Freely Available British and Irish Public Legal Information
[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback]
Court of Appeal in Northern Ireland Decisions
You are here: BAILII >> Databases >> Court of Appeal in Northern Ireland Decisions >> CG v Facebook Ireland Ltd & Anor [2016] NICA 54 (21 December 2016)
URL: http://www.bailii.org/nie/cases/NICA/2016/54.html
Cite as: [2016] NICA 54, [2017] 2 CMLR 29, [2019] NI 21, [2017] EMLR 12
[New search] [Printable RTF version] [Help]
| [2016] NICA 54 |
Ref: | MOR10142 |
| Judgment: approved by the Court for handing down | Delivered: | 21/12/2016 |
| (subject to editorial corrections)* |
BETWEEN:
Plaintiff/Respondent and Cross-Appellant;
Defendants/Appellants and Respondents to Cross Appeal.
MORGAN LCJ (giving the judgment of the court)
[1] This case is primarily concerned with the liability in damages of information society services, in this case Facebook, for misuse of private information as a result of postings on their sites by third parties. The first and second named appellants, Facebook Ireland Ltd and Joseph McCloskey, hereinafter respectively referred to as “"Facebook”" and “"McCloskey”", appeal from an Order of Stephens J filed on 4 March 2015 whereby he held Facebook liable to the respondent for misuse of private information in respect of three profile pages on its social network together with the comments generated by those pages and McCloskey liable for unlawful harassment in respect of the first of those profile pages and comments. He awarded damages in each case. He further made an order that the first appellant should terminate the Facebook profile page ""Keeping Our Kids Safe from Predators 2"" (“"Predators 2”") and prohibited McCloskey from harassing, pestering or molesting the respondent whether by publishing, distributing or transmitting any information relating to or on the website Facebook.com or otherwise howsoever.
[2] The respondent cross appeals on the basis that Facebook should be held liable in respect of the three profile pages and comments on the basis that by its pursuit of economic activity within the United Kingdom by operation of the Facebook social network and through the operation of an office, branch and/or subsidiary it is a data controller under section 5 of the Data Protection Act 1998 (“"the 1998 Act”") in respect of personal data and sensitive personal data processed on the Facebook social network and is in breach of the 1998 Act. McCloskey did not pursue his appeal and accordingly it is dismissed. Both Facebook and the respondent lodged appeals against the level of damages but at the hearing neither pursued that issue. Mr White QC appeared with Mr Hopkins for Facebook and Mr Tomlinson QC appeared with Mr Girvan for the respondent. We are grateful to all counsel for their helpful oral and written submissions.
[3] The corporate structure within which Facebook was established is set out at paragraph 90 of the judgment at first instance:
(a) Facebook Ireland Limited is a private limited company incorporated in the Republic of Ireland.
(b) Facebook Ireland Limited is wholly owned by Facebook Ireland Holdings which is an unlimited company and does not file accounts. It is not possible to establish from publicly available information details of its trading and intergroup transactions.
(c) Facebook Ireland Holdings is owned by Facebook International Holdings II (99%) which is registered in Ireland and by Facebook Cayman Holdings Limited III (1%) which is registered in the Cayman Islands. The Cayman Islands do not levy corporation tax.
(d) In 2012 Facebook Ireland Limited paid €770.6m to Facebook Ireland Holdings for the right and licence to utilise the Facebook platform.
(e) Facebook Ireland Limited is the data controller with respect to the personal data of users outside the US and Canada.
(f) Facebook UK Limited is a private limited company incorporated in the UK. It is wholly owned by Facebook Global Holdings II LLC. It derives all of its income from providing marketing support services to Facebook Ireland Limited. It does not operate, host or control the Facebook service. It has offices in the United Kingdom.
(g) A data processing agreement is in place between Facebook Ireland Limited and Facebook UK Limited under which Facebook UK Limited as “"data processor”" processes certain personal data on behalf of Facebook Ireland Limited as “"data controller”" in order to generate advertising revenue in the United Kingdom.
[4] Stephens J described the operation of the Facebook website at paragraphs 18-21:
“"[18] Facebook is a medium for the dissemination and acquisition of information available to anyone who can access it. Users can disseminate information by establishing independent dedicated pages for a broad range of purposes – for example, the creation of a personal profile or as in this case the pursuit of a campaign. Other Facebook users can access the information on those pages and can then contribute to the page by posting material on it. For someone to post on Facebook they must themselves have a Facebook account.
[19] Facebook states that it is the world’'s largest social networking site with over 1.3 billion monthly active users worldwide in over 200 jurisdictions, who register an average of 350 million photographs a day and some 3 billion “"likes”" and comments. In its skeleton argument the first defendant asserted that “"with billions of posts, likes, photos, and comments added to Facebook daily, Facebook could not reasonably scour its site in hopes of finding content at issue – a true needle in a haystack.”"
[20] The first defendant maintains ultimate control over everything that appears on its website and has the ability to remove anything that it wishes at any stage from any of the pages that have been created. In arriving at a decision as to whether to remove material the first defendant purports to apply the standards set out in its terms and conditions. The first defendant states that it can remove any content or information that is posted on Facebook if it believes that it violates its statement or its policies. The statement and policies declare that users:-
(a) will not bully, intimidate or harass any user.
(b) will not post content that is hate speech, threatening, or … incites violence; or contains … graphic or gratuitous violence.
(c) will not do anything unlawful, misleading, malicious or discriminatory.
(d) will not post content or take any action on Facebook that infringes or violates someone else’'s rights or otherwise violates the law.
The first defendant also asserts that it does not tolerate bullying or harassment and that whereas it will allow users to speak freely on matters and people of public interest, it will take action on all reports of abusive behaviour directed at private individuals. The first defendant goes on to assert that safety is Facebook’'s top priority. That it will remove content and may escalate to law enforcement when it perceives a genuine risk of physical harm, or a direct threat to public safety. That users may not credibly threaten others, or organise acts of, what it terms “"real world”" violence.
[21] Every posting on Facebook has its own Uniform Resource Locator (“"URL”"). Accordingly an initial posting on any profile/page has one URL and then every comment posted under that initial posting has its own URL. If the main URL is taken down then every subsequent comment posted under it with all their unique URLs are also taken down. If the initial posting is not taken down it is possible to delete any of the individual comments posted under it.”"
[5] Facebook operates a reporting system by which an individual can ask for postings to be removed. The system requires the individual to provide the first appellant with the URL for each and every posting about which complaint is made. To find the URL of a particular posting the person complaining has to go to the webpage concerned and to click on each posting to obtain the relevant URL. In circumstances where a website is attracting numerous comments, each of which has its own URL, additional offending material may have been generated by the time the initial complaint is made.
The factual background to the three profile pages
[6] In August 2012 McCloskey opened a Facebook page entitled ""Keeping Our Kids Safe from Predators"". He posted on the page the name and photograph of XY and referred to his previous criminal convictions. In 2005 XY had admitted six charges of indecent assault, six charges of gross indecency with a child and one of inciting a child to commit an act of gross indecency. The offences were committed between 1982 and 1989. He was sentenced to 6 years imprisonment. He had a total of 15 convictions of this kind having first offended 1980.
[7] When creating a page on Facebook there are a range of privacy settings which may be imposed to regulate the extent of access to the page. McCloskey did not impose any privacy settings so the Facebook page was open as a result of which access was available to anyone who was a Facebook user. Those who access such sites are generally referred to as “"friends”" and can choose whether to like the page. Numerous comments were posted on the page including threats that XY would be burned out of his rented accommodation. On 14 November 2012 he issued proceedings claiming an injunction and damages against Facebook. McCloskey had not been identified as the operator of the page at that time. McCloskey J heard XY''s application for interim relief. He found that some of the comments were threatening, intimidatory, inflammatory, provocative, reckless and irresponsible. On 30 November 2012 he granted an interim injunction requiring Facebook to remove the page, the effect of which was also to remove the related comments. Immediately thereafter, McCloskey set up a new profile page, Predators 2. It was also dedicated to the identification of sex offenders. There were no privacy settings so the page was again open. XY’'s claim was eventually resolved by way of undertakings given in June 2013. The pleadings in the XY case referred to the existence of the Predators 2 page but there was no reference on that page or its comments to XY nor was there any reference on the original Predator page to the respondent.
[8] CG was sentenced to 10 years imprisonment on 27 March 2007 for offences of indecent assault and gross indecency. At the time of his conviction in March 2007 the Irish News, a newspaper with a wide circulation in Northern Ireland, carried an article which identified CG by name, stated that he had been convicted of a specific number of sex offences, identified the age and sex of his two victims and the particular characteristic of one of them and the duration over which he had befriended the parents of one of his victims. It also included a photograph of CG. He was released on licence on 27 February 2012. On release the risks posed by him were managed on a multi-agency basis under the Public Protection Arrangements in Northern Ireland (PPANI) which emphasises the need to prevent inappropriate disclosure of information in relation to sex offenders, such as details of the offender’'s residence, as such disclosure is likely to interfere with the level of co-operation by the offender and the rehabilitation process.
[9] On 22 April 2013 McCloskey posted a copy of the article which had been published in the Irish News at the time of CG’'s conviction together with the photograph of CG on the Predator 2 page. At the top of the page it was stated that Predator 2 was an information site to promote awareness. Those posting comments were asked to refrain from rude/violent comments. Posting such comments could lead to their removal. Those who liked the page were asked to indicate their approval by leaving a heart symbol, “"<3”". At the bottom of the article the second appellant had posted ""say what you like on this one apart from violence my friends"". The profile page also referred to other sex offenders in similar terms. The second appellant claimed that the page had 25,000 friends.
[10] This posting attracted more than 150 comments. Some of the comments simply consisted of the heart symbol. A number of comments referred to sentencing levels and the need for the protection of children but many were hostile to the respondent. Despite the request for restraint the comments included abusive language, violent language including expressions of support for those who would commit violence against the respondent, references to where he was living or may be living and expressions of support for those who would seek to exclude him from the area in which he was believed to live.
[11] On Friday 26 April 2013 the respondent’'s solicitors wrote to both Facebook and Johns Elliott, the solicitors in Northern Ireland who had previously acted for Facebook in the XY litigation. The letters enclosed a hard copy of the profile page as at that date and indicated that the material was defamatory and put their client''s life at immediate risk. The letter sought the removal of the offending material forthwith and proposals for compensation. By letter dated 2 May 2013 Facebook’'s solicitor responded indicating that Facebook provides users and non-users with online tools to report improper content. The solicitor stated that Facebook can and does disable content that violates its terms of service when properly and specifically advised of such violations. The letter then referred to the internet sites that should be used. Facebook’'s solicitors went on to suggest that the respondent make use of the online tools and identify the offending content by URL to enable Facebook to investigate the complaint. The solicitor stressed the requirement to specifically identify the alleged offending contact by URL as Facebook could not make a proper assessment if simply provided with a link to a profile page containing thousands of comments.
[12] By a response of the same date the respondent’'s solicitor advised that their client did not wish to be affiliated with Facebook in any way and therefore did not wish to use the online tools to report the content. The solicitor enclosed a number of screenshots highlighting abusive comments but indicated that it was not possible to identify individual alleged offending conduct by a series of different URLs. The solicitor submitted that the offending content was a single thread accessed by the McCloskey’'s Predator 2 profile page. The respondent issued proceedings against both appellants on 28 May 2013 and claimed interim relief, although by 22 May 2013 Facebook had taken down all postings in relation to the respondent.
[13] RS is the father of one of CG’'s victims and had his own profile page on Facebook. He had earlier posted comments on the Predators 2 page about the general area in which he believed CG resided. On 13 November 2013 he uploaded the photograph of the respondent that had appeared on McCloskey’'s profile page to his own page. He identified the respondent by name as a convicted sex offender and stated the area in which he formerly lived and that in which he believed he was then living. He described the respondent as a danger to all kids male and female and advised those reading the page to keep their eyes open and their kids safe.
[14] The respondent''s solicitor wrote to Facebook on 15 November 2013. The letter noted that between 13 and 15 November 2013 the photograph of the respondent had been shared 1622 times and that other Facebook users had included comments threatening violence to the respondent. The letter asserted that the comments were defamatory and put the respondent''s life at immediate risk and requested that Facebook remove them, identifying the main URL.
[15] By return letter of 15 November 2013 Facebook’'s solicitor requested the respondent’'s solicitor to provide the specific URLs for each and every individual comment. The respondent’'s solicitor replied by letter dated 26 November 2013 stating that the posting identified their client, the location where he lived and that he was a risk to children. It was contended that the posting was designed to place him at risk of degrading treatment, harassment, abuse and vigilantism. The following day Facebook’'s solicitor wrote indicating that Facebook could not investigate such comments absent identification of the URL for each specific comment. Without specific URLs the letter stated that they were unable to locate the alleged comments. The specific URLs were provided by the respondent’'s solicitor on 3 and 4 December 2013 and all of the material was removed by Facebook on 4 or 5 December 2013 by taking down the main URL and thereby removing all the comments.
[16] The third complaint concerned a further publication by RS on his Facebook page on 23 December 2013 when he reposted the photograph of the respondent. There were 2 comments, one of which stated that this was what a “"pedo”" looked like and the other advising that this should be shared before it was taken down as the respondent was “"a danger to all kids”". A letter of claim was sent to Facebook on 8 January 2014 identifying the relevant URLs and stating that the comments were defamatory and put the respondent’'s life at risk. The page was taken down on 22 January 2014. It was accepted by the respondent in this appeal that the allegation of defamation in each of the letters of claim was entirely without substance and there was no appeal against the dismissal by the learned trial judge of the claims based on the imminent risk to life.
[17] The general effect on the respondent as found by the learned trial judge was that he was extremely concerned about potential violence. He was also concerned about the effect on his family. In his evidence the respondent said that he did not object to name calling as that was something he had to live with as a result of his conviction but he was concerned when there was an attempt to find out where he lived or to hurt his family. There were a number of incidents between May 2013 and Christmas 2013 where he was approached and verbally abused by members of the public. A psychiatric report indicated that he had sustained an exacerbation of pre-existing anxiety as a result of the postings. His relationship with his immediate family and his child was adversely affected.
[18] The learned trial judge also noted the evidence about the public protection arrangements in Northern Ireland, the primary purpose of which is the assessment and management of risk from sex offenders to help protect the public from serious harm. The key ingredients to stability for an offender who is being rehabilitated into the community are a home, employment and a circle of family and friends. Adverse publicity combined with precise identification of the offender''s whereabouts substantially disrupts those key ingredients and thereby increases the risk of reoffending.
The learned trial judge’'s decision
[19] The learned trial judge first addressed McCloskey’'s liability. He set out the detailed evidence supporting his conclusion that McCloskey set up and operated his profile page to destroy the family life of sex offenders, to expose them to total humiliation and vilification, drive them from their homes and expose them to the risk of serious harm. In addition to the respondent other similar offenders were identified on his profile page. The learned trial judge considered that McCloskey was totally indifferent to the lawfulness of his conduct and was motivated by a deep hatred of sex offenders. He concluded that his conduct amounted to harassment of the respondent.
[20] The case made against Facebook was based on misuse of private information. Private information is that in respect of which there is a reasonable expectation of privacy. The test was objective and had to be applied broadly, so that the court would, in taking account of all the circumstances, consider the individual’'s attributes, the nature of the activity in which he had been involved, the place where it had happened and the nature and purpose of the intrusion ( JR38 [2015] UKSC 42 approving Murray v Express Newspapers [2008] EWCA Civ 446 at paragraph [36]). Although he adopted this approach by reference to his previous decision in Kenneth Callaghan v Independent News and Media [2009] NIQB 1 the learned trial judge went on in this case to accept the submission by counsel for the respondent that the Data Protection Act 1998 provided a useful touchstone as to what information was deemed to be private for the purpose of that tort. He found support for that approach in the judgment of Tugendhat J in Green Corns Ltd v Claverley Group Limited [2005] EWHC 958.
[21] He concluded that any photograph of the respondent which could be used to identify exactly where he lived, his name if used in conjunction with other information which might identify where he lived, his present address or any description of the area in which he previously lived if that information could be used to identify him, his criminal convictions and the risk he posed to the public except insofar as they should be disclosed in accordance with the public protection arrangements and any information about his family members were all private information both individually and in combination.
[22] He further noted that Facebook did not call any evidence to establish that it did not have the capacity, resources or knowledge to look for or to assess material in relation to McCloskey. He considered that Facebook was put on notice by the XY litigation of the whole nature of McCloskey’'s activities and the degree and nature of his motivation against sex offenders in Northern Ireland. He also inferred that the Facebook knew or ought to have known of the profile page Predators 2 given that any simple searches by it would have revealed the new profile page with an almost identical name and with identical purposes. He considered that Facebook had the capacity, resources and knowledge to look for and to assess material in relation to the respondent on McCloskey’'s profile page without receiving any letter of claim or any complaint from him.
[23] Although the letters complaining about the posts alleged defamation and an immediate risk to the respondent’'s life the learned trial judge concluded that it was apparent to anyone looking at the posts that they ought to have been giving consideration to unlawfulness on the additional grounds of unlawful harassment, breach of article 3 ECHR and unlawful misuse of private information. It was common case that the posts could not constitute defamation and the claim based on the positive duty under Article 2 ECHR was properly dismissed.
[24] The first appellant is an information society service (ISS) within the meaning of Directive 2000/31/EC (the e-Commerce Directive). Article 15 of the e-Commerce Directive provides that a general obligation shall not be imposed on an ISS provider to monitor the information which they transmit or store. Nor is there a general obligation actively to seek facts or circumstances indicating illegal activity.
[25] Under the Electronic Commerce (EC Directive) Regulations 2002 (“"the 2002 Regulations”") an ISS will not be liable for damages where it does not have actual knowledge of unlawful activity or information and is not aware of facts and circumstances from which it would have been apparent to the service provider that the activity or information was unlawful. If it obtained such knowledge then it will not be liable if it acts expeditiously to remove or disable access to such information. The learned trial judge rejected Facebook’'s contention that there was a requirement to give notice in a particular manner. He concluded that actual knowledge of the unlawful activity was acquired by virtue of the XY litigation, that litigation combined with the letters sent to Facebook and its solicitors and by virtue of those letters combined with some elementary investigation of the profile page and/or internet. Neither the e-Commerce Directive nor the 2002 Regulations provided any defence to the claim of misuse of private information.
[26] In relation to the claim under the Data Protection Act 1998 the issue was whether Facebook was established in the United Kingdom. The learned trial judge noted that this issue only arose during the trial. Discovery was not given in relation to it and no application for discovery or interrogatories was brought on behalf of the respondent. The issue addressed by the learned trial judge was whether the first appellant by virtue of its relationship with Facebook UK Ltd, set out at 3(g) above, maintained an office, branch or agency through which it carried on activity in the United Kingdom. In the absence of relevant discovery the learned trial judge concluded that on balance the respondent had not established this proposition.
The submissions of the parties
[27] Mr White submitted that the principal content complained of by the respondent consisted of information which was already in the public domain. It was contained in the press article reporting the respondent''s conviction for child sex offences. Subsequent comments on the article consisted mainly of commentary and public opinion on the matter. The learned trial judge erred in relying upon the categories of sensitive personal data in the Data Protection Act 1998. Mr White accepted that the publication of information in relation to the present address of the respondent was private information but submitted that the indication only of a general area in which the respondent resided was insufficient. Neither individually nor cumulatively was there a reasonable expectation of privacy in relation to any of the information.
[28] Even if Facebook’'s non-removal of the content amounted to the tort of misuse of private information the learned trial judge ought to have found that it was exempt from legal liability by virtue of Regulation 19 of the 2002 Regulations. Past complaints relating to content on another profile page concerning another individual cannot fix an ISS provider with actual knowledge of unlawful activity or information in relation to different content subsequently posted about a different individual. This would amount to an impermissible proactive monitoring obligation. In addition, the notification letters received by Facebook were insufficiently precise as to the location of the allegedly unlawful content and failed to identify the reasons why the content was said to be unlawful. The letters did not, therefore, fix Facebook with actual knowledge of unlawful content and it was entitled to the exemption from liability provided by the 2002 Regulations.
[29] Mr Tomlinson submitted that the determination of the reasonable expectation of privacy in this case required an examination of the reasonable expectation that there would be no interference with the broader right of personal autonomy. That was why the categories of sensitive personal data in section 2 of the Data Protection Act 1998 were material. In considering that question the court had to take into account all of the circumstances in the case including those set out in Murray v Express Newspapers plc.
[30] This was an intrusion case. Special considerations attach to photographs in the field of privacy. As a means of invading privacy a photograph is particularly intrusive. Privacy can be invaded by further publication of information or photographs already disclosed to the public (see Lord Nicholls at [255] in OBG v Allan [2008] 1 AC 1). In any event it is clear that information which is in the public domain can, through the passage of time, recede into the past and become part of a person''s private life.
[31] In considering the reasonable expectation of privacy the context was important. The PPANI provided a framework in which information concerning convicted sex offenders was to be disclosed. The disclosures on Predator 2 were contrary to those arrangements. That is relevant to the reasonable expectation question. Secondly, this information was published in combination with other information with the express intention of inciting others to intrude into the respondent’'s personal space and otherwise interfere with his right to family life.
[32] Mr Tomlinson noted that the pleadings in the XY litigation expressly referenced Predators 2. Accordingly Facebook plainly had actual knowledge that McCloskey was operating Predators 2 for the purpose of seriously interfering with the family life of sex offenders. The judge was correct to infer that Facebook was aware of the nature of his unlawful activity and that one of the individuals being targeted was the respondent. The judge did not impose any general obligation to monitor or actively seek out facts and circumstances indicating illegal activity. He drew the correct inference as to Facebook’'s actual knowledge. It was accepted that the correspondence from the respondent''s solicitors did not specifically identify the unlawful activity. It is likely that some investigation would have been carried out and as a result the relevant knowledge would have been acquired.
[33] In its original defence Facebook admitted that it was a data controller for the purposes of the Data Protection Act 1998 (the 1998 Act). In the course of the trial it amended its defence to contend that the 1998 Act did not apply to the first appellant. The basis for this was that section 5 of the 1998 Act applied to a data controller only if the data controller was established in the United Kingdom and the data was processed in the context of that establishment. Section 5(3)(c) of the 1998 Act stated that a person was established in the United Kingdom if it maintained in the United Kingdom an office, branch or agency through which it carried on any activity or maintained a regular practice.
[34] It was common case that Facebook was a data controller established in the Republic of Ireland and that the information on the Predators 2 page was personal data and sensitive personal data of which the respondent was the data subject. The evidence indicated that Facebook UK Ltd provided marketing support services to Facebook and processed certain personal data on its behalf in the United Kingdom. There was no applicable discovery made by Facebook in relation to this issue and no request by the respondent for discovery of particular documents.
[35] The learned trial judge found that there was a relatively high level of possibility that Facebook maintained an office, branch or agency through which it carried on an activity in the United Kingdom by virtue of its relationship with Facebook UK Ltd but on balance was not persuaded that the respondent had established that to the requisite standard. By way of cross appeal Mr Tomlinson submitted that, in particular, the decision of the CJEU in Google Spain v AEPD [2014] QB 1022 supported the view that section 5 of the 1998 Act should be given a broad interpretation and that the judge had erred in his approach.
[36] Mr White submitted that the issue was one of fact for the judge. In Google Spain the court expressly stated on a number of occasions that it was necessary to adopt an expansive approach to the applicable law test because of the risk that the data subject would be left unprotected compromising the principle of effectiveness. This was not such a case because the first appellant was established in the Republic of Ireland. The approach of the learned trial judge was consistent with the decision of the ECJ in Weltimmo v Nemeti (C-230/14) EU which stated that the concept of establishment depended upon real and effective activity exercised through stable arrangements. It was accepted that an entity could be established in more than one member state and if so it had to comply with the relevant law in each such state.
Consideration
[37] Before turning to the areas in dispute between the parties it is helpful to record the areas of agreement. There was no dispute about the finding of the learned trial judge that McCloskey had harassed the respondent. That was based on his conclusion that McCloskey intended to torment the respondent by subjecting him to constant intimidation by oppressive and unreasonable conduct sufficient to give rise to criminal liability (see R v Curtis [2010] EWCA 123). Although Regulation 19 of the 2002 Regulations exempts an ISS provider from damages or other pecuniary remedy or criminal sanction where it has no actual knowledge of unlawful activity or information and is not aware of facts or circumstances from which it would have been apparent to the service provider that the activity or information was unlawful, there was no prohibition on the court granting an injunction to deal with the continuation of the harassment by McCloskey. Facebook did not take issue with the injunctive relief ordered by the learned trial judge requiring it to terminate the Predators 2 page as a remedy in respect of the harassment claim against McCloskey.
[38] In R (on the application of C) v Secretary of State for Justice [2016] UKSC 2 the Supreme Court dealt with an anonymity application in respect of an offender convicted of murder who was applying to the Parole Board for unsupervised release. Lady Hale noted the media and victim interest in open justice and set out the competing interests in favour of anonymity at paragraph 39.
“"39 In favour of anonymity are all the general considerations about harm to the patient''s health and well-being, the “"chilling effect”" of a risk of disclosure, both on his willingness to be open with his doctors and other carers, and on his willingness to avail himself of the remedies available to challenge his continued deprivation of liberty, long after the period deemed appropriate punishment for his crimes has expired. Added to those are the specific risk elements in this case identified in the letter from his responsible clinician: see para 9 above. The existence of a risk to the appellant from members of the public is also acknowledged in the letters of the Secretary of State and reflected in the Parole Board''s requirement that he change his name. He is much more likely to be able to lead a successful life in the community if his identity is not generally known. The risk of “"jigsaw”" identification, of people putting two and two together, will remain despite the change of name.”"
[39] Although the confidentiality of the appellant’'s medical information was engaged in that case some of the factors identified by Lady Hale were present in this case. There were a number of comments threatening the welfare of the offender and causing him distress and alarm. Those responsible for the PPANI identified the chilling effect of disclosure of his home and movements and the problems such disclosure would present to rehabilitation. The learned trial judge incorporated evidence that he had received in Callaghan v Independent News [2009] NIQB 1 about the risks to the safety of those who were identified in the community by the media after their release. There was no change of name in this case and that protection was not, therefore, in place. The comments on the Predators 2 page included reference to the area in which he lived and that where he used to live and where his family was residing. Although the area in which he was allegedly living was one in which many thousands of people were residing and there was no identification of an address or street it was clear that some of those posting on the Predators 2 page were seeking to establish the respondent’'s whereabouts.
[40] We accept that this was an appropriate case to make the Order taking down the site in order to protect the respondent from continued intimidation generated from McCloskey’'s site. Where there is intimidation or alarm of the required severity caused by unreasonable or oppressive conduct there is protection available by law by virtue of the Protection from Harassment (Northern Ireland) Order 1997 (the 1997 Order). Plainly this legislation deals with protection from intrusion and is intended to support personal autonomy. The tort of misuse of private information is aimed at securing similar values protected by Article 8 of the Convention but it can only come into play where it is established that any information in respect of which complaint is made is private and the publisher knew or ought to have known that it was private. There is no such constraint on the use of the 1997 Order and it is apparent, therefore, that these protections are complementary.
[41] We agree with much of the learned trial judge’'s analysis of the law concerning the tort of misuse of private information. The values protected by Article 8 of the Convention, particularly autonomy and dignity, are at the core of the cause of action. The tort protects both confidentiality and intrusion. There was no dispute between the parties that this was essentially a case about intrusion. The disclosure or repetition of information could only engage the tort if there was a reasonable expectation of privacy in respect of that information (see In re JR38 [2015] UKSC 42). The question of whether there has been a reasonable expectation of privacy “"is a broad one, which takes account of all the circumstances of the case”" (see Murray v Express Newspapers). The respondent placed particular emphasis on the context in this case. We accept that the context can be important but it is not necessarily decisive as to whether a reasonable expectation of privacy has been established. We do not accept any suggestion that because there is some coincidence in the values which the tort and the 1997 Order seek to protect that they are inevitably interchangeable in that breach of one leads to the conclusion that there has been breach of the other.
[42] The determination of whether the repetition or disclosure of private information achieves the level of intrusion protected by Article 8 of the Convention is inevitably fact sensitive. In conducting that exercise we accept that the context can include the disclosure or repetition of information which itself is not protected but which together with other private information can lead to unlawful intrusion.
[43] In this case the learned trial judge concluded that each piece of information set out at paragraph [21] above was private and further that the cumulative disclosure of the information constituted an unlawful intrusion into the respondent’'s personal autonomy. Mr White attacked this conclusion particularly in relation to the respondent''s convictions. He relied upon the observations of the majority of the Supreme Court in R(T) v Chief Constable of Greater Manchester Police and Others [2014] UKSC 35 stating that the point at which a conviction recedes into the past and becomes part of a person''s private life will usually be the point at which it becomes spent under the Rehabilitation of Offenders Act 1974. The respondent is now serving the licence period of his sentence and the conviction has not, therefore, become spent. The length of the sentence means that the conviction will never become spent. Although R(T) was decided shortly before the hearing it does not appear that it was brought to the attention of the learned trial judge as it is not mentioned in the judgment.
[44] We agree that with the passage of time the protection of an offender by prohibiting the disclosure of previous convictions may be such as to outweigh the interests of open justice. In principle, however, the public has a right to know about such convictions. Information about what has happened in open court can be freely communicated by members of the public unless there is some compelling reason to prevent it. The open justice principle is fundamental to securing public confidence in the administration of justice and is particularly important in the criminal context where the public is concerned with the punishment and rehabilitation of the offender and the extent of the risk of harm he may present. This is, therefore, a factor of very significant weight which can only be outweighed by the interest of the individual in freedom from intrusion in the most compelling circumstances.
[45] The learned trial judge relied upon the definition of sensitive personal data in the 1998 Act to determine whether information was private. We consider that considerable caution should be exercised before reading across the matters set out in that definition as though they were items of private information. The 1998 Act regulates those who are engaged in the control and distribution of organised information about members of the public. The fact that the information is regulated for that purpose does not necessarily make it private. The test remains whether there is a reasonable expectation of privacy.
[46] In his evidence the respondent indicated that he had to live with name calling because that was part of his conviction. His concern was not with the publication of his name and the background to his convictions but with the attempts to establish where he lived and the risk of harm as a result of that. We do not consider that the principle of open justice had to be qualified in this case by prohibiting the republication of the offender’'s name and the details of his convictions alone. There was no evidence that on its own publication of that material raised any material issue of concern. Despite the reporting of these matters to the police no risks from such publication were expressed by them.
[47] It is clear from the judge''s conclusion that he was particularly alert to the risks posed as a result of the identification of the respondent’'s address. It is common case that the posts on the second appellant’'s profile page at the time of the letter of claim included three comments referring to the general area in which the respondent apparently resided. It was an area in which many thousands of others resided. There was no identification of a property or a street. Whether an address or location is private information is likely to be highly fact sensitive. The area described in this instance was a diffuse residential part of a city. In order to establish a reasonable expectation of privacy the respondent had to show that the person publishing the information knew or ought to have known that there was a reasonable expectation that the information should have been kept private.
[48] We accept that the publication of the address of the respondent in circumstances where he was subject to harassment and there was some threat to him if that address was revealed would constitute the disclosure of private information. The PPANI arrangements for his licence were also relevant in determining the extent to which such publication constituted intrusion. Mr White submitted that in this case the information was of such a general character that it was not information in respect of which there was a reasonable expectation of privacy. That may have been so if we were considering the information about location on its own but there were other factors in this case.
[49] There was no evidence that the photograph of the appellant on McCloskey’'s profile page had been taken in circumstances where he had a reasonable expectation of privacy. The issue was whether in the context of this case the republication of that photograph disclosed private information. The context was the campaign of harassment conducted by McCloskey as found by the judge. The principle of open justice discussed above applied to the republication in a limited way since the photograph together with the information on his convictions identified him as an offender. The photograph together with the locality was directed to his address. The harassment context is in our opinion determinative. We doubt whether the republication of the photograph on its own would have constituted the publication of private information but in view of the campaign of harassment and threatened violence to the offender, the identification of the locality in which he was living, his name, photograph and the circumstances of the offending this was cumulatively information in respect of which the respondent had a reasonable expectation of privacy because of the risk that those who wished to do him harm could have established his whereabouts in order to do so.
[50] Some six months after the Predators 2 page had been taken down RS uploaded a photograph of the respondent identifying him as a sex offender, his name and information on the general area in which he was living to RS’'s profile page. The page was shared 1622 times and attracted a number of threatening comments. Against a background of the identification of the respondent as a sex offender, the fact that RS had posted on Predators 2 details of the locality in which the respondent was living, the republication of the general area in which he was allegedly living, the previous history of harassment through the second appellant’'s profile page and the use of his photograph we consider that the trial judge was correct to conclude for broadly the same reasons set out above that the respondent enjoyed a reasonable expectation of privacy on the same basis.
[51] That material was removed by taking down the main URL on 4 or 5 December 2013. On 23 December 2013 RS reposted a photograph of the respondent. There were two comments which indicated that this was what a “"Pedo”" looked like. There was no reference to an address, locality or the name of the respondent. There was no claim of any sort against RS in these proceedings. The principle of open justice protects the right of the citizen to communicate the decisions of the criminal justice system to others. This posting did no more than that and the respondent did not have a reasonable expectation of privacy in respect of it.
The e-Commerce Directive and the 2002 Regulations
[52] As discussed at paragraph [24] and [25] above there are particular provisions in the Directive and 2002 Regulations limiting the liability of an ISS provider for damages other than where it has actual knowledge of the unlawfulness of the publication or knowledge of facts and circumstances which make the unlawfulness transparent. In light of the acceptance by Facebook that the injunction was appropriate on the basis set out at paragraph [37] above the only issue in the appeal is whether Facebook is liable in damages for misuse of private information. There was no case made against it in respect of any harassment of the respondent.
[53] Article 15 of the Directive applies to any ISS provider which offers only the storage of information provided by a recipient of the service. That clearly includes Facebook. The Article states that member states shall not impose a general obligation on providers to monitor the information which they transmit or store or a general obligation actively to seek facts or circumstances indicating illegal activity.
[54] The internet has dramatically changed the way that we share information. The extent of that change can be seen from the matters set out in the judgment of Stephens J at paragraph [4] above. Commerce has been responsible for driving much of that change but we have also had a social revolution. Indeed the internet has not alone changed our lives but it has also changed our vocabulary. A tablet is no longer made of stone, a bit does not help to guide a horse and a cookie is more likely to affect your privacy than alleviate the pangs of hunger between meals!
[55] The commercial importance of ISS providers is recognised in Recital 2 of the Directive which notes the significant employment opportunities and stimulation of economic growth and investment in innovation from the development of electronic commerce. The purpose of the exemption from monitoring is to make the provision of the service practicable and to facilitate the opportunities for commercial activity. The quantities of information described by the learned trial judge at paragraph [19] of his judgment explain why such a provision is considered necessary. Although the 2002 Regulations do not contain a corresponding provision they need to be interpreted with the monitoring provision in mind.
[56] Regulation 19 of the 2002 Regulations effectively transposed Article 14 of the Directive:
“"19. Where an information society service is provided which consists of the storage of information provided by a recipient of the service, the service provider (if he otherwise would) shall not be liable for damages or for any other pecuniary remedy or for any criminal sanction as a result of that storage where—
(a) the service provider—
(i) does not have actual knowledge of unlawful activity or information and, where a claim for damages is made, is not aware of facts or circumstances from which it would have been apparent to the service provider that the activity or information was unlawful; or
(ii) upon obtaining such knowledge or awareness, acts expeditiously to remove or to disable access to the information…”"
Regulation 22 of the said Regulations is headed “"Notice for the purpose of actual knowledge”":
“"22. In determining whether a service provider has actual knowledge for the purposes of regulation… 19(a)(i), a court shall take into account all matters which appear to it in the particular circumstances to be relevant and, among other things, shall have regard to—
(a) whether a service provider has received a notice through a means of contact made available in accordance with regulation 6(1)(c), and
(b) the extent to which any notice includes—
(i) the full name and address of the sender of the notice;
(ii) details of the location of the information in question; and
(iii) details of the unlawful nature of the activity or information in question.”"
[57] Regulation 6 of the 2002 Regulations requires an ISS provider to make available to those using its service general information. In particular Regulation 6(1)(c) requires that the ISS provider make available to the recipient of the service in a form and manner which is easily, directly and permanently accessible the details of the service provider, including his electronic mail address, so as to make it possible to contact him rapidly and communicate with him in a direct and effective manner. It is apparent, therefore, that the scheme of the 2002 Regulations is to set up an easily accessible notice and take down procedure so that a complainant can utilise the Regulation 22 mechanism to establish actual knowledge and thereby establish an entitlement to damages if there is a failure to take down an unlawful posting.
[58] The learned trial judge recorded the submission by Facebook that there was a requirement to give notice in accordance with the online notification procedure prescribed by it before actual knowledge could be acquired. He rejected that submission and was clearly right to do so. The test prescribed by the 2002 Regulations simply requires actual knowledge or awareness of facts and circumstances which make it apparent that the activity or information was unlawful. Actual knowledge is sufficient however acquired. It is apparent, however, that the statutory scheme for electronic notification is intended to provide a speedy, direct and accessible service at minimal cost for those who may be harmed by the continued publication of any unlawful information. Those using the service will often not have the benefit of professional assistance and the approach to the Regulations needs to factor this into account when assessing the nature of the notification.
[59] Mr White submitted that the judge erred in his approach to the application of the 2002 Regulations. At paragraph [61] of his judgment he stated that Facebook did not attempt to prove that they did not have the capacity or resources or knowledge to look for or to assess material in relation to McCloskey having been put on notice of his activities by virtue of the XY litigation. Mr White claimed that the Directive and the 2002 Regulations effectively exempted Facebook from having to look for material. He drew attention in particular to the final sentences in paragraph [61]:
“"I also infer that the first defendant knew or ought to have known of the profile/page “"Keeping our Kids Safe from Predators 2”" given that any simple searches by the first defendant would have revealed the new profile page with an almost identical name and with identical purposes. I consider that the first defendant had the capacity, resources and knowledge to look for and to assess material in relation to CG on the second defendant’'s profile/page without receiving any letter of claim or any complaint from CG.”"
It was submitted that this passage again appeared to impose a monitoring obligation on Facebook requiring it to conduct searches without notice for the purpose of gathering information in order to avoid liability. Such an obligation was inconsistent with the terms of the e-Commerce Directive.
[60] At paragraph 94 of the judgment when considering the Directive and the 2002 Regulations the judge said that Facebook could not be liable until it had actual or constructive knowledge of unlawful activity. The reference to constructive knowledge again tended to suggest some form of obligation on the part of Facebook to conduct enquiries with a view to ascertaining further information. At paragraph 95 the learned trial judge set out the three separate ways in which he concluded that actual knowledge of unlawful activity was acquired:
“"a) by virtue of the XY litigation,
b) by virtue of that litigation combined with the letters sent to the first defendant and to its solicitors, and
c) by virtue of those letters combined with some elementary investigation of the profile/page and/or the internet.”"
We have already drawn attention to the manner in which the learned trial judge used the XY litigation in the preceding paragraph as a source of notice but the last of the three matters referred to imposes an obligation of investigation on Facebook of materials other than those of which it would have been aware. The judge concluded, however, that by looking at the postings with the knowledge of the XY litigation Facebook would have been aware of facts or circumstances from which it would have been apparent to it that the activity or information was plainly unlawful being misuse of private information and harassment of the respondent. We will come back to that conclusion.
[61] The judge returned to that issue at paragraph [100] in which he stated that both of the appellants knew or ought to have known that the content of the profile page, Predators 2, was oppressive and unreasonable and amounted to harassment of the respondent. Mr White again criticised this passage as indicating that the learned trial judge relied upon constructive rather than actual knowledge of relevant facts, requiring, as it did, Facebook to interrogate all of the postings generated by the profile page.
[62] We are satisfied that there is substance in these submissions. The e-Commerce Directive and the implementing 2002 Regulations seek to strike a balance between two competing principles. On one hand the freedom to exchange information has revolutionised our social engagement and the manner in which we conduct our commercial and working lives. Any restriction on that freedom may impact on our participation in the benefits of the information society. Given the quantities of information generated the legislative steer is that monitoring is not an option. In contrast to this public interest there is a need to ensure the protection of personal autonomy and dignity. The Regulations seek to achieve that through a notice and take down procedure. The issue for us is, therefore, whether Facebook had actual knowledge of the misuse of private information which we have identified or knowledge of facts and circumstances which made it apparent that the publication of the information was private. The task would, of course, have been different if there had been a viable claim in harassment made against Facebook.
[63] In respect of McCloskey’'s page the first piece of information that the judge relied upon was the XY litigation. There was no allegation of misuse of private information relevant to the making of the interim order in that case. It was a case of harassment. The judge concluded that the existence of the XY litigation was itself sufficient to fix Facebook with actual knowledge of unlawful disclosure of information on Predators 2 or awareness of facts and circumstances from which it would have been apparent that the publication of the information constituted misuse of private information. In our view such a liability could only arise if Facebook was subject to a monitoring obligation which disclosed the publication of information in respect of which there was a reasonable expectation of privacy. Even if the judge was entitled to conclude that the existence of the XY litigation was a fact or circumstance which made apparent to Facebook the propensity of the creator of that page, McCloskey, to harass those convicted of sexual offences that did not fix Facebook with knowledge about the publication of private information concerning the respondent. The furthest that the respondent can put the matter is that the XY litigation included reference to the Predators 2 page operated by McCloskey but it did not include any reference to the respondent, nor was any Order made in respect of Predator 2 in the XY litigation. We do not accept that the XY litigation made it apparent to Facebook that the disclosure of information was unlawful on grounds of privacy.
[64] The second piece of information relied upon by the judge was the correspondence. The letter of claim to the first appellant on 26 April 2013 enclosed 13 pages of downloaded material which it was alleged was defamatory and put the respondent''s life at immediate risk. The letter provided the URL for the Predators 2 page and for McCloskey’'s profile page. It did not identify the URL of any specific comment posted on the page. It did not identify any claim based on misuse of private information or harassment. It did not refer to the XY litigation or the profile page the subject of that litigation. It is common case that the claims based on defamation and breach of Article 2 of the ECHR were both entirely misconceived. The posts were plainly not defamatory because they were true and since Facebook is not a public authority it owed no Article 2 duty under the Convention. Indeed it is important to note that despite the invitation of Facebook’'s solicitors to raise the matter with the police no information was forthcoming from them suggesting any risk to the respondent. The correspondence did not, therefore, provide actual notice of the basis of claim which is now advanced.
[65] That leads to consideration of whether the correspondence made the basis of claim apparent. The content of the Predators 2 page referred to the respondent, his conviction and his photograph as published by the Irish News in 2007. This was information that had previously been published. The relatively recent conviction for a serious sexual offence was public information. Even if, for some reason, it fell outside the guidance given in R(T) Facebook had not been informed of any fact or circumstance to explain why that should be so. Similarly there was nothing to indicate that the republishing of the respondent’'s photograph constituted private information. No case was made in the correspondence to indicate why that photograph consisted of private information.
[66] Many of the comments were innocuous and merely included the heart symbol. Some were abusive and threatening. Three of the comments referred to a general area in which the respondent was believed to be living. There was, however, nothing in the letter of claim to indicate that the publication of that information was the issue in respect of which the complaint was being made. No further correspondence was sent directly to Facebook until after the site had been taken down. There was correspondence to Facebook’'s solicitors but this did not add to Facebook’'s knowledge. Those solicitors directed the respondent’'s solicitors to the online reporting mechanism.
[67] Despite the fact that there was no attempt to use the online reporting system in this case the judge noted that no general evidence was given as to the accuracy of the notification system. He drew the adverse inference that the absence of discovery and evidence in relation to the system indicated that it was inadequate and would not withstand independent scrutiny. The absence of evidence was unsurprising given that the adequacy of the notification system was not in issue in the case. The respondent did not attempt to utilise it at any stage of these proceedings. In those circumstances we do not consider that it was open to the learned trial judge to draw the adverse inference that the system was inadequate.
[68] As we have noted the learned trial judge concluded at paragraph [100] that the Predators 2 site was oppressive and unreasonable in relation to the respondent and that both appellants knew or ought to have known that it amounted to harassment of them. Part of the difficulty with this case is that the issue in this appeal has centred solely on the tort of misuse of private information whereas the first instance litigation was concerned also with the remedy for harassment by McCloskey. The only information notified to Facebook by the correspondence was that set out at paragraphs [65] and [66] above. We accept that Facebook had an obligation to read the material provided with the correspondence but abusive comments about the nature of the offending was not misuse of private information. The correspondence contained three references to the general area in which the offender was allegedly living but the lack of specificity could not have made it apparent that the information was private. By the time of trial the judge had considerably more material including further references to the area in which the respondent lived. In his conclusion on harassment and misuse of private information he relied heavily on the importance of the PPANI and his findings about other activities carried out in respect of other offenders by McCloskey. None of that information was conveyed to Facebook prior to McCloskey’'s site being taken down.
[69] We are satisfied that the notice and take down procedure contemplated by the Directive and 2002 Regulations is intended to be a relatively informal and speedy process by which those entitled to protection can get a remedy. It follows, therefore, that the omission of the correct form of legal characterisation of the claim ought not to be determinative of the knowledge of facts and circumstances which fix social networking sites such as Facebook with liability. What is necessary is the identification of a substantive complaint in respect of which the relevant unlawful activity is apparent. We have concluded that the substance of the privacy claim was the publication of material tending to identify the location in which the respondent was residing in the context of the information on the profile page and the threatening comments. The correspondence did not, however, express any concern about the publication of the area in which the respondent was allegedly residing. Without some indication in the letter of claim that the address was the issue we do not consider that the correspondence raised any question of privacy in respect of the material published.
[70] Mr Tomlinson submitted that the burden of proof that the first appellant did not have actual knowledge or sufficient knowledge of facts or circumstances lay on the first appellant. The answer in our view lies in the structure of the 2002 Regulations which not alone provide the test in Regulation 19 but also provide a mechanism for the transmission of information through Regulations 6 and 22. In our view it is for the claimant to adduce prima facie evidence that the ISS provider has actual knowledge of relevant facts or information before the provider is fixed with the obligation to prove that it did not. The correspondence on behalf of the respondent in respect of the second appellant’'s page relied on misconceived causes of action and declined to advance any detailed analysis of the materials to support a claim of unlawful disclosure of private information. The first appellant was not in a position to conduct that exercise on its own. For the reasons given we do not consider that in the case of the second appellant’'s profile page and postings such prima facie evidence was established.
[71] The first profile page posted by RS included reference to the offences which he had committed, the photograph of the respondent and a reference to the general area in which he had lived and that in which he was then believed to be living. The letter of claim dated 15 November 2013 complained about the photograph and a number of threatening and abusive comments and alleged defamation and interference with the right to life. None of the comments of which complaint was made referred to the area in which the respondent was living. No separate complaint was made about the identification of the area in which the respondent was living nor was there any reference to the tort of misuse of private information. The respondent’'s solicitors were asked to identify any offending URL by return of post. By letter of 26 November 2013 the solicitors for RS referred to the identification of the general area in which the respondent was living. They noted that the PSNI had called at the respondent’'s home to advise him that his life was under threat from loyalist paramilitaries. In response the solicitors were again asked by return to specify any offending URL to enable the first appellant to locate it. They eventually did so on 3/4 December and the site was taken down the following day.
[72] Although there was no complaint of misuse of private information we consider that the notification on 26 November 2013 was sufficient to establish knowledge of facts and circumstances which made it apparent that the material published was private information. The references to the location where the respondent was living were repeated on a number of occasions and raised as an obvious matter of concern in these circumstances. The proper operation of the notice and take down procedure should have caused Facebook to respond. They were on notice of the risk from the additional information about the location of his residence. They had the location of the page from the correspondence of 13 November 2013. They were not entitled to close their eyes to the information on the respondent’'s address contained within the page and comments. Facebook was obliged to act as a diligent economic operator (See L’'Oréal SA v eBay International [2012] Bus LR 1369). We conclude, therefore, that the first appellant had knowledge of facts and circumstances from 26 November 2013 from which it should have been apparent that private information was being disclosed. The onus then lay on Facebook to demonstrate that it acted expeditiously to take the information down. It did not seek to do so. Facebook is accordingly liable in misuse of private information from 26 November 2013 until the information was removed on 4/5 December 2013.
[73] After the page was taken down the photograph was reposted on 23 December but again the complaint related to defamation and right to life. No complaint about the privacy of the information was made. We do not accept that the evidence establishes that Facebook ought to have known of any misuse of private information as a result of that posting.
Data protection
[74] The relevant jurisdictional extent of the 1998 Act is set out in section 5:
“"5. - (1) Except as otherwise provided… this Act applies to a data controller in respect of any data only if-
(a) the data controller is established in the United Kingdom and the data are processed in the context of that establishment…
(3) For the purposes of subsection (1)… each of the following is to be treated as established in the United Kingdom-…
(d) any person who … maintains in the United Kingdom-
(i) an office, branch or agency through which he carries on any activity, or
(ii) a regular practice;
and the reference to establishment in any other EEA State has a corresponding meaning.”"
The case was opened and began before Stephens J on the basis that the Act applied to Facebook and at paragraph 5 of its defence it admitted that it was the data controller with respect to the data of users based outside of the United States of America and Canada of the social network for the purposes of the 1998 Act. During the hearing Facebook was given leave to amend its defence to plead that the Act did not apply to it in respect of that data for the reasons set out below.
[75] It was agreed that the information on Predators 2 was personal data and sensitive personal data of which the respondent was the data subject. Facebook was the data controller in respect of that data. As appears from paragraph 3 above Facebook is a private limited company incorporated in the Republic of Ireland. Facebook UK Limited is a private limited company incorporated in the UK which provides marketing support services to Facebook and obtains all of its income from providing those services. Its function includes the generation of advertising revenues in the UK. It has offices in the UK but does not operate, host or control the Facebook service. A data processing agreement is in place between Facebook and Facebook UK Limited under which Facebook UK Limited as “"data processor”" processes certain personal data on behalf of Facebook in order to generate advertising revenue in the United Kingdom. The respondent submitted that Facebook was established in the United Kingdom by virtue of its relationship with Facebook UK Ltd.
[76] The learned trial judge concluded that on balance he was not persuaded that the respondent had established that Facebook, by virtue of its relationship with Facebook UK Limited, maintained an office, branch or agency through which it carried on any activity in the United Kingdom. He noted that in light of the way that the issue arose in the course of the proceedings no discovery on this issue had been sought or provided and accepted that a different conclusion could be reached on different facts in another case.
[77] Section 5 of the 1998 Act gave effect to Article 4 of the Data Protection Directive 95/46/EC dealing with the national law applicable:
""1. Each Member State shall apply the national provisions it adopts pursuant to this Directive to the processing of personal data where:
(a) the processing is carried out in the context of the activities of an establishment of the controller on the territory of the Member State; when the same controller is established on the territory of several Member States, he must take the necessary measures to ensure that each of these establishments complies with the obligations laid down by the national law applicable;""
[78] Article 4(1)(a) of this provision was the subject of extensive consideration by the ECJ in Google Spain v AEPD and Gonzalez Case C-131/12 [2014] QB 1022. The background was that Mr Gonzalez complained to AEPD (the Spanish Data Protection Agency) that a Google search against his name in 2010 contained a link to two newspaper reports in 1998 where his name appeared in respect of a real estate auction arising from attachment proceedings for the recovery of Social Security debts. The proceedings had been fully resolved for a number of years and he requested that Google Spain be required to remove or conceal the personal data relating to him so that the reports ceased to be included in the search results.
[78] Google offered its services in Spain through Google Search which was accessed through its Spanish website. Google Search was operated by Google Inc which is the parent company of the Google group and had its seat in the United States. In connection with Google Search, commercial advertising services were provided. Google Spain was established to promote the sale of advertising space. It had its seat in Madrid and acted as a commercial agent for the Google group in that member state. Google Spain was the controller in Spain of two filing systems which contained the personal data of customers who concluded contracts for advertising services with Google Inc.
[79] The question for the ECJ was whether Article 4(1)(a) of Directive 95/46 was to be interpreted as meaning that the processing of personal data was carried out in the context of the activities of an establishment of the controller on the territory of a member state when the operator of a search engine set up in a member state a branch subsidiary which was intended to promote and sell advertising space offered by that engine and which orientated its activity towards the inhabitants of that member state.
[80] The court noted at paragraph [48] of its judgment that recital 19 in the preamble to the Data Directive 95/46 EC stated that establishment on the territory of a member state implies the effective and real exercise of activity through stable arrangements and that the legal form of such an establishment whether simply a branch or a subsidiary with legal personality is not the determining factor. It was common case that Google Spain was engaged in the effective and real exercise of activity through stable arrangements in Spain. It was a subsidiary of Google Inc on Spanish territory and therefore an establishment within the meaning of Article 4(1)(a) of Directive 95/46. The court noted that the Directive did not require the processing of personal data to be carried out by the establishment concerned but only that it be carried out in the context of the activities of the establishment.
[81] In order to ensure effective and complete protection in particular of the right to privacy those words could not be interpreted restrictively. Recitals 18 to 20 in the preamble to the Directive sought to protect individuals from being deprived of the protection guaranteed by the Directive. The court accordingly held that the processing of personal data for the purposes of a search engine such as Google Search which was operated by an undertaking that had its seat in a third state but had an establishment in the member state was carried out in the context of the activities of that establishment if the latter was intended to promote and sell in that member state advertising space offered by the search engine which served to make the service offered by that engine profitable.
[82] The approach to the concept of establishment under Article 4(1)(a) in the Directive was again considered by an ECJ Chamber in Weltimmo v Nemzeti Adatvedelmi (Case C-320/14) [2016] 1 WLR 863. The data controller was registered in Slovakia and operated a website dealing with Hungarian properties. There was a complaint by advertisers using the website to the Hungarian authorities about excess charging and they imposed a fine on the data controller. The data controller appealed on the basis that it was not established in Hungary and therefore not subject to the jurisdiction of the Hungarian authorities. The issue was referred to the ECJ in order to determine the principles upon which the domestic court should act.
[83] The court followed the approach in Google Spain noting that the Directive prescribed a particularly broad territorial scope, that the words “"in the context of the activities of an establishment"" should not be interpreted restrictively and that establishment on the territory of a member state implied the effective and real exercise of activity through stable arrangements. The legal form of such an establishment whether simply a branch or a subsidiary with a legal personality was not the determining factor. Accordingly in order to establish whether the data controller has an establishment in a member state other than the member state where it was registered both the degree of stability of the arrangements and the effective exercise of activities in that other member state must be interpreted in the light of the specific nature of the economic activities and the provision of services concerned. The concept of establishment extended to any real and effective activity, even a minimal one, exercised through stable arrangements.
[84] The court noted that Weltimmo clearly pursued a real and effective activity in Hungary through its website. It had a representative in Hungary who had sought to negotiate a settlement of unpaid debts with the advertisers. It had a bank account in Hungary. It had an address for the management of its everyday business affairs in Hungary. The court concluded that that was sufficient to constitute an establishment. If those matters were proved Weltimmo was established in Hungary as that was sufficient to prove that the processing of personal data was carried out in the context of the activities of the establishment.
[85] We have already discussed at paragraph [73] the circumstances in which the data protection issue emerged before the learned trial judge. It is, however, not clear how the issue developed before him. Although it appears that Google Spain may have been cited to him there is no discussion of it in that part of the judgment dealing with the establishment issue. He could not, of course, have considered Weltimmo since neither the Advocate General’'s opinion nor the court’'s decision were published prior to the delivery of judgment. We simply do not know what legal principles the learned trial judge applied in coming to his determination that Facebook was not established in the United Kingdom.
[86] In seeking to support the judge’'s conclusion Mr White relied first upon the line of authority set out in Murray v Royal County Down Golf Club [2005] NICA 52 that where the only matter for decision is whether the judge has come to a right conclusion on the facts the court should not interfere unless he has not taken all the circumstances into consideration or has misapprehended the evidence or drawn an inference which there is no evidence to support. The difficulty with that submission is that the case law to which we have referred sets out how the court should determine whether the data controller is established in this jurisdiction and whether the data are processed in the context of that establishment. The judge made no reference to that case law. The determination of this issue is not a pure question of fact and in the absence of any consideration of the authorities by the judge we are obliged to consider them on appeal.
[87] Secondly, the first appellant submitted that the mere fact that the Facebook service was accessible in the UK did not mean that it was established here. We agree. Recital 19 of the e-Commerce Directive reinforces that point. Thirdly, Mr White relied upon Richardson v Facebook and Google (UK) Ltd[2015] EWHC 3154 (QB). In that case Warby J upheld the Master’'s Order striking out a libel claim against Facebook (UK) Limited based on publications on the Facebook Service on the ground, inter alia, that Facebook (UK) Limited was not the entity responsible for hosting or controlling the Facebook Service. That is not, of course, the issue in this case and Warby J expressly left open at paragraph [59] the conclusion that the data processing activities of Facebook undertaken in England and Wales were carried out in the context of advertising and other activities by Facebook (UK) Ltd so that they were subject to English data protection law. This case is, therefore, of no assistance to the first appellant.
[88] The principal argument advanced by Facebook was that it was established in a member state of the EU, Ireland, and was regulated in terms of data protection by the domestic law of that member state which implemented the Data Protection Directive. It was not regulated by the domestic law of other member states from which its service was accessible. The Data Protection Directive emphasises the objective of an internal market and free cross-border flow of data between member states. The nationality or place of residence of the data subject, the place where the data processing took place and the place of which the service was accessible were not relevant to the location of the establishment. Mr White accepted, however, that the data controller may be established in a number of member states and be subject to the data protection laws within those member states although he noted the risk of inconsistent approaches in different member states.
[89] On behalf of Facebook it was submitted that the decision in Google Spain was motivated by the particular circumstances of that case. The court was asked to hold that EU residents did not benefit from data protection rights when they dealt with the provider of Internet services located in the United States. Accordingly it was submitted that the court adopted an expansive approach to the applicable law test because of the risk that the data subject might be left unprotected and the effectiveness of the Directive would be compromised.
[90] We do not accept the latter submission. The decision in Weltimmo built upon the jurisprudence developed by the ECJ in Google Spain and supports the conclusion that the Directive has a particularly broad territorial scope and should not be interpreted restrictively. The evidence indicates that Facebook (UK) Ltd was established for the sole purpose of promoting the sale of advertising space offered by Facebook the effect of which is to make the service offered more profitable. It conducts its activities within the United Kingdom and is responsible for engaging with those within this jurisdiction who seek to use the Facebook service for advertising. It holds relevant data which it processes on behalf of Facebook in respect of advertising customers. There is no direct evidence of its connection with Facebook but there is an irresistible inference in the absence of any further explanation that Facebook (UK) Ltd was established to service Facebook and is part of the wider Facebook group of companies.
[91] We are satisfied, therefore, that Facebook (UK) Ltd plainly engages in the effective and real exercise of activity through stable arrangements in the United Kingdom and having regard to the importance of those activities to Facebook’'s economic enterprise the processing of data by Facebook was carried out in the context of the activities of that establishment. Facebook is, therefore, a data controller for the purposes of section 5 of the 1998 Act.
[92] The only remaining issue is whether Regulation 19 of the 2002 Regulations which exempts an ISS which consists of the storage of information provided by a recipient of the service operates to relieve Facebook of liability for damages under the 1998 Act in the absence of actual knowledge of unlawfulness or facts and circumstances from which it would have been apparent that the activity or information was unlawful. It was common case that the claim under the 1998 Act would not add to damages payable in respect of misuse of information. This issue arises, therefore, in respect of the entitlement to damages for the postings and comments on the McCloskey profile page and any postings and comments on the RS page prior to 26 November 2013.
[93] In support of the submission that the e-Commerce Directive did not limit the entitlement to damages under the 1998 Act Mr Tomlinson pointed first to the fact that Article 1(5) of the e-Commerce Directive which defined its objective and scope stated that it would not apply to questions relating to information society services covered by Directives 95/46/EC and 97/66/EC. These are the Directives dealing with data protection.
[94] This is mirrored by Regulation 3 of the 2002 Regulations which provides that nothing in the Regulation shall apply in respect of questions relating to information society services covered by the Data Protection Directive and the Telecommunications Data Protection Directive and Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector. Mr Tomlinson also relies upon recital 14 of the e-Commerce Directive which records that the aforesaid Directives already establish the Community legal framework in the field of personal data.
[95] We accept all of that but the starting point has to be the matter covered by the e-Commerce Directive which is the exemption for information society services from the liability to pay damages in certain circumstances. The provisions do not interfere with any of the principles in relation to the processing of personal data, the protection of individuals with regard to the processing of personal data or the free movement of such data. The provisions do, however, provide a tailored solution for the liability of information society services in the particular circumstances outlined in the e-Commerce Directive. We do not consider that this is a question relating to information society services covered by the earlier Data Protection Directives and accordingly do not accept that the scope of the exemption from damages is affected by those Directives. Regulation 3 of the 2002 regulations must be read accordingly.
Conclusion
[96] We find that Facebook are liable to the respondent in damages for misuse of private information for the period from 26 November 2013 until 4/5 December 2013 in respect of the first RS page. Facebook''s appeal in relation to the remaining periods is allowed. We allow the cross-appeal and hold that Facebook is a data controller for the purposes of section 5 of the Data Protection Act 1998. We conclude that Facebook is entitled to the protection of the e-Commerce Regulations against claims for damages under the 1998 Act. We will hear the parties on the appropriate remedies and costs. The injunction should remain in place. We will hear the parties on the appropriate remedies and costs.