member State to which the data controller is subject.  The purpose of the processing shall be determined in that legal basis.  The EU law or the Member State law must meet an objective of public interest and be proportionate to the legitimate aim pursued.

65.     An indicative list of the type of legislative measures that a Member State is entitled to lay down is provided under Article 23 of the GDPR.  It should be explained that this list appears in the specific context of the imposition of restrictions on the rights of a data subject under Chapter III of the GDPR.  Restrictions may be imposed inter alia when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard the enforcement of civil law claims.

66.     This chapter is not directly engaged by the present proceedings.  However, Article 6 does contain a cross-reference to Article 23.  It is implicit from this cross-reference that the indicative list is also relevant in the context of domestic legislative measures which impose a “legal obligation” on a data controller.

67.     It follows from this cross-reference that a Member State is entitled to lay down legislative measures which are necessary and proportionate to safeguard the “enforcement of civil law claims”.  This concept has been considered by Advocate General Bobek in Land Nordrhein-Westfalen, Case C-620/19, EU:C:2020:649.  (It proved unnecessary for the Court of Justice to address the substance of the case in circumstances where it held that the reference was inadmissible).

68.     The Advocate General assumed that the reference to “enforcement of civil law claims” is intended to permit the EU or national legislature to decide that, in the context of proceedings for the enforcement of civil law claims, the specific rules on discovery prevail, in case of conflict, over the general rules stemming from data protection.  The Advocate General further found that, notwithstanding the use of the word “enforcement”, the phrase is not confined to the final stage of proceedings.  Rather it should be understood, more broadly, as also referring to the start of proceedings in order to have one’s subjective right recognised and thus protected.  See paragraphs 122 and 123 of the Opinion as follows.

          “[…] I fail to see the logic of why the EU legislature would permit Member States to maintain their specific regimes on discovery only in certain types or stages of civil procedures and not in others.  If reasons relating to the protection of the integrity and fairness of civil law proceedings allow Member States to introduce restrictions to the rights of data subjects (and obligations of data controllers), those rules should arguably apply, in principle, at any stage of the proceedings.

          The opposite interpretation would also seems counterintuitive: why allow Member States to limit access during the final (or enforcement) stage of the proceedings but not before?  As the referring court rightly points out, the administrator would have acquired the information sought by then, and the rule restricting access would have become meaningless.”

          *Footnotes omitted.

69.     As appears, the justification for the restriction on the rights of data subjects under Chapter III of the GDPR relates to the protection of the integrity and fairness of civil law proceedings.

70.     Returning to the circumstances of the present case, the school authorities rely on domestic legislative measures introduced pursuant to the discretion afforded to a Member State under Article 6(1)(c) of the GDPR.  More specifically, reliance is placed on sections 41 and 47 of the Data Protection Act 2018.  The combined effect of these two sections is that the processing of personal data for a purpose other than the purpose for which the data has been collected shall be lawful to the extent that such processing:

(a)     is necessary and proportionate for the purposes of providing or obtaining legal advice or for the purposes of, or in connection with, legal claims, prospective legal claims, legal proceedings or prospective legal proceedings, or

(b)     is otherwise necessary and proportionate for the purposes of establishing, exercising or defending legal rights.

71.     It is submitted by counsel that the disclosure order is necessary and proportionate to allow the school authorities to enforce its disciplinary rules, and, in particular, its code of conduct on the use of social media.

72.     It is apparent from Article 6(1)(c) of the GDPR that domestic legislative measures which impose “legal obligations” on a data controller must meet an objective of public interest and be proportionate to the legitimate aim pursued.  The domestic legislative measures must also comply with the requirements of the Charter.  It follows that, in interpreting sections 41 and 47 of the Data Protection Act 2018, this court should, insofar as possible, do so in a manner which is consistent with the GDPR and the Charter.

73.     There is little doubt but that these domestic legislative provisions would allow for the making of disclosure orders in the context of prospective legal proceedings for defamation, provided of course that the intended plaintiff is able to establish, at the very least, a prima facie case of wrongdoing.  This would appear to be consistent with the GDPR and the Charter.  Any expectation of anonymity on the part of the account user would have to yield to the countervailing public interest in vindicating an individual’s right to their good name by way of proceedings for defamation.  The imposition of a threshold requirement that an applicant must establish a prima facie case of wrongdoing ensures that the measure is proportionate and not open to abuse.

74.     The unusual feature of the present case is that the disclosure order is not sought in respect of intended legal proceedings.  Rather, the school authorities, in their grounding affidavit, assert a different public interest, namely their interest in disciplining members of the school community, whether students or staff.  The question arises as to whether this purpose represents a public interest objective which is capable of justifying an interference with the rights to privacy, data protection and freedom of expression.  To adopt the memorable phrase of the Supreme Court of the United States, students do not “shed their constitutional rights to freedom of speech or expression at the schoolhouse gate” (citation at paragraph 80 below).

75.     It is not obvious on the basis of the case law to date what the answer to this question is.  Accordingly, I propose to make a reference to the Court of Justice for a preliminary ruling.  The issues to be addressed in the reference are recited under the next heading below.

SUMMARY AND FORM OF ORDER

76.     The objective of these proceedings is to compel the social media platform, Instagram, to identify the individuals who had operated one of its user accounts.  The school authorities seek to identify these individuals for the stated purpose of dealing with them by way of what the school authorities describe as a “disciplinary or pastoral response”.

77.     The application for the disclosure order has a number of unusual features.  First and foremost, the disclosure order is not sought for the purposes of instituting legal proceedings against the individuals whose identity is to be unmasked.  Secondly, there is no ongoing mischief alleged.  The offending user account had been rendered inactive within a matter of days of its first being created.  The content has been removed and the school authorities have the password to the user account.  Thirdly, the application for the disclosure order was first moved in court more than one year after the user account had been rendered inactive.  Finally, there is no evidence before the court that either An Garda Síochána or the Child and Family Agency were sufficiently concerned by the complaints made to them by the school authorities to seek information from Facebook themselves.

78.     The school authorities’ application for a disclosure order presents significant legal issues in respect of privacy, data protection and freedom of expression.  In particular, an issue arises as to whether the user of a social media platform, who has chosen to be anonymous, is entitled to an expectation that that choice will be respected absent some countervailing public interest objective in disclosure. 

79.     Any expectation of anonymity must, of course, yield to the public interest in the prosecution of criminal offences, especially in respect of child abuse.  Similarly, any expectation of anonymity must yield to the public interest in vindicating an individual’s right to their reputation by way of proceedings for defamation. 

80.     It is far less obvious that the public interest asserted by the school authorities overrides the rights of the students and staff.  The right to “freedom of expression” under the European Convention on Human Rights is applicable not only to “information” or “ideas” that are favourably received or regarded as inoffensive or as a matter of indifference, but also to those that offend, shock or disturb the State or any sector of the population.  ( Handyside v. United Kingdom (1976) 1 EHRR 737).

81.     To adopt the memorable phrase of the Supreme Court of the United States, students do not “shed their constitutional rights to freedom of speech or expression at the schoolhouse gate”.  School officials may only regulate speech that “would ‘materially and substantially interfere with the requirements of appropriate discipline in the operation of the school” ( Tinker v. Des Moines Independent Community School District, 393 U.S. 503 (1969), at 506 and 509).  The US Supreme Court has very recently heard arguments on the application of these principles to the regulation of a student’s use of social media.  ( Mahanoy Area School District, Petitioner v. B. L., Respondent.  Docket No. 20-255). 

82.     There is a respectable argument that similar principles may apply under EU law, and, in particular, under the Charter.

83.     I propose to make a reference to the Court of Justice for a preliminary ruling pursuant to Article 267 of the TFEU.  The issues to be addressed in the reference are as follows.

(1).    Do the rights conferred under Article 7, Article 8 and Article 11 of the Charter of Fundamental Rights of the European Union imply a right, in principle, to post material anonymously on the internet (subject always to any countervailing objective of public interest)?  If so, is this right qualified in the case of the students and staff of a secondary school?

(2).    What is the threshold to be met under the General Data Protection Regulation and/or the Charter before the provider of a social media platform can be compelled to disclose, to a third party, information which would identify an otherwise anonymous account user?  Is it necessary for the third party seeking disclosure to establish a strong prima facie case of tortious wrongdoing and an intention to pursue legal proceedings?  Alternatively, does the board of management of a secondary school have a sufficient interest in disciplining its students and staff for their online activities to entitle it to disclosure, even in the absence of an intention to pursue legal proceedings?  If so, is it necessary to establish that the online activities are disruptive to the school environment?

(3).    Is there any necessity for a national court to attempt to put the affected party on notice of an application which seeks to identify the operators of an otherwise anonymous user account?  Should, for example, the national court direct that the social media platform notify the party and inform them that they have an opportunity to make submissions anonymously to the court?

84.     I will hear the parties as to the precise form of reference.  The applicant’s solicitors are requested to furnish a copy of this judgment to the Office of the Attorney General and to the Commission for Data Protection.  Those parties have liberty to apply, if they so wish, to be heard on the form of the reference.

85.     This case will be listed before me for further directions on 14 June 2021 at 2 pm.

86.     Finally, pending the determination of the Article 267 reference, the limited reporting restrictions imposed on 7 December 2020 pursuant to section 45 of the Courts (Supplemental Provisions) Act 1961 (as amended) remain in force.  No material should be published or broadcast which might identify any of the individuals (whether minors or adults) referred to in the Instagram account the subject-matter of the within proceedings.  For the avoidance of doubt, no redactions are required when reporting the content of this judgment: it may be reported as is.

Result:     Article 267 Reference to Court of Justice for a preliminary ruling.