Northern Ireland High Court of Justice, Masters' decisions

You are here: BAILII >> Databases >> Northern Ireland High Court of Justice, Masters' decisions >> MM v BC, RS and Facebook Ireland [2019] NIMaster 5 (12 April 2019)
URL: http://www.bailii.org/nie/cases/NIHC/Master/2019/5.html
Cite as: [2019] NIMaster 5

[New search] [Printable PDF version] [Help]

MM v BC, RS and Facebook Ireland [2019] NIMaster 5 (12 April 2019)

Ref: 2019NIMASTER5

Neutral Citation No: [2019] NIMaster 5

Judgment: approved by the Court for handing down

(subject to editorial corrections)*

Delivered: 12/04/2019

No. 16/049896

IN THE HIGH COURT OF JUSTICE IN NORTHERN IRELAND

QUEENS BENCH DIVISION

Between:

Plaintiff;

AND

BC, RS and FACEBOOK IRELAND

Defendants.

MASTER MCCORRY

By summons issued 9th May 2018 the plaintiff applies for an Order pursuant to Order 20, rule 5 of the Rules of the Court of Judicature (Northern Ireland) 1980, granting leave to amend the writ of summons to add claims against the third defendant (Facebook) for Breach of the Data Protection Act 1998, negligence and misuse of private information. The initial relief sought against the third defendant, in the writ of summons issued 6th June 2016, was damages pursuant to section 8 of the Human Rights Act 1998 for failing to have in place an adequate "reporting mechanism" by which the plaintiff could report publication of offending content relating to her on 28th May 2016. She now seeks to amend the summons to add claims under additional causes of action including: damages pursuant to section 13 of the Data Protection Act by failing to comply with its duties as a data controller; damages for negligence in relation to the publication and transmission of, and failure to expeditiously assist in the locating of, and expeditiously remove, 'revenge porn' images of the plaintiff; and damages for the misuse of private information whereby private images of the plaintiff were circulated on the Facebook platform.

The plaintiff is a young woman who was in a relationship with the first defendant, a young man of similar age. The second defendant is a friend of the first defendant. During their relationship, which lasted about one year starting January 2014, the first defendant took sexually explicit photographs of the plaintiff and in addition the plaintiff, using Facebook Messenger, sent nude pictures of herself to him. The plaintiff and first defendant split up acrimoniously and following the plaintiff's refusal to see him again, in an act of what is now commonly known as 'revenge porn', the first defendant placed the photographs on Facebook using Messenger. These were further disseminated by the second defendant.

The plaintiff became aware of what had occurred when she was told by a friend on 28th May 2016 who also forwarded to her a photograph of her naked and screenshot showing that the second defendant had used private messaging to send her 2 naked images, one of the plaintiff and the other of another friend with whom he had been in a relationship. She telephoned the police who unfortunately were unhelpful. She then tried to complain to the third defendant but it said it could not remove the images without the uniform resource locators ("URLs") which the plaintiff could not access because the images had been sent by Messenger. The plaintiff was understandably extremely distressed because the images were not deleted and sought medical assistance with the "out of hours" doctors' service. For the purposes of these proceedings she also subsequently obtained a report by a consultant psychiatrist Dr Mangan. A community worker in her apartment block put her in contact with her solicitor on 1st June 2016, emergency legal aid was sought and granted and the plaintiff applied for an interim injunction which was granted on 3rd June 2016.

The action against the first and second defendants, who actually posted the offending material about the plaintiff, was based on their negligence, misuse of private information, breach of confidence, breach of the Protection from Harassment (Northern Ireland) Order 1997, breach of the Data Protection Act 1998 and section 8 of the Human Rights Act 1998. In addition she sought an injunction pursuant to the Protection from Harassment Order and an injunction pursuant to the inherent jurisdiction requiring the first and second defendants to delete all images or messages relating to the plaintiff. The ex parte application for injunctive relief was heard by Horner J on 3rd June 2016. An interim injunction was ordered: preventing the first and second defendants from further harassing, pestering, annoying or molesting the plaintiff by distributing, broadcasting or transmitting images or messages pertaining to the plaintiff on Facebook or any other website; and ordering them to delete the images. Orders were also made: requiring the third defendant to suspend the first and second defendants' Facebook accounts; requiring the third defendant to discover in advance of close of pleadings all material it held in respect of the first and second defendants' accounts; and requiring the first and second defendants to file affidavits within 48 hours disclosing the names of those to whom the images had been disseminated.

Further orders were granted including a direction by the Court that a joint expert's report ("Ryan Report") be commissioned, and also on an order by Stephens J on 13th June 2016, that the first and second defendant's Facebook accounts not be suspended without further order to enable them to use the data tool to obtain all necessary information to identify all relevant postings so that they could be removed. Following this on 24th June 2016 Stephens J ordered the third defendant to deactivate the first and second defendants' accounts ensuring that any and all information therein be retained as evidence. On 4th October 2016 Stephens J further ordered the third defendant to reactivate the accounts with new passwords to be shared only with the plaintiff's solicitors, the defendants' solicitors, the joint expert and no other person. This was essentially to allow the joint expert access to the accounts and all postings thereon following which he was able to complete his report. This identified that the images had been disseminated to 25 accounts including people who knew the plaintiff. This substantially concluded the action so far as the first and second defendants were concerned.

On 15th March 2017 the plaintiff applied for an interim injunction requiring the third defendant to locate and delete from its platform all images of the plaintiff. This was refused by Maguire J on 1st December 2017 on the grounds that: there was no evidence that there had been further dissemination beyond the 25 accounts identified where deletion had already occurred; the absence of evidence that the plaintiff would sustain grave damage if the injunction was not granted, and because the court was satisfied that the compliance with such an order would be technically problematic, onerous, time consuming and expensive disproportionate to the likely benefits.

The plaintiff submits that in the course of the hearing of that application (although I note this is not expressly alluded to in the judgment by Maguire J) it was discovered that the third defendant had the technical capability to examine all images uploaded on its platform and to check whether or not a particular image is a match with other images, for example in the plaintiff's private images. It therefore had greater technical ability to assist the plaintiff in locating and removing the images which it did not use at the material time. It failed to examine uploaded content and to prohibit indecent images from being uploaded. That failure provided the vehicle for users to share the plaintiff's private images. In the event the revenge porn images of the plaintiff were not finally removed until February/March 2017. This forms the thrust of the plaintiff's additional causes of action. However, the third defendant, in affidavits by Olivia O'Kane (solicitor, sworn 27th June 2018) and Jack Gilbert of Facebook (sworn 24th April 2017 for the application before Maguire J), assert that the facts alleged by the plaintiff mischaracterise the steps taken by the third defendant to assist the plaintiff and rebut the allegation that she was left unaided.

It would of course be inappropriate in the course of this interlocutory application for leave to amend, that this court attempt on the basis of conflicting affidavit evidence, to reach any findings of fact in respect of the contrary allegations made by the plaintiff and third defendant. The role of the court is to decide whether the tests for amendment set out in Order 20, rule 5 of the Rules of the Court of Judicature (NI) 1980 are satisfied. This enables the court to permit amendment at any stage of the proceedings subject to Order 15, rules 6, 7 and 8: even where, if it thinks it is just to do so, a relevant period of limitation current at the date of issue of the writ has expired; or where the amendment adds or substitutes a new cause of action, as long as it arises out of the same or substantially the same facts as the initial cause of action claimed. Order 15, rule 6. 7 and 8 are not particularly relevant to the present case and the third defendant has not raised the question of limitation. Rather it points to the two year delay from the date of issue of the writ in 2016 before the plaintiff sought to add the additional causes of action, where the third defendant asserts that there are no new facts not previously known to the plaintiff which have emerged since then.

The plaintiff cites Beoco Ltd v Alfa Laval C Ltd and another [1995] QB 137 where Stuart-Smith LJ observed: "the guiding principle in giving leave to amend is that all amendments should be allowed at any state of the proceedings to enable all issues between the parties to be determined, provided that the amendment will not result in prejudice or injustice to the other party which cannot properly be compensated for in costs." Lateness is of course a factor which the court takes into account for example if it prejudices the defendant in some way, but the fundamental point is that where, as in the present case, the proposed amendments add a new cause or causes of action, those new claims must have some prospect of success otherwise leave to amend is refused. This forms the main point of contention between the parties.

Whilst the law in respect of amendment is well established a brief mention of the other authorities cited is warranted. In Collier v Blount Petre Kramer [2004] EWCA Civ 467, LTL 1/4/2004 para 2004, the plaintiff sued his former solicitors who had advised him in respect of the transfer of valuable property to his daughter which then became the subject of proceedings between him and the daughter wherein he claimed that the property had been transferred to her to hold the beneficial interest on trust for him. That action had failed at first instance and on appeal because the court had concluded that the scheme had been to defraud creditors and the plaintiff was therefore precluded on grounds of public policy from asserting the existence of an oral trust. He then sued his solicitors asserting, inter alia, that he had not been advised to secure the execution of a deed of trust. He sought to amend to join his wife, one of the partners of the defendant firm individually and his daughter. His application was dismissed by the judge and he appealed where Lord Mance, delivering the judgment of the court, considered the various strands of the plaintiff's proposed revised case and affirmed that leave should be refused because of, among other reasons, its "lack of intrinsic merit".

Lough Neagh Exploration v Morrice [1999] NIJB 43, was an appeal from the Chancery Master's dismissal of the action on the ground that it raised the same causes of action and concerned the same subject matter as a pending action in the Republic of Ireland, and was therefore frivolous and vexatious and an abuse of the process of the court. Late in the day the plaintiff sought leave to amend to limit the claim to actions and activities in this jurisdiction and to claim declaratory relief which could only be ordered here, substantially changing the nature of the case. At page 46 Girvan J held: "…. The proposed new case argued for by the plaintiff is so fundamentally different from the case as pleaded in the unamended writ that the better course would be to leave it to the plaintiff to issue separate proceedings. As pointed out in the Supreme Court Practice 1999, vol., para 20/8/28: "The Court will not refuse to allow an amendment simply because in introduces a new case … But it will do so where the amendment would change the action into one of a substantially different character which would more conveniently be the subject of a fresh action (see Raleigh v Goschen [1898] 1 Ch 73 at 81…"" Leave to amend was refused.

The defendant objects to the application for leave to amend on a number of grounds. These include denial of the plaintiff's assertion that it did not assist her until 15th March 2017, claiming that it had removed the images from Messenger and placed a technical block to prevent them being sent. Secondly, it had to access the plaintiff's own account because some images had been sent by her to the first defendant and they did not receive her URL until 22nd February 2017. Thirdly, it questions what new facts the plaintiff has only become aware of giving rise to the new claims which were not known to her in 2016.

However the main thrust of the third defendant's objection to the application is that the new claims are unsustainable because of the provisions of Regulation 19 of the Electronic Commerce (EC Directive) Regulations 2002 (the "E-Commerce Regulations") implementing in domestic law Article 14 of Directive 2000/31/EC (the E-Commerce Directive") and providing a conditional exemption from liability in the case of an information society service provider ("ISSP") which provides hosting services. Regulation 19 provides that an ISSP cannot be found liable for storing unlawful data where the ISSP lacked actual knowledge the data was illegal or, upon learning of the illegal nature of the data, acted expeditiously to remove it. The Court of Appeal has confirmed that Facebook is such an ISSP which prima facie can avail of the safe harbour under the E-commerce Regulations and E-commerce Directive: CG v Facebook Ireland [2017] EMLR 12 at [24]-[25] and [52].

Regulation 19 states:

"Where an Information Society service is provided which consists of the storage of information provided by a recipient of the service, the service provider (if he otherwise would) shall not be liable for damages or for any other pecuniary remedy or for any criminal sanction as a result of that storage where –

(a) the service provider –

(i) does not have actual knowledge of unlawful activity or information and, where a claim for damages is made, is not aware of facts or circumstances from which it would have been apparent to the service provider that the activity or information was unlawful; or

(ii) upon obtaining such knowledge or awareness, acts expeditiously to remove or to disable access to the information; and

(b) the recipient of the service was not acting under the authority or the control of the service provider."

Thus under Regulation 19 (a) (i) an ISSP is only deprived of the hosting exemption where it has "actual knowledge of unlawful activity or information" or was "aware of facts and circumstances from which it would have been apparent to the service provide that the activity or information was unlawful". The emphasis is on actual knowledge or actual awareness as opposed to constructive knowledge or notice. See Collins on Defamation (2014) at para 17.40 (The Regulation 19 formation directs attention only to facts or circumstances of which the host is actually aware, as opposed to facts of which the host could, or ought to, have been aware"). See further CG v Facebook Ireland [2017] EMLR 12 (at [60]-[62]), in which the Court was satisfied there was substance in the submissions by counsel for Facebook that the Trial Judge in that case has erred by relying upon a notion of constructive knowledge.

In CG v Facebook Ireland, the Court of Appeal confirmed that it is for the plaintiff to adduce prima facie evidence that the ISSP has actual knowledge of relevant facts or information before the ISSP is fixed with the obligation to prove that it did not. To establish actual knowledge on the part of the ISSP, the plaintiff/complainant must have identified "a substantive complaint in respect of which the relevant unlawful activity is apparent" (at [69] and [70]). The third defendant in the present case asserts that the first time that the plaintiff provided 'actual notice of the basis of the claim which is now advanced' is when it issued the present application. Therefore, it argues, there is no legal basis upon which it could be held liable in respect of the new causes of action, and it is pointless to permit amendment of the writ or pleadings which could serve no purpose. As regards the second limb of Regulation 19, namely at (a) (ii), "upon obtaining such knowledge or awareness, acts expeditiously to remove or to disable access to the information", the third defendant submits that the plaintiff's bald assertion that Facebook had failed to expeditiously assist the plaintiff is not supported by any evidence that this was the case. The question therefore is what the third defendant knew about the plaintiff's complaint, when it knew about it, what it did about it and when.

The thrust of the plaintiff's case is that the third defendant's reporting systems were inadequate, as was its response to the plaintiff's complaints when made. In the present case the plaintiff's situation was complicated by the fact that the images were disseminated by private messaging on Facebook, further complicated by the fact that a number of the images had actually been sent to the first defendant by the plaintiff herself using private messaging. She did not have the URLs for the images disseminated by the first and second defendants because they were sent to her by a friend as copies. She was unable to make an online report because of the inadequacy of the online reporting system, where the adequacy of the system was obviously outside her control and entirely within the third defendant's control. However, the images having come to her attention on 28th May 2016, she was already in court in an application for an injunction ordering removal of the images just five days later on 3rd June 2016. The third defendant was therefore aware of her complaint by that date but still was unable to finally confirm removal of the images until 8th March 2017, although it did remove images and place a technical block on them to prevent them being sent by Messenger much earlier than that.

On 14th June 2016 the third defendant advised the court and the other parties that they should obtain the necessary data directly from Facebook themselves. That suggests that Facebook had the necessary information and it is therefore appropriate to ask why it simply did not pass that information itself to the other parties. This preceded, and possibly prompted the comment by Stephens J on 15th June 2016 that this was "an inadequate method of creating a complete record of what appears on the Facebook account": and at [8] of his judgment:

"I would also make the comment. I would have thought that Facebook has or should have a method of recording and preserving information that is put onto their accounts so as to assist courts in preventing Facebook being used as a tool to abuse individuals. The court looks to Facebook to assist. That is to provide technical assistance in order to achieve what everyone seeks to achieve, namely that individuals can live their lives free from harassment, abuse and instances of revenge porn."

The plaintiff's case is therefore that the online reporting systems were inadequate in this case where the offending content was being sent by messenger because in order to make a full online complaint the plaintiff required information, such as the relevant URLs, before she could even lodge the complaint, information which Facebook itself had the technical ability to access.Instead, the plaintiff argues, in this case the Court had to direct a report by a joint expert to achieve what Facebook could and should have done itself, and having done so should have acted earlier to remove all offending material and ensure that it could not be further disseminated. It is its failure to do so that the plaintiff says gives rise to the additional causes of action.

In an application to amend by the plaintiff the onus is on the plaintiff to satisfy the court that the amendments are necessary to put all matters upon which there must be adjudication before the court. This is different from, for example an application to strike out pleadings as disclosing no reasonable cause of action (O.18, rule 19 (1) a), where for the purposes of the application the facts are presumed to be as pleaded by the plaintiff. Further, under Regulation 19 it is for the plaintiff to adduce prima facie evidence that the ISSP has actual knowledge of relevant facts or information before the ISSP is fixed with the obligation to prove that it did not. To establish actual knowledge on the part of the ISSP, the plaintiff/complainant must have identified "a substantive complaint in respect of which the relevant unlawful activity is apparent" (CG v Facebook Ireland at [69] and [70]). There is no concept of constructive notice. Further, the High Court in England in Davison v Habeeb & Ors [2012] 3 CMLR 6 applying the ruling of the European Court of Justice in L'Oreal SA and Ors v eBay International AG and Ors [2012] Bus LR 1369 emphasises that a complaint to be substantive must alert the ISSP that the conduct complained off is unlawful.

On the other hand, if the systems put in place by Facebook are such that it is difficult for someone in the position the plaintiff found herself in to access the necessary information to make a substantive complaint requires input from Facebook itself, then satisfying the onus placed upon them by Regulation 19 is extremely challenging. It is important therefore in applying CG v Facebook Ireland to be clear what the Court of Appeal actually said and did in that case?

The case concerned the posting on Facebook of information concerning the identity and whereabouts of a convicted sex offender CG by a defendant McCloskey and another known as RS. On 26th April 2013 CG's solicitors wrote to Facebook enclosing a hard copy of the profile page and warned that the material was defamatory and put his life at risk. Facebook's response of 2nd May 2013 suggested that he use the online tools for reporting improper content and identifying it by reference to the URL. He declined to do so, instead his solicitor provided screenshots of the offending material which consisted of a single thread on McCloskey's Facebook page. By 22nd May 2013 Facebook had taken down the postings but nevertheless on 28th May 2013 CG issued a writ in respect of misuse of private information by Facebook and harassment by McCloskey. On 13th November 2013 RS the father of one of CG's victims, using his own Facebook page, uploaded the picture of CG, identifying him by name and providing his former address and the area where he now lived and asserting that he was a danger to children. When CG's solicitors wrote to Facebook on 15 November they were told that Facebook could do nothing without details of the URL of each comment. The solicitors provided RS's address and the information was taken down on 4th or 5th December 2013. RS reposted the material on 22nd December 2013 prompting 2 comments from which CG's solicitors were able to provide the URLs on 8th January 2014 and the material was taken down on 28th January 2014. At first instance CG was awarded damages against Facebook for misuse of private information in respect of the 3 pages complained of together with the comments they had generated. Facebook appealed.

Delivering the judgment of the Court the Lord Chief Justice said as follows:

"67. Despite the fact that there was no attempt to use the online reporting system in this case the judge noted that no general evidence was given as to the accuracy of the notification system. He drew the adverse inference that the absence of discovery and evidence in relation to the system indicated that it was inadequate and would not withstand independent scrutiny. The absence of evidence was unsurprising given that the adequacy of the notification system was not an issue in the case. The respondent did not attempt to utilise it at any stage of these proceedings. In those circumstances we do not consider that it was open to the learned trial judge to draw the adverse inference that the system was inadequate.

68. As we have noted the learned trial judge concluded at [100] that the Predators 2 site was oppressive and unreasonable in relation to the respondent and that both appellants knew or ought to have known that it amounted to harassment of them. Part of the difficulty with this case is that the issue in this appeal has centred solely on the tort of misuse of private information whereas the first instance litigation was concerned also with the remedy for harassment by McCloskey. The only information notified to Facebook by the correspondence was that set out at [65] and [66] above. We accept that Facebook has an obligation to read the material provided with the correspondence but abusive comments about the nature of the offending was not misuse of private information. The correspondence contained three references to the general area in which the offender was allegedly living but the lack of specificity could not have made it apparent that the information was private. By the time of trial the judge had considerably more material including further references to the area in which the respondent lived. In his conclusion on harassment and misuse of private information he relied heavily on the importance of the PPANI and his findings about other activities carried out in respect of other offenders by McCloskey. None of that information was conveyed to Facebook prior to McCloskey's site being taken down.

69. We are satisfied that the notice and take down procedure contemplated by the Directive and 2002 Regulations is intended to be a relatively informal and speedy process by which those entitled to protection can get a remedy. It follows, therefore, that the omission of the correct form of legal characterisation of the claim ought not to be determinative of the knowledge of facts and circumstances which fix social networking sites such as Facebook with liability. What is necessary is the identification of a substantive complaint in respect of which the relevant unlawful activity is apparent. We have concluded that the substance of the privacy claim was the publication of material tending to identify the location in which the respondent was residing in the context of the information on the profile page and the threatening comments. The correspondence did not, however, express any concern about the publication of the area in which the respondent was allegedly residing. Without some indication in the letter of claim that the address was the issue we do not consider that the correspondence raised any question of privacy in respect of the material published.

70. Mr Tomlinson submitted that the burden of proof that the first appellant did not have actual knowledge or sufficient knowledge of facts or circumstances lay on the first appellant. The answer in our view lies in the structure of the 2002 Regulations which not alone provide the test in reg.19 but also provide a mechanism for the transmission of information through reg.6 and 22. The correspondence on behalf of the respondent in respect of the second appellant's page relied on misconceived causes of action and declined to advance any detailed analysis of the materials to support a claim of unlawful disclosure of private information. The first appellant was not in a position to conduct that exercise on its own. For the reasons given we do not consider that in the case of the second appellant's profile page and postings such prima facie evidence was established.

71. The first profile page posted by RS included reference to the offences which he had committed, the photograph of the respondent and a reference to the general area in which he had lived and that in which he was then believed to be living. The letter of claim dated 15 November 2013 complained about the photograph and a number of threatening and abusive comments and alleged defamation and interference with the right to life. None of the comments of which complaint was made referred to the area in which the respondent was living. No separate complaint was made about the identification of the area in which the respondent was living nor was there any reference to the tort of misuse of private information. The respondent's solicitors were asked to identify any offending URL by return of post. By letter of 26 November 2013 the solicitors for RS referred to the identification of the general area in which the respondent was living. They noted that the PSNI had called at the respondent's home to advise him that his life was under threat from loyalist paramilitaries. In response the solicitors were again asked by return to specify any offending RL to enable the first appellant to locate it. They eventually did so on ¾ December and the site was taken down the following day.

72. Although there was no complaint of misuse of private information we consider that the notification of 26 November 2013 was sufficient to establish knowledge of facts and circumstances which made it apparent that the material published was private information. The references to the location where the respondent was living were repeated on a number of occasions and raised as an obvious matter of concern in these circumstances. The proper operation of the notice and take down procedure should have caused Facebook to respond. They were on notice of the risk from the additional information about the location of his residence. They had the location of the page from the correspondence of 13 November 2013. They were not entitled to close their eyes to the information on the respondent's address contained with the page and comments. Facebook was obliged to act as a diligent economic operator (see L'Oreal SA v eBay International [2012] Bus LR 1369). We conclude, therefore that the first appellant had knowledge of facts and circumstances from 26 November 2013 from which it should have been apparent that private information was being disclosed. The onus then lay on Facebook to demonstrate that it acted expeditiously to take the information down. It did not seek to do so. Facebook is accordingly liable in misuse of private information from 26 November 2013 until the information was removed on 4/5 December 2013."

Thus in CG v Facebook Ireland the issue of the adequacy of the reporting system did not arise and it was held that the trial judge had been wrong to hold, without evidence, that the system was inadequate [67]. The issues at first instance had been harassment and misuse of private information but on the appeal the main issue was in relation to the tort of misuse of private information: where the court considered that abusive comments about the plaintiff's offending did not constitute misuse of private information; and further that the information contained in correspondence to Facebook was so lacking in specificity as to not constitute private information. It did not therefore constitute a substantive complaint, as required by the Regulation [68].

At [69] the Court observed that the notice and take down procedure contemplated by the Directive and 2002 Regulations is intended to be a relatively informal and speedy process by which those entitled to protection can get a remedy, so that omission of the correct form of legal characterisation of the claim ought not to be determinative of the knowledge of facts and circumstances which fix social networking sites such as Facebook with liability. What is necessary is the identification of a substantive complaint in respect of which the relevant unlawful activity is apparent. However, the complaint did not raise any concern about the publication of the plaintiff's address, which now formed part of the misuse of private information claim. It was for this reason that the Court determined that the correspondence did not raise the privacy issue and therefore there was no substantive complaint in that regard.

At [71] the Court reaffirms that it is for the claimant to adduce prima facie evidence that the ISS provider has actual knowledge of relevant facts or information before the provider is fixed with the obligation to prove that it did not. It notes again that the complaint in the letter of claim dated 13th November 2013 did not raise an issue about the publication of the place where the plaintiff was living. However, at [72] it finds that the subsequent letter approximately 2 weeks later (26th November 2013) whilst not complaining of misuse of private information was sufficient to establish knowledge of facts and circumstances which made it apparent that the material published was private information to which Facebook, properly operating the notice and take down procedure should have responded, and by failing to do so was liable for misuse of private information from 26th November 2013 until the date when it was taken down on 5th December 2013.

What appears clear from this is, firstly, whilst emphasising the requirement under the Regulation for a substantive complaint the Court decided the appeal on the particular facts of the case, which differ in many respects from the present case. Secondly, the notification and take down procedure is supposed to be informal with the purpose of giving the complainant a speedy remedy, and the Court is not concerned about the legal characterisation of the complaint. Thirdly, what is required is that the ISSP have before it sufficient information to alert it to use of the website for unlawful abusive activity or misuse of private information, such that it would be obliged to act expeditiously by taking the offending material down and preventing it from being further disseminated. This is what I understand is meant by "substantive complaint". In the present case it is not therefore fatal that the plaintiff did not lodge her complaint using the online procedure, particularly where it is part of her case that limitations in that procedure, which is supposed to be flexible and informal, prevented her from doing so. What is required is that a substantive complaint was made which alerted the third defendant to the abusive conduct of the first and second named defendants by their disseminating of offending material, namely nude pictures of the plaintiff, so that it can expeditiously respond by removing it and preventing further dissemination.

The real question is whether or not this was done in this case, to assess which we must go back to the evidence at the initial hearings, which is what the Court of Appeal did in CG v Facebook Ireland. In so doing in this interlocutory application the purpose is not to adjudicate on disputed facts but to ascertain what Facebook knew. The plaintiff moved expeditiously in this case. She was notified of the offending material on 28th May 2016. She tried to contact the third defendant but as in CG v Facebook Ireland, it required the URLs of the images before it could act and the plaintiff could not access the URLs.

The Writ of Summons was issued 6th June 2016, just 8 days after the plaintiff became aware of the offending postings, and 2 days after Horner J on 3^rd June 2016 had granted an interim injunction preventing the first and second defendants from further harassing, pestering, annoying or molesting the plaintiff by distributing, broadcasting or transmitting images or messages pertaining to the plaintiff on Facebook or any other website; ordering them to delete the images. Orders were also made: requiring the third defendant to suspend the first and second defendants' Facebook accounts; requiring the third defendant to discover in advance of close of pleadings all material it held in respect of the first and second defendants accounts; and requiring the first and second defendants to file affidavits within 48 hours disclosing the names of those to whom the images had been disseminated. The writ then claimed with respect to the third defendant, damages pursuant to section 8 of the Human Rights Act 1998 for failure to have in place an adequate reporting mechanism by which the plaintiff could report publication of offending content relating to her on 28th May 2016.

Therefore, by this point the third defendant, whilst it did not have the URLs, had everything else, including the names of the people who had posted the material, when they did it, the nature of that material and the distress caused to the plaintiff. The joint expert report was also directed by the court but the expert could not access the first and second defendants' accounts. This necessitated various orders by Stephens J on: 13th June 2016 stopping the suspension of their accounts to enable them to provide necessary information; on 24th June 2016 requiring the third defendant to deactivate their accounts, and 4th October reactivating them again to allow the expert to access them. It was in the course of this process that Stephens J on 15th June 2016 made the observations at paragraph [8] of his judgment quoted at [18] above, that Facebook has or should have a method of recording and preserving information that is put onto their accounts so as to assist courts in preventing Facebook being used as a tool to abuse individuals.

It is not entirely clear when the third defendant eventually took down the offending material in part because the date of the 'Ryan Report' given by Jack Gilbert, who filed an affidavit on behalf of Facebook, is 11th January 2016 which predates the events giving rise to this action and simply cannot be correct. I have not seen a copy of that report. It was that report which identified what images had been sent, and which Facebook acted upon to remove them. However, it is clear this occurred many months after the initial posting but before an interlocutory application before Maguire J by Notice of Motion dated 15th March 2017. It would appear that the third defendant did not finally confirm to the plaintiff that the material had been removed until March 2017.

It is asserted by the plaintiff that in the course of these proceedings it became evident that Facebook had the technical capacity to remove the content earlier, but it is not clear, what that evidence is. Whether Facebook did or did not have that capacity is a question of fact which it is not for this court to determine, but clearly if it did, it can be argued that it ought to have been used earlier in the circumstances of a case such as this.

At this stage the plaintiff must put before the court material to show that it has an arguable case in respect of the causes of action set out in the proposed amended pleadings, not to prove that case. It must also show that the additional causes of action do not render the action substantially different in character from the case originally pleaded, and as the factual matrix does not really change it seems to me that the plaintiff succeeds in this respect. I do not think that it can be argued that nude pictures taken and shared between two people in a relationship can be other than private information. Nor can it be denied that disseminating the images was other than misuse of private information, or that save for any protection afforded by Regulation 19, that allowing such images to be disseminated was other than a failure to protect and manage private data. Nevertheless, the plaintiff must overcome the obstacle of Regulation 19 by showing that a substantive complaint in the meaning of the Regulation, and as constructed and applied by the Court of Appeal in CG v Facebook Ireland, was made and received. Such a report need not be online using the report and removal tool. It need not set out the specific legal characterisation of the complaint, but it must be sufficient to constitute a substantive complaint. It seems to me that the third defendant's argument that Regulation 19, and how it was applied in CG v Facebook Ireland, the primary authority on which they rely, is too restrictive and beyond what was envisaged by the Court of Appeal in that case. Proceeding on the affidavit evidence before me this court cannot determine the precise factual matrix, including the length of time over which Facebook could be deemed at fault but it is unnecessary that it does so. It is sufficient for this court to conclude that the plaintiff has established that she has an arguable case as set out in the proposed amended pleading, to which a complete answer may or may not be afforded to the third defendant, by the Regulation.

As regards the third defendant's subsidiary arguments, I am not persuaded that any of these individually, or taken together, should deny the plaintiff the opportunity to amend to enable her full case to be litigated. Denial of the plaintiff's assertion that it did not assist her until 15th March 2017, claiming that it had removed the images from Messenger and placed a technical block to prevent them being sent, is a factual issue for trial. That it had to access the plaintiff's own account because some images had been sent by her to the first defendant and they did not receive her URL until 22nd February 2017 gives rise to factual issues as to what the third defendant had the technical capacity, if any, to do earlier. Finally, in questioning what new facts the plaintiff has only become aware of giving rise to the new claims which were not known to her in 2016, in a sense seeks to set any plaintiff amending to add a cause of action an impossible task, because if there were new facts the third defendant would then argue that it was a case of a substantially different character.

I conclude therefore that the plaintiff has satisfied the various tests which the court requires before leave to amend to add additional causes of action is granted. In those circumstances the plaintiff should be allowed to amend her pleadings as sought and I grant leave accordingly. I will hear counsel as to costs.